Public tracking

Share an opaque link so your buyer can check a package without an account or exposed personal data.

Public tracking is for your buyer, not your systems. It needs no authentication and returns a view with reduced personal data.

Get the shipment link

The token is minted when the label is purchased. A DRAFT shipment carries publicTrackingToken as null. Read the token or the URL from any of these sources:

https://app.sendit.mx/track/2f68c611-30af-4a86-9cde-793413af5f65

GET /v1/shipments omits both on purpose: a bearer credential does not belong on a collection you can enumerate. To build a “share tracking” affordance from a list row, fetch the shipment by its id.

Do not construct the URL from the tracking number, and there is no public lookup by tracking number and name. If the recipient loses the link, share it again from your system.

The token is a bearer credential. Anyone with the link can retrieve the status.

Retrieve the status with the token

curl https://api.sendit.mx/v1/tracking/public/2f68c611-30af-4a86-9cde-793413af5f65

{
  "success": true,
  "data": {
    "object": "public_tracking",
    "trackingNumber": "DHL123456789MX",
    "carrierCode": "DHL",
    "status": "IN_TRANSIT",
    "estimatedDeliveryDate": "2026-08-04T00:00:00.000Z",
    "actualDeliveryDate": null,
    "destination": {
      "city": "Monterrey",
      "state": "Nuevo León"
    },
    "events": [
      {
        "eventCode": "IN_TRANSIT",
        "description": "En tránsito",
        "occurredAt": "2026-08-01T15:30:00.000Z",
        "isException": false,
        "location": {
          "city": "San Luis Potosí",
          "state": "San Luis Potosí",
          "country": "MX"
        }
      }
    ],
    "branding": null
  }
}

The response excludes the name, street, neighborhood (colonia), postal code, organization settings, and prices. Responses can be cached for 60 seconds.

Each event’s location carries city, state, and country. Each one can be null. It has no postalCode: that field is stripped deliberately, so do not model one.

Read the status with shipment vocabulary

The status field uses shipment statuses, not tracker statuses. The values are DRAFT, PENDING, LABEL_PURCHASED, READY_FOR_PICKUP, PICKED_UP, IN_TRANSIT, OUT_FOR_DELIVERY, DELIVERED, RETURNED, FAILED, and CANCELLED.

A shared link almost always starts at LABEL_PURCHASED, because the token is minted at label purchase. Handle that status explicitly instead of letting it fall through to your default branch. UNKNOWN and PRE_TRANSIT belong to trackers and never appear here.

Show your brand when enabled

Turn on publicTrackingPage in your notification branding. It is off by default. When active, the response can add only these fields:

{
  "branding": {
    "displayName": "Tienda Ejemplo",
    "logoUrl": "https://cdn.example.com/logo.png",
    "accentColor": "#1D4ED8",
    "footer": "Gracias por tu compra"
  }
}

If you do not enable the branded page, branding is null in full. The footerText you stored arrives here as footer. The logoUrl and accentColor are re-validated on this response and come back null if the stored value fails. The replyTo value is never public.

Invalidate a leaked link

If the link reached the wrong person, issue a new one:

curl -X POST https://api.sendit.mx/v1/shipments/clxq1w2e3r4t5y6u7i8o9p0a/tracking-token/rotate \
  -H "X-API-Key: sk_live_..."

{
  "success": true,
  "data": {
    "object": "public_tracking_token",
    "shipmentId": "clxq1w2e3r4t5y6u7i8o9p0a",
    "publicTrackingToken": "6f1c2b90-1f0a-4f2e-9a3f-6b7c8d9e0f11",
    "trackingUrl": "/v1/tracking/public/6f1c2b90-1f0a-4f2e-9a3f-6b7c8d9e0f11",
    "rotatedAt": "2026-08-04T18:04:11.000Z"
  }
}

You need the OPERATOR role or above. API keys need the shipments:write scope.

Voiding a label clears the token. Only a new purchase mints another.

Protect the token

• Share the link only with the recipient.
• Do not send the token to analytics tools.
• Do not include it in referral data to third-party sites.
• Generate links only from resources returned by the API.

Handle errors

Use live shipments only

Public tracking works only for live shipments. Retrieve test-mode shipments through authenticated endpoints.