The Travr API

curl https://api.travr.pro/v1/me \
  -H "Authorization: Bearer trv_live_YOUR_KEY"

curl "https://api.travr.pro/v1/vehicles?limit=50" \
  -H "Authorization: Bearer trv_live_YOUR_KEY"

curl "https://api.travr.pro/v1/vehicles/VEHICLE_ID/positions?from=2026-10-01T00:00:00Z&to=2026-10-02T00:00:00Z" \
  -H "Authorization: Bearer trv_live_YOUR_KEY"

curl -X POST https://api.travr.pro/v1/vehicles/VEHICLE_ID/commands \
  -H "Authorization: Bearer trv_live_YOUR_KEY" -H "Content-Type: application/json" \
  -d '{"type":"locate"}'

Create one through the API (or in the console):

curl -X POST https://api.travr.pro/v1/webhooks \
  -H "Authorization: Bearer trv_live_YOUR_KEY" -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/travr","events":["trip.ended","alert.raised"]}'

What arrives:

{
  "id": "8b04b737-0a8f-44fe-a3fd-6114e1704e2b",
  "event": "trip.ended",
  "created_at": "2026-10-01T11:03:23.013Z",
  "attempt": 1,
  "data": {
    "vehicle": { "id": "…", "name": "CK0202", "registration": "CK0202", "company_id": "…" },
    "trip": { "id": "…", "started_at": "…", "ended_at": "…", "distance_km": 12.4, "duration_s": 1860,
              "start": { "latitude": 51.52, "longitude": -0.26, "address": null },
              "end":   { "latitude": 51.53, "longitude": -0.20, "address": null } }
  }
}

Verify the signature — t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body" with your webhook secret> — on the raw request body, before parsing it:

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyTravr(rawBody, signatureHeader, secret) {
  const parts = Object.fromEntries(signatureHeader.split(',').map((kv) => kv.split('=')));
  const age = Math.abs(Date.now() / 1000 - Number(parts.t));
  if (!(age < 300)) return false;                       // older than five minutes: replay
  const expected = createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
  return expected.length === parts.v1.length && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}