M Express integration guide
This guide helps backend engineers add two M Express capabilities safely: customer-safe public tracking and signed delivery webhooks. You can choose the right capability, implement its contract, and verify it before release.
What you can do here
Read a delivery projection from a tracking_number, or receive delivery events in your own service. Both integrations are server-to-server concerns.
Choose the right capability
| Your product needs to… | Use | Start here |
|---|---|---|
| Let a customer check a shipment by tracking number | Public Tracking | Public Tracking |
| Update your own systems when a delivery changes | Webhooks | Webhooks |
| Build either integration safely | Shared setup and release checks | Get started |
Tracking is request/response: your service asks when it needs a fresh, customer-safe view. Webhooks are delivery-driven: M Express posts an event to your receiver, and your service verifies, stores, and processes it. Many integrations use both—show tracking in a customer UI, then use webhooks to keep internal workflows current.
Data visibility boundary
Public Tracking accepts only a tracking_number and returns a deliberately narrow customer projection. It does not return recipient contact or address data, package scan codes, POD media, precise location, driver or device identity, billing data, raw scans, or internal audit and risk information.
Webhooks are sent only to a configured receiver. Treat each payload as an integration event, verify its signature over the unchanged bytes, and keep its contents within the access controls appropriate for your system.
Documentation host is not the API host
This site, https://docs.mexpress.nz, serves documentation only. Production API requests always begin with https://mexpress.nz/api/v1.
A short route to production
- Read Get started and keep signing secrets in server-side secret storage.
- Implement the appropriate Tracking request or Webhook receiver using the contract examples.
- Exercise normal, unavailable, rate-limited, duplicate, and retry paths.
- Use the checklists on the relevant pages before enabling the integration.
Next step
Start with Get started to set the API host, secret boundary, and acceptance path.