Developers & Integrations

Integrate with the NorbiTracka platform

Public registry and catalog endpoints, first-party mobile SDK behaviour, and enterprise onboarding — documented honestly.

NorbiTracka is built for first-party Android and portal clients. We do not operate a public third-party app marketplace or open write API for arbitrary integrators. Enterprise partners should contact sales for scoped access.

Mobile

Flutter Android client with native ProtectionEngine, Device Admin receiver, BLE recovery mesh, and on-device SMS fallback.

Backend

Laravel API (v0.5.x), PostgreSQL, Sanctum auth, immutable audit logs, Paystack billing, Termii/Africa's Talking SMS, FCM push.

Web

Next.js owner portal and staff admin. Static marketing site at norbitracka.com. Map tiles via OpenStreetMap; geo proxy via Nominatim/OSRM.

Public endpoints (no auth)

GET https://norbitracka.com/api/ — API name, version, capability flags
GET https://norbitracka.com/api/plans — live pricing catalog (NGN, entitlements)
GET https://norbitracka.com/api/registry/lookup?q= — IMEI or Norbi ID status (throttled)
GET https://norbitracka.com/api/registry/ownership/{device}?hash= — ownership proof verification (throttled)

Registry responses never include GPS, owner name, or account email. Rate limits apply.

Try the check UI

Authentication model

Authenticated routes use Laravel Sanctum bearer tokens issued at login. OAuth (Google), passkeys, and MFA challenges are available when configured.

Login: POST /api/auth/login → bearer token
Refresh: POST /api/auth/token/refresh
Mutating requests (POST/PUT/PATCH/DELETE) require HMAC-SHA256 signing: timestamp + method + path + sha256(body), keyed by token
Signing window: 5 minutes with replay protection
GET/HEAD/OPTIONS and public auth routes skip signing

Internal signing details for third parties are shared under enterprise agreement only.

Authenticated device API (first-party)

The Android app and portal consume these routes. They are not documented as a public integrator surface.

Devices — CRUD, transfer, ownership certificate, locations, heartbeat
Commands — issue, pending queue, acknowledge (lock, locate, capture, wipe, …)
Locate — start, latest, live watch sessions
Incidents & evidence — create, attach artifacts, verify hashes, export case file
Family, geofences, SOS, recovery sightings, billing, support tickets
Platform — GET /api/platform returns capability flags for the signed-in account

Inbound webhooks (infrastructure)

These endpoints exist for payment and messaging providers — not for customer integration.

POST /api/webhooks/paystack — billing events (HMAC-SHA512 verified)
POST /api/webhooks/termii/delivery — SMS delivery receipts
POST /api/webhooks/africastalking/incoming — inbound SMS commands
POST /api/webhooks/whatsapp — SOS / dispatch messages

Enterprise integration path

Organisation provisioning — business, campus, agency, government kinds
License keys — admin-issued, redeemed via POST /api/licenses/redeem
Agent desk — verified agents with cell-bucket sightings only
Fleet visibility API consumed by portal — scoped roles, no covert control
Custom entitlements — catalog-managed plan flags (devices, capture, agent dispatch)

Contact sales User guide — orgs

Security requirements for partners

TLS 1.2+ for all API traffic
Store bearer tokens in secure enclave / Keystore — never embed in client-side web JS
Implement HMAC signing exactly as specified for mutating calls
Do not log precise GPS, PINs, or recovery secrets
Webhook consumers must verify provider signatures before trusting payloads

Remote command types

Issued via authenticated API and reflected in portal command history.

Command	Description
lock / unlock	Device protection overlay
locate	Request last-known coordinates
ring	Audible alert
enable_tracking / disable_tracking	Continuous location stream while enabled
capture_photo / audio / video / screen	Remote evidence (plan-gated)
wipe	Factory reset — irreversible
display_message	Owner message on lock screen

Incident types

Standard incident classifications across mobile, API, and portal.

theft_suspected
sos
panic
tamper
geofence_enter
geofence_exit
unauthorized_access
missing_child

Example — registry lookup

Public, throttled, no authentication required.

GET https://norbitracka.com/api/registry/lookup?q=867530012345678

Response (example):
{
  "found": true,
  "status": "lost",
  "query_kind": "imei"
}

Example — SMS command format

Trusted-number inbound only when SMS is enabled for the account.

#NORBI#LOCATE 1234
#NORBI#LOCK 1234 867530012345678
#NORBI#SOS 1234

Enterprise integration

Scoped API access, organisation provisioning, and agent programmes are arranged through sales — not self-serve keys.

Contact sales Email info@norbitracka.com