Xpeng Open Platform /oauth2/queryData API Integration Guide

1. API Overview

/oauth2/queryData is used by third-party enterprises to query and submit vehicle data download tasks after obtaining user authorization. The interface does two things at once:

1. First call: submits a data download task and returns "DataFileExporting".
2. Subsequent calls: queries task status based on cached recordNo and returns either a download URL or a status string.

2. Preparation

• Register a developer account and have an approved mobile application; once approved, the corresponding appId and appSecret will be sent to the applicant's email. To apply, send an email to glo.open@xpeng.com with the following information: the integrating enterprise name, third-party application name, and integration owner's contact email.
• After applying for and passing Xpeng login review, you can start the integration process.
• Authorized users can obtain openId, accessToken, enterpriseName, and scopeCode from the email they receive.

3. Endpoint

4. HTTP Method

POST

5. Request Parameters

5.1 Query Parameters

5.2 Body Parameters

Content-Type: application/json

5.3 Request Example

{
  "openId": "6c6d6091390ffb38e70935b31397e0672e3e8cd8",
  "accessToken": "eyJ0eXBlIjoxLCJ2ZXJzaW9uIjoiMS4wLjAiLCJhbGciOiJIUzI1NiJ9...",
  "enterpriseName": "XXXX Enterprise Name",
  "scopeCode": "d580644744cd40ddbdf88ad5a5125613"
}

6. Response

6.1 Response Field Description

6.2 Success Response Examples

First Submit / Exporting

{
  "code": 0,
  "data": "DataFileExporting",
  "msg": null
}

File Available for Download

{
  "code": 0,
  "data": "https://example.com/download?token=xxx",
  "msg": null
}

Export Failed

{
  "code": 0,
  "data": "DataFileExportFailed",
  "msg": null
}

6.3 Failure Response Examples

Note: the wording of msg is resolved dynamically based on the request language; the msg value below is illustrative only. desc has fixed wording and should be used as the basis for error handling.

Download Limit Exceeded

{
  "code": 12064024,
  "data": null,
  "msg": "Server unavailable. Please try again later",
  "desc": "Download count exceeded the limit"
}

Authorization Record Not Found

{
  "code": 12064019,
  "data": null,
  "msg": "Server unavailable. Please try again later",
  "desc": "No authorization record for this user and application"
}

accessToken Expired

{
  "code": 4004001,
  "data": null,
  "msg": "Server unavailable. Please try again later",
  "desc": "accesstoken已过期"
}

7. Status Flow Description

The interface returns different data values based on the downstream task status:

8. Validity and Limits

9. Signature Calculation Rules

9.1 Build Signature String stringA

1. From Query parameters, exclude appId and sign. Add body ("body" as key, body content as value) to the fields participating in signature.
2. Sort keys in natural ascending order, then concatenate as key1+value1+key2+value2 without separators.
3. Example: stringA = "body" + ${bodyContent (empty string if none)} + "nonce" + ${nonce}

9.2 Build String stringB

1. Prepend appId and append appSecret to stringA.
2. Example: stringB = ${appId} + stringA + ${appSecret}

9.3 Calculate Signature sign

1. Compute SHA1 of stringB, then convert the result to lowercase.
2. Example: sign = SHA1(stringB).toLowerCase()

Note: appSecret is obtained after the application is approved on the Xpeng Open Platform.

9.4 Signature Examples

The examples below demonstrate how to generate the sign for /oauth2/queryData based on the rules above.

Example 1: Using /oauth2/authorize to demonstrate concatenation

GET https://xxx.xpeng.com/open/oauth2/authorize?appId=APPID&nonce=NONCE&state=STATE&sign=SIGN

StringA = bodynonceNONCEstateSTATE
StringB = APPIDbodynonceNONCEstateSTATEAPPSECRET
sign    = SHA1(StringB).toLowerCase()

Example 2: Complete example for /oauth2/queryData

Given:

appId     = APPID
appSecret = APPSECRET
nonce     = 1787020880806
body      = {"openId":"xxx","accessToken":"yyy","enterpriseName":"XXXX Enterprise Name","scopeCode":"abc"}

Build signature strings:

StringA = body{"openId":"xxx","accessToken":"yyy","enterpriseName":"XXXX Enterprise Name","scopeCode":"abc"}nonce1787020880806
StringB = APPIDbody{"openId":"xxx","accessToken":"yyy","enterpriseName":"XXXX Enterprise Name","scopeCode":"abc"}nonce1787020880806APPSECRET
sign    = SHA1(StringB).toLowerCase()

Notes:

• StringA only contains the keys body and nonce (in natural ascending order), because appId and sign do not participate in the signature string concatenation.
• appId is prepended to StringA and appSecret is appended to form StringB.
• The final sign is SHA1(StringB) converted to lowercase.

10. Calling Example

10.1 cURL Example

curl --location 'https://open-eu.uat.xpeng.com/open/oauth2/queryData?appId=YOUR_APP_ID&nonce=1787020880806&sign=YOUR_SIGN' \
  --header 'Content-Type: application/json' \
  --data '{
    "openId": "6c6d6091390ffb38e70935b31397e0672e3e8cd8",
    "accessToken": "eyJ0eXBlIjoxLCJ2ZXJzaW9uIjoiMS4wLjAiLCJhbGciOiJIUzI1NiJ9...",
    "enterpriseName": "XXXX Enterprise Name",
    "scopeCode": "d580644744cd40ddbdf88ad5a5125613"
  }'

10.2 PowerShell Example

When running curl.exe in PowerShell, use --% to stop PowerShell parsing and avoid special characters being escaped:

curl.exe --% --location "https://open-eu.uat.xpeng.com/open/oauth2/queryData?appId=YOUR_APP_ID&nonce=1787020880806&sign=YOUR_SIGN" `
  --header "Content-Type: application/json" `
  --data '{"openId":"6c6d6091390ffb38e70935b31397e0672e3e8cd8","accessToken":"eyJ...","enterpriseName":"XXXX Enterprise Name","scopeCode":"d580644744cd40ddbdf88ad5a5125613"}'

11. Error Codes

12. Notes

1. The /oauth2/queryData interface requires both signature verification and accessToken verification; ensure both are valid.
2. enterpriseName must exactly match the name used during authorization (including case and spaces); the system compares MD5 hashes.
3. scopeCode is a one-time authorization credential; keep it secure.
4. After receiving DataFileExporting, it is recommended to call this interface again after a delay (e.g., 5-10 seconds) to query task status.
5. If 12064024 is returned, the submission limit for the past 24 hours has been reached; retry after 24 hours.

Document Version: 1.0
Last Updated: 2026-08-19