Carrier API error decoder & serverless bypass guide.

Look up why direct carrier calls from Cloudflare Workers, Vercel, and AWS Lambda fail with Akamai 403/428, UPS 250003, FedEx 422, or 17TRACK -18019902 / -18010020—and replace them with one synchronous GET across 125 carriers.

HTTP 403 Forbidden / 428 Precondition Required / 250003 Invalid Access LicenseUPS

Akamai Bot Manager blocking Cloudflare Workers, Vercel Functions & AWS Lambda datacenter IPs

Why it fails: UPS's tracking endpoints sit behind Akamai Bot Manager, TLS fingerprinting, and legacy XML Access License deprecation (error 250003). Direct requests from serverless functions (Cloudflare Workers, Vercel, AWS Lambda) lack enterprise shipper OAuth credentials or fail Akamai sensor challenges with 403 / 428.

How lastscanned fixes it: Replace the direct UPS OAuth + Track API handshake with a single stateless GET request to lastscanned. Zero UPS shipper account numbers or OAuth token caches required.

Drop-in synchronous replacement

curl "https://api.lastscanned.com/v1/track/1Z999AA10123456784" \
  -H "Authorization: Bearer lsk_live_YOUR_API_KEY"
USPS Web Tools Retired / v3 OAuth 401 & 429 / 92… Pre-Shipment Blind SpotUSPS / OSM / Pitney Bowes

USPS Web Tools XML retirement, v3 OAuth rate limits, and missing 926129 / 927489 consolidator scans

Why it fails: USPS retired its legacy TrackV2 XML API in favor of v3 OAuth 2.0 (which requires COPRA/Business Customer Gateway enrollment and enforces strict 429 rate limits). Furthermore, USPS returns only 'Shipping Label Created, USPS Awaiting Item' for 3–7 days while OSM Worldwide or Pitney Bowes transports 92… parcels.

How lastscanned fixes it: Query GET /v1/track/{number} for USPS, and pass ?carrier=osm or ?carrier=pitneybowes on 92… barcodes to pull live middle-mile sort hub scans before USPS DDU induction.

Drop-in synchronous replacement

curl "https://api.lastscanned.com/v1/track/92612903029511573030094531?carrier=osm" \
  -H "Authorization: Bearer lsk_live_YOUR_API_KEY"
HTTP 422 Unprocessable Entity / NOT.AUTHORIZED.ERROR / TRANSACTION_ID_ONLYFedEx

FedEx Track API OAuth token churn in stateless edge functions & production project validation gates

Why it fails: FedEx's REST Track API requires a short-lived OAuth 2.0 bearer token on every call (causing token-churn latency in stateless edge workers), rejects unvalidated production keys with NOT.AUTHORIZED.ERROR, and returns 422 or incomplete scan history on smartpost/ground reference numbers.

How lastscanned fixes it: Call GET /v1/track/{number} with your static lastscanned API key. 12, 15, 20, and 22-digit (96…) FedEx numbers are auto-detected and normalized in one call.

Drop-in synchronous replacement

curl "https://api.lastscanned.com/v1/track/794812345678" \
  -H "Authorization: Bearer lsk_live_YOUR_API_KEY"
HTTP 401 / 403 Firebase App Check & Undocumented Regional Courier EndpointsVeho / OnTrac / SpeedX / GOFO / UniUni

Regional last-mile couriers lack public self-serve REST APIs or enforce Firebase App Check / Turnstile

Why it fails: Regional couriers like Veho (VH…), UniUni (UUS…), SpeedX (SPX…), GOFO Express (GFUS…), OnTrac/LaserShip (1LS…), Better Trucks, and Intelcom/Dragonfly either gate their APIs behind enterprise merchant contracts or require browser-minted Firebase App Check / proof-of-work tokens.

How lastscanned fixes it: lastscanned supports all regional last-mile couriers out of the box behind the exact same GET /v1/track/{number} endpoint and JSON schema.

Drop-in synchronous replacement

curl "https://api.lastscanned.com/v1/track/VH0123456789AB" \
  -H "Authorization: Bearer lsk_live_YOUR_API_KEY"
-18019902 Not Registered Yet / -18010020 Extra Params / Instant 10× Quota17TRACK / AfterShip / Legacy Aggregators

Asynchronous register-first latency, 10× Instant quota cost, and April 2026 USPS Mailer ID (mid) gates

Why it fails: Calling 17TRACK's gettrackinfo on a new number fails with -18019902 unless you first POST /register and wait for an async webhook. Their synchronous getRealTimeTrackInfo costs 10 quotas per call, blocks USPS (21051) and DHL eCommerce US (7047), and requires extra parameters (-18010020, including USPS 6-digit Mailer ID mid since April 1, 2026) across 150 carriers.

How lastscanned fixes it: Switch to GET /v1/track/{number} on lastscanned: synchronous on the first call, 1 quota per unique number per month (unlimited free re-polls on Pro), and zero extra parameters required.

Drop-in synchronous replacement

curl "https://api.lastscanned.com/v1/track/LP00658129481029" \
  -H "Authorization: Bearer lsk_live_YOUR_API_KEY"

Test a live synchronous lookup right now

No carrier developer portal approval, no shipper account number, and no webhook registration queue.

Get an API keyRead full troubleshooting docs →

Carrier API troubleshooting FAQ

Why does calling UPS or FedEx tracking endpoints from Cloudflare Workers, Vercel, or AWS Lambda return 403 Forbidden?
Major carrier portals sit behind Akamai Bot Manager and TLS/IP reputation filters that block cloud datacenter ASN ranges, or require multi-step shipper account OAuth handshakes. lastscanned gives your serverless function a clean REST endpoint (https://api.lastscanned.com/v1/track/{number}) with Browser Integrity Check disabled so any HTTP client works.
What causes 17TRACK error -18019902 and -18010020?
Error -18019902 ('Tracking number is not registered yet') occurs because 17TRACK requires an asynchronous POST /register step before you can query tracking info. Error -18010020 ('Submitted additional parameters are incorrect') happens on 150 carriers where 17TRACK requires extra parameters such as destination_country, postal_code, or USPS Mailer ID (mid). lastscanned requires only the tracking number on a single synchronous GET call.
What replaces the retired USPS Web Tools TrackV2 XML API?
Instead of migrating to USPS v3 OAuth 2.0 and enrolling in the Business Customer Gateway (which still misses OSM Worldwide and Pitney Bowes middle-mile scans on 92… labels), call GET https://api.lastscanned.com/v1/track/{number}.

All 125 supported carriers

Major carriers

Regional and last mile

International posts and couriers

Cross-border