The integration surface, before you ask for it.
Enough to answer an architecture review: how authentication works, how tenants are addressed, what the API families are, how feeds and batch exchange work, and what the field devices speak. Full reference documentation and a sandbox are issued with an engagement.
Bearer tokens, and a tenant on every request.
Token auth
Personal access tokens issued at login and sent as Authorization: Bearer <token>. Tokens are revocable individually, and logout revokes the presenting token rather than the whole account.
Tenant addressing
Every request carries X-Tenant-Id. A missing or unauthorised tenant is refused before any query runs, so cross-tenant reads are structurally impossible rather than filtered out later.
Device tokens
Field devices — validators, handhelds, TVM, TOM, OBU — authenticate as devices, not as people. A device is bound to its own tenant, so a stolen operator credential does not become a gate credential.
OTP flows
Passenger and crew apps support one-time-password sign-in alongside password login, with the OTP transport configured per deployment.
Rate limiting
Per-route throttles on public and authenticated endpoints; limits are stated per family and tuned to the deployment.
Errors
Consistent JSON error envelope with a machine-readable code and a human message, so integrations can branch on the code rather than parse prose.
What is exposed, grouped by who calls it.
| Family | Base path | Caller | Covers |
|---|---|---|---|
| Application APIs | |||
| Customer | /api/mobile/v1 | Passenger app | Journey planning, nearby stops, bookings, tickets and passes, wallet, payments, notifications. |
| Driver | /api/mobile/v1/driver | Driver app | Duty and assignment, assigned routes and vehicles, trip lifecycle, location reporting, incidents. |
| Conductor | /api/mobile/v1/conductor | Conductor app | On-board ticketing, passenger counts, trip and fare capture. |
| Parent / Employee | /api/mobile/v1/parent | Parent and staff app | Pickup schedule, live tracking, boarding and drop events, absence reporting, alerts. |
| Depot | /api/mobile/v1/depot | Depot app | Readiness, dispatch, crew and vehicle allocation, approvals, broadcasts. |
| Device & integration APIs | |||
| Fare collection | /api/v1/fares, /offline-fares, /tap-events, /tickets, /hotlist | Validators, gates, ETM | Fare tables including an offline set, tap ingestion, ticket issue and validation, card hotlist distribution. |
| Telematics | /api/v1/vehicle-locations, /obu, /engine-diagnostics, /battery-readings, /driver-behavior | OBU, AVL units | Position, engine and battery telemetry, driving events, panic. |
| Passenger information | /api/v1/pis, /display, /announce | Display boards, PA | Arrival predictions, board content, audio announcements. |
| Passenger counting | /api/v1/passenger-counts | APC / door sensors | Per-door boarding and alighting counts by stop and trip. |
| Master data & sync | /api/v1/master-data, /sync | Any device | Routes, stops, fares and calendars pushed to devices, with delta sync for intermittent connectivity. |
| Field surveys | /api/v1/surveys, /tasks, /photos | Enumerator app | Instrument delivery, assignment, offline response upload, photo capture. |
| Device ingestion | /api/v1/obu/ingest | OBU, AVL units | The single authenticated entry point for device records — stage 4 of the , before normalisation. |
| Camera & snapshot | /api/v1/obu/commands, /obu/snapshot | OBU cameras | Downlink commands to the on-board unit with acknowledgement, and event-triggered snapshot upload. |
| Driver display unit | /api/v1/ddu | In-cab display | Control-room messages to the cab, driver acknowledgement, and driver-initiated SOS. |
| Platform integration | /api/v1/integration | External systems | API key issue and revocation, demand and pickup-point exchange, entity export. |
Standards first, custom second.
GTFS static
Import an agency's static feed, or publish one. Routes, stops, trips, calendars and shapes, with a validation pass on import.
GTFS-Realtime
Vehicle positions, trip updates and service alerts, consumed from an existing feed or produced from RouteSync's own telemetry. Decoded natively — no external service in the path.
Webhooks
Outbound event delivery for the events that matter to a downstream system — trip lifecycle, incidents, panic, validation. Configured per integration.
SFTP batch
Scheduled file exchange where an ERP, HR or finance system prefers files — rosters in, billing and reconciliation out.
GeoJSON
Zones, boundaries and alignments in and out, so GIS work does not have to be redone inside the platform.
Exports
Service specifications, route workbooks and MIS reports as XLSX, CSV and PDF, stamped with the assumption-set version that produced them.
Reviewing this for an integration?
Tell us the system you need to connect and we will send the endpoint reference for that path.