REST API

TrackDrive is API-first. Every resource in the platform is exposed through a standardized REST API — anything you can do in the dashboard, you can do programmatically. Some customers run the entire system through the API behind their own agent interfaces and back-office tools.

Built API-First, Not Bolted On

The API isn't an afterthought — it's the foundation. The same endpoints that power TrackDrive's own grids and forms are the ones you call, so the API is always complete and always current. Manage calls, leads, buyers, offers, schedules, numbers, recordings, suppression lists, and more over a clean, RESTful interface with JSON responses.

Two Ways to Authenticate

Secure every request with the credential type that fits your use case:

• Company Access Tokens — basic authentication with a public/private key pair, scoped to a single company. Each key pair carries its own granular permissions, so you can issue a token that, say, only reads calls or only manages leads.
• Developer Access Tokens — token authentication tied to a user. The token inherits that user's existing permissions, including every company they're allowed to access — ideal for internal tools that span accounts.

Examples

A Company Access Token uses HTTP Basic auth: base64-encode your public_key:private_key pair and pass it in the Authorization header.

# Base64-encode your public and private keys (note the -n flag):
echo -n 'tdpub1234...:tdprv1234...' | base64

# Use it in the Authorization header on any request:
curl -H "Authorization: Basic BASE64_ENCODED_PUBLIC_AND_PRIVATE_KEY" \
     "https://your-subdomain.trackdrive.com/api/v1/calls?in_progress=true&order=created_at"
          

Responses are clean JSON with cursor-based pagination and rich metadata on every call:

{
  "status": 200,
  "calls": [
    {
      "uuid": "45b56ab9-bb6b-45f9-...",
      "caller_number": "+19545550100",
      "number_called": "+18555550123",
      "offer": "Auto Insurance",
      "buyer": "Call Centre 1",
      "buyer_converted": "Converted",
      "buyer_revenue": 25.0,
      "status": "finished",
      "recording_url": "https://.../recording.mp3",
      "created_at": "2026-02-23T12:11:47-05:00"
    }
  ],
  "metadata": { "page": 1, "total_pages": 1, "per_page": 25, "total_count": 3, "next_cursor": 34982856 }
}
          

Creating a lead is just as simple — post your schedule's lead token plus any custom fields:

curl -H "Authorization: Basic BASE64_ENCODED_PUBLIC_AND_PRIVATE_KEY" \
     "https://your-subdomain.trackdrive.com/api/v1/leads?lead_token=YOUR_SCHEDULE_TOKEN&caller_id=19515550100&email=john@example.com&loan_amount=500"
          

Full endpoint reference, parameters, and live examples live in the API documentation.

Granular, Per-Key Permissions

Don't hand out all-or-nothing keys. Each Company Access Token can be limited to exactly the resources it needs — calls, leads, buyers, offers, schedules, phone numbers, call recordings, suppression lists, text messages, traffic sources, billing, and more — or granted full access. Tokens can also be scoped to a single agent (collaborator), and paused instantly without being deleted.

Locked Down & Logged

API access is protected and fully auditable:

• IP whitelisting — restrict any token to approved IP addresses (see API IP Whitelist).
• Encrypted at rest — private keys and developer tokens are encrypted, never stored in plain text.
• Authorization on lead creation — optionally require a valid token even on lead-post endpoints, so no one can inject leads without credentials.
• Detailed security logs — every API session is tracked with its IP address, country, ISP, and network (ASN), and blocked-IP attempts are recorded — so you can see exactly who is using each key and from where.

View API Docs Get Started Free