API

API reference

Version 1. Requests use HTTPS and return JSON unless noted.

Interactive OpenAPI docs · openapi.json

Authentication

Send your key in the X-API-Key header. A key is shown once when you create it; we store only a hash.

X-API-Key: pt_live_xxxxxxxxxxxx_<secret>

Endpoints

MethodPathAuthPurpose
GET/v1/feedsAPI keyFeeds your plan includes, with freshness and allowed filters
GET/v1/feeds/{code}/recordsAPI keyCurrent records of a feed, with filters, since and pagination
GET/v1/feeds/{code}/export.csvAPI keyThe whole feed as a streamed CSV with your licence reference
GET/v1/carriers/{dot}API keyOne carrier by USDOT number, from the feeds you can access
GET/v1/usageAPI keyThis month's requests and rows, and your limits
GET/v1/eventsAPI keyCarrier authority events for the feeds and states your plan includes
GET, POST/v1/webhooksAPI keyList your webhook endpoints and the event types your plan includes
POST/v1/opt-outPublicAsk for a business record to be removed

Filters

ParameterMeaningFeeds
stateUS state (two-letter codes, comma separated) us_new_authority_weekly us_small_carriers_active us_revocation_pending us_insurance_lapse_alerts us_brokers
trucks_minMinimum power units (trucks) us_new_authority_weekly us_small_carriers_active us_revocation_pending us_insurance_lapse_alerts
trucks_maxMaximum power units (trucks) us_new_authority_weekly us_small_carriers_active us_revocation_pending us_insurance_lapse_alerts
granted_sinceAuthority granted on or after a date us_new_authority_weekly us_small_carriers_active us_revocation_pending us_brokers
min_days_in_businessAt least this many days since the authority date us_new_authority_weekly us_small_carriers_active us_revocation_pending us_brokers
max_days_in_businessAt most this many days since the authority date us_new_authority_weekly us_small_carriers_active us_revocation_pending us_brokers
general_freightHauls general freight us_new_authority_weekly
has_cellHas a cell phone on file us_new_authority_weekly us_brokers
time_zoneUS time zone us_new_authority_weekly
phone_typePhone type: mobile, landline or either (use 'has cell phone' for filed cell numbers) us_small_carriers_active us_revocation_pending us_insurance_lapse_alerts
entity_typeBroker or freight forwarder us_brokers
sinceOnly records granted or verified on or after this date (YYYY-MM-DD)All feeds
page, page_sizePage number and page size (page size up to 1000)All feeds

Errors

Errors use application/problem+json with a stable code field.

HTTPcodeMeaning
401invalid_api_keyThe key is missing or not valid
401revoked_api_keyThe key was revoked
403plan_has_no_api_accessYour plan does not include API access
403not_entitledYour plan does not include this feed
403feed_not_liveThe feed is not live yet
400invalid_filterA filter is not allowed on this feed, or its value is not valid
404not_foundNothing matched
429rate_limitedToo many requests this minute; wait for the Retry-After seconds
429quota_exceededThe monthly row quota is used up
503stale_sourceStatus checks are being refreshed; stale records are never served

Rate limits

Every authenticated response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.

Events

Events are changes to a carrier's operating authority, recorded by the registry and detected by our checks. You see an event type only when your plan includes a feed that carries it, limited to your plan's states. Businesses on the removal list are never returned. Store next_cursor and pass it back to continue; new events never shift earlier pages.

ParameterMeaning
typeComma-separated event types (default: every type your plan includes)
sinceEvents we detected at or after this RFC 3339 time (default: 7 days ago)
stateUS state (two-letter codes, comma separated)
limit, cursorlimit up to 1000 per page; cursor from the previous response
typeMeaning
new_authority_grantedAuthority granted
insurance_cancellation_suspensionSuspension after an insurance cancellation
revocation_pendingRevocation pending on active authority
reinstatedAuthority reinstated
authority_inactiveAuthority inactive or withdrawn when we last checked
curl -H "X-API-Key: pt_live_…" "https://…/v1/events?type=insurance_cancellation_suspension&state=TX&since=2026-09-01T00:00:00Z"

Webhooks

Register endpoints in the dashboard or with the API. Each delivery is a POST with a JSON body, retried after 1 minute, 10 minutes, 1 hour, 6 hours and 24 hours, then marked failed. An endpoint is paused after 20 failed deliveries in a row and the account owner is emailed.

MethodPathPurpose
GET/v1/webhooksList your webhook endpoints and the event types your plan includes
POST/v1/webhooksRegister an https endpoint (returns the signing secret once)
DELETE/v1/webhooks/{id}Pause an endpoint
POST/v1/webhooks/{id}/testQueue a signed test delivery
POST/v1/webhooks/{id}/rotateRotate the signing secret

Verify every delivery: split the Pingtail-Signature header into t and v1, compute HMAC-SHA256 with your secret over the text t, a dot and the raw request body, compare it with v1 in constant time, and reject a t older than 5 minutes.

Pingtail-Signature: t=1757851200,v1=5f0c…(64 hex)

# Python
import hashlib, hmac, time
def verify(secret: str, raw_body: bytes, header: str, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts["t"])
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), str(t).encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])
{"id": "evt_1042", "type": "insurance_cancellation_suspension", "created": "2026-09-14T11:16:02+00:00",
 "data": {"usdot": "4600002", "docket": "MC1830002", "state": "TX", "occurred_at": "2026-09-11",
          "source_dataset": "official registry",
          "verify_method": "Recorded in the official registry; detected by our registry checks",
          "data": {"legal_name": "SAMPLE FREIGHT INC", "reason": "Involuntary Suspension - insurance cancellation"}}}