feat(fleetbase-api): driver manifests and driver password endpoints

postman/collections/Fleetbase API/Drivers/Change Driver Password.params.yaml

@@ -0,0 +1,18 @@
+$kind: params
+fields:
+  - name: current_password
+    type: string
+    required: true
+    description: The driver's existing password. The change is refused without it.
+  - name: password
+    type: string
+    required: true
+    description: The new password. Must be at least 8 characters.
+  - name: password_confirmation
+    type: string
+    required: false
+    description: When present, must match `password`.
+  - name: device_name
+    type: string
+    required: false
+    description: Name for the replacement token issued to the caller. Defaults to `navigator`.

postman/collections/Fleetbase API/Drivers/Change Driver Password.request.yaml

@@ -0,0 +1,26 @@
+$kind: http-request
+name: "Change Driver Password"
+description: |-
+  Changes the password of a driver who is signed in, proving the current one.
+
+  A password change is an authorisation decision rather than an attribute update, which is why it is not part of `PUT /drivers/:id` — that endpoint does not accept a password at all. Supplying the wrong `current_password` is refused and changes nothing.
+
+  Every other session is revoked when the password changes, and a fresh token is returned in the same response, so the caller keeps working while other devices are signed out.
+url: "{{base_url}}/{{namespace}}/drivers/:id/change-password"
+method: POST
+pathVariables:
+  - key: id
+    value: "{{driver_id}}"
+    description: (Required) The driver whose password is being changed.
+
+body:
+  type: json
+  content: |-
+    {
+      "current_password": "{{driver_current_password}}",
+      "password": "{{driver_new_password}}",
+      "password_confirmation": "{{driver_new_password}}",
+      "device_name": "navigator"
+    }
+
+order: 13000

postman/collections/Fleetbase API/Drivers/List Driver Manifests.queryParams.yaml

@@ -0,0 +1,14 @@
+$kind: queryParams
+fields:
+  - name: status
+    type: string
+    required: false
+    description: Comma separated statuses to include, such as `pending,in_progress`.
+  - name: on
+    type: string
+    required: false
+    description: Only manifests scheduled on this date, as `YYYY-MM-DD`.
+  - name: limit
+    type: integer
+    required: false
+    description: Maximum manifests to return. Defaults to 30.

postman/collections/Fleetbase API/Drivers/List Driver Manifests.request.yaml

@@ -0,0 +1,16 @@
+$kind: http-request
+name: "List Driver Manifests"
+description: |-
+  Lists the manifests assigned to a driver, newest first.
+
+  A manifest is a driver's route: an order-agnostic sequence of stops which may span several orders, or none the driver has seen as an order.
+
+  Defaults to a recent window rather than the driver's whole history. Use `status` and `on` to narrow it further.
+url: "{{base_url}}/{{namespace}}/drivers/:id/manifests"
+method: GET
+pathVariables:
+  - key: id
+    value: "{{driver_id}}"
+    description: (Required) The driver whose manifests to list.
+
+order: 13300

postman/collections/Fleetbase API/Drivers/Request Driver Password Reset.params.yaml

@@ -0,0 +1,6 @@
+$kind: params
+fields:
+  - name: identity
+    type: string
+    required: true
+    description: The driver's email address or phone number.

postman/collections/Fleetbase API/Drivers/Request Driver Password Reset.request.yaml

@@ -0,0 +1,19 @@
+$kind: http-request
+name: "Request Driver Password Reset"
+description: |-
+  Sends a password reset code to a driver who cannot sign in.
+
+  The code goes by email or SMS depending on whether `identity` looks like an email address or a phone number.
+
+  The response is the same whether or not the identity belongs to a driver. That is deliberate: an endpoint that answered differently for an unknown number would be a way to enumerate an organization's drivers.
+url: "{{base_url}}/{{namespace}}/drivers/forgot-password"
+method: POST
+
+body:
+  type: json
+  content: |-
+    {
+      "identity": "{{driver_email}}"
+    }
+
+order: 13100

postman/collections/Fleetbase API/Drivers/Reset Driver Password.params.yaml

@@ -0,0 +1,14 @@
+$kind: params
+fields:
+  - name: identity
+    type: string
+    required: true
+    description: The driver's email address or phone number — the same one the code was sent to.
+  - name: code
+    type: string
+    required: true
+    description: The verification code sent by `POST /drivers/forgot-password`.
+  - name: password
+    type: string
+    required: true
+    description: The new password. Must be at least 8 characters.

postman/collections/Fleetbase API/Drivers/Reset Driver Password.request.yaml

@@ -0,0 +1,21 @@
+$kind: http-request
+name: "Reset Driver Password"
+description: |-
+  Sets a new password using the code sent by `POST /drivers/forgot-password`.
+
+  A wrong code, an expired code and an unknown identity all return the same error, so the endpoint cannot be used to test which of the three happened.
+
+  Every session is revoked on success. A reset is a recovery from losing control of an account, so nothing that was signed in stays signed in.
+url: "{{base_url}}/{{namespace}}/drivers/reset-password"
+method: POST
+
+body:
+  type: json
+  content: |-
+    {
+      "identity": "{{driver_email}}",
+      "code": "{{driver_password_reset_code}}",
+      "password": "{{driver_new_password}}"
+    }
+
+order: 13200

postman/collections/Fleetbase API/Manifests/.resources/definition.yaml

@@ -0,0 +1,6 @@
+$kind: collection
+description: |-
+  A manifest is a driver's route: an order-agnostic sequence of stops which may span several orders, or none the driver has seen as an order.
+
+  These endpoints are for the driver running the route. Creating, cancelling and deleting a manifest is dispatch work and is not part of the consumable API.
+order: 8500

postman/collections/Fleetbase API/Manifests/.resources/object.yaml

@@ -0,0 +1,22 @@
+$kind: object
+name: Manifest
+description: |-
+  A route assigned to a driver for a day, made of ordered stops.
+example: |
+  {
+    "id": "manifest_7KpQ2Rx9Vz",
+    "status": "in_progress",
+    "scheduled_date": "2026-08-23",
+    "started_at": "2026-08-23T07:12:04.000000Z",
+    "completed_at": null,
+    "total_distance_m": 41200,
+    "total_duration_s": 5400,
+    "stop_count": 8,
+    "completed_stops": 3,
+    "pending_stops": 5,
+    "driver_name": "Ron",
+    "vehicle_name": "EAS-01",
+    "notes": null,
+    "updated_at": "2026-08-23T09:02:00.000000Z",
+    "created_at": "2026-08-23T06:40:00.000000Z"
+  }

postman/collections/Fleetbase API/Manifests/Optimize a Manifest.params.yaml

@@ -0,0 +1,10 @@
+$kind: params
+fields:
+  - name: latitude
+    type: number
+    required: false
+    description: The driver's current latitude. The walk starts here when both coordinates are given.
+  - name: longitude
+    type: number
+    required: false
+    description: The driver's current longitude.

postman/collections/Fleetbase API/Manifests/Optimize a Manifest.request.yaml

@@ -0,0 +1,28 @@
+$kind: http-request
+name: "Optimize a Manifest"
+description: |-
+  Re-sequences the stops a driver has not done yet, nearest first.
+
+  This is the driver's optimise, not the orchestrator's. The orchestrator allocates orders across a fleet and produces manifests; this reorders the stops of one manifest that is already assigned.
+
+  It is a nearest-neighbour walk over road distances: from the driver's position to the closest remaining stop, then the closest from there. That is usually a large improvement on an arbitrary order and is not guaranteed optimal.
+
+  Completed and skipped stops keep their place — a route already driven is not re-planned. A manifest with fewer than three stops still to do is returned unchanged, since there is no ordering to find.
+
+  Send `latitude` and `longitude` to start the walk from where the driver actually is. Without them it starts from the first stop still to do.
+url: "{{base_url}}/{{namespace}}/manifests/:id/optimize"
+method: POST
+pathVariables:
+  - key: id
+    value: "{{manifest_id}}"
+    description: (Required) The manifest to re-sequence.
+
+body:
+  type: json
+  content: |-
+    {
+      "latitude": 1.3521,
+      "longitude": 103.8198
+    }
+
+order: 2000

postman/collections/Fleetbase API/Manifests/Retrieve a Manifest.request.yaml

@@ -0,0 +1,14 @@
+$kind: http-request
+name: "Retrieve a Manifest"
+description: |-
+  Retrieves a manifest with its stops, in the sequence they are to be driven.
+
+  Each stop carries its place inline — a route of twenty stops is one request, not twenty-one — along with its status, estimated and actual arrival, and the distance and duration from the previous stop.
+url: "{{base_url}}/{{namespace}}/manifests/:id"
+method: GET
+pathVariables:
+  - key: id
+    value: "{{manifest_id}}"
+    description: (Required) The manifest to retrieve.
+
+order: 1000

postman/collections/Fleetbase API/Manifests/Update a Manifest Stop.params.yaml

@@ -0,0 +1,10 @@
+$kind: params
+fields:
+  - name: status
+    type: string
+    required: false
+    description: One of `arrived`, `completed` or `skipped`. Anything else is refused.
+  - name: meta
+    type: object
+    required: false
+    description: Arbitrary metadata to store against the stop, such as a note left on arrival.

postman/collections/Fleetbase API/Manifests/Update a Manifest Stop.request.yaml

@@ -0,0 +1,23 @@
+$kind: http-request
+name: "Update a Manifest Stop"
+description: |-
+  Marks a stop on a manifest as arrived, completed or skipped.
+
+  Status changes run through the manifest's own transitions rather than writing a column, so arrival and completion timestamps are recorded and a manifest completes itself when its last stop does.
+
+  Any other status is refused and changes nothing.
+url: "{{base_url}}/{{namespace}}/manifest-stops/:id"
+method: PATCH
+pathVariables:
+  - key: id
+    value: "{{manifest_stop_id}}"
+    description: (Required) The stop to update.
+
+body:
+  type: json
+  content: |-
+    {
+      "status": "arrived"
+    }
+
+order: 3000