ParkedIn Fleet API — developer guide

How your rental system integrates with ParkedIn: send licence plates to manage parking operators' whitelists (Feature 1), and receive licence plate scan events from those operators (Feature 2).

Overview

Access is set up by ParkedIn after a contract is signed — there is no self-service sign-up. At onboarding we create your company account, link it to your parking operators, give you your API key and, if you use scan events, register your webhook URL and give you its signing secret.

Base URL & authentication

All requests go to https://api.parkedin.net and must carry your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer fpk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

• Your key starts with fpk_live_. It is shown to you once at onboarding; ParkedIn stores only a hash and cannot retrieve it again. If it is lost or exposed, contact us for a new one.
• Keep the key on your server. Never put it in a browser, mobile app or public repository.
• Every request only ever sees and changes your own company's vehicles.

Licence plate format

• 2 to 15 characters: letters, digits, hyphens and spaces (A–Z a–z 0–9 - space).
• ParkedIn normalises every plate: trimmed, upper case, spaces turned into -. "zh 123 ab" is stored and returned as "ZH-123-AB".
• Responses and scan events always use the normalised form — match against it in your system.

Add vehicles

Adds one or more licence plates to your active fleet. Each new or re-activated plate is passed on to every parking operator linked to your account.

Request

curl -X POST https://api.parkedin.net/vehicles \
  -H "Authorization: Bearer $PARKEDIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "vehicles": [
      { "plate": "ZH-123-AB" },
      { "plate": "zh 456 cd" },
      { "plate": "BE-789-EF" }
    ]
  }'

Response 200

{
  "added": ["ZH-123-AB", "ZH-456-CD"],
  "reactivated": ["BE-789-EF"],
  "already_active": [],
  "summary": { "requested": 3, "newly_active": 3, "unchanged": 0 }
}

• added — new plates. reactivated — plates you removed earlier and are adding again. already_active — no change.
• Adding a plate that is already active is harmless, so a request can safely be repeated.

Remove vehicles

Removes one or more licence plates from your active fleet. The removal is passed on to every linked parking operator. Note the body is a plain list of plate strings.

Request

curl -X DELETE https://api.parkedin.net/vehicles \
  -H "Authorization: Bearer $PARKEDIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "vehicles": ["ZH-123-AB", "ZH-999-ZZ"] }'

Response 200

{
  "removed": ["ZH-123-AB"],
  "not_found": ["ZH-999-ZZ"],
  "already_inactive": [],
  "summary": { "requested": 2, "newly_inactive": 1, "unchanged": 1 }
}

• A removed plate is marked inactive, not deleted. Add it again with POST /vehicles to re-activate it.
• Plates you never added come back in not_found; the request still succeeds.

List vehicles

Returns your own vehicle list — useful to reconcile ParkedIn against your fleet system.

curl "https://api.parkedin.net/vehicles?status=active&limit=500&offset=0" \
  -H "Authorization: Bearer $PARKEDIN_API_KEY"

{
  "vehicles": [
    { "plate": "ZH-456-CD", "status": "active",
      "added_at": "2026-11-14T09:12:03.000Z", "updated_at": "2026-11-14T09:12:03.000Z" }
  ],
  "count": 1, "limit": 500, "offset": 0
}

Results are newest first. To page through a larger fleet, increase offset by limit until count is less than limit.

Batches & call volume

• Batch updates are supported. POST and DELETE /vehicles each accept up to 1000 plates per request. For an initial load of a larger fleet, send several requests of up to 1000 plates.
• All or nothing. Each request is applied in one transaction: if it fails, none of its plates are changed, and it is safe to send again.
• Response time. Allow 1–2 seconds per request; larger batches take longer. Use a client timeout of at least 30 seconds.
• Send in sequence. Send requests one after another rather than in parallel, and prefer one batch over many single-plate calls.

Errors

Errors return JSON with an error code and a readable message. Validation errors also list each problem in details:

{
  "error": "bad_request",
  "message": "Validation failed",
  "details": [ { "path": "vehicles.0.plate", "message": "Plate number contains invalid characters" } ]
}

Scan event webhook

When a linked parking operator's camera reads one of your active plates and the operator sends that scan to ParkedIn, we send it to the HTTPS webhook URL registered for your company. Your webhook URL and signing secret are set up at onboarding; contact us to change them.

Payload

POST <your webhook url>
Content-Type: application/json
X-Event-Type: vehicle.scanned
X-Event-Id: 7f3d1e6a-8b2c-4d9e-a1f0-2c3b4a5d6e7f
X-Signature: 9c1e…   # HMAC-SHA256 of the raw body, hex

{
  "event_id": "7f3d1e6a-8b2c-4d9e-a1f0-2c3b4a5d6e7f",
  "event_type": "vehicle.scanned",
  "plate_number": "ZH-123-AB",
  "location_id": "zn-01",
  "location_name": "Zurich Nord",
  "scanned_at": "2026-07-04T14:32:07.000Z",
  "scan_type": "entry",
  "operator_id": "…",
  "operator_name": "Zurich Parking Nord"
}

Events can arrive out of order — order them by scanned_at.

Verify the signature

Compute HMAC-SHA256 of the raw request body (the exact bytes received, not re-serialised JSON) with your webhook secret, hex-encode it, and compare it to X-Signature in constant time. Reject the request if they differ.

// Node.js
import crypto from "node:crypto";
const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
const ok = expected.length === signature.length &&
  crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

# Python
import hmac, hashlib
expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
ok = hmac.compare_digest(expected, signature_header)

Retries & duplicates

Answer with any 2xx as soon as you have stored the event, and do the processing afterwards. We wait up to 8 seconds.

• Delivery is at least once: the same event_id can arrive more than once. Store processed event_ids, ignore repeats, and still answer 2xx.
• Redirects are not followed — register the final HTTPS URL.
• A scan we could not deliver is kept and can be re-sent once the cause is fixed.

What happens after a call

Which operators you are linked to, and how each is connected, is agreed at onboarding. Questions? hello@parkedin.io