generated: '2026-08-25' method: searched source: >- https://maven-machines.readme.io/docs/basic-concepts.md and https://maven-machines.readme.io/docs/standard-tms-integration.md (docs), reconciled against the securitySchemes declared in all 21 documents under openapi/ summary: types: - apiKey api_key_in: - header oauth2: false openid_connect: false mutual_tls: false http_basic: false http_bearer: false schemes: - name: api_key type: apiKey in: header parameter: apiKey description: >- A single per-fleet, per-environment key sent as the `apiKey` request header on every protected call. Maven states it plainly in the middleware documentation: "All protected endpoints require an API key in the `apiKey` request header", and "Your `apiKey` determines which Maven environment (dev, qa, staging, prod) receives the request." The truckload documentation adds that "the apiKey header authenticates and authorizes the request to submit trip data for a specific company" — so the key is the tenant selector as well as the credential. sources: - openapi/maven-machines-users-openapi.json - openapi/maven-machines-assets-openapi.json - openapi/maven-machines-company-locations-openapi.json - openapi/maven-machines-shipments-openapi.json - openapi/maven-machines-shipment-locations-openapi.json - openapi/maven-machines-linehaul-openapi.json - openapi/maven-machines-manifest-commands-openapi.json - openapi/maven-machines-planning-and-dispatch-openapi.json - openapi/maven-machines-workflow-openapi.json - openapi/maven-machines-messages-openapi.json - openapi/maven-machines-market-apps-openapi.json - openapi/maven-machines-smart-openapi.json - openapi/maven-machines-reports-openapi.json - openapi/maven-machines-rest-service-manual-openapi.json - openapi/maven-machines-aaa-cooper-middleware-openapi.json - openapi/maven-machines-averitt-middleware-openapi.json - openapi/maven-machines-bozzutos-middleware-openapi.json - openapi/maven-machines-reddy-ice-middleware-openapi.json - openapi/maven-machines-roy-miller-middleware-openapi.json - openapi/maven-machines-triple-s-steel-middleware-openapi.json tenancy: model: key-scoped detail: >- The key binds a caller to one company. A 401 in the users specification is described as "This endpoint may only be executed for company 1". The planning-and-dispatch definition additionally templates the tenant into the server URL — https://integrations.mavenmachines.com/companies/{companyKey}/ — so a caller integrating against that definition supplies the company twice, once in the path and once implicitly through the key. environments: - name: production base_url: https://integrations.mavenmachines.com/ - name: staging base_url: https://integrations-staging.mavenmachines.com/ note: Keys are not interchangeable between environments. key_management: self_serve: false rotation_documented: false scopes: false expiry_documented: false detail: >- Maven publishes no key-issuance, rotation, expiry or revocation procedure, no scope or permission model on the key, and no self-serve developer signup. Keys are provisioned to contracted fleets. Driver-facing permissions (e.g. "Market App Access") are managed in the Maven Fleet Admin portal as user roles, not as API scopes. public_endpoints: - path: GET / service: reddy-ice middleware detail: '"GET / is public and does not require an API key." Health check only; returns "Hello World!".' gaps: - >- All 17 OpenAPI 3.0.0 documents DECLARE the apiKey scheme in components.securitySchemes but do NOT apply it at document level (`security` is null). Only the four 3.1.0 documents carry a top-level security requirement. A client generated from the 3.0.0 documents authenticates nothing by default — see overlays/ for the correction. - No OAuth, OIDC or mTLS option for enterprise fleets; a single long-lived shared header key is the only credential. - /.well-known/openid-configuration and /.well-known/oauth-authorization-server return 404 on every Maven host, including accounts.mavenmachines.com.