Using the REST API

The REST API provides on-demand, request/response access to vehicle, charger, and diagnostics data. It is one of the two parallel ways to access data; the other is MQTT streaming. Everything on this page concerns the REST API, where every authenticated request requires a DPoP proof.

For the complete endpoint list, parameters, and response schemas, see the API Reference.

Prerequisites

You are…	Get an access token via
Vehicle owner / customer	Authorization Code or Device Code
Third-party developer	Delegated Authorization Code
Fleet operator	Client Credentials

You also need a DPoP key pair (PS256) - see DPoP.

Base URL

All API requests use a single base URL:

https://data.jlr-vcdp.com

Authenticating a request

Every authenticated call needs two headers:

• Authorization: DPoP <access_token> - your DPoP-bound access token.
• DPoP: <proof_jwt> - a fresh DPoP proof JWT, unique per request, with htm (method) and htu (URL) matching the call. See DPoP for how to build it.

curl -X GET https://data.jlr-vcdp.com/v1/vehicles/SALGA2BN6PH123456 \
  -H "Authorization: DPoP eyJhbGciOiJSUzI1NiIs..." \
  -H "DPoP: eyJhbGciOiJFUzI1NiIsInR5cCI6ImRwb3Arand0..."

A worked call (Node.js)

Reusing the DPoP helper from the Quickstart:

async function getVehicleStatus(privateKey, publicJwk, accessToken, vin) {
  const url = `https://data.jlr-vcdp.com/v1/vehicles/${vin}/status`;
  const dpopProof = await createDPoPProof(privateKey, publicJwk, 'GET', url);

  const response = await fetch(url, {
    headers: {
      Authorization: `DPoP ${accessToken}`,
      DPoP: dpopProof,
    },
  });

  if (!response.ok) {
    const problem = await response.json();
    throw new Error(`${problem.title}: ${problem.detail}`);
  }
  return response.json();
}

Public (unauthenticated) endpoints

The Metadata Catalog and health endpoints are public and need no token or DPoP proof:

# Health
curl https://data.jlr-vcdp.com/health

# List signal categories
curl https://data.jlr-vcdp.com/v1/categories

See Data Categories for the catalog.

Pagination and filtering

List endpoints (for example alerts and journeys) support paging and sorting:

Parameter	Meaning
page	Zero-based page index.
size	Page size.
sort	Sort expression.

Example:

curl -X GET "https://data.jlr-vcdp.com/v1/vehicles/SALGA2BN6PH123456/journeys?page=0&size=20&from=2026-01-01T00:00:00Z&to=2026-01-31T23:59:59Z" \
  -H "Authorization: DPoP eyJ..." \
  -H "DPoP: eyJ..."

Many endpoints also accept domain filters (for example severity and active on alerts). See the API Reference for each endpoint's parameters.

Signals, VSS, and timestamps

Response values map to the COVESA VSS tree and carry a timestamp indicating when the value was transmitted from the vehicle. Timestamps are ISO 8601 (UTC):

{
  "name": "Vehicle.Powertrain.TractionBattery.StateOfCharge.Current",
  "timestamp": "2026-07-28T05:16:53.000Z",
  "unit": "percent",
  "value": 72.5
}

Rate limits

Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. When you exceed the limit you get 429 Too Many Requests with a Retry-After header. For details and backoff guidance, see Rate Limiting.

note

If you need high-frequency updates, prefer MQTT streaming over polling the REST API.

Error responses

Errors use RFC 7807 Problem Details (application/problem+json). The body follows the platform's ProblemDetail schema:

{
  "type": "/errors/validation-failed",
  "title": "Validation Failed",
  "status": 400,
  "detail": "The request payload contains invalid fields",
  "instance": "/v1/vehicles/INVALID-VIN",
  "correlationId": "550e8400-e29b-41d4-a716-446655440000",
  "violations": [
    { "field": "vin", "rejectedValue": "INVALID-VIN", "message": "must be exactly 17 characters" }
  ]
}

Status	title	Typical cause	Action
400	Bad Request / Validation Failed	Malformed parameter or payload (see violations).	Fix the flagged fields.
401	Unauthorized	Missing/expired access token, or missing/invalid DPoP proof.	Refresh the token or re-send with a fresh DPoP proof. See DPoP.
403	Forbidden	Authenticated, but your client is not configured to access this vehicle or data category.	Check the vehicles and data categories set on your client, or that the customer's consent still covers this request.
404	Not Found	VIN/charger/resource not found or not accessible to you.	Verify the identifier and that it is mapped/registered to you.
429	Too Many Requests	Rate limit exceeded.	Back off per Retry-After. See Rate Limiting.
500	Internal Server Error	Unexpected server condition.	Retry with backoff; report with the correlationId if persistent.

Every response carries an X-Correlation-ID header - include it when contacting support. For retry patterns, see Error Handling.

Next steps

• Quickstart - End-to-end first call.
• DPoP - Build the required proof.
• Streaming - Real-time alternative to polling.
• API Reference - Full specification.