Skip to main content
POST
This route starts the execution of a remote command for a single specific vehicle. The command is executed in the background. Use the GET /vehicle-command/{command_id} route to check the command status.
The ignition commands enable_ignition and disable_ignition require two-step confirmation. On the first call (without the code field), the command is not executed: the response returns status: "Confirmation" with a 6-digit code and a message to display to the user. To execute the command, resend the same request including the received code. All other commands are executed in a single call.

​
Request

Header
​
string
required
The bearer token used to authenticate the company.
​
string
required
HMAC SHA256 signature of the request body, using the application’s sign-secret as the key. The body must be serialized as JSON without extra spaces and with keys sorted alphabetically before generating the signature. See the example below:
The code field (when sent in the second step of ignition commands) is not part of the signature. Only vin and command are signed.
Body
​
string
required
The Vehicle Identification Number (VIN) of the vehicle to which the command will be sent.
​
string
required
The remote command to execute on the vehicle.
​
string
The 6-digit confirmation code returned in the first step of ignition commands (enable_ignition and disable_ignition). Provide it to execute the command in the second call. This does not apply to other commands.

​
Response

​
string
The unique identifier (UUID) of the command registered in the mobway system. Use this ID to check the command status later with GET /vehicle-command/{command_id}.
​
string
The vehicle’s unique identification number.
​
string
The command that was requested.
​
string
The initial status of the command. It can be “Confirmation”, when an ignition command is waiting for the second confirmation step (resubmission with the code), “Pending”, when the command has not yet been processed, or “Error”, when the command was not executed successfully.
​
datetime
The date and time when the command was registered in the mobway system [YYYY-MM-DD HH:MM:SS] (UTC-3).
​
string
The 6-digit confirmation code. It is present only in the confirmation response (status: "Confirmation") for ignition commands. Resend the request with this value in the code field to execute the command.
​
string
The alert message, in Portuguese, to be displayed to the user before confirming the action. It is present only in the confirmation response.
​
string
The cause of the request error. This field is only present when the request fails.
  • “Invalid VIN. VIN must be a string. At least one VIN is required.”: The request is malformed because the required vin parameter is missing.
  • “Invalid command. Command must be a string. At least one command is required.”: The request is malformed because the required command parameter is missing.
  • “VIN not found or unauthorized access.”: The requested VIN is invalid, is not associated with your company, or the vehicle ownership type does not allow this action.
  • “Command not found or unauthorized access.”: The requested command is not available for this vehicle, either because of OEM restrictions or because it is not included in your package plan.
  • “Sign-secret not found.”: The HMAC signature provided in the X-Signature header does not match any application associated with the company.
  • “X-Signature invalid.”: The HMAC signature provided in the X-Signature header does not match the signature calculated from the request body.
  • “Failed to send command to the OEM.”: An error occurred while attempting to send the command to the OEM system.
  • “Failed to initiate command with the OEM or retrieve status URL.”: An error occurred while initiating the command with the OEM or obtaining the URL required to check the status later.
  • “Confirmation invalid”: The provided confirmation code is invalid. Restart the flow by sending the request without the code field to obtain a new code.
  • “Confirmation already used”: The confirmation code has already been used. Each code can be used only once. Restart the flow by sending the request without the code field to obtain a new one.