Integration reference
API reference
{error:{code,message,requestId,retryable}}.Authentication
/api/partner/v1/oauth/tokenclient_id/client_secret for a bearer token. Form-encoded, unscoped.Reference data
/api/partner/v1/fleetscope: fleet:read/api/partner/v1/fleet/{vehicleCode}scope: fleet:read/api/partner/v1/locationsscope: locations:read/api/partner/v1/locations/{locationCode}scope: locations:read/api/partner/v1/ratesscope: rates:readShop & quote
/api/partner/v1/availabilityscope: availability:read/api/partner/v1/quotesscope: quotes:writeReservations
/api/partner/v1/reservationsscope: reservations:writeIdempotency-Key./api/partner/v1/reservationsscope: reservations:read/api/partner/v1/reservations/{reservationId}scope: reservations:read/api/partner/v1/reservations/{reservationId}scope: reservations:write501 MODIFICATION_NOT_SUPPORTED. Cancel and re-book./api/partner/v1/reservations/{reservationId}/cancelscope: reservations:cancel409 CANCELLATION_NEEDS_STAFF instead of cancelling — a human applies the refund policy.501 than an endpoint whose behaviour on a price change nobody has decided.Idempotency
Reservation creation requires an Idempotency-Key header, 8–200 characters, unique per attempt. An identical retry (same key, same body) replays the original response with Idempotent-Replay: true — no second booking is created. The same key with a different body returns 409 IDEMPOTENCY_CONFLICT; nothing is created. A key reused after 24 hours is treated as fresh.
Reuse the same key for every retry of the same booking, including after a timeout. A timeout is not evidence that the booking failed; retrying with the same key is how you find out safely. The Idempotency-Key is the only thing protecting you from double-booking — a quote is not single-use, so presenting the same quoteId under a new key creates a second real reservation rather than a replay. Send a partnerReference as a second belt: one reference is one rental, permanently.
Rate limits
Limits are per API client, not per IP. A 429 carries Retry-After in whole seconds — honour it. Every response from a rate-limited endpoint carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, on success as well as on a 429. X-RateLimit-Reset is an ISO-8601 timestamp, not epoch seconds.
POST /oauth/token is the exception: it is limited on two separate buckets (per client and per source IP), so it reports neither as X-RateLimit-*. Back off on its Retry-After. Request one token per ~10 minutes and you will never see it.
Error codes
Switch on code, never on message. retryable is true only when retrying the identical request may succeed.
| Code | HTTP | Retryable | Meaning |
|---|---|---|---|
| UNAUTHORIZED | 401 | No | Authentication required. |
| INVALID_CLIENT | 401 | No | Client authentication failed. |
| INVALID_TOKEN | 401 | No | The access token is missing, malformed, or expired. |
| INSUFFICIENT_SCOPE | 403 | No | The access token does not carry the scope this operation requires. |
| PARTNER_DISABLED | 403 | No | This partner account is not active. |
| VALIDATION_ERROR | 400 | No | The request body failed validation. |
| MALFORMED_JSON | 400 | No | The request body is not valid JSON. |
| MALFORMED_XML | 400 | No | The request body is not valid Rocket Partner XML. |
| NOT_ACCEPTABLE | 406 | No | Accept must allow application/json, application/xml, or text/xml. |
| REQUEST_TOO_LARGE | 413 | No | The request body exceeds the maximum size. |
| UNSUPPORTED_MEDIA_TYPE | 415 | No | Content-Type must be application/json, application/xml, or text/xml. |
| INVALID_ACCOUNT_CODE | 400 | No | The account code is unknown or not enabled for this partner. |
| INVALID_RATE_CODE | 400 | No | The rate code is unknown, not enabled, or outside its validity window. |
| RATE_NOT_APPROVED | 409 | No | This rate plan is awaiting Rocket commercial approval and cannot be sold yet. |
| INVALID_LOCATION | 400 | No | The location code is unknown or not active. |
| LOCATION_NOT_ONE_WAY | 400 | No | One-way rental is not available between these locations. |
| INVALID_RENTAL_WINDOW | 400 | No | Pickup and dropoff must be valid Vietnam local times, with dropoff after pickup. |
| INVALID_VEHICLE | 400 | No | The vehicle code is unknown or not published to partners. |
| FLEET_PROFILE_INCOMPLETE | 409 | No | This vehicle has no complete partner specification yet and cannot be sold through the API. |
| NOT_FOUND | 404 | No | The requested resource does not exist. |
| NO_AVAILABILITY | 409 | No | No vehicle class is offerable for the requested criteria. |
| QUOTE_EXPIRED | 409 | No | The quote has expired. Request a new quote. |
| QUOTE_INVALID | 400 | No | The quote reference is not valid for this partner or has been tampered with. |
| QUOTE_STALE | 409 | No | The price has changed since the quote was issued. Request a new quote. |
| IDEMPOTENCY_KEY_REQUIRED | 400 | No | This operation requires an Idempotency-Key header. |
| IDEMPOTENCY_CONFLICT | 409 | No | This Idempotency-Key was already used with a different request body. |
| IDEMPOTENT_REPLAY_IN_FLIGHT | 409 | Yes | An identical request is still being processed. Retry shortly. |
| DUPLICATE_PARTNER_REFERENCE | 409 | No | A reservation already exists for this partner reference. |
| RESERVATION_REJECTED | 422 | No | Rocket declined the reservation. Quote the requestId to support for the reason. |
| INVALID_STATE_TRANSITION | 409 | No | The reservation is not in a state that allows this operation. |
| CANCELLATION_NEEDS_STAFF | 409 | No | A rental payment or security deposit is associated with this reservation, so Rocket staff must review the cancellation. The request has been recorded and Rocket has been alerted. |
| MODIFICATION_NOT_SUPPORTED | 501 | No | Reservation modification is not supported in v1. Cancel and re-book. |
| RATE_LIMITED | 429 | Yes | Rate limit exceeded. |
| API_DISABLED | 503 | Yes | The partner API is not enabled on this environment. |
| DEPENDENCY_UNAVAILABLE | 503 | Yes | A downstream dependency is temporarily unavailable. |
| INTERNAL_ERROR | 500 | Yes | Unexpected error. Quote the requestId when reporting it. |