Getting Started
Welcome to the Jaguar Land Rover (JLR) Data Hub developer documentation. This platform provides secure, consent-governed access to vehicle data under the EU Data Act framework.
What is the JLR Data Hub?
Connected Jaguar and Land Rover vehicles generate telemetry that is transmitted to secure JLR servers - status information (for example mileage or doors), usage metrics (for example charging history). The JLR Data Hub makes that data available to authorised parties in two independent, parallel ways:
- A REST API for on-demand, request/response access to the latest and historic vehicle data.
- An MQTT streaming service for real-time delivery of a configured set of signals as they change.
The REST API and the streaming service are independent solutions with no direct dependency on each other. You can use either or both.
All access is governed by consent and complies with EU Data Act requirements. Signal data follows the COVESA Vehicle Signal Specification (VSS).
Who are you? Choose your path
The platform serves three audiences. Each follows a slightly different route to obtain credentials and authenticate. Find yourself in the table below, then follow the linked guide.
| You are… | You want to… | Primary auth flow | Guide |
|---|---|---|---|
| A vehicle owner / customer accessing your own vehicle's data | Read your data via API or stream it in real time | Browser Authorization Code or Device Code; Client Credentials for streaming | Vehicle Owners |
Glossary
| Term | Definition |
|---|---|
| Access token | Short-lived credential presented to the API or stream to prove authorisation. |
| Category | A logical grouping of related signals (for example EV data, diagnostics). |
| Client assertion | A short-lived JWT signed with your private key (private_key_jwt) that authenticates your client at the token endpoint, verified against your uploaded public certificate. There is no client secret. See Client Assertion. |
| Client configuration | The attributes set on a client when its credentials are created - the vehicles and data categories it may access. This governs what a token can reach; there are no developer-requested scopes. |
| Client credentials | OAuth2 grant for server-to-server access with no interactive user, authenticated with a client assertion. Used by fleet operators for the API and by everyone for the MQTT stream. |
| DPoP | Demonstrating Proof-of-Possession (RFC 9449) - binds an access token to your key pair. Required for REST API calls; not used for MQTT streaming. |
| JLR Data Hub | The JLR platform this documentation describes. |
| Mapping / consent | The link between a customer account and a VIN, and the customer's permission for a party to access that VIN's data. Managed in the portal, not via the API. |
| Refresh token | Longer-lived credential used to obtain a new access token without re-running the full flow. |
| Signal | A single data point generated by the vehicle, identified by a vssIdentifier. |
| VIN | Vehicle Identification Number - the standardised 17-character code that uniquely identifies a vehicle. |
| VSS | Vehicle Signal Specification - the COVESA standard tree that signal names map to (for example Vehicle.Powertrain.TractionBattery.StateOfCharge.Current). |
Prerequisites
What you need depends on your persona (see the table above), but in general:
- A registered JLR account (either InControl or OneApp for a customer) and a client created in
the portal (which gives you a
client_id). How you obtain this differs per persona. - A key pair (PS256 / RSA) whose public certificate you upload when creating the client; you sign a client assertion with the private key to authenticate. There is no client secret.
- For REST API access: a DPoP key pair (PS256 / RSA) for proof-of-possession token binding.
- Familiarity with OAuth2 and, for browser/customer flows, PKCE.
Base URL
All API requests use a single base URL:
https://data.jlr-vcdp.com
Steps to get connected
The exact first step differs per persona, but every integration follows the same high-level path:
- Register / create your client - Get your
client_idand configure the client (vehicles and/or data categories, callback URI, and your public certificate). Vehicle owners and developers do this in the portal UI; fleet operators are onboarded for client-credentials access. - Consent & mapping - Ensure the relevant consent/mapping is in place for the vehicles and data categories your client is configured for.
- Authenticate - Obtain an access token via the flow for your persona.
- Access data - Call the REST API (with a DPoP proof) and/or connect to the MQTT stream (token used as the connection password).
Next steps
- Authentication overview - How the OAuth2 flows, tokens, and DPoP fit together, with a grant/persona matrix.
- Quickstart guide - Get your first API call working in minutes.
- API Reference - Full OpenAPI specification.