Base URL
All requests go to a single host. There is one production server today.Sandbox access is provisioned per customer. Contact developers@tread.io to request a sandbox account.
Authentication
The API uses bearer tokens. Two flows exist depending on who is calling.- User session tokens — for human users. Stytch issues a short-lived JWT after a user logs in (email + password, magic link, or SSO). Use this when building tools that act on behalf of a signed-in user.
- Machine-to-machine (M2M) tokens — for server-to-server integrations. Tread issues a Client ID and Client Secret. Exchange them at the auth endpoint for an access token using the OAuth 2.0 client credentials grant.
Bearer header.
401 unauthorized, fetch a new one. See Generate an auth token in the Authentication group in the sidebar for the exact request shape. To get M2M credentials, email developers@tread.io.
Required headers
An invalid
Content-Type returns 415 unsupported_media_type. An invalid Accept returns 406 not_acceptable.
Pagination
List endpoints use cursor-based pagination. Passpage[limit] to set page size. The default is 25 and the maximum is 100.
Link header with next and prev URLs when more results exist.
next link until the header no longer includes one. The page[after] cursor is opaque — do not parse it.
Errors
Every error response uses the same envelope. Thecode mirrors the HTTP status.
409 and 422 responses include an errors array with model, field, and message fields you can surface to end users.
Resources
The API exposes most of what Horizon manages. Major resource families:
Each family has its own group in the left-hand sidebar. Click in to see the endpoints, request shape, and a try-it-out console.
Webhooks
Tread can push events to your endpoint when records change — Orders accepted, Loads approved, Tickets created, and more. Webhooks are configured per company. See the Webhooks integration page for setup, retry behavior, and the event catalog.Parent and child companies
A company can have a parent. A user in the parent has the same role and permission level in every child. Most endpoints scope to a company via the URL — for example,GET /v1/companies/{company-id}/projects lists Projects for one specific company. Use the company-scoped variant when you need to read or write data inside a child.
parent_company_id is read-only in the API. Circular references are rejected. List child companies with GET /v1/companies/{company-id}/children.
Quick example
Fetch the first page of Projects for a company.Going further
Generate an auth token
Log in and exchange credentials for a bearer token.
Webhooks
Subscribe to events and receive them in real time.
Tread Horizon app
Sign in to the platform that backs this API.
Importer APIs (Beta)
Bulk-load Orders, Projects, Tickets, and Files with async ingest endpoints.
Status
Live uptime and incident history.