Skip to main content
Technical Preview

Overview

Webfleet is Bridgestone’s fleet management service (formerly TomTom Telematics). Its integration API, WEBFLEET.connect, is a single HTTPS endpoint, https://csv.webfleet.com/extern, where every operation is selected with an action parameter. This template asks for JSON output (outputformat=json) and ISO 8601 dates in UTC (useISO8601=true). The app has one client-mode connector, WebfleetConnect, with 35 events: 21 reads and 14 writes. Typical uses are putting truck and van positions next to plant data (inbound ETAs at the dock, dwell time at the gate), reacting to Webfleet events and cold chain readings in LoT rules, and sending orders or text messages to drivers when a batch is ready. Each event publishes the reply on <topic>/response.

Reads

Writes and generic calls

For continuous tracking, use the message queue instead of polling ShowObjectReport. Create the queue once with CreateQueue (message class 0 for everything including positions, 2 for everything except positions), then call PopQueueMessages and, after you have stored the batch, AckQueueMessages. Pop and ack must not overlap.

Prerequisites

  • A Webfleet account with WEBFLEET.connect enabled and an API key (36 characters). Customers request one through the Webfleet support form (product Integration, category API key request); .connect partners get one during onboarding.
  • A dedicated Webfleet user for the API, with the access rights the integration needs (for example read access to all objects, edit access to orders). The API acts as that user, so its rights limit what every event can see and change.
  • The account name, which goes in every request.
  • InsertExternalEvent and SetExternalObjectData also need a registered Webfleet Plugin tied to the API key and the Webfleet Plugin feature booked on the vehicles.

Connection and security

  • Base address. https://csv.webfleet.com is the same for every account. Only HTTPS is accepted.
  • Auth. HTTP Basic (RFC 7617) with the Webfleet user name and password, plus account and apikey as query parameters. User name and password in the URL were removed at the end of June 2026. Store Basic <base64(user:password)> in a broker secret (suggested name WEBFLEET_AUTHORIZATION) and the key in WEBFLEET_APIKEY, and pass both in the payload with GET SECRET.
  • Writes. Events in the writes table change orders, events or vehicle outputs. SwitchOutput drives a real output on the LINK device. Each write is marked # WRITE in the .lot file; restrict who can publish to those topics with an RBAC rule.
  • Encoding. Values are placed in the query string as they are. URL-encode free text (ordertext, messagetext, data, the query and form tails) before publishing, for example Load%20pallets. Do not send empty values: Webfleet treats an empty parameter as “clear this value” on update actions.

Pacing and errors

  • Request limits are per action and per account and are listed in the tables. ShowTripReport and ShowEventReport allow 1 request per minute, ShowObjectReport 6 per minute, most other reads 10 per minute, order and message writes 300 per 30 minutes, and creating or deleting a queue 10 per day. Exceeding a limit blocks further calls until a full limit interval passes without requests.
  • ShowTracks accepts at most 2 days per call. PopQueueMessages returns at most 500 messages per call.
  • Errors come back with HTTP 200 and a JSON body {"errorCode": <n>, "errorMsg": "..."}, and in the X-Webfleet-Errorcode and X-Webfleet-Errormessage headers. For example a wrong key answers {"errorCode":1143,"errorMsg":"API key is invalid"}. Check for errorCode in the response topic rather than relying on the HTTP status.
  • Send and update actions answer with an empty body on success. Reads with no data answer [].
  • Field names in the JSON output match the CSV column names in the reference. Positions in ShowTracks, ShowNearestVehicles and the queue are integers in micro degrees (divide by 1,000,000).

Payload

Example actions

These actions read all objects once a minute, pop the message queue every 30 seconds and acknowledge each batch when the reply arrives, and read today’s events every 5 minutes, all inside the request limits. Credentials come from broker secrets. In production, acknowledge only after the batch is stored.

Deployable connector

The base address is already correct for every account. Set the secrets, then deploy.

Testing

See TEST.md in the package. Static checks against the WEBFLEET.connect reference (every action, parameter and request limit), a local mock of the API and the error controls all pass, and the real endpoint was confirmed to reject calls without a valid key (errorCode 1143). A live run needs an account, an API key and an API user: WEBFLEET_ACCOUNT=... WEBFLEET_APIKEY=... WEBFLEET_USER=... WEBFLEET_PASSWORD=... python3 smoke_webfleet.py.

Suggested branches

  • feat/rest-api-route-webfleet
  • feat/docs-rest-api-webfleet
Hugo owns GitHub pushes. Nothing was pushed from the factory.
Last modified on October 21, 2026