EonsFleet Developer Portal

Make your first API call in 4 steps

The API is REST-based and returns JSON. All endpoints live under /api/v1/.

# Register org + admin
POST /api/v1/organization/register
Content-Type: application/json
X-Request-Type: client

{
  "organization_name": "Acme Fleet",
  "email":             "admin@acmefleet.ng",
  "password":          "s3cr3t!",
  "first_name":        "Ada",
  "last_name":         "Obi"
}

POST /oauth/token
Content-Type: application/json

{
  "grant_type":    "password",
  "client_id":     2,
  "client_secret": "YOUR_CLIENT_SECRET",
  "username":      "admin@acmefleet.ng",
  "password":      "s3cr3t!",
  "scope":         ""
}

# Response:
{
  "token_type":    "Bearer",
  "expires_in":    86400,
  "access_token":  "eyJ0eXAiOiJK...",
  "refresh_token": "def50200..."
}

Authorization: Bearer <access_token>
X-Request-Type: client          # always "client" for user-context API calls

GET /api/v1/vehicles
Authorization: Bearer eyJ0eXAiOiJK...
X-Request-Type: client

# 200 OK — paginated list of vehicles for your organization

How authentication works

EonsFleet uses Laravel Passport (OAuth 2.0) with two guards and optional API key authentication for programmatic access.

POST /oauth/token
grant_type:    password
client_id:     2
client_secret: <secret>
username:      user@email.com
password:      secret

POST /oauth/token
grant_type:    refresh_token
client_id:     2
client_secret: <secret>
refresh_token: def50200...

# Create a key (requires Bearer token)
POST /api/v1/api-keys

# Use the key
X-API-KEY: eons_live_abc123...
X-Request-Type: client

Why X-Request-Type is required

The IdentifyRequestSource middleware reads this header to select the correct Passport guard (client vs admin) and to route the request to the correct authentication pipeline. Without it, the system cannot determine which user pool to authenticate against.

Access control model

Authorization is layered: role-based permissions gate individual endpoints, and subscription plan entitlements gate entire feature modules.

Available roles (client guard)

Subscription plan gates

Routes protected by org.subscription:{feature} middleware check whether your organization's active subscription includes the required module. Accessing a gated route without the subscription returns 402.

Driver-specific endpoints

Routes under /api/v1/drivers/me* are restricted to users with the driver role and require Bearer token authentication (auth:client):

Consistent JSON:API error envelope

All error responses follow the same structure. Never parse HTTP status codes alone — always read errors[].code for machine-readable detail.

{
  "message": "Validation failed",
  "errors": [
    {
      "status": "422",
      "code":   "VALIDATION_ERROR",
      "title":  "Validation Failed",
      "detail": "The vehicle_id field is required.",
      "source": {
        "pointer": "/data/attributes/vehicle_id"
      }
    }
  ],
  "meta": {
    "request_id":        "17e0abc1-fd81-4d01-bf90-583772354bee",
    "version":            "v1",
    "timestamp":          "2026-03-04T12:00:00.000Z",
    "execution_time_ms":  7.43
  }
}