API and XML integration

JSON is selected when Accept is absent. If both are acceptable, the higher q value wins and ties choose JSON. XML responses use the selected type (application/xml or text/xml) with UTF-8. An unsupported Accept returns 406 NOT_ACCEPTABLE with a JSON error. OAuth, scopes, validation, rate limits and business rules are shared by both representations. XML does not grant additional access. The token endpoint is the exception: its request and OAuth success/error responses remain form-encoded and JSON.

Each XML business request starts with request; each XML business response starts with response. The root has version="1" and one direct object child. Every element belongs to the Rocket namespace. The prefix is optional; a default namespace is also valid.

A missing property is different from a property set to null. Duplicate property names and the names __proto__, prototype and constructor are rejected. Only predefined and numeric character references are accepted. A standard XML 1.0 declaration with optional UTF-8 encoding is accepted at the document start. Document types, comments, CDATA, other processing instructions and custom entities are rejected. Bodies must be valid UTF-8, at most 32,000 bytes, no deeper than 32 levels and no larger than 4,096 XML nodes/items. The XSD checks recursive XML shape, while each endpoint's existing request schema checks allowed and required fields.

Rocket converts XML to the same JSON-shaped value used by the JSON API and applies the same Zod validation and business service. The response uses the same field names and values, encoded with the same typed elements. The parser rejects invalid UTF-8, malformed XML, forbidden XML constructs and excessive nesting or node counts with 400 MALFORMED_XML; request bodies over 32,000 bytes receive 413.

Exchange credentials once and reuse the token for 600 seconds. HTTP Basic is preferred; form-body client authentication is also accepted.

curl --user "$ROCKET_CLIENT_ID:$ROCKET_CLIENT_SECRET" \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=client_credentials&scope=availability:read' \
  https://rocketcarrentalsvietnam.com/api/partner/v1/oauth/token

Save the JSON access_token and send it as a bearer token.

Example request body for POST /availability (scope availability:read):

<rocket:request xmlns:rocket="urn:rocket:partner-api:v1" version="1">
  <rocket:object>
    <rocket:property name="pickupLocation"><rocket:string>HCM-APT</rocket:string></rocket:property>
    <rocket:property name="dropoffLocation"><rocket:string>HCM-CITY</rocket:string></rocket:property>
    <rocket:property name="pickupDate"><rocket:string>2026-10-20</rocket:string></rocket:property>
    <rocket:property name="pickupTime"><rocket:string>10:00</rocket:string></rocket:property>
    <rocket:property name="dropoffDate"><rocket:string>2026-10-23</rocket:string></rocket:property>
    <rocket:property name="dropoffTime"><rocket:string>10:00</rocket:string></rocket:property>
  </rocket:object>
</rocket:request>

Send it in availability.xml:

curl --include --request POST \
  --header "Authorization: Bearer $ROCKET_ACCESS_TOKEN" \
  --header 'Content-Type: application/xml' \
  --header 'Accept: application/xml' \
  --data-binary @availability.xml \
  https://rocketcarrentalsvietnam.com/api/partner/v1/availability

The result is wrapped in response and uses the same typed mapping. Business errors use that envelope too, with the same error fields and HTTP status as JSON. Log X-Request-Id and quote it when contacting support.

XML is available on the existing business paths:

Available scopes: fleet:read · locations:read · rates:read · availability:read · quotes:write · reservations:read · reservations:write · reservations:cancel.

• Availability is model-level; there is no unit inventory or decrementing allotment, and no physical vehicle is guaranteed at reservation time.
• Cancellation changes booking state; it does not calculate or promise a refund. A booking with money taken may require Rocket staff.
• There is no isolated sandbox. Initial integration credentials can read live catalogue and pricing data but have no reservation scope.
• Executed data-protection terms are required before live traveller bookings.
• Rocket XML is proprietary. It is not SOAP, has no WSDL, and does not imply OpenTravel/OTA compatibility or membership/certification.

These limits apply to JSON and XML alike. They do not add pricing, settlement, support or service-level terms; those are settled in the distribution agreement.

Download OpenAPI · Partner documents

This page describes the current API contract. It does not promise a delivery date, effort, price, service level or support response time; nor does it accept a commercial or legal instrument Rocket has not reviewed.