Public Tracking

Unlike every other page in this API reference, this endpoint requires no API key and no login. It’s what powers the public tracking link that gets shared with a shipment’s recipient.

How tokens are created

A tracking link isn’t generated automatically for every shipment — it’s minted on demand. Inside the app, a user with shipment-read access selects Share on a shipment (Shipments page), which calls an authenticated endpoint (POST /shipments/:id/share) that:

• Generates a random token for that shipment the first time it’s shared, and stores it on the shipment record.
• Returns the same token on every subsequent share — the link doesn’t change once created.

See the User Guide’s Shipments → Sharing a public tracking link for the in-app walkthrough. The resulting link opens the app’s own tracking page (/track/:token); the API endpoint below is what that page calls.

Endpoint

GET /track/:token

No authentication header is needed or checked. :token is the opaque token from the share link.

Example request

curl https://tenant.logistall.cloud/api/track/9f2e4a1b7c3d5e6f8a0b1c2d3e4f5a6b

Example response

{
  "shipmentNumber": "SHP-00482",
  "status": "in_transit",
  "mode": "ftl",
  "originCity": "Casablanca",
  "destCity": "Tanger",
  "pickupScheduledAt": "2026-07-10T08:00:00.000Z",
  "deliveryScheduledAt": "2026-07-12T17:00:00.000Z",
  "events": [
    {
      "eventType": "departure",
      "status": "in_transit",
      "description": "Left Casablanca distribution hub",
      "city": "Casablanca",
      "eventAt": "2026-07-10T09:15:00.000Z"
    },
    {
      "eventType": "pickup",
      "status": "pickup_scheduled",
      "description": null,
      "city": "Casablanca",
      "eventAt": "2026-07-10T08:05:00.000Z"
    }
  ]
}

Note that events[] here includes a description field — the free-text note a dispatcher or driver can attach to a tracking event. This is the one difference from the tracking[] array on the authenticated GET /v1/shipments/:id endpoint, which doesn’t include it.

What is never exposed

This endpoint is intentionally minimal. It never returns:

• The shipment’s internal id (only its human-readable shipmentNumber).
• Customer or carrier names.
• Any address, contact, or other PII beyond origin/destination city names.
• Pricing, charges, invoice, or any financial data.
• Which tenant/company the shipment belongs to (the token alone resolves it server-side).
• Any data belonging to other shipments, customers, or tenants — the token only ever unlocks the one shipment it was minted for.

If you need more than this — customer names, addresses, pricing — that requires an authenticated API key against /v1/shipments/:id or the equivalent in-app pages, not this endpoint.

Errors

Status	Body	When
404	{ "error": "Not found" }	The token doesn’t match any shipment in any active tenant.
500	{ "error": "Server error" }	Unexpected server error.

There’s no way to enumerate or list valid tokens — a token only works if you have the exact link.