auto.cc API

Overview

The auto.cc API is composed of two backends served under a unified domain:

All requests use JSON (application/json) unless otherwise noted. File uploads use multipart/form-data.

Supported Brands

Xiaomi (SU7 Max, SU7 Ultra, YU7), Zeekr (001, 9X), BYD (Seal 05 DM-i), Avatr (12), Li Auto (L6), Jetour (T2 i-DM, G700), Maextro (S800)

Supported Markets

DE, AT, CH, FR, IT, ES, PT, NL, BE, FI, GR, IE, SK, SI, LU, AE (UAE). Currencies: EUR, AED.

Authentication

All authenticated endpoints require a JWT Bearer token in the Authorization header:

Authorization: Bearer <token>

Tokens are issued by POST /api/login (Dashboard API) or POST /api/auth/login (Client API). They use HS256 signing and expire after 8 hours.

Token Payload (Dashboard API)

{
  "username": "john.doe",
  "department": "Sales",
  "role": "admin",
  "iat": 1774880047,
  "exp": 1774908847
}

Authorization Levels

Permissions Object

The login response includes a permissions object. Admins get all permissions:

{
  "service": true,
  "sales": true,
  "logistics": true,
  "accounting": true
}

Error Handling

Errors are returned as JSON with an error field:

{ "error": "Invalid credentials." }

Login

{
  "username": "john.doe",
  "password": "secret",
  "department": "Sales"
}

{
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "user": {
    "username": "john.doe",
    "role": "admin",
    "department": "Sales",
    "permissions": { "service": true, "sales": true, "logistics": true, "accounting": true }
  }
}

Verify & Logout

User Management

Admin-only CRUD for platform user accounts.

Leads (CRM)

Sales leads synced with Close.com CRM. All endpoints require Sales department access.

Deals

Sales deals with pipeline tracking, value, and analytics.

Sales Orders

Test Drives

Test drive booking with Stripe payments, calendar scheduling, SMS/email confirmations.

Vehicle Pipeline

End-to-end vehicle import pipeline from order to delivery, with Kanban board and full audit history.

Unified Customer Profile

Multi-source customer deduplication engine (Close.com, Lexoffice, Stripe, Postgres, Configurator). Includes AI-powered duplicate detection with Claude review.

Invoices

All accounting endpoints require Accounting department access or Admin role.

Expenses & Documents

Banking (CAMT52 & CSV)

Import and reconcile bank transactions from CAMT52 XML, CSV statements, or manual upload.

Lexoffice Integration

Intercompany Invoicing

DATEV Export

Vehicle Inventory

Tax & Registration Documents

Repair Manuals

DRM-protected repair manual viewer. PDFs are stored on S3 and rendered server-side as watermarked PNG pages (per-user watermark with username).

Parts Catalog

Parts Orders

Remote Diagnostics

Service Chat (RAG)

{
  "messages": [
    { "role": "user", "content": "How do I replace the brake pads on the Xiaomi SU7 Max?" }
  ],
  "vehicle": "Xiaomi SU7 Max",
  "brand": "Xiaomi",
  "model": "SU7 Max",
  "vin": "LSJ..."
}

{
  "reply": "To replace the brake pads on the Xiaomi SU7 Max...",
  "sources": [
    { "manual": "SU7-Max-Brake-System", "s3Key": "manuals/xiaomi/su7max/...", "page": 42, "brand": "Xiaomi", "model": "SU7 Max" }
  ],
  "parts": [
    { "partId": "SU7-BP-F01", "description": "Front brake pad set", "category": "Brakes" }
  ],
  "usage": { "input_tokens": 1234, "output_tokens": 567 },
  "toolCalls": 2
}

Sales Agent

{
  "messages": [
    { "role": "user", "content": "What's the price of a Xiaomi SU7 Max in Germany?" }
  ],
  "sessionId": "abc123"
}

{
  "reply": "The Xiaomi SU7 Max starts at...",
  "usage": { "input_tokens": 800, "output_tokens": 300 },
  "toolCalls": 1
}

Wallet

Internal credit system. Used for parts orders (25 EUR fee) and remote diagnostics (75 EUR fee). Top-up via Stripe.

Push Notifications

Push notification management via OneSignal.

Companies

Mail, SMS & OTP

Admin & Server

Stripe Webhooks

Content

Image Studio — Upload & Process

Base URL: https://auto.cc/studio. Separate Flask backend for car listing image processing.

Image Studio — AI Generation

Generate photorealistic showroom images using Kling AI (text-to-image and image-to-image).

Image Studio — Reference

Background Presets

AI View Templates

SU7 Color Options

Client API — Auth

Separate NestJS API for the client-facing portal (vehicle ordering, configurator, financing). Uses cookie-based auth with access_token cookie + JWT Bearer header.

Client Portal

All endpoints require client authentication.

Admin (NestJS)

Admin role required for all endpoints.

Public Forms

All endpoints require reCAPTCHA token. No authentication needed.

Data & Inventory

Public/optional-auth endpoints for vehicle inventory browsing and XTool device management.

Webhooks

Inbound webhooks from payment providers and external services. Signature verification replaces JWT auth.

User Management (NestJS)

Admin-only. Uses Prisma ORM with PostgreSQL.