Onfleet
Dispatch and track last-mile deliveries — create tasks, manage workers, teams and hubs, and get notified as tasks move through Onfleet.
About
Onfleet ships in the w6w first-party pack. It declares 32 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.
- App id
io.w6w.onfleet- Version
- 0.1.0
- Author
- w6w
- Licence
- MIT
- Categories
- Commerce & Payments · Productivity
Overview
Onfleet dispatches and tracks last-mile deliveries: create a task with a destination and recipient, assign it to a worker, team or the organization’s own unassigned pool, and follow it through unassigned → assigned → active → completed. A task can be force-completed, updated (only notes/metadata once active, only metadata/custom fields once completed — Onfleet locks the rest), or deleted while still unstarted.
Workers, teams and hubs are the dispatch primitives: a worker carries a vehicle and a duty state, a team groups workers under a hub and managers, and a hub is a home address a team dispatches from. Destinations and recipients can be created standalone and referenced by ID across many tasks — a warehouse that ships all day should create its destination once. Webhooks cover the task lifecycle (created, assigned, started, completed, failed, delayed) plus worker duty changes, so a workflow can react without polling.
Left out: route optimization, route plans, barcode scanning, custom task templates and administrator management — these are either dashboard-configured features with no stable public shape to automate against, or operator-level account management rather than steps in a delivery workflow.
Build with Onfleet
Three routes to the same 32 actions. The Workflow tab is generated from Onfleet's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
Create destination
destination-create Create a reusable address, geocoded by Onfleet unless coordinates are given.
Get organization
organization-get Fetch this connection's own organization: name, timezone, country, delegatees.
Get connected organization
organization-get-delegatee Fetch the details of an organization connected to this one.
Create recipient
recipient-create Create a reusable recipient. `phone` is the unique identifier and unset afterwards.
Update recipient
recipient-update Update a recipient's name, notes, SMS setting or metadata. `phone` cannot change — create a new recipient instead.
Create task
task-create Create a delivery or pickup task, with a destination and optional recipient.
Update task
task-update Update a task. Only `notes`/`metadata` may change once a task is active, and only `metadata`/custom fields once it is completed — everything else is ignored past that point.
Create webhook
webhook-create Register an HTTPS URL to receive Onfleet events for the chosen trigger.
List webhooks
webhook-list List every registered webhook. `isEnabled: false` means 300+ consecutive delivery failures auto-disabled it.
Update webhook
webhook-update Update a webhook's URL, trigger, threshold or connection-events setting.
Create worker
worker-create Add a worker (driver/courier). Onfleet texts them an app download link and a temporary password.
List workers near a location
worker-list-by-location Find workers within a radius (meters) of a coordinate.
Update worker
worker-update Update a worker's name, teams, vehicle, capacity or display name. `phone` cannot be changed this way — Onfleet ignores it without an error.
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Onfleet's real ids.
{
"manifestVersion": "2",
"name": "onfleet-example",
"steps": [
{
"id": "destination-create",
"uses": {
"app": "io.w6w.onfleet",
"action": "destination-create",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"address": "<address>"
}
}
]
}Here are some of the things you can do
-
Create destination
performdestination-create -
Get destination
readdestination-get -
Create hub
performhub-create -
List hubs
searchhub-list -
Update hub
performhub-update
+27 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Onfleet, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Onfleet. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "destination-create",
payload: {
address: "<value>",
// location: "<value>",
// notes: "<value>",
// language: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value);npm install -g @w6w/cliw6w run conn_YOUR_CONNECTION_ID --action destination-create --payload '{"address":"<value>"}'Give an AI agent Onfleet — without giving it Onfleet's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.onfleet#destination-create",
"input": {
"address": "<address>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Onfleet connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
What the agent gets
Credentials it can't read
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
A tool surface scoped to the caller
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
A durable workflow in one call
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Health-aware discovery
Onfleet's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Onfleet itself is MIT, and the runtime that executes it is source-available (FSL).
Health checks
Onfleet declares its own checks, so its health is a property of the app rather than something the host guesses at.
Onfleet platform status
Onfleet's own API — the one component every action here calls through. Other components (Dashboard, Maps, driver apps, ETA, location streaming) are named when affected but do not change the verdict.
Request-rate headroom
Onfleet's 20 req/s budget is shared across every API key on the organization, read from the `X-RateLimit-*` headers on the cheapest available call.