API and webhooks
An ISF API your TMS can file through
Create and submit ISFs and entries from your own system. REST in, with JSON or XML. Signed webhooks out when CBP answers.
Endpoints
ISF and entry, read and write
The public API lives at /api/public/v1. It runs under your organization and your plan, so it can do what your account can do in the app, no more.
API submissions go through the same rule checks as the app, and each CBP request and response is logged on the filing.
| Method | Path | What it does |
|---|---|---|
| GET | /ping | Check your key, scopes and plan |
| GET · POST | /shipments | List ISF filings · create an ISF draft |
| GET | /shipments/{id} | Read one ISF |
| POST | /shipments/{id}/submit | Submit the ISF to CBP |
| GET · POST | /entries | List entries · create an entry draft (prefill from a linked ISF) |
| GET | /entries/{id} | Read one entry |
| POST | /entries/{id}/send | Send the entry to CBP |
In and out
REST or XML in. Signed webhooks out.
JSON is the default. Send XML with Content-Type: application/xml and ask for XML back with Accept: application/xml. Customs identifiers stay strings, so leading zeros survive.
Register a callback URL and we POST status changes to it: filing.submitted, filing.accepted, filing.rejected, entry.sent, entry.accepted, entry.rejected. Each delivery carries an X-MCL-Signatureheader, an HMAC-SHA256 of the raw body with your endpoint's signing secret. Failed deliveries are retried, and the last outcome shows on the endpoint.
curl -X POST https://app.mycargolens.com/api/public/v1/shipments/{id}/submit \
-H "Authorization: Bearer mcl_live_…"POST /your/webhook HTTP/1.1
X-MCL-Event: filing.accepted
X-MCL-Signature: sha256=<hex>
{ "event": "filing.accepted", "createdAt": "…", "data": { … } }Security
Scoped keys you can revoke
Keys come with your account and are created in the app under Settings → API. Give each key only the scopes it needs: filings:read, filings:write, entries:read, entries:write. Revoke any key at any time.
The same roles, MFA and audit trail protect the app.
Settings → API
TMS production
mcl_live_…
- filings:read
- filings:write
- entries:read
- entries:write
Reporting (read only)
mcl_live_…
- filings:read
- entries:read
No integration yet?
Start in the app, add the API when you're ready
You don't have to wait for IT. File in the app with templates and bulk submit, then move your highest-volume lane to the API. The filings, checks and history are the same either way.
Where it stands
What you get today
- Version
1.0.0-foundation. - No SDKs yet. It's plain HTTP, so any language works.
- The full OpenAPI reference is shared after your walkthrough.
- API pricing on request, same rule as the app: charged when CBP accepts. Volume and API pricing
Questions developers ask
Our team sets up your account after a walkthrough. Then you create keys in the app under Settings → API.
Not yet. The API is REST over HTTPS with JSON or XML, so any HTTP client works.
Recompute the HMAC-SHA256 of the raw request body with your endpoint's signing secret and compare it to X-MCL-Signature in constant time.
No. The same rule checks run on API submissions as in the app.
No. Register a webhook and status changes come to you. You can still read any filing with GET.
MyCargoLens does. Your system creates and submits them through the API, and each request and response is kept on the filing.
API and volume pricing is on request. You're charged when CBP accepts, as in the app.
Book a demo
Bring your developer and your ops lead
Book a 20-minute API walkthrough. We'll show a filing created, submitted and answered over the API, and the webhook landing on the other side.