A REST API for your own systems

Overview

The fleetfeat REST API v1 gives your own systems — ERP, HR, accounting — read access to your company's data. You create an API client in fleetfeat, choose which data it may read, and use it to fetch an access token via OAuth2. The API is included in every plan.

• Read-only: apart from the token endpoint, every endpoint is a GET; you cannot change data in fleetfeat via the API.
• A client belongs to exactly one company and only sees its data — always the whole company.
• JSON, snake_case field names, all timestamps in UTC as ISO 8601, amounts in cents.
• Lists with cursor pagination and filters by period, licence plate or VIN.
• At most 300 requests per minute per client.

Quick start

Three steps to the first response. The examples use curl; any other HTTP library works the same way.

1. Create an API client

Log in to fleetfeat and open Settings → API access. Only users with access to the whole company and the permission “Build & export reports” see this area — usually the super admin.

Give the client a name (e.g. “SAP production”) and, under “Released data”, choose only the scopes your integration needs.

After creating it, fleetfeat shows the client ID and the client secret. The secret is shown exactly once; we only store a checksum. If it is lost, renew it in the same place (“Rotate secret”). “Revoke” blocks the client and all its tokens immediately.

2. Fetch a token

Your system exchanges client ID and secret for an access token (OAuth2 client credentials). The token is valid for 60 minutes; after that, simply fetch a new one.

curl -s -X POST https://fleetfeat.de/api/v1/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials

Response:

{
  "access_token": "ffat_…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "vehicles:read service-orders:read"
}

3. First request

With the token in the header Authorization: Bearer …, request your company's vehicles:

curl -s "https://fleetfeat.de/api/v1/vehicles?limit=50" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response (shortened):

{
  "data": [
    {
      "id": "…",
      "fin": "…",
      "license_plate": "…",
      "make": "…",
      "model": "…",
      "mileage_km": …,
      "updated_at": "…"
    }
  ],
  "next_cursor": "…"
}

If the response contains a next_cursor, fetch the next page with ?cursor=<value>. On the last page, next_cursor is null.

Scopes and permissions

A scope is a type of data a client may read. You choose the scopes when creating the client; when fetching a token, your system can request a subset with scope. Without the scope, an endpoint responds with 403 insufficient_scope.

A client never returns more than its creator sees in the app. Some scopes therefore also require the matching permission from team management when the client is created:

• tasks:read → “Manage deadlines & licence checks”
• cost-centers:read → “See costs & TCO”
• invoices:read → “See invoices & receipts”

Without this permission, fleetfeat does not allow the scope.

Limits and pagination

• Rate limit: 300 requests per minute per client. Every data-endpoint response to a valid token carries X-RateLimit-Limit and X-RateLimit-Remaining; above the limit you get 429 with Retry-After (seconds).
• Rejected requests (403, 400) also count against the limit.
• Page size: limit from 1 to 200, 50 entries by default.
• Download links for documents, invoice PDFs and e-invoices are valid for 5 minutes and are fetched without the bearer token.
• The API rejects unknown parameters with 400 instead of silently ignoring them.

Error format

Every error from the data endpoints has the same format: an object error with a machine-readable code, an English message and — for parameter errors — the field field.

{
  "error": {
    "code": "insufficient_scope",
    "message": "This endpoint requires the scope \"drivers:read\"."
  }
}

The token endpoint follows the OAuth2 standard (RFC 6749 §5.2) with error and error_description, e.g. invalid_client for a wrong client ID or secret.

Data protection

A client moves your company's data into another system — depending on the scopes, including personal data of your employees. You are responsible for that system and its operator: it belongs in your record of processing activities, and you need a data processing agreement (DPA) with its operator.

Driver data — driver assignments, the current driver of a vehicle, drivers on tasks, the driver assignment of traffic fines — is only returned with the scope drivers:read.

Never via the API: driving licence data, traffic fine hearings, notes, email addresses.

Every authenticated request is logged with client, endpoint (without query parameters), status and time, and deleted automatically after 12 months.

Stability promise and changelog

Our promise for your integration:

/v1 stays backwards compatible; new fields may appear without notice, removing or renaming a field only happens with a new major version and at least 6 months' notice.

Changelog

• Addition without a new version · 2026-10-25 — 403 driver_data_not_available on driver endpoints (/drivers, /fines) when the person who created the client may not see driver data or no longer belongs to the organisation; driver fields are then omitted on the other endpoints.
• Addition without a new version · 2026-10-22 — 403 module_not_available also when the company has hidden the module in its settings (traffic fines, cost centres).
• Addition without a new version · 2026-10-15 — New task status erledigt_ausstehend (reported as done, approval by the fleet manager pending).
• Addition without a new version · 2026-10-06 — New vehicle fields max_speed_kmh and work_machine_kind.
• Addition without a new version · 2026-10-03 — New vehicle fields for commercial vehicles (e.g. gross_weight_kg, axle_count) and electric vehicles (e.g. battery_capacity_kwh, wltp_range_km).
• 1.2.0 · 2026-09-27 — Document types: /api/v1/invoices returns subscription invoices, cancellations and corrections in addition to service invoices, with kind and the reference corrects_invoice_id.
• 1.1.0 · 2026-09-26 — Tasks, vehicle documents (with download link), traffic fines, cost centres and invoices (with PDF and e-invoice), each with its own scope.
• 1.0.0 · 2026-09-26 — First release: token endpoint (OAuth2 client credentials), vehicles, driver assignments and service orders.

Endpoints

Every endpoint of this version, generated from the same specification the server delivers at /api/v1/openapi.json.

Data models

Questions about your integration? Write to info@fleetfeat.de.