REST API reference

This page covers the v0.3.24 (build 137) application API.

The default API prefix is https://your-domain.example/api/v1. Protected operations use an access token:

Authorization: Bearer <accessToken>

Sign in with POST /api/v1/auth/login; renew access with POST /api/v1/auth/refresh.

Example login body:

{
  "identifier": "admin@example.com",
  "password": "your-password",
  "deviceName": "Android",
  "platform": "android",
  "appVersion": "1.0.0"
}

Refresh behavior in v0.3.24

The web application's authenticated API modules share token-refresh handling. When an access token expires, requests can renew it and retry using the new access token. For custom clients, implement refresh-token rotation securely and retry only as appropriate; avoid infinite refresh loops.

Additional personal settings

The API validates preferences for distance units (km/mi), speed units (km/h or mph), European or US date format, and 12-hour or 24-hour time display. Use the actual property names and enums in the OpenAPI specification rather than guessing them.

API coverage

The API covers authentication, MFA and passkeys, user and device management, vehicle ownership and sharing, trips and GPS points, odometer readings, statistics, mapping and reverse geocoding, import/export, settings, background jobs, and administration.

Authoritative version-specific contract: OpenAPI YAML at v0.3.24.

For a running installation, set SHOW_API_UI=true to enable optional Swagger UI at /api and /api/docs. The specification is available at /api/v1/openapi.yml when enabled.