The reference, and a sandbox that behaves like it.

Authentication

One key per integration, created by an administrator, carrying only the scopes it needs. Keys go in the header; a key seen in a URL is treated as leaked and revoked.

curl https://api.nml.sa/fleet/v1/vehicles \
  -H "Authorization: Bearer $SAQR_KEY"

Scopes

• read:fleet
• write:drivers
• write:jobs
• write:geofences
• write:webhooks
• read:exports

Write scopes can be granted on any plan but only work on Command; elsewhere they return plan_required.

Pagination

Cursors, not page numbers. A cursor marks a position in the stream, so rows that arrive while you page — a backfill after a dead zone, say — land after it instead of shifting every page by one.

let since = localStorage.cursor;          // or wherever you keep it
let page;
do {
  const r = await fetch(`https://api.nml.sa/fleet/v1/positions?limit=1000${since ? "&since=" + since : ""}`,
    { headers: { Authorization: `Bearer ${key}` } });
  if (r.status === 429) { await sleep(Number(r.headers.get("Retry-After")) * 1000); continue; }
  page = await r.json();
  await save(page.data);                   // save first…
  since = localStorage.cursor = page.next; // …then move the cursor
} while (page.has_more);

Save the rows before you save the cursor. The other order loses a page whenever the process dies in between.