Samsara API: What Your Fleet Can Actually Automate
A truck enters the customer’s yard. Carly sends the arrival update while Samsara records the geofence event. A fault code can reach the shop, a DVIR defect can become a maintenance task, and driver or dispatcher follow-up can continue across email, Slack, calendars, and recurring fleet briefs.
You can generate a Samsara API token yourself in about thirty seconds, and no plan blocks you from doing it. Samsara’s own knowledge base says it plainly: “Access to the API is enabled for all customers.”
But that sentence is doing less work than it looks like. API access is universal. Individual endpoints are gated by which licenses your organization holds — and that’s the distinction that decides whether the integration you have in mind is possible.
What fleets actually automate with it
Before the setup details, the jobs worth doing. These are the ones that come up repeatedly, and all three are things a dispatcher currently does by watching a screen:
- Arrival and departure notifications that don’t need watching. A truck enters a customer’s geofence and the customer gets the text automatically, instead of your dispatcher noticing twenty minutes later and typing it out.
- Fault codes that book themselves in. An engine fault comes in at 2pm; right now it often sits until someone reviews the dashboard, and the truck is down before anyone calls the shop. The fault can open a maintenance task and notify the shop the moment it fires.
- DVIR defects that reach the right person. A driver submits a defect and it waits in a queue. It can instead go straight to the maintenance manager with the vehicle, driver, and defect in one message.
None of these need a developer to invent anything — Samsara already knows all three happened. The work is connecting “Samsara knows” to “someone acts.”
Getting a token
Settings (bottom of the dashboard) → API Tokens → + Add an API Token. Set a name, choose Tag Access, pick a permission scope, save, and copy the token immediately.
The gate is a role, not a contract. You need Full Admin, Standard Admin, or a custom role with edit permissions on API Tokens — and that role has to manage the Entire Organization. Tag-Level Admins cannot create tokens at all, which is the single most common reason someone gets stuck here. You can create as many tokens as you need.
OAuth 2.0 is a different story: it’s for marketplace apps, requires app certification, and isn’t the path for wiring up your own fleet.
Which endpoints your licenses unlock
This is the part worth checking before you scope anything. Samsara publishes a required-licenses matrix, and the shape of it is:
- Telematics – Essential covers the core: vehicle stats and its feed/history, routes, DVIRs, defects, documents, fuel purchases, driver messaging
- Essential Plus adds everything HOS and ELD — logs, clocks, violations, daily logs, driver ELD events — plus IFTA reporting
- Premier adds safety scores, driver efficiency, fuel-energy and idling reports, compliance settings, and the vehicle immobilizer
- Safety – Essential or Premier is an alternative unlock path for safety events and safety scores
- Paid add-ons gate specific data on the stats endpoint: EV diagnostics, immobilizer, and spreader diagnostics each require their own add-on
Webhooks are gated the same way — ten event types, including geofence entry and exit, engine faults, and route stop arrival, need Telematics Essential at minimum.
Samsara publishes no public tier pricing; the pricing article is customer-login-only. So the honest answer on cost is that there’s no separate API fee documented anywhere — you’re paying for the data product, and API capability tracks whatever plan you already hold.
The rate limit that actually bites
The headline number is 150 requests per second per token, with 200 per second across the organization. Neither is the constraint you’ll hit.
The real ceiling is endpoint-level and per organization: most GET endpoints sit at Level Two, which is 5 requests per second for the entire org. Most writes are Level One at 100 per minute. The stats feed and history endpoints get Level Three at 10 per second.
That per-organization scoping matters more than the number. Every token in your account shares the same 5/sec — including the ones held by Fleetio, your ERP connector, and any other vendor you’ve onboarded. Your new automation is competing with integrations you didn’t write and can’t see the consumption of. Exceeding it returns a 429 with a Retry-After header in seconds.
What fires on its own
Samsara has two push systems: Alert Webhooks and Event Subscriptions (Webhooks 2.0). Setup is Settings → Webhooks → Add Webhook, HTTPS only, up to five custom headers.
Only four event types are GA: AlertIncident, DvirSubmitted, SevereSpeedingStarted, and SevereSpeedingEnded.
Everything else is still beta — and “everything else” happens to be the events an automation actually wants: GeofenceEntry, GeofenceExit, EngineFaultOn, EngineFaultOff, RouteStopArrival, RouteStopDeparture, RouteStopEtaUpdated, FormSubmitted, DriverCreated, VehicleUpdated, and about a dozen more.
AlertIncident is the pragmatic workaround: it’s the catch-all that carries whatever alerts you’ve configured in the dashboard, including geofence and speeding conditions and custom rules. If you want stable push today, configure the alert in Samsara and catch the incident.
Delivery is HMAC-SHA256 signed in X-Samsara-Signature, needs a 2XX, and retries with exponential backoff up to five attempts with no replay API. A receiver outage longer than that means the events are simply gone.
It genuinely writes
Worth stating, because plenty of telematics APIs are read-only and Samsara’s isn’t. Confirmed live routes include creating routes, drivers, documents, DVIRs, addresses, tags, and industrial assets, sending messages to drivers, and patching drivers, vehicles, and compliance settings.
One caveat on the published spec: the GitHub OpenAPI spec is stale at version 2021-06-09. Generate a client from it and you’ll be working against a five-year-old surface. Treat the live developer docs as canonical.
Five things that will cost you an afternoon
- Pagination lies about being finished. A page can return zero results while
hasNextPageis stilltrue. The obvious “stop when the data array is empty” loop silently drops records. Cursors also expire after 30 days, and feed endpoints want you to wait at least five seconds afterhasNextPage: false. - Drivers can never be deleted. ELD compliance forbids it, so there’s no
DELETE. You setdriverActivationStatusto deactivated instead. Sync code written against normal CRUD assumptions breaks the first time someone offboards. - The token displays once. Refresh the page and it’s unreadable forever. Worse, regenerating a lost token deletes the old one — instantly breaking every live integration using it.
- Tag Access is a write trap. If your token is tag-scoped, every object you create has to include that tag in the request body, or the write fails.
- There’s no CORS. Server-side only. Nothing browser-based will work.
Sandbox access exists but isn’t self-serve — you request it from Samsara Support with your org ID, and the test data is simulated GPS for three vehicles over a hundred days.
Getting something to happen when the event lands
The gap between “Samsara can tell me a truck entered a geofence” and “something useful happened as a result” is where most of this work actually sits. The webhook fires into whatever you’ve built to receive it, and for most fleets that’s a Slack channel someone stopped reading.
Handing that to an AI assistant runs into a specific wall.
The unattended-work gap closed in 2026: ChatGPT Scheduled Tasks and Claude Cowork both run on their own. The remaining gap is what starts them. These run on a timer, not in response to an event in your apps, so "when this happens, do that" is still outside what they do.
So “summarize last week’s speeding events” is comfortably within what ChatGPT or Claude will do against a Samsara export. “Text the dispatcher the moment a driver arrives at a stop” is not, because nothing on that side is listening for the arrival.
Carly is built for that half:
- Fires on the Samsara event itself — the webhook arrives, Carly acts, whether or not anyone is at a laptop
- Runs the whole response in one flow — read the incident, look up the driver and vehicle, draft the message, send it, log it
- Actually sends — email through Gmail and Outlook with attachments, not drafts waiting on you
- Handles the unglamorous parts — re-polling around the five-attempt retry ceiling is exactly the kind of job worth automating, since Samsara has no replay API
Because Samsara exposes a public API, you can connect it natively to Carly from the Integrations tab with your API token. Carly can then use Samsara in on-demand, recurring, and event-triggered workflows. AI agents start at $35/month, and workflow steps that don’t use AI run free and unlimited.
Frequently Asked Questions
Do I need a special plan to use the Samsara API?
No. Samsara states that API access is enabled for all customers, and you create tokens yourself from the dashboard. What varies by plan is which endpoints return data — HOS needs Telematics Essential Plus, safety scores need Premier, EV diagnostics need the EV add-on.
How do I get a Samsara API token?
Settings → API Tokens → + Add an API Token. You need Full Admin, Standard Admin, or a custom role with API Token edit permissions, and the role must manage the entire organization. Tag-Level Admins can’t create tokens.
What is the Samsara API rate limit?
150 requests per second per token and 200 per second per organization, but the binding constraint is the per-endpoint limit — most GET endpoints allow only 5 requests per second across your whole organization, shared with every other integration holding a token.
Does Samsara have webhooks?
Yes, but only four event types are generally available: AlertIncident, DvirSubmitted, SevereSpeedingStarted, and SevereSpeedingEnded. Geofence, engine fault, and route stop events are still in beta. AlertIncident can carry dashboard-configured alerts as a stable alternative.
Can the Samsara API write data, or only read it?
It writes. You can create routes, drivers, addresses, documents, DVIRs, and tags, send messages to drivers, and update vehicles and compliance settings. The one hard exception is drivers, which can be deactivated but never deleted, because of ELD rules.
More: AI agents for ops · Best AI workflow automation tools · Best AI agents for productivity
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
