Developers

Open to requests

The API grows on real cases. If you need something that is not there, one more field, an event, a write from your system, write to us: we expect specific requests and we stay open and available to build them together. support@dronetrake.com

Specification

The OpenAPI 3.1 specification is public and updated with every version: https://dronetrake.com/api/v1/openapi.yaml

GET https://dronetrake.com/api/v1/organization · GET /api/v1/school/students · GET /api/v1/school/tasks · GET /api/v1/school/tasks/{id} · GET /api/v1/school/attestations · GET /api/v1/missions · GET /api/v1/missions/{id} · GET /api/v1/flights

Authentication

Every request carries a token in the Authorization: Bearer header. Tokens are created in the panel under Business → API & integrations, belong to an organisation and have explicit scopes.

curl -H "Authorization: Bearer dt_xxxxxxxx_…" https://dronetrake.com/api/v1/organization

Scopes

• organization.read — Organisation (read)
• school.read — School programme: students, tasks, attestations (read)
• operations.read — Operations: missions and flights with hours per person (read)

Limits

120 requests per minute per token. Beyond that, 429 with Retry-After.

Errors

Always JSON: {"error": {"code", "message"}}. 401 missing or invalid token, 403 insufficient scope or programme not active, 404 not found, 429 too many requests.

Webhooks

Register an https endpoint in the panel (Business → Webhooks) and pick the events. Each delivery is a JSON POST with the headers X-Dronetrake-Event, X-Dronetrake-Delivery (unique id) and X-Dronetrake-Signature (t=<unix>,v1=HMAC-SHA256 of the body prefixed with t.). Answer 2xx within 10 seconds; otherwise we retry after 1 minute, 5, 30, 2 hours and 12 hours, then the delivery is abandoned and visible in the log. Thirty failures in a row switch the endpoint off.

• school.task.accepted — Task accepted by the student
• school.task.declined — Task declined
• school.task.revoked — Task revoked by the school
• school.task.completed — Task completed
• school.task.attested — Attestation issued
• school.student.enrolled — Student enrolled
• school.student.left — Student left
• mission.completed — Mission completed
• flight.logged — Flight logged in the logbook

POST https://esempio.scuola.it/dronetrake
X-Dronetrake-Event: school.task.attested
X-Dronetrake-Delivery: 7f3c…-…
X-Dronetrake-Timestamp: 1788950000
X-Dronetrake-Signature: t=1788950000,v1=9c1e…

{"id":"7f3c…","event":"school.task.attested","created_at":"2026-09-08T12:00:00+00:00","organization":{"id":165,"name":"Dronetrake Academy"},"data":{"task":{…},"attestation":{…}}}

Evidence

Every request is logged: who read what, when, with which outcome. Creating and revoking tokens are acts in the organisation's evidence chain.

Coming next

Signed webhooks on school programme events and write access on request. Write to us at support@dronetrake.com.