External API
Docs & Playground
Vehicles/get_command_token

get_command_tokentoken required

Mints a short-lived command token (object_key) used by downstream services to issue remote commands to one or more vehicles.

Try in playground
POST/api— body field action.name = "get_command_token"

Parameters

NameTypeRequiredDescription
vehicle_idnumberoptionalSingle vehicle id. Either `vehicle_id` or `vehicles` must be supplied.e.g. 591723
vehiclesstringoptional`@`-delimited list of positive vehicle ids. Takes precedence over `vehicle_id` when both are present.e.g. 591723@591724
object_typestringoptionalOptional subscription / object type tag stored alongside the minted token. Defaults to an empty string.e.g. remote_command

Notes

Returns errorcode '1' on invalid `vehicle_id` / `vehicles`, errorcode '2000' when the caller has no permission for any of the supplied vehicles, and errorcode '999' on internal errors.

Request

curl
curl -X POST 'https://private.develop-1.questar.io/v2/private-questar-units/api' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  --data '{"action":{"name":"get_command_token","parameters":[{"vehicle_id":591723,"vehicles":"591723@591724","object_type":"remote_command"}]}}'
Body
{
  "action": {
    "name": "get_command_token",
    "parameters": [
      {
        "vehicle_id": 591723,
        "vehicles": "591723@591724",
        "object_type": "remote_command"
      }
    ]
  }
}

Response

Successful responses always wrap the action's payload in response.properties. The action_value field reports the handler outcome: "0" for success, "1" for invalid params, "2" for not allowed, "3" for limit-exceeded /pagination-session-expired, "999" for general error.

Authentication is checked before the action runs and fails the same way for every action. A token that is not valid returns HTTP 200 with action_value "2" and description invalid_session; an empty bearer returns "2" with session_token_required. Read the description to tell these apart from an action's own "2". With no Authorization header the gateway answers HTTP 401 {"message":"Unauthorized"}, and with a bearer that is not a token HTTP 403 {"message":"Forbidden"}.

200 OK
{
  "response": {
    "properties": {
      "action_name": "get_command_token",
      "action_value": "0",
      "description": "success",
      "data": [
        {
          "object_type": "remote_command",
          "object_key": "unit_key_1@unit_key_2"
        }
      ]
    }
  }
}