API quickstart

Create an API key, choose scopes, authenticate with a Bearer token and make your first request to the RouteOne REST API.

The RouteOne REST API lets your own systems create orders, check rates and serviceability, fetch labels, track shipments and cancel shipments. It is meant for server-to-server use. Never call it from a browser or mobile app, because your key would be exposed. All requests and responses are JSON over HTTPS, and field names are snake_case.

Base URL

https://app.routeonex.com/api/public/v1

Create an API key

  1. 1Open Settings and choose Configure API.
  2. 2Click Generate New API Key.
  3. 3Tick the Scopes the key needs (see the table below) and add a Description such as the name of the integration.
  4. 4Click Generate Key.
  5. 5Copy the key straight away. RouteOne stores only a hashed copy, so it is shown once. If you lose it, revoke it and generate a new one.

To stop a key working, click Revoke next to it. The same page contains the full API documentation with examples.

Scopes

Each key works only on the endpoints its scopes allow. Anything else returns 403.

ScopeEndpointAllows
orders:writePOST /ordersCreate orders
tracking:readGET /trackRead shipment status and scan history
serviceability:readGET /serviceabilityCheck pincode serviceability
rates:readPOST /ratesGet shipping quotes
labels:readGET /labelsDownload label PDFs
shipments:cancelPOST /cancelCancel shipments that have not dispatched

Give each integration its own key with only the scopes it needs.

Authenticate

Send the full key, which looks like rok_xxxxxxxxxxxx.<secret> (the key ID, a dot, then the secret), as a Bearer token. Add Content-Type: application/json on POST requests.

Authorization: Bearer <keyId>.<secret>

Your first request

Check whether a pincode is serviceable (needs the serviceability:read scope):

curl "https://app.routeonex.com/api/public/v1/serviceability?pincode=560001" -H "Authorization: Bearer <keyId>.<secret>"

A successful reply looks like this:

{ "ok": true, "pincode": "560001", "city": "Bengaluru", "state": "Karnataka", "serviceable": true, "cod": true }

Responses and errors

Every response contains ok. Errors look like { "ok": false, "error": "weight_kg must be greater than 0" }.

StatusMeaning
400Invalid JSON or an invalid field. error names the field.
401Missing or malformed Authorization header, unknown key, wrong secret or a revoked key.
403The key lacks the required scope, or the account is suspended (code: "account_suspended").
404Not found in your account, or an unknown endpoint.
409Conflict, such as a duplicate order_id.
422An Idempotency-Key was reused with a different body.
429Rate limit exceeded.
500Unexpected server error. It is safe to retry with the same Idempotency-Key.

Rate limit

Each key can make 120 requests per minute (a sliding window). Responses include X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds). Over the limit you get a 429 with a Retry-After header in seconds. Wait that long, then retry.

Keep keys out of source code and front-end apps. Store them in your server's secret manager, and revoke any key you think has leaked.

Still need help? Email support@routeone.app with your order ID or AWB, or raise a ticket from Help Center › Ticket in the app.