Agreement and go-live
Onboarding
Four separate stages
These are deliberately not bundled — you can be finished with the first while the third has not started.
| Stage | Needed to | Status |
|---|---|---|
| Technical specification | Read, review, design and estimate | Available now — this portal, the full spec, and openapi.yaml |
| NDA / data-protection terms | Exchange traveller data | Required before any real booking. Vietnam's Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/NĐ-CP apply. |
| Commercial & rate agreement | Agree the model, the percentage, who is merchant of record, who owns refunds | Not yet drafted. |
| Production credential activation | Send live traffic | After all of the above, plus a joint certification call |
Environment status
The API is live; access is per credential
/api/partner/v1/* path is served. Without a credential they answer 401: what you can reach is decided by the client we issue you and the scopes on it, not by a global switch. So there is nothing to wait for on our side — as soon as you have a client id and secret, you can authenticate.Your first credential is deliberately read-and-shop only — fleet:read, locations:read, rates:read, availability:read, quotes:write. You can authenticate, read the whole fleet and take real quotes with it. It carries no reservations:* scope, so it cannot create a booking. That is what makes it safe for us to hand you a working key on day one, given what the next paragraph says.
Your integration credential reaches Rocket's live production fleet, locations and pricing. Rocket runs a single production database. Certification happens on a scheduled attended call, against a small number of agreed test reservations that are cancelled immediately afterwards — Rocket runs one database and it is production: no synthetic inventory, no sample pricing, no isolated copy. What protects you during integration is not a separate environment — it is that your credential carries no reservation scope, so it cannot create, read, cancel or modify a reservation. Those calls answer 403 INSUFFICIENT_SCOPE. Reservation capability is activated separately after joint approval, and Rocket prefers to issue a new client for it so there is a clean audit boundary.
What Rocket still has to decide
None of these block you reviewing or building against the specification. They do block go-live.
- The commercial model, as set out in Rocket's partner proposal.
- Merchant of record, settlement and who carries FX.
- Who owns cancellation refunds and chargebacks, and who holds the refundable security deposit.
- Tax and fee presentation.
- Support hours, response times, and the notice period for a breaking API change.
What Rocket needs from you
- Confirmation that model-level availability is acceptable to your platform.
- Whether a permanently isolated test environment is a hard requirement on your side — it means new infrastructure and is a decision Rocket has not taken.
- Your expected look-to-book ratio and peak request volume, so rate limits are sized before your first peak.
- Your codes for the four namespaces — vehicles, locations, accounts and rates.
- Whether you need webhooks for booking status changes, or will poll.
- Your tax and currency requirements.
- Your draft agreement, if you would like to start from it.