Integrations and open API

Standard interfaces

• REST API v1 (documented with OpenAPI 3.1): lines, stops, trips, employees, boardings and indicators; organization-specific API keys and per-endpoint permissions
• Webhooks: Notifications for trips, boardings, incidents and changes; signed and with retries
• Corporate sign-in: Single sign-on with Microsoft Entra ID, OIDC, SAML 2.0; LDAP / Active Directory
• HR import: Scheduled file or API import, safely applied with an error-row threshold
• GTFS / GTFS-Realtime: Feeds for passenger information displays and transit apps
• MQTT: Direct location intake from GPS devices
• SMS, WhatsApp, email and push notifications: Templates editable per organization

Open REST API

• Authentication uses an API key created by the organization. The key is shown only once; it can be revoked and given an expiry date.
• Permissions are per endpoint: lines, trips, fleet, employee read / write, boardings, reports, costs, operations, GTFS.
• Employee endpoints return shuttle assignments; address information is not exposed through the API.
• There is a per-client rate limit; the contract is published as openapi.json.

Webhooks

Events such as trip started / completed / canceled, vehicle or driver changed, boarding, incident opened / resolved and change set published are reported to your system instantly. Every request is signed with HMAC-SHA256. Failed deliveries are retried at increasing intervals; the delivery log, test sends and signing key rotation are handled from the screen.

Corporate identity

• Single sign-on with Microsoft Entra ID and OIDC (Keycloak, Okta, Google Workspace, etc.).
• SAML 2.0 (ADFS, Okta, Shibboleth, etc.).
• LDAP / Active Directory: Sign-in with the directory password and employee directory sync (a disabled account becomes an inactive employee).
• If multi-factor authentication was performed at the identity provider and the organization trusts it, two-step verification is not asked again.

GTFS and GTFS-Realtime

Your shuttle network is exported in GTFS, the public transit standard: stops, lines, trips, stop times and route geometry. The GTFS-Realtime feed publishes vehicle positions, estimated arrivals and cancellations. This lets on-campus passenger information displays or map apps show your shuttles.

Notification channels

SMS (Netgsm, İleti Merkezi, Twilio), WhatsApp (Meta WhatsApp Cloud, with approved templates) and email (the organization's SMTP or system email). Vehicle changes, delays, shuttle-approaching alerts and announcements also reach employees without an app account. Templates are edited by type, channel and language, with a preview and an SMS character counter.

Security

Every external address the server connects to (webhook, LDAP, MQTT, SMTP, HR file) is checked both when saved and at connection time so that it cannot resolve to the internal network. Secret keys are stored encrypted and are not shown in the interface or the audit log.

Frequently asked questions

Does RotaMerkezi have an API?

Yes. There is an open REST API v1 documented with OpenAPI 3.1. The organization creates its own API keys and grants each key only the permissions it needs.

Can users sign in with Microsoft 365 / Entra ID accounts?

Yes. Single sign-on is supported with Microsoft Entra ID, generic OIDC and SAML 2.0; sign-in with the directory password via LDAP / Active Directory is also available.

Can you pull employee data automatically from our HR system?

Yes. You can use scheduled import of a CSV / Excel file served over HTTPS, employee writes through the API or LDAP directory sync. All routes go through the same validation rules.

Which SMS providers are supported?

Netgsm, İleti Merkezi and Twilio. For WhatsApp, the Meta WhatsApp Cloud API is used.