Rocket Car Rentals Vietnam — Partner API

Authentication is OAuth 2.0 client credentials. Note that the token endpoint is form-encoded, as the OAuth specification requires; every other endpoint takes and returns JSON.

# 1. Exchange your credentials for a token (form-encoded, per OAuth 2.0)
curl -X POST https://rocketcarrentalsvietnam.com/api/partner/v1/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials&client_id=...&client_secret=...'

# 2. Use it on every other call
curl https://rocketcarrentalsvietnam.com/api/partner/v1/fleet \
  -H 'Authorization: Bearer <access_token>'

Tokens last 10 minutes. Cache and reuse one rather than minting per request — the token endpoint is rate limited. There is no refresh token: you already hold credentials, so you re-authenticate.

1. Availability is at the vehicle-model level, not the individual-car level. Rocket offers a model in a city and holds no specific registration plate until pickup. If your platform requires a decrementing count of physical units, tell us now — that is a change to how Rocket runs its fleet, not an API option.
2. Reservations cannot be modified. PATCH /reservations/{id} deliberately answers 501. Cancel and re-book. We would rather refuse than pretend to support a partial amendment we cannot apply consistently.

• Money is never a bare number. Every amount is an object with an integer in minor units: { "currency": "USD", "amount": 43000, "exponent": 2, "display": "$430.00" }.
• Errors share one envelope — { "error": { "code", "message", "requestId", "retryable" } }. Switch on code, never on message. Quote requestId to support and we can find the exact call.
• Booking writes require an Idempotency-Key header. Retrying with the same key returns the same reservation instead of creating a second one.
• The version is in the path. A breaking change gets a new path, never a silent edit to this one.

Generate your client from the OpenAPI 3.1 schema rather than from this prose. It is validated in Rocket's CI against the implementation — every documented path must exist in the router and every route must be documented, in both directions, so this documentation cannot quietly drift from the running API.

Download openapi.yaml