Developers

Build on AutoNexa

Connect booking engines, aggregators, fines providers, GPS platforms and accounting tools to your rental operation with a REST API and signed webhooks.

Download OpenAPI spec Get an API key

Overview

Everything is JSON over HTTPS. Each API key belongs to one rental company and can only see that company's data.

Scoped API keys

read, write, fines:write and telematics:write scopes.

Signed webhooks

HMAC-SHA256 signed events for bookings, contracts, invoices, payments and fines.

Fines Feed

Push tolls and fines; AutoNexa matches them to the right contract and driver.

Telematics ingest

Stream GPS points from any tracker or platform.

Base URL

https://platform.autonexa.ae/functions/v1/api/v1

Authentication

Owners and admins create keys in AutoNexa under Developers → API keys. The full key is shown once. Send it in the Authorization header as a Bearer token, or in an x-api-key header. Revoke a key at any time; it stops working immediately.

curl "https://platform.autonexa.ae/functions/v1/api/v1/vehicles?status=available&limit=50" \
  -H "Authorization: Bearer cf_live_YOUR_KEY"

Keys are stored as SHA-256 hashes. Never put a key in a browser or mobile app: call the API from your server.

Endpoints

Lists return { data, next_cursor }. Pass ?limit= (max 200) and ?cursor= from the previous page; ?page= also works.

Method	Path	Scope	Description
GET	/v1/vehicles	read	List vehicles with their last GPS position. Filters: status, category_id, branch_id.
GET	/v1/vehicles/{id}	read	One vehicle.
GET	/v1/availability	read	Vehicles free between from and to (ISO 8601), optionally by category_id / branch_id, with a per-category summary.
GET	/v1/customers	read	List customers. Filters: q (name, email, phone, Emirates ID), updated_since.
POST	/v1/customers	write	Create a customer.
GET	/v1/customers/{id}	read	One customer.
GET	/v1/bookings	read	List bookings. Filters: status, customer_id, from, to (pick-up time).
POST	/v1/bookings	write	Create a booking for a customer or a guest. Prices default to the category rates.
GET	/v1/bookings/{id}	read	One booking.
PATCH	/v1/bookings/{id}	write	Change status to confirmed, cancelled or no_show.
GET	/v1/contracts	read	List rental agreements. Filters: status, customer_id, vehicle_id.
GET	/v1/contracts/{id}	read	One rental agreement.
GET	/v1/invoices	read	List VAT invoices with lines. Filters: status, customer_id, contract_id, from, to.
GET	/v1/charges	read	List tolls, fines and other charges. Filters: status, type, from, to.
POST	/v1/charges	fines:write	Fines Feed: push up to 500 charges per request.
POST	/v1/telematics/positions	telematics:write	Push GPS points for a registered tracker.

Create a booking

curl -X POST "https://platform.autonexa.ae/functions/v1/api/v1/bookings" \
  -H "Authorization: Bearer cf_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"category_id":"<uuid>","pickup_at":"2026-11-01T10:00:00+04:00","return_at":"2026-11-05T10:00:00+04:00","guest_name":"Sara Ali","guest_phone":"+971501234567"}'

Webhooks & events

Add https endpoints under Developers → Webhooks and choose the events to receive. Deliveries time out after 5 seconds; check the delivery log for status codes.

*booking.*booking.createdcontract.*contract.activecontract.returnedinvoice.issuedinvoice.paidpayment.succeededpayment.failedcharge.createdcharge.matchedtelematics.alertcheque.bounced

POST https://your-server.example/carfleet/webhooks
Content-Type: application/json
X-AutoNexa-Event: payment.succeeded
X-AutoNexa-Signature: sha256=5f1c…

{ "id": "6b0d…", "event": "payment.succeeded", "created_at": "2026-10-30T09:12:44Z",
  "data": { "id": "…", "amount": 1250.00, "currency": "AED", "invoice_id": "…", "status": "succeeded" } }

Verify the signature

Compute HMAC-SHA256 of the raw request body with your endpoint's signing secret and compare it, in constant time, with the X-AutoNexa-Signature header.

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.AUTONEXA_WEBHOOK_SECRET; // from Developers → Webhooks

// use the RAW body: re-serialising the JSON changes the bytes and breaks the signature
app.post("/carfleet/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-AutoNexa-Signature") || "";          // "sha256=<hex>"
  const expected = "sha256=" + crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
  const a = Buffer.from(header), b = Buffer.from(expected);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return res.status(401).end();

  const event = JSON.parse(req.body.toString("utf8"));          // { id, event, created_at, data }
  console.log(event.event, event.data?.id);
  res.sendStatus(200);                                           // reply fast; process async
});

app.listen(3000);

Fines Feed

For rental software vendors and data partners delivering Salik, Darb, Parkin, Mawaqif, RTA and police fines.

Send an array (or { charges: [...] }) of up to 500 items with type, external_ref, plate_emirate, plate_code, plate_number, occurred_at, amount, location, description and black_points.
AutoNexa finds the vehicle by plate and the contract that was active at occurred_at, including vehicle swaps, and adds your admin fee.
Re-sending the same type + external_ref is safe: it is reported as duplicate and not stored twice.

curl -X POST "https://platform.autonexa.ae/functions/v1/api/v1/charges" \
  -H "Authorization: Bearer cf_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '[{"type":"salik","external_ref":"SLK-883421","plate_emirate":"DXB","plate_code":"A","plate_number":"12345","occurred_at":"2026-10-29T08:14:00+04:00","amount":4,"location":"Al Barsha gate"}]'

{
  "data": [
    { "index": 0, "external_ref": "SLK-883421", "type": "salik", "status": "matched",
      "id": "…", "vehicle_id": "…", "contract_id": "…", "customer_id": "…" },
    { "index": 1, "external_ref": "PRK-1102", "type": "parkin", "status": "unmatched", "id": "…" },
    { "index": 2, "external_ref": "SLK-883421", "type": "salik", "status": "duplicate" }
  ],
  "summary": { "matched": 1, "unmatched": 1, "duplicate": 1, "invalid": 0 }
}

Telematics ingest

Register the tracker in AutoNexa and assign it to a vehicle, then push points by its device identifier (IMEI). Up to 500 points per request.

curl -X POST "https://platform.autonexa.ae/functions/v1/api/v1/telematics/positions" \
  -H "Authorization: Bearer cf_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"device_identifier":"864895030000000","points":[{"lat":25.2048,"lng":55.2708,"ts":"2026-10-30T09:00:00Z","speed":62,"ignition":true}]}'

Each point: lat, lng and optional ts, speed (km/h), heading, odometer (km), ignition and fuel (%). Speeding, geofence and after-hours alerts are raised automatically and sent as telematics.alert webhooks.

Rate limits & errors

120 requests per minute per key. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers; a 429 includes Retry-After.

{ "error": { "code": "insufficient_scope", "message": "This API key needs the 'write' scope." } }

400	invalid_parameter / invalid_request / invalid_json
401	unauthorized: missing, invalid or revoked key
402	plan_required: API access needs an active Scale plan
403	insufficient_scope
404	not_found
409	conflict / device_unassigned
429	rate_limited: see Retry-After

Ready to connect your systems?

API access is included in the Scale plan and available during your free trial.

Start free trial Book a 20-min demo

14-day free trial · no card · onboarding & data migration included · Arabic & English