Reference
Schemas
The objects the API accepts and returns, field by field, exactly as the OpenAPI contract defines them.
Event
object
idstring (uuid)requiredFor deduplication: delivery is “at least once”.
Possible values:
alert.createdalert.acknowledgedalert.resolvedalert.reopenedalert.worker_acknowledgedmuster.startedmuster.kind_changedmuster.phase_changedmuster.targets_changedmuster.updatedmuster.worker_missingmuster.endedapi_versionstringrequiredPossible values:
2026-09-24created_atstring (date-time)requiredorganization_idstring (uuid) | nullrequiredThe site’s company.
nullin test events.site_idstring (uuid)requireddata{ alert } | { muster }requiredThe complete object exactly as the
GETwould return it at that moment.One of 2 shapes
- variant 1
Fields of Alert22
idstring (uuid)requiredPossible values:
sosfall_detectedrestricted_zone_entryforbidden_zone_entrypermit_expired_insidepermit_closed_insideheat_stressevacuation_helpworker_call_requestdevice_offlinelow_batteryearthquaketsunami_riskPossible values:
lowmediumhighcriticalPossible values:
unacknowledgedacknowledgedresolvedtitlestringrequiredWith
include_worker_names, the title the control room reads (it carries the person’s name). Without it, one composed of the type, the zone and theexternal_id, with no name.date_createdstring (date-time)requireddate_last_modifiedstring (date-time)requiredFor ordering: webhooks don’t guarantee order, and anything older than what you already have is discarded.
Fields of SiteRef2
idstring (uuid)requirednamestringrequired
Fields of ZoneRef2
idstring (uuid)requirednamestringrequired
Fields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
Fields of DeviceRef4
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequired
Fields of Location7
latitudenumberrequiredfrom -90 to 90
longitudenumberrequiredfrom -180 to 180
uncertainty_mnumber | nullrequiredUncertainty radius in metres.
nullif unknown: not knowing it is not the same as it being perfect.minimum 0
sourcestringrequiredzone: the person was in a privacy zone and the point is the zone’s, not theirs.Possible values:
gpsnetworkzonemaskedbooleanrequiredThe point is the representative one for a privacy zone.
position_date_utcstring (date-time)requiredheightobject | nullrequiredHeight above ground by barometer, when it can be stated;
nullif not.
location_withheldbooleanrequiredThe position exists but is not delivered: in “emergencies only”, an alert below the severity that lifts the veil doesn’t show it, and neither does the dashboard.
One of 9 shapes
triggerstringrequiredHow it was requested: on the watch screen, with the physical button, after an unanswered fall, or from the control room.
Possible values:
watch_buttonwatch_hardware_buttonafter_fallcontrol_room
escalated_to_sosbooleanrequiredDid not answer the watch’s “Are you OK?” and it escalated to SOS.
zone_typestringrequiredPossible values:
restrictedforbiddenpermit_referencestring | nullrequiredThe permit to work (job safety analysis, JSA) in force, if there was one.
Nothing derived from heart rate: vital signs don’t leave through the API, not even aggregated.
actionstringrequiredWhat the watch has told them: stop, drink and find shade. There are no levels.
Possible values:
stop_and_restheat_index_cnumber | nullrequiredThe plant’s heat index (°C).
sun_exposure_minutesinteger | nullrequired
reasonstring | nullrequiredWhat they said on the watch: trapped, injured or helping someone else.
Possible values:
trappedinjuredhelpingmuster_idstring (uuid)required
voice_notebooleanrequiredWith no coverage, the watch recorded a voice message (it can be heard in the dashboard).
minutes_silentintegerrequired
battery_pctintegerrequiredfrom 0 to 100
magnitudenumber | nullrequireddistance_kmnumber | nullrequiredofficialbooleanrequiredfalse: a SafeOnuba estimate with no official warning.true: an official bulletin confirmed by a person.felt_at_sitebooleanrequiredetastring (date-time) | nullrequiredEstimated arrival of the wave (tsunami).
Fields of Nearby5
kindstringrequiredPossible values:
personvehicleworkerobjectrequiredvehicle_typestring | nullrequireddistance_mintegerrequiredreported_atstring (date-time)required
Fields of VehicleWarning4
atstring (date-time)requiredvehicle_typestring | nullrequireddistance_mintegerrequiredworker_acknowledged_atstring (date-time) | nullrequired
worker_acknowledged_atstring (date-time) | nullrequiredThe worker pressed “Got it” on their watch (watch time).
Fields of ActionBy2
atstring (date-time)requiredbystringrequiredWho: a person from the dashboard, or “Client · Operator (via integration)”.
resolvedobject | nullrequiredResolved: by whom, when and with what note.
Fields3
atstring (date-time)requiredbystringrequiredWho: a person from the dashboard, or “Client · Operator (via integration)”.
notestring | nullrequired
assigned_tostring | nullrequiredsimulatedbooleanrequiredRaised in a drill or with simulated watches.
panel_urlstring (uri)required
- variant 2
Fields of Muster13
idstring (uuid)requiredFields of SiteRef2
idstring (uuid)requirednamestringrequired
statusstringrequiredPossible values:
activecompletedcancelledphasestringrequiredinspecting: headcount complete and the control room is checking the plant; watches say “do not go back until further notice”.Possible values:
evacuatinginspectingPossible values:
generaltsunamiearthquakereasonstring | nullrequiredstarted_atstring (date-time)requiredended_atstring (date-time) | nullrequireddeadlineobject | nullrequiredFields2
atstring (date-time)requiredsourcestringrequiredTsunami: the time of an official warning, or the ceiling in the zone’s plan. Never a physical calculation.
Possible values:
officialplan_estimate
originobject | nullrequiredWhere the emergency comes from.
nullin an evacuation with no origin (a general drill).Fields5
latitudenumberrequiredlongitudenumberrequiredradius_mintegerrequiredlabelstring | nullrequired
targets_revisionintegerrequiredGoes up every time the targets change (ruling out, restoring, change of type).
totalsobjectrequiredThe same figures as the dashboard banner and the closing summary: the server counts them. In an ended evacuation, what remains is what was recorded on ending —arrived and total— and the rest comes out as
null.Fields7
expectedintegerrequiredsafeintegerrequiredhelpinteger | nullrequiredwrong_pointinteger | nullrequiredpendinginteger | nullrequiredno_signalinteger | nullrequirednot_worninteger | nullrequired
The targets for the type, ruled-out ones included.
Fields of AssemblyPoint5
idstring (uuid)requirednamestringrequiredstatusstringrequiredPossible values:
availableexcludedcountinteger | nullrequiredPeople safe at this point.
nullin an ended evacuation: on ending, only the total is kept.excludedobject | nullrequired
Used by: Changes to an alert, Changes to an evacuation
EventType
string
muster.updated: the headcount has changed (checked every 5 s, only emitted if it changes). muster.targets_changed: the control room has ruled out or restored a muster point.
alert.createdalert.acknowledgedalert.resolvedalert.reopenedalert.worker_acknowledgedmuster.startedmuster.kind_changedmuster.phase_changedmuster.targets_changedmuster.updatedmuster.worker_missingmuster.ended
Used by: Replay events
Alert
object
idstring (uuid)requiredPossible values:
sosfall_detectedrestricted_zone_entryforbidden_zone_entrypermit_expired_insidepermit_closed_insideheat_stressevacuation_helpworker_call_requestdevice_offlinelow_batteryearthquaketsunami_riskPossible values:
lowmediumhighcriticalPossible values:
unacknowledgedacknowledgedresolvedtitlestringrequiredWith
include_worker_names, the title the control room reads (it carries the person’s name). Without it, one composed of the type, the zone and theexternal_id, with no name.date_createdstring (date-time)requireddate_last_modifiedstring (date-time)requiredFor ordering: webhooks don’t guarantee order, and anything older than what you already have is discarded.
Fields of SiteRef2
idstring (uuid)requirednamestringrequired
Fields of ZoneRef2
idstring (uuid)requirednamestringrequired
Fields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
Fields of DeviceRef4
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequired
Fields of Location7
latitudenumberrequiredfrom -90 to 90
longitudenumberrequiredfrom -180 to 180
uncertainty_mnumber | nullrequiredUncertainty radius in metres.
nullif unknown: not knowing it is not the same as it being perfect.minimum 0
sourcestringrequiredzone: the person was in a privacy zone and the point is the zone’s, not theirs.Possible values:
gpsnetworkzonemaskedbooleanrequiredThe point is the representative one for a privacy zone.
position_date_utcstring (date-time)requiredheightobject | nullrequiredHeight above ground by barometer, when it can be stated;
nullif not.Fields4
height_mnumberrequireduncertainty_mnumberrequiredbuildingstring | nullrequiredfloorstring | nullrequired
location_withheldbooleanrequiredThe position exists but is not delivered: in “emergencies only”, an alert below the severity that lifts the veil doesn’t show it, and neither does the dashboard.
One of 9 shapes
triggerstringrequiredHow it was requested: on the watch screen, with the physical button, after an unanswered fall, or from the control room.
Possible values:
watch_buttonwatch_hardware_buttonafter_fallcontrol_room
escalated_to_sosbooleanrequiredDid not answer the watch’s “Are you OK?” and it escalated to SOS.
zone_typestringrequiredPossible values:
restrictedforbiddenpermit_referencestring | nullrequiredThe permit to work (job safety analysis, JSA) in force, if there was one.
Nothing derived from heart rate: vital signs don’t leave through the API, not even aggregated.
actionstringrequiredWhat the watch has told them: stop, drink and find shade. There are no levels.
Possible values:
stop_and_restheat_index_cnumber | nullrequiredThe plant’s heat index (°C).
sun_exposure_minutesinteger | nullrequired
reasonstring | nullrequiredWhat they said on the watch: trapped, injured or helping someone else.
Possible values:
trappedinjuredhelpingmuster_idstring (uuid)required
voice_notebooleanrequiredWith no coverage, the watch recorded a voice message (it can be heard in the dashboard).
minutes_silentintegerrequired
battery_pctintegerrequiredfrom 0 to 100
magnitudenumber | nullrequireddistance_kmnumber | nullrequiredofficialbooleanrequiredfalse: a SafeOnuba estimate with no official warning.true: an official bulletin confirmed by a person.felt_at_sitebooleanrequiredetastring (date-time) | nullrequiredEstimated arrival of the wave (tsunami).
Fields of Nearby5
kindstringrequiredPossible values:
personvehicleworkerobjectrequiredFields4
idstring (uuid) | nullrequirednullin alerts from before 24 September 2026, when it was not yet being copied.external_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
vehicle_typestring | nullrequireddistance_mintegerrequiredreported_atstring (date-time)required
Fields of VehicleWarning4
atstring (date-time)requiredvehicle_typestring | nullrequireddistance_mintegerrequiredworker_acknowledged_atstring (date-time) | nullrequired
worker_acknowledged_atstring (date-time) | nullrequiredThe worker pressed “Got it” on their watch (watch time).
Fields of ActionBy2
atstring (date-time)requiredbystringrequiredWho: a person from the dashboard, or “Client · Operator (via integration)”.
resolvedobject | nullrequiredResolved: by whom, when and with what note.
Fields3
atstring (date-time)requiredbystringrequiredWho: a person from the dashboard, or “Client · Operator (via integration)”.
notestring | nullrequired
assigned_tostring | nullrequiredsimulatedbooleanrequiredRaised in a drill or with simulated watches.
panel_urlstring (uri)required
Used by: Alert detail, Acknowledge or resolve an alert
AlertType
string
What has happened. earthquake and tsunami_risk concern the whole plant: they carry no worker or device. A nearby vehicle is not an alert: it appears inside an incident’s alert (nearby, vehicle_warnings).
sosfall_detectedrestricted_zone_entryforbidden_zone_entrypermit_expired_insidepermit_closed_insideheat_stressevacuation_helpworker_call_requestdevice_offlinelow_batteryearthquaketsunami_risk
Used by: List alerts
Severity
string
Severity: low (information), medium (warning), high (serious), critical (critical: SOS, fall, “I can’t evacuate”).
lowmediumhighcritical
Used by: List alerts
AlertStatus
string
acknowledged: an operator has taken charge. It is not the same as worker_acknowledged_at, which means the worker has seen the alert on their watch.
unacknowledgedacknowledgedresolved
Used by: List alerts
SiteRef
object
idstring (uuid)requirednamestringrequired
ZoneRef
object | null
idstring (uuid)requirednamestringrequired
WorkerRef
object | null
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
DeviceRef
object | null
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequired
Location
object | null
latitudenumberrequiredfrom -90 to 90
longitudenumberrequiredfrom -180 to 180
uncertainty_mnumber | nullrequiredUncertainty radius in metres.
nullif unknown: not knowing it is not the same as it being perfect.minimum 0
sourcestringrequiredzone: the person was in a privacy zone and the point is the zone’s, not theirs.Possible values:
gpsnetworkzonemaskedbooleanrequiredThe point is the representative one for a privacy zone.
position_date_utcstring (date-time)requiredheightobject | nullrequiredHeight above ground by barometer, when it can be stated;
nullif not.Fields4
height_mnumberrequireduncertainty_mnumberrequiredbuildingstring | nullrequiredfloorstring | nullrequired
AlertDetails
SosDetails | FallDetails | ZoneDetails | HeatStressDetails | EvacuationHelpDetails | WorkerCallDetails | DeviceOfflineDetails | LowBatteryDetails | HazardDetails
Depends on type.
One of: SosDetails | FallDetails | ZoneDetails | HeatStressDetails | EvacuationHelpDetails | WorkerCallDetails | DeviceOfflineDetails | LowBatteryDetails | HazardDetails
SosDetails
object
triggerstringrequiredHow it was requested: on the watch screen, with the physical button, after an unanswered fall, or from the control room.
Possible values:
watch_buttonwatch_hardware_buttonafter_fallcontrol_room
FallDetails
object
escalated_to_sosbooleanrequiredDid not answer the watch’s “Are you OK?” and it escalated to SOS.
ZoneDetails
object
zone_typestringrequiredPossible values:
restrictedforbiddenpermit_referencestring | nullrequiredThe permit to work (job safety analysis, JSA) in force, if there was one.
HeatStressDetails
object
Nothing derived from heart rate: vital signs don’t leave through the API, not even aggregated.
actionstringrequiredWhat the watch has told them: stop, drink and find shade. There are no levels.
Possible values:
stop_and_restheat_index_cnumber | nullrequiredThe plant’s heat index (°C).
sun_exposure_minutesinteger | nullrequired
EvacuationHelpDetails
object
reasonstring | nullrequiredWhat they said on the watch: trapped, injured or helping someone else.
Possible values:
trappedinjuredhelpingmuster_idstring (uuid)required
WorkerCallDetails
object
voice_notebooleanrequiredWith no coverage, the watch recorded a voice message (it can be heard in the dashboard).
DeviceOfflineDetails
object
minutes_silentintegerrequired
LowBatteryDetails
object
battery_pctintegerrequiredfrom 0 to 100
HazardDetails
object
magnitudenumber | nullrequireddistance_kmnumber | nullrequiredofficialbooleanrequiredfalse: a SafeOnuba estimate with no official warning.true: an official bulletin confirmed by a person.felt_at_sitebooleanrequiredetastring (date-time) | nullrequiredEstimated arrival of the wave (tsunami).
Nearby
object
Who was within 100 m when a critical alert was raised (SOS, fall). Distance, never position; anyone in a privacy zone doesn’t count.
kindstringrequiredPossible values:
personvehicleworkerobjectrequiredFields4
idstring (uuid) | nullrequirednullin alerts from before 24 September 2026, when it was not yet being copied.external_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
vehicle_typestring | nullrequireddistance_mintegerrequiredreported_atstring (date-time)required
VehicleWarning
object
Nearby-vehicle warnings that person received during the incident window. They are warnings, not alerts.
atstring (date-time)requiredvehicle_typestring | nullrequireddistance_mintegerrequiredworker_acknowledged_atstring (date-time) | nullrequired
ActionBy
object | null
atstring (date-time)requiredbystringrequiredWho: a person from the dashboard, or “Client · Operator (via integration)”.
Muster
object
idstring (uuid)requiredFields of SiteRef2
idstring (uuid)requirednamestringrequired
statusstringrequiredPossible values:
activecompletedcancelledphasestringrequiredinspecting: headcount complete and the control room is checking the plant; watches say “do not go back until further notice”.Possible values:
evacuatinginspectingPossible values:
generaltsunamiearthquakereasonstring | nullrequiredstarted_atstring (date-time)requiredended_atstring (date-time) | nullrequireddeadlineobject | nullrequiredFields2
atstring (date-time)requiredsourcestringrequiredTsunami: the time of an official warning, or the ceiling in the zone’s plan. Never a physical calculation.
Possible values:
officialplan_estimate
originobject | nullrequiredWhere the emergency comes from.
nullin an evacuation with no origin (a general drill).Fields5
latitudenumberrequiredlongitudenumberrequiredradius_mintegerrequiredlabelstring | nullrequiredFields of ZoneRef2
idstring (uuid)requirednamestringrequired
targets_revisionintegerrequiredGoes up every time the targets change (ruling out, restoring, change of type).
totalsobjectrequiredThe same figures as the dashboard banner and the closing summary: the server counts them. In an ended evacuation, what remains is what was recorded on ending —arrived and total— and the rest comes out as
null.Fields7
expectedintegerrequiredsafeintegerrequiredhelpinteger | nullrequiredwrong_pointinteger | nullrequiredpendinginteger | nullrequiredno_signalinteger | nullrequirednot_worninteger | nullrequired
The targets for the type, ruled-out ones included.
Fields of AssemblyPoint5
idstring (uuid)requirednamestringrequiredstatusstringrequiredPossible values:
availableexcludedcountinteger | nullrequiredPeople safe at this point.
nullin an ended evacuation: on ending, only the total is kept.excludedobject | nullrequiredFields4
reasonstringrequiredrecommendedbooleanrequiredThe system had recommended it (radius or wind). Whoever rules it out is always a person.
atstring (date-time)requiredbystringrequired
MusterKind
string
generaltsunamiearthquake
AssemblyPoint
object
idstring (uuid)requirednamestringrequiredstatusstringrequiredPossible values:
availableexcludedcountinteger | nullrequiredPeople safe at this point.
nullin an ended evacuation: on ending, only the total is kept.excludedobject | nullrequiredFields4
reasonstringrequiredrecommendedbooleanrequiredThe system had recommended it (radius or wind). Whoever rules it out is always a person.
atstring (date-time)requiredbystringrequired
TokenResponse
object
access_tokenstringrequiredtoken_typestringrequiredPossible values:
Bearerexpires_innumberrequiredPossible values:
3600scopestringrequired
Used by: Request a token (client_credentials)
OAuthError
object
Token error, in the RFC 6749 §5.2 format.
errorstringrequiredPossible values:
invalid_requestinvalid_clientunauthorized_clientunsupported_grant_typeinvalid_scopeerror_descriptionstring
Used by: Request a token (client_credentials)
TokenRequest
object
grant_typestringrequiredPossible values:
client_credentialsclient_idstringrequiredclient_secretstringrequiredscopestringSpace-separated; a subset of the client’s. Without it, all of the client’s.
Used by: Request a token (client_credentials)
SiteList
object
Fields of Site5
idstring (uuid)requirednamestringrequiredlocationstring | nullrequiredprivacy_modestringrequiredon_demand(“emergencies only”): a person’s position is only visible with an open alert fromunveil_min_severity, during an evacuation, or with an approved request. The API obeys the same rule as the dashboard.Possible values:
continuouson_demandPossible values:
lowmediumhighcritical
Used by: The client’s sites
Site
object
idstring (uuid)requirednamestringrequiredlocationstring | nullrequiredprivacy_modestringrequiredon_demand(“emergencies only”): a person’s position is only visible with an open alert fromunveil_min_severity, during an evacuation, or with an approved request. The API obeys the same rule as the dashboard.Possible values:
continuouson_demandPossible values:
lowmediumhighcritical
Problem
object
Error in RFC 9457 format (application/problem+json), with the real HTTP status code.
typestringrequiredURI that identifies the problem type.
titlestringrequiredstatusintegerrequireddetailstringinstancestringcodestringrequiredStable error code, to program against. The text may change; this won’t.
Used by: The client’s sites, A site’s zones and muster points, List alerts, Alert detail, Acknowledge or resolve an alert, List evacuations, Status and headcount of an evacuation, Who is missing, List workers, Worker detail, List watches, Latest visible positions, Replay events, List destinations, Create a destination, Delete a destination, Rotate the signing secret, Send a test event, Launch a test scenario
ZoneList
object
Fields of Zone5
idstring (uuid)requirednamestringrequiredtypestringrequiredPossible values:
work_arearestrictedforbiddenassembly_pointprivacybuildinggeometryobject | nullrequiredGeoJSON polygon (WGS84).
nullfor privacy zones: the name and type are given, not where they are (pending validation with the committee).Fields2
typestringrequiredPossible values:
Polygoncoordinatesarray<array<array>>required
assembly_pointobject | nullrequiredOnly on muster points.
Fields5
servesarray<string>requiredPossible values:
generaltsunamiearthquakeelevation_mnumber | nullrequiredelevation_sourcestring | nullrequiredPossible values:
demverifiedverticalbooleanrequiredVertical refuge (a building).
capacityinteger | nullrequired
Used by: A site’s zones and muster points
Zone
object
idstring (uuid)requirednamestringrequiredtypestringrequiredPossible values:
work_arearestrictedforbiddenassembly_pointprivacybuildinggeometryobject | nullrequiredGeoJSON polygon (WGS84).
nullfor privacy zones: the name and type are given, not where they are (pending validation with the committee).Fields2
typestringrequiredPossible values:
Polygoncoordinatesarray<array<array>>required
assembly_pointobject | nullrequiredOnly on muster points.
Fields5
servesarray<string>requiredPossible values:
generaltsunamiearthquakeelevation_mnumber | nullrequiredelevation_sourcestring | nullrequiredPossible values:
demverifiedverticalbooleanrequiredVertical refuge (a building).
capacityinteger | nullrequired
AlertPage
object
Fields of Alert22
idstring (uuid)requiredPossible values:
sosfall_detectedrestricted_zone_entryforbidden_zone_entrypermit_expired_insidepermit_closed_insideheat_stressevacuation_helpworker_call_requestdevice_offlinelow_batteryearthquaketsunami_riskPossible values:
lowmediumhighcriticalPossible values:
unacknowledgedacknowledgedresolvedtitlestringrequiredWith
include_worker_names, the title the control room reads (it carries the person’s name). Without it, one composed of the type, the zone and theexternal_id, with no name.date_createdstring (date-time)requireddate_last_modifiedstring (date-time)requiredFor ordering: webhooks don’t guarantee order, and anything older than what you already have is discarded.
Fields of SiteRef2
idstring (uuid)requirednamestringrequired
Fields of ZoneRef2
idstring (uuid)requirednamestringrequired
Fields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
Fields of DeviceRef4
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequired
Fields of Location7
latitudenumberrequiredfrom -90 to 90
longitudenumberrequiredfrom -180 to 180
uncertainty_mnumber | nullrequiredUncertainty radius in metres.
nullif unknown: not knowing it is not the same as it being perfect.minimum 0
sourcestringrequiredzone: the person was in a privacy zone and the point is the zone’s, not theirs.Possible values:
gpsnetworkzonemaskedbooleanrequiredThe point is the representative one for a privacy zone.
position_date_utcstring (date-time)requiredheightobject | nullrequiredHeight above ground by barometer, when it can be stated;
nullif not.Fields4
height_mnumberrequireduncertainty_mnumberrequiredbuildingstring | nullrequiredfloorstring | nullrequired
location_withheldbooleanrequiredThe position exists but is not delivered: in “emergencies only”, an alert below the severity that lifts the veil doesn’t show it, and neither does the dashboard.
One of 9 shapes
triggerstringrequiredHow it was requested: on the watch screen, with the physical button, after an unanswered fall, or from the control room.
Possible values:
watch_buttonwatch_hardware_buttonafter_fallcontrol_room
escalated_to_sosbooleanrequiredDid not answer the watch’s “Are you OK?” and it escalated to SOS.
zone_typestringrequiredPossible values:
restrictedforbiddenpermit_referencestring | nullrequiredThe permit to work (job safety analysis, JSA) in force, if there was one.
Nothing derived from heart rate: vital signs don’t leave through the API, not even aggregated.
actionstringrequiredWhat the watch has told them: stop, drink and find shade. There are no levels.
Possible values:
stop_and_restheat_index_cnumber | nullrequiredThe plant’s heat index (°C).
sun_exposure_minutesinteger | nullrequired
reasonstring | nullrequiredWhat they said on the watch: trapped, injured or helping someone else.
Possible values:
trappedinjuredhelpingmuster_idstring (uuid)required
voice_notebooleanrequiredWith no coverage, the watch recorded a voice message (it can be heard in the dashboard).
minutes_silentintegerrequired
battery_pctintegerrequiredfrom 0 to 100
magnitudenumber | nullrequireddistance_kmnumber | nullrequiredofficialbooleanrequiredfalse: a SafeOnuba estimate with no official warning.true: an official bulletin confirmed by a person.felt_at_sitebooleanrequiredetastring (date-time) | nullrequiredEstimated arrival of the wave (tsunami).
Fields of Nearby5
kindstringrequiredPossible values:
personvehicleworkerobjectrequiredFields4
idstring (uuid) | nullrequirednullin alerts from before 24 September 2026, when it was not yet being copied.external_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
vehicle_typestring | nullrequireddistance_mintegerrequiredreported_atstring (date-time)required
Fields of VehicleWarning4
atstring (date-time)requiredvehicle_typestring | nullrequireddistance_mintegerrequiredworker_acknowledged_atstring (date-time) | nullrequired
worker_acknowledged_atstring (date-time) | nullrequiredThe worker pressed “Got it” on their watch (watch time).
Fields of ActionBy2
atstring (date-time)requiredbystringrequiredWho: a person from the dashboard, or “Client · Operator (via integration)”.
resolvedobject | nullrequiredResolved: by whom, when and with what note.
Fields3
atstring (date-time)requiredbystringrequiredWho: a person from the dashboard, or “Client · Operator (via integration)”.
notestring | nullrequired
assigned_tostring | nullrequiredsimulatedbooleanrequiredRaised in a drill or with simulated watches.
panel_urlstring (uri)required
next_cursorstring | nullrequiredOpaque cursor for the next page;
nullif there are no more.
Used by: List alerts
AlertUpdate
object
Two states, acknowledged and resolved, plus the operator. Acknowledging self-assigns the alert if nobody was handling it, as in the dashboard.
statusstringrequiredPossible values:
acknowledgedresolvedresolution_reasonstringOn resolving: why. Free text; it goes in the alert’s timeline next to the note.
up to 200 characters
notestringup to 500 characters
Fields of Actor2
namestringrequiredup to 120 characters
external_idstringup to 64 characters
Used by: Acknowledge or resolve an alert
Actor
object
The operator in the customer’s control room who takes the action. Required: “acknowledged” measures a person’s response, and without a name the timeline would only show the client’s.
namestringrequiredup to 120 characters
external_idstringup to 64 characters
MusterPage
object
Fields of Muster13
idstring (uuid)requiredFields of SiteRef2
idstring (uuid)requirednamestringrequired
statusstringrequiredPossible values:
activecompletedcancelledphasestringrequiredinspecting: headcount complete and the control room is checking the plant; watches say “do not go back until further notice”.Possible values:
evacuatinginspectingPossible values:
generaltsunamiearthquakereasonstring | nullrequiredstarted_atstring (date-time)requiredended_atstring (date-time) | nullrequireddeadlineobject | nullrequiredFields2
atstring (date-time)requiredsourcestringrequiredTsunami: the time of an official warning, or the ceiling in the zone’s plan. Never a physical calculation.
Possible values:
officialplan_estimate
originobject | nullrequiredWhere the emergency comes from.
nullin an evacuation with no origin (a general drill).Fields5
latitudenumberrequiredlongitudenumberrequiredradius_mintegerrequiredlabelstring | nullrequiredFields of ZoneRef2
idstring (uuid)requirednamestringrequired
targets_revisionintegerrequiredGoes up every time the targets change (ruling out, restoring, change of type).
totalsobjectrequiredThe same figures as the dashboard banner and the closing summary: the server counts them. In an ended evacuation, what remains is what was recorded on ending —arrived and total— and the rest comes out as
null.Fields7
expectedintegerrequiredsafeintegerrequiredhelpinteger | nullrequiredwrong_pointinteger | nullrequiredpendinginteger | nullrequiredno_signalinteger | nullrequirednot_worninteger | nullrequired
The targets for the type, ruled-out ones included.
Fields of AssemblyPoint5
idstring (uuid)requirednamestringrequiredstatusstringrequiredPossible values:
availableexcludedcountinteger | nullrequiredPeople safe at this point.
nullin an ended evacuation: on ending, only the total is kept.excludedobject | nullrequiredFields4
reasonstringrequiredrecommendedbooleanrequiredThe system had recommended it (radius or wind). Whoever rules it out is always a person.
atstring (date-time)requiredbystringrequired
next_cursorstring | nullrequiredOpaque cursor for the next page;
nullif there are no more.
Used by: List evacuations
MissingWorkerList
object
Fields of MissingWorker10
Fields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
Fields of DeviceRef4
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequired
statusstringrequiredPossible values:
helpwrong_pointpendingno_signalnot_wornneeds_rescuebooleanrequiredHas an open SOS or fall and has not arrived: cannot leave on their own.
help_reasonstring | nullrequiredPossible values:
trappedinjuredhelpingassembly_pointobject | nullrequiredThe point where they are or said they were (with
wrong_point, one that is unusable).Fields3
idstring (uuid)requirednamestringrequiredvalidbooleanrequired
declared_atstring (date-time) | nullrequiredlast_seen_atstring (date-time) | nullrequiredFields of Location7
latitudenumberrequiredfrom -90 to 90
longitudenumberrequiredfrom -180 to 180
uncertainty_mnumber | nullrequiredUncertainty radius in metres.
nullif unknown: not knowing it is not the same as it being perfect.minimum 0
sourcestringrequiredzone: the person was in a privacy zone and the point is the zone’s, not theirs.Possible values:
gpsnetworkzonemaskedbooleanrequiredThe point is the representative one for a privacy zone.
position_date_utcstring (date-time)requiredheightobject | nullrequiredHeight above ground by barometer, when it can be stated;
nullif not.Fields4
height_mnumberrequireduncertainty_mnumberrequiredbuildingstring | nullrequiredfloorstring | nullrequired
location_withheldbooleanrequired
Used by: Who is missing
MissingWorker
object
Fields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
Fields of DeviceRef4
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequired
statusstringrequiredPossible values:
helpwrong_pointpendingno_signalnot_wornneeds_rescuebooleanrequiredHas an open SOS or fall and has not arrived: cannot leave on their own.
help_reasonstring | nullrequiredPossible values:
trappedinjuredhelpingassembly_pointobject | nullrequiredThe point where they are or said they were (with
wrong_point, one that is unusable).Fields3
idstring (uuid)requirednamestringrequiredvalidbooleanrequired
declared_atstring (date-time) | nullrequiredlast_seen_atstring (date-time) | nullrequiredFields of Location7
latitudenumberrequiredfrom -90 to 90
longitudenumberrequiredfrom -180 to 180
uncertainty_mnumber | nullrequiredUncertainty radius in metres.
nullif unknown: not knowing it is not the same as it being perfect.minimum 0
sourcestringrequiredzone: the person was in a privacy zone and the point is the zone’s, not theirs.Possible values:
gpsnetworkzonemaskedbooleanrequiredThe point is the representative one for a privacy zone.
position_date_utcstring (date-time)requiredheightobject | nullrequiredHeight above ground by barometer, when it can be stated;
nullif not.Fields4
height_mnumberrequireduncertainty_mnumberrequiredbuildingstring | nullrequiredfloorstring | nullrequired
location_withheldbooleanrequired
WorkerPage
object
Fields of Worker8
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequiredrolestring | nullrequiredis_activebooleanrequiredFields of DeviceRef4
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequired
date_last_seenstring (date-time) | nullrequiredThe most recent of the last position and the watch’s last contact.
next_cursorstring | nullrequiredOpaque cursor for the next page;
nullif there are no more.
Used by: List workers
Worker
object
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequiredrolestring | nullrequiredis_activebooleanrequiredFields of DeviceRef4
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequired
date_last_seenstring (date-time) | nullrequiredThe most recent of the last position and the watch’s last contact.
Used by: Worker detail
DevicePage
object
Fields of Device8
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequiredmodelstring | nullrequiredstatusstringrequiredPossible values:
activeinactivemaintenancelostwornboolean | nullrequirednull: not known (no wrist sensor).Fields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
next_cursorstring | nullrequiredOpaque cursor for the next page;
nullif there are no more.
Used by: List watches
Device
object
idstring (uuid)requiredserialstringrequiredbatteryinteger | nullrequiredfrom 0 to 100
date_last_seenstring (date-time) | nullrequiredmodelstring | nullrequiredstatusstringrequiredPossible values:
activeinactivemaintenancelostwornboolean | nullrequirednull: not known (no wrist sensor).Fields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
PositionList
object
Fields of Position4
device_idstring (uuid)requiredFields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
Fields of Location7
latitudenumberrequiredfrom -90 to 90
longitudenumberrequiredfrom -180 to 180
uncertainty_mnumber | nullrequiredUncertainty radius in metres.
nullif unknown: not knowing it is not the same as it being perfect.minimum 0
sourcestringrequiredzone: the person was in a privacy zone and the point is the zone’s, not theirs.Possible values:
gpsnetworkzonemaskedbooleanrequiredThe point is the representative one for a privacy zone.
position_date_utcstring (date-time)requiredheightobject | nullrequiredHeight above ground by barometer, when it can be stated;
nullif not.Fields4
height_mnumberrequireduncertainty_mnumberrequiredbuildingstring | nullrequiredfloorstring | nullrequired
in_vehiclebooleanrequired
Used by: Latest visible positions
Position
object
Only the positions the privacy veil allows at that moment: in “emergencies only”, anyone with nothing open doesn’t appear.
device_idstring (uuid)requiredFields of WorkerRef4
idstring (uuid)requiredexternal_idstring | nullrequiredThe worker’s code at the company (the one in its personnel system).
nullif not given.namestringFull name. Only if the contract includes it; otherwise the property doesn’t appear.
contractorstring | nullrequired
Fields of Location7
latitudenumberrequiredfrom -90 to 90
longitudenumberrequiredfrom -180 to 180
uncertainty_mnumber | nullrequiredUncertainty radius in metres.
nullif unknown: not knowing it is not the same as it being perfect.minimum 0
sourcestringrequiredzone: the person was in a privacy zone and the point is the zone’s, not theirs.Possible values:
gpsnetworkzonemaskedbooleanrequiredThe point is the representative one for a privacy zone.
position_date_utcstring (date-time)requiredheightobject | nullrequiredHeight above ground by barometer, when it can be stated;
nullif not.Fields4
height_mnumberrequireduncertainty_mnumberrequiredbuildingstring | nullrequiredfloorstring | nullrequired
in_vehiclebooleanrequired
EventPage
object
Fields of Event7
idstring (uuid)requiredFor deduplication: delivery is “at least once”.
Possible values:
alert.createdalert.acknowledgedalert.resolvedalert.reopenedalert.worker_acknowledgedmuster.startedmuster.kind_changedmuster.phase_changedmuster.targets_changedmuster.updatedmuster.worker_missingmuster.endedapi_versionstringrequiredPossible values:
2026-09-24created_atstring (date-time)requiredorganization_idstring (uuid) | nullrequiredThe site’s company.
nullin test events.site_idstring (uuid)requireddata{ alert } | { muster }requiredThe complete object exactly as the
GETwould return it at that moment.One of 2 shapes
- variant 1
Fields of Alert22
idstring (uuid)requiredPossible values:
sosfall_detectedrestricted_zone_entryforbidden_zone_entrypermit_expired_insidepermit_closed_insideheat_stressevacuation_helpworker_call_requestdevice_offlinelow_batteryearthquaketsunami_riskPossible values:
lowmediumhighcriticalPossible values:
unacknowledgedacknowledgedresolvedtitlestringrequiredWith
include_worker_names, the title the control room reads (it carries the person’s name). Without it, one composed of the type, the zone and theexternal_id, with no name.date_createdstring (date-time)requireddate_last_modifiedstring (date-time)requiredFor ordering: webhooks don’t guarantee order, and anything older than what you already have is discarded.
location_withheldbooleanrequiredThe position exists but is not delivered: in “emergencies only”, an alert below the severity that lifts the veil doesn’t show it, and neither does the dashboard.
worker_acknowledged_atstring (date-time) | nullrequiredThe worker pressed “Got it” on their watch (watch time).
resolvedobject | nullrequiredResolved: by whom, when and with what note.
assigned_tostring | nullrequiredsimulatedbooleanrequiredRaised in a drill or with simulated watches.
panel_urlstring (uri)required
- variant 2
Fields of Muster13
idstring (uuid)requiredstatusstringrequiredPossible values:
activecompletedcancelledphasestringrequiredinspecting: headcount complete and the control room is checking the plant; watches say “do not go back until further notice”.Possible values:
evacuatinginspectingPossible values:
generaltsunamiearthquakereasonstring | nullrequiredstarted_atstring (date-time)requiredended_atstring (date-time) | nullrequireddeadlineobject | nullrequiredoriginobject | nullrequiredWhere the emergency comes from.
nullin an evacuation with no origin (a general drill).targets_revisionintegerrequiredGoes up every time the targets change (ruling out, restoring, change of type).
totalsobjectrequiredThe same figures as the dashboard banner and the closing summary: the server counts them. In an ended evacuation, what remains is what was recorded on ending —arrived and total— and the rest comes out as
null.The targets for the type, ruled-out ones included.
next_cursorstring | nullrequiredOpaque cursor for the next page;
nullif there are no more.
Used by: Replay events
WebhookEndpointList
object
Fields of WebhookEndpoint7
idstring (uuid)requiredurlstring (uri)requiredevent_typesarray<EventType | "alert.*" | "muster.*">requiredfiltersobjectrequiredFields3
site_idsarray<string (uuid)>min_severitySeverityPossible values:
lowmediumhighcriticalcontractorsarray<string>
is_activebooleanrequiredfailing_sincestring (date-time) | nullrequiredHas been failing since then. The destination is not disabled automatically: the next SOS would stop arriving without anyone deciding it.
created_atstring (date-time)required
Used by: List destinations
WebhookEndpoint
object
idstring (uuid)requiredurlstring (uri)requiredevent_typesarray<EventType | "alert.*" | "muster.*">requiredfiltersobjectrequiredFields3
site_idsarray<string (uuid)>min_severitySeverityPossible values:
lowmediumhighcriticalcontractorsarray<string>
is_activebooleanrequiredfailing_sincestring (date-time) | nullrequiredHas been failing since then. The destination is not disabled automatically: the next SOS would stop arriving without anyone deciding it.
created_atstring (date-time)required
WebhookEndpointCreated
object
idstring (uuid)requiredurlstring (uri)requiredevent_typesarray<EventType | "alert.*" | "muster.*">requiredfiltersobjectrequiredFields3
site_idsarray<string (uuid)>min_severitySeverityPossible values:
lowmediumhighcriticalcontractorsarray<string>
is_activebooleanrequiredfailing_sincestring (date-time) | nullrequiredHas been failing since then. The destination is not disabled automatically: the next SOS would stop arriving without anyone deciding it.
created_atstring (date-time)requiredsecretstringrequiredThe signing secret. Shown only this once.
Used by: Create a destination
WebhookEndpointCreate
object
urlstringrequiredevent_typesarray<EventType | "alert.*" | "muster.*">requiredfiltersobjectFields3
site_idsarray<string (uuid)>min_severitySeverityPossible values:
lowmediumhighcriticalcontractorsarray<string>
Used by: Create a destination
WebhookSecretRotated
object
secretstringrequiredprevious_valid_untilstring (date-time)required
Used by: Rotate the signing secret
SandboxScenarioRun
object
run_idstring (uuid)requiredPossible values:
sosfallheat_stressevacuationsite_idstring (uuid)requiredresourceobjectrequiredWhat it has opened: check it with its
GET, or wait for the webhook.Fields2
typestringrequiredPossible values:
alertmusteridstring (uuid)required
ends_atstring (date-time)requiredWhen it closes by itself.
Used by: Launch a test scenario
SandboxScenario
string
sos,fall,heat_stress: a test person presses SOS, falls or suffers heat stress. The alert goes out (alert.created) and, if nobody resolves it first withPUT /v1/alerts/{id}, it resolves itself after 10 min (alert.resolved).evacuation: a general evacuation of 3 min. At 15 s four people arrive at point A; at 35 s someone arrives at B and the control room rules it out (muster.targets_changed); at 55 s a person asks for help (alert.created,evacuation_help); at 95 s whoever was at B moves on to C; at 3 min, all clear (muster.ended). In between,muster.updatedevery time the headcount changes.
sosfallheat_stressevacuation
SandboxScenarioRequest
object
Possible values:
sosfallheat_stressevacuationsite_idstring (uuid)The sandbox site. Without it, the first one of yours that is a sandbox site.
Used by: Launch a test scenario