AUTHENTICATION

API keys are issued for a specific integration and customer scope. An API key only provides access to the endpoints and shipment data authorised for that integration.

Supplying the API key

Include the API key in the following HTTP request header:

ShellX-API-KEY: <API key>

The API key must be supplied with every request.

Do not include the API key in the URL, query string or request body.

Example request

Shellcurl --request GET \
  --url "https://api.cargooffice.com.au/API/external/shipments/details.php?ref=0075052479" \
  --header "Accept: application/json" \
  --header "X-API-KEY: <API key>"

Base URL

The production API base URL is:

HTMLhttps://api.cargooffice.com.au/API/external/

All requests must use HTTPS.

API key security

API keys must be treated as confidential credentials.

API consumers should:

• Store the API key in a secure secret or configuration store.

• Avoid embedding the API key in client-side applications or publicly distributed code.

• Avoid recording the API key in application logs.

• Avoid committing the API key to source control.

• Only provide the API key to personnel who require access to the integration.

• Notify CargoOffice if an API key is suspected to have been exposed.

CargoOffice will provide the API key separately using an approved secure delivery method.

IP allowlisting

API access may be restricted to approved source IP addresses.

Where IP allowlisting is enabled, requests must originate from one of the public IP addresses registered for the integration. Changes to these addresses should be provided to the nominated CargoOffice contact.

Authentication problems

A request may be rejected when:

• The X-API-KEY header is missing.

• The API key is incorrect or inactive.

• The API key is not authorised to use the requested endpoint.

• The request is outside the customer scope assigned to the API key.

• The request originates from an IP address that has not been allowlisted.

Clients should check the HTTP response status and any JSON error information returned by the endpoint.