Integrations

Connect your terminal and steamship-line credentials

Tracking Adapters is the one screen where your workspace stores the terminal and steamship-line logins that LongShorty uses to sign in and update containers. Most sources need nothing from you. Three of them need an account you own, and knowing which is which is the whole job.

7 minute setup · Updated July 27, 2026

You cannot add a source yourself.

The list on this page is not a catalog to shop from. Conterminal enables each source for your workspace, and the page shows only the ones already enabled plus any still in development. If a terminal you use is not listed, no amount of credential entry will add it — ask support to enable it.

What an adapter is

An adapter is one source LongShorty knows how to read. LongShorty is the worker that signs into terminal, rail, and steamship-line systems on a schedule and writes what it finds back onto your containers. It is not the document parser — nothing on this page affects how a PDF you email in gets read.

Each adapter reports a fixed set of milestones. A terminal adapter certifies which marine terminal a container is actually at and when it gated out or was returned empty. A steamship-line adapter reads the carrier's own tracking for the same container, usually through the bill of lading. Rail is thinner than people expect: CSX is the only direct rail adapter available to a workspace today, and most other rail milestones arrive secondhand through steamship-line sources such as Maersk, MSC, and ONE. BNSF is a customer-credential rail source that is still in development.

Getting to the page

Open the workspace menu and select Tracking Adapters, or search for it in the navigation — it is registered under the keywords tracking adapters, credentials, terminal, and emodal.
The page header reads Tenant Admin / Tracking Adapters, with the subtitle “Configure enabled tracking sources for your workspace name.” A Return to workspace link sits above it.
Four counters run across the top: Available, Enabled, Ready, and Needs Setup. In-development sources count toward Available but never toward Enabled, so those two numbers legitimately differ.
Below that is a single Sources table with the columns Adapter, Status, Updated, Notes, and Actions. Row actions stay invisible until you hover the row or tab into it.

Four status badges appear in that table:

Ready: Enabled for your workspace and either needs no credentials or has a usable credential row. Nothing to do.
Needs setup: Enabled, but there is no usable credential. LongShorty will not get anything from this source until that is fixed.
In development: A source Conterminal is still building. You may be asked to store credentials early; runtime polling stays off until Conterminal activates it.
Credentials stored: The in-development variant of the same row once a credential has been saved for it.

Access is narrow on purpose. The page requires the tenant_admin role in a Forwarder or Importer workspace and at least one adapter already enabled for your organization. Carrier and warehouse workspaces never get it, and neither does tenant_manager. See why a page is missing if you expected to have it.

Which sources need a login and which are public endpoints

Nine of the fifteen sources need no credential at all. They are either public tracking endpoints or, in CSX's case, keyed by Conterminal and scoped to your terminals. Only eModal, Maher, and Octopi ask you for an account. Here is the full set of sources a workspace can be enabled for, what each one reports, and what it wants from you:

Source	Type	Reports	Credentials
eModal	Terminal	terminal identity, gate out, empty return	You enter them here
PNCT	Terminal	terminal identity, gate out, empty return	None — public endpoint
APM	Terminal	terminal identity, gate out, empty return	Conterminal-managed
Maher	Terminal	terminal identity, gate out, empty return	You enter them here
Octopi	Terminal	terminal identity, gate out, empty return	You enter them here
CSX (ShipCSX Equipment Lookup)	Rail	rail milestones, gate out, empty return	None — platform-keyed lookup
CMA CGM Tracking	Steamship line	terminal identity, gate out, empty return	None — public endpoint
Dole Ocean Cargo	Steamship line	terminal identity, gate out	None — public endpoint
Evergreen ShipmentLink	Steamship line	terminal identity, gate out, empty return	None — public endpoint
Maersk Tracking	Steamship line	terminal identity, gate out, empty return	None — public endpoint
ONE	Steamship line	terminal identity, gate out, empty return	None — public endpoint
Atlantic Container Line	Steamship line	terminal identity, gate out, empty return	None — public endpoint
Seaboard Marine	Steamship line	terminal identity, gate out, empty return	None — public endpoint
HOLT Gloucester	Terminal	terminal identity, gate out, empty return	Required, but no form on this page
HOLT Packer	Terminal	terminal identity, gate out, empty return	Required, but no form on this page

The Notes column on the live page says the same thing in three words or fewer. A credential-free source reads Public endpoint, except CSX, which reads Platform-keyed ShipCSX lookup. A source running on Conterminal's own credential rather than yours reads Conterminal-managed. A source you configured summarizes what is stored — for example Account: yourname, or CSP user: yourname, CSP primary configured for Maher.

Two sources need a login you cannot enter.

HOLT Gloucester and HOLT Packer require terminal credentials, but their rows are status-only — there is no Add button and no form. If either sits at Needs setup with a dash in Notes, that is not something you can fix from this screen. Contact support and have the HOLT Connect account ready.

Adding credentials per adapter

Saving a credential is a live sign-in, not a note to self. Conterminal authenticates against the provider before it writes anything, so a wrong password fails immediately rather than sitting in the table looking configured.

Open the row's form. Hover the row and select Add (blue, with a plus) if nothing is stored yet, or Edit (with a pencil) to replace what is there. A popover opens headed with the source name and a one-line description of what that source expects.
Enter the account. The identity field is labeled per source: Username for eModal, CSP Username for Maher, Email for Octopi. Editing an existing credential prefills it with the stored account.
Enter the password. The second field is labeled Password, or Password / secret on an in-development row. Both fields are required; submitting either one empty returns “Identity and password are required” in a red banner.
Submit. The button is labeled for the source: Store eModal Credentials, Store Maher CSP Credentials, or Store Octopi Credentials.
Read the banner. A green banner across the top confirms the save — it uses the internal adapter key, so eModal reports “emodal credentials stored.” A red banner means nothing was written; the message is passed straight through from the provider.

What each source expects

eModal: “Store the eModal account used for this workspace. Tokens are refreshed from the encrypted bootstrap password.” Conterminal exchanges the username and password with eModal SSO for an access and refresh token, then keeps refreshing on its own.
Maher: “Store the Maher CSP account. CSP is the primary Maher path; official API fallback remains optional and platform-managed.” Conterminal signs in to Maher CSP and stores the returned token and CSP user record.
Octopi: “Store the Octopi account used for this workspace. The encrypted password is used to refresh the browser session.” Conterminal walks the real Octopi login form, including its CSRF token, before saving.

Use a terminal account issued to the company, not the one you use personally, wherever the terminal allows it. The stored password is reusable by design, and a shared service account is far easier to rotate than a named user's login.

Sources still in development

Two rows are collection-only today: BNSF and Conley Tideworks. Both use the generic Account / username label, and they differ in one important way. Conley Tideworks is labeled Validate and Store and really does attempt a terminal login before saving — “Tests one terminal login before saving. Runtime polling stays off until activation.” BNSF is labeled Save Credentials and stores what you type without checking it: “Stores BNSF Customer Portal credentials for future activation. Runtime polling stays off until activation.”

A saved in-development credential does nothing yet. The row moves from In development to Credentials stored, but no polling starts until Conterminal activates the adapter. Do not close an internal ticket on the strength of that badge.

Previewing and testing

Preview

The Preview action is press-and-hold, not click. Hold the pointer down on it and a small panel appears with two fields, Account and Password / secret. Release the button, move the pointer off it, scroll, resize the window, or press Escape and the panel closes. It only appears on rows that actually hold a stored secret — never on a public endpoint and never on a Conterminal-managed row.

Preview shows the real password, not a redacted one.

This is not a masked hint or a last-four. Conterminal decrypts the stored secret and displays it in full. Anyone who can open this page can read every terminal password your workspace has stored, so treat the Preview button the way you would treat a password manager in front of a shared desk. If that is not acceptable for your organization, keep the number of tenant_admins small.

The only failure text the panel ever shows is Unavailable. It covers every reason at once: no stored secret, a credential row that belongs to a different organization, an adapter that is not previewable, or a decryption failure. It is deliberately uninformative — do not read a specific cause into it.

Test

Test opens a popover headed source name connection test and runs immediately — you do not press anything else. While it runs it shows “Testing source name…”. A Rerun control in the header repeats it. The result is a colored badge — healthy, degraded, down, or error — a sentence, and an Observed timestamp.

A pass reads Connection healthy. A pass with a caveat reads Connection reachable but degraded. A failure with no detail from the provider reads Connection failed; otherwise the provider's own error is shown verbatim.

Test is only meaningful on some sources.

Only PNCT, eModal, APM, Maher, Octopi and the in-development adapters have a real probe behind the button. Every other source — including CSX, CMA CGM, Dole, Evergreen, Maersk, ONE, ACL, Seaboard Marine, HOLT Gloucester and HOLT Packer — falls through to the eModal check and reports “No eModal credential row was found for the requested scope” no matter how healthy it is. That message on a non-eModal row is a quirk of the test button, not a problem with your tracking. Ignore it.

Maher runs two probes at once — the CSP login that actually matters and an optional official-API fallback. When CSP passes and the fallback does not, the test genuinely succeeded but the badge still renders in the red error style. Read the sentence, not the color.

Platform-managed fallbacks

Some rows run on a credential Conterminal owns rather than one you entered. When that happens the Notes column reads Conterminal-managed and the Preview button disappears, because there is nothing of yours to show. The row can still be Ready — a platform credential is a real credential.

APM Terminals: “APM Track and Trace is managed by Conterminal. No tenant cookie, telemetry, or consumer-key entry is required here.” If APM needs attention the fix is on Conterminal's side, not yours.
CSX: “CSX ShipCSX Equipment Lookup is platform-keyed and tenant-scoped by terminal, so this workspace does not need to store credentials.”
Evergreen and Maersk: Public and can serve as the primary managed-tracking source when no terminal adapter is listed for a container. Nothing to store.
PNCT and Dole: PNCT is a public terminal endpoint. Dole traceability is public and scoped by container, vessel, and voyage. Both need nothing from you.

Conterminal can also take a source out of your hands entirely. If it does, saving or testing that source returns “Platform controls this adapter for your organization.” when the source is still running for you, or “Platform has not activated this adapter for your organization.” when it is not. Neither is a credential problem, and retrying will not clear it.

What Conterminal keeps

Stored per credential: The account identity you typed (username, email, or Maher CSP username), the password encrypted at rest, whatever session material the provider returns — an eModal access and refresh token with an expiry, a Maher CSP token and user record — the last validation result for in-development sources, and the timestamp shown in the Updated column.
Scoped to your workspace: Every read and write is filtered by your organization. A credential that belongs to another organization is rejected with “Selected credential does not match the active workspace” rather than being read.

The stored password is recoverable, not one-way.

Conterminal encrypts it rather than hashing it, because the worker has to replay your actual password to re-establish a terminal session. That is what makes automated tracking work, and it is also why Preview can show it back to you in plain text. Assume that anything you store here is readable by every tenant_admin in your workspace, and rotate it at the terminal if that assumption stops being acceptable.

Replacing a credential overwrites the old one in place — there is no history and no second copy. There is no delete action on this page; if a source must be turned off entirely, ask support to disable it for your workspace.

Troubleshooting

Tracking Adapters is not in the workspace menu

The entry is gated twice: you need the tenant_admin role in a Forwarder or Importer workspace, and your organization needs at least one adapter already enabled. An admin whose workspace has no enabled adapters sees no menu entry at all — the item does not appear and then bounce you. Ask support whether any adapter is enabled for your organization before chasing your role.

Opening the URL directly lands on /protected/unauthorized

Same two gates, reached the hard way. A carrier or warehouse workspace, a tenant_manager or tenant_user, or an organization with no active adapter access all end here. Switch to the right workspace first; if you are already a tenant_admin there, the missing piece is the adapter access itself.

“Platform has not enabled that adapter for this workspace”

A red banner after saving or testing. The adapter is not active for your organization, so nothing was written. This is normal if the row you acted on was in development, or if access was revoked between the page loading and your click. Reload the page to see the current list.

“Platform controls this adapter for your organization.”

Conterminal manages this source centrally and tenant edits are blocked. The related message “Platform has not activated this adapter for your organization.” means the same thing for a source that is not running for you yet. Neither is fixed by re-entering the password.

“Identity and password are required”

One of the two fields was blank or whitespace only. Both are mandatory for every source that offers a form, including the in-development ones.

The test says “No eModal credential row was found for the requested scope” on a source that is not eModal

Expected. The test button only has a real probe for PNCT, eModal, APM, Maher, Octopi and the in-development adapters; every other source falls through to the eModal check and reports its message. It says nothing about that source's health. Judge public sources by whether container data is arriving, not by this button.

“Access token expired — will auto-refresh on next sync”

eModal only, and harmless. The stored token aged out and Conterminal will mint a new one from the encrypted password on the next run. Re-entering your eModal password does not speed this up.

“Session expired — re-bootstrap from browser DevTools” or “No credentials configured — manual bootstrap needed”

APM only. APM session material is platform-managed and cannot be entered from this page. Contact support rather than trying to fix it in the row.

“Login failed; verify the account identity and password.”

The terminal login page came back still showing its login form, which means the credentials were rejected. Sign in to the terminal portal yourself in a browser to confirm the account works and is not locked out or awaiting a password change, then store it again. The variant “Login failed; the terminal portal returned an authentication error.” means the same thing.

“The login page did not expose the expected credential form.” or “Login response did not include the expected authenticated session cookie.”

The terminal site changed shape or is down; the probe never got as far as judging your password. This is a Conterminal-side fix. Report it with the source name and the time, and do not keep retrying with different passwords.

A row shows “Needs validation”, “Last test failed”, or “Validation failed”

In-development sources record the outcome of the last credential test on the row. “Needs validation” means credentials were stored but never successfully tested. Open Test and read the message; if it passes, the row settles to “Validated”.

The Preview panel says “Unavailable”

There is no decryptable secret behind that row for your workspace. It happens on public and Conterminal-managed sources, on a row whose credential belongs to another organization, and when the stored secret cannot be decrypted. The message deliberately does not distinguish between them; if the row is one you configured and Preview will not open, contact support.

Contact Conterminal Support

Enabling a new source, disabling one, and anything to do with APM, HOLT Gloucester, or HOLT Packer credentials all have to go through support — there is no self-service path for them on this page.