Rocket Car Rentals Vietnam — Partner API

Authentication is OAuth 2.0 client credentials. Note that the token endpoint is form-encoded, as the OAuth specification requires, and returns JSON. Business endpoints support JSON and Rocket XML; send Accept: application/xml for XML responses and Content-Type: application/xmlfor XML request bodies. See the XML integration guide for the schema and examples.

# 1. Exchange your credentials for a token.
#    Send them as HTTP Basic (client_secret_basic) — the recommended method.
curl -X POST https://rocketcarrentalsvietnam.com/api/partner/v1/oauth/token \
  -u 'YOUR_CLIENT_ID:YOUR_CLIENT_SECRET' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials'

# 2. Use it on every other call
curl https://rocketcarrentalsvietnam.com/api/partner/v1/fleet \
  -H 'Authorization: Bearer <access_token>'

Tokens last 10 minutes. Cache and reuse one rather than minting per request — the token endpoint is rate limited. There is no refresh token: you already hold credentials, so you re-authenticate.

1. Availability is at the vehicle-model level, not the individual-car level. Rocket offers a model in a city and holds no specific physical vehicle. If your platform requires a decrementing count of physical units, tell us now — that is a change to how Rocket runs its fleet, not an API option.
2. Reservations cannot be modified. PATCH /reservations/{id} deliberately answers 501. Cancel and re-book. We would rather refuse than pretend to support a partial amendment we cannot apply consistently.

• Money is never a bare number. Every amount is an object with an integer in minor units: { "currency": "USD", "amount": 43000, "exponent": 2, "display": "$430.00" }.
• Errors share one envelope — { "error": { "code", "message", "requestId", "retryable" } }. Switch on code, never on message. Quote requestId to support and we can find the exact call.
• Booking writes require an Idempotency-Key header. Retrying with the same key returns the same reservation instead of creating a second one.
• The version is in the path. A breaking change gets a new path, never a silent edit to this one.

Generate your client from the OpenAPI 3.1 schema rather than from this prose. It is checked by Rocket's local release gate, npm run verify, against the implementation — every documented path must exist in the router and every route must be documented, in both directions, so this documentation cannot quietly drift from the running API. The repository does not run this validation automatically in GitHub Actions.

Download openapi.yaml