Carrier Credentials

Tracking data can only flow once your account has working credentials for each carrier you track. You manage these yourself, either through the tracking web app or directly through the API as described below.

Adding credentials

POST /carrier/credentials with an object keyed by the carrier's SCAC code:

POST /carrier/credentials
x-api-key: <your-api-key>
Content-Type: application/json

{
  "MAEU": {
    "clientId": "your-client-id",
    "clientSecret": "your-client-secret"
  }
}

Credentials are merged per carrier: posting MAEU credentials leaves your existing HLCU credentials untouched, and re-posting a carrier replaces that carrier's set.

Each carrier expects its own fields:

Carrier	SCAC	Required fields
OOCL	OOLU	apiKey, clientId
COSCO	COSU	apiKey, clientId
Maersk	MAEU	clientId, clientSecret
ONE	ONEY	username, password
Yang Ming	YMLU	apiKey
CMA CGM	CMAU	apiKey
MSC	MSCU	clientId, certificate, privateKey, and/or the Service Bus group (see below)
HMM	HDMU	apiKey
Evergreen	EGLV	apiKey
ZIM	ZIMU	subscriptionKey, clientId, clientSecret, scope
Hapag-Lloyd	HLCU	clientId, clientSecret

MSC

MSC credentials come in two independent groups, and you may have either or both: the Track & Trace API (clientId, plus base64-encoded PEM certificate and privateKey) and the Azure Service Bus queue MSC provisions for push subscriptions (serviceBusEndpoint, serviceBusQueueName, serviceBusSasPolicyName, serviceBusSasKey). Each group only works as a complete set.

Verifying credentials

POST /carrier/health-check runs a live connectivity test against a carrier's API using the credentials on your account:

{ "scacCode": "MAEU" }

The response reports the carrier's HTTP status and a pass/fail summary; see Test connectivity to a carrier API. Run it after adding credentials, or whenever tracking data isn't arriving as expected.

Checking what's configured

GET /carrier/credentials returns the carrier credentials currently stored against your account, keyed by SCAC code.

Clearing credentials

DELETE /carrier/credentials removes stored credentials for the SCAC codes you list (e.g. after rotating a key with the carrier):

{ "carriers": ["MAEU"] }

See Clear carrier credentials.