Developers
TaxiD API Documentation
Build mobility, delivery, and corporate-travel products on the TaxiD platform.
Served REST endpoints
Server-to-server authentication
TypeScript & Python
Signed webhooks
Contracted limits
Public reference. Private credentials.
Endpoint descriptions and examples are public. Credentials, usage, delivery logs and approval records belong to your signed-in partner account. Account registration does not automatically grant partner membership or production access.
Sandbox
Use environment-bound test credentials. Mobility bookings are simulated, never dispatched or charged; settlement reads do not return production money. Quote endpoints may use approved inventory and current rate cards, so the sandbox is not a separate invented fleet.
Production
Live keys require an approved go-live review with an independent reviewer. Real bookings still pass TaxiD’s existing pricing, supply, payment and policy controls. Changing the environment selector never upgrades a test credential.
Endpoint reference
Base URL: https://pvbgymafdxdcdencsmbk.supabase.co/functions/v1/logistics-partner-api/v1
| Operation | Required scope | Behaviour |
|---|---|---|
| POST /shipments | logistics.shipments.write | Create the package set of a logistics order. |
| GET /shipments/{id} | logistics.shipments.read | One partner-owned shipment and package states. |
| GET /packages/{id} | logistics.packages.read | One package with its milestone history. |
| GET /routes/{id} | logistics.routes.read | Route stops restricted to this partner's packages. |
| GET /delivery-attempts/{id} | logistics.packages.read | One partner-owned delivery attempt outcome. |
| POST /returns | logistics.returns.write | Request return authorization for a package. |
| GET /returns/{id} | logistics.returns.read | One partner-owned return and its lifecycle state. |
| GET /exceptions | logistics.exceptions.read | Operational exceptions on this partner's shipments. |
| GET /webhooks | logistics.webhooks.manage | Partner webhook metadata; never the signing secret. |
| GET /openapi.json | Client credentials | Public OpenAPI generated by the served gateway; no credential required. |
| GET /white-label/domains | whitelabel.manage | Your white-label web addresses with the DNS TXT record to publish and verification status. |
| POST /white-label/domains | whitelabel.manage | Register a domain; publish the returned TXT record at _taxid-verify.<domain> and TaxiD verifies it. Sandbox is simulated. |
| GET /sso/connections | whitelabel.manage | Your SAML single sign-on connections and their status. |
| POST /sso/connections | whitelabel.manage | Register an email domain with your SAML metadata URL; TaxiD activates it after review. Sandbox is simulated. |
| POST /air/quotes | mobility.quotes.read | Server-priced quotes for every live partner aircraft on a route. Nothing is booked. |
| POST /orders | logistics.orders.write | Create a logistics order priced by TaxiD. Always returned unpaid. |
| GET /orders/{id} | logistics.orders.read | One order with its packages. |
| GET /tracking/{reference} | logistics.tracking.read | Track by TaxiD tracking number or your own reference. |
| GET /pod/{id} | logistics.pod.read | Proof-of-delivery metadata and its integrity hash. |
| POST /rentals/quotes | mobility.quotes.read | Server-priced rental quotes from the live rate card. Nothing is booked. |
| POST /rides/quotes | mobility.quotes.read | Locked server price for the partner's linked rider account. |
| POST /rides/bookings | mobility.bookings.write | Confirm a ride from a valid quote. Sandbox is simulated. |
| POST /rides/bookings/:id/cancel | mobility.bookings.write | Cancel a ride this partner booked. |
| POST /rentals/bookings | mobility.bookings.write | Book at the server-recalculated price; M-Pesa collects payment. Sandbox is simulated. |
| POST /charters/bookings | mobility.bookings.write | Request a charter; price recalculated on the server. Sandbox is simulated. |
| GET /settlements | settlement.read | Your statements, newest first, with cursor paging. |
| GET /settlements/{id} | settlement.read | One statement with its order lines. |
| GET /ledger | settlement.read | Your append-only partner ledger, read-only. |
| GET /documents/statements/{id} | documents.read | Statement content with a SHA-256 hash you can verify. |
| POST /oauth/token | Client credentials | Exchange client_id and secret for a one-hour scoped bearer token (grant_type=client_credentials). |
Gateway OpenAPI document · Status, errors and webhook verification
Credential types
- Client ID / consumer ID
- The integration identifier. This is not a password or a browser-safe authorization key.
- Client secret / consumer secret
- The private server credential paired with the ID. Newly issued values are shown once; keep them out of mobile apps, browser code, repositories and logs.
- OAuth access token
- A short-lived bearer credential carrying approved scopes and the issuing key’s environment. Treat it as a secret.
- Webhook signing secret
- A separate endpoint credential for verifying deliveries. It is not interchangeable with a client secret. TaxiD does not provide Stripe-style publishable keys.
Availability by service
Quoting & Availability: Air-charter quotes are live at POST /v1/air/quotes. Rental quotes are live at POST /v1/rentals/quotes. Ride quotes are live at POST /v1/rides/quotes for partners with a linked TaxiD rider account.
Booking & Orders: Logistics orders and shipments are live at /v1/orders and /v1/shipments. Ride, rental and charter bookings are live at /v1/rides/bookings, /v1/rentals/bookings and /v1/charters/bookings (sandbox keys get simulated bookings).
Tracking & Telemetry: Logistics tracking, routes, delivery attempts and proof of delivery are live. Ride tracking is not yet exposed.
Documents & Evidence: Settlement statement documents with a SHA-256 content hash are live at GET /v1/documents/statements/{id}. Receipts and tax invoices are still issued inside TaxiD portals.
Settlement & Reconciliation: Read-only statements (GET /v1/settlements, /v1/settlements/{id}) and your ledger (GET /v1/ledger) are live for production keys; test keys return empty lists.
Identity & Governance: OAuth 2.0 client-credentials is live at POST /v1/oauth/token (one-hour scoped tokens). client_id:secret keeps working.