API keys and webhooks

The Marque API lets your own code read your drives, vehicles and stats, or an organization’s fleet. An API key is what that code signs in with. A webhook works the other way round: Marque calls a URL of yours when something happens, so you don’t have to keep asking. Everything the API offers is listed in the API reference.

Creating a key

1. Open Settings, then Developer.
2. Tap Create key, give it a name you’ll recognise later, and pick how long it lasts.
3. Choose what it may do, then create it.
4. Copy the key straight away. It’s shown once; Marque keeps only a fingerprint of it, so nobody can show it to you again. Lost it? Rotate the key or create a new one.

We email you whenever a key is created, so a key you didn’t make never goes unnoticed.

Scopes

A key carries only the scopes you give it. Read only lets it look; Read & write also lets it add and change drives and vehicles. You can tick scopes one by one instead.

• Drive routes are a separate opt in. Without them a key sees distances, times and stats but never where you drove. With them, each route comes back with your privacy zone trimmed from both ends.
• Heart rate and other biometrics are never available through the API, whatever the scopes.

Expiry and rotation

Every key expires: after 30, 90 or 365 days, or any number of days up to a year. We email you a week before one runs out.

To replace a key without downtime, rotate it. You get a new secret at once, and the old one keeps working for the grace period you pick: 1 hour, 24 hours or 7 days, or not at all. Swap the new secret into your code before the old one stops.

Revoking

Revoke stops a key immediately. Anything still using it gets refused from the next request. Revoked and expired keys stay in the list, greyed out, so you can see what they were.

Allowed IPs

If your code always runs from the same place, list its addresses or CIDR ranges (like 203.0.113.0/24) when you create the key. A request from anywhere else is refused, even with the right secret. Leave the list empty to allow any address.

Keys for an organization

Owners and managers of an organization can create keys for the fleet itself under the Developer tab in the organization’s dashboard. An organization key reads the organization’s cars, drives, logbook, members and alerts. A fleet key never sees the route of a personal trip. Changes it makes are recorded as the member who created it; if that person deletes their Marque account, the key still reads but needs rotating before it can write again.

Webhooks

Add an endpoint under Webhooks, choose the events it should receive, and Marque sends a request to it each time one happens.

• The URL has to use HTTPS and be reachable from the internet.
• Every request is signed to the Standard Webhooks spec. Check the webhook-signature header with the endpoint’s signing secret, which starts with whsec_ and, like a key, is shown only once.
• Answer with a 2xx status within 10 seconds. If you don’t, we retry with growing gaps for a little over a day.
• If an endpoint keeps failing for 3 days, we switch it off and email you. Fix the receiver, then turn it back on.

Each endpoint keeps a list of recent deliveries with the response your server gave. Use Send test to try your receiver, and Redeliver to send any delivery again.