Tesla Fleet API for shops: what it can and cannot do

What is the Tesla Fleet API?

It is Tesla's official interface for third-party applications: an OAuth-scoped REST API of roughly 60 vehicle commands plus Fleet Telemetry, a streaming channel that pushes vehicle signals to an authorized application. A shop uses it through a vendor's application; it is not something a shop stands up on its own counter.

The published command list at developer.tesla.com includes door_lock and door_unlock, actuate_trunk, charge_port_door_open and _close, honk_horn, flash_lights, remote_start_drive, set_valet_mode, reset_valet_pin, set_sentry_mode, set_pin_to_drive, window_control, guest_mode, and trigger_homelink. It is a useful list. It is a partial list — Tesla publishes roughly sixty. What matters is that the published list is exhaustive: if a capability is not on it, no application has it.

The one-paragraph version of what Fleet API is, and what it refuses to do, lives in the glossary.

Can a shop connect a customer's Tesla without the owner?

No. Signed vehicle commands require the owner to add the application's virtual key to the car through a tesla.com/_ak/<domain> link or QR code. Tesla describes this as requiring a trusted user-in-the-loop, preventing even Tesla's backend from accessing these capabilities. There is no path where a shop unilaterally instruments a customer's car.

Tesla’s own phrasing in the virtual key developer guide is worth quoting because it settles arguments: adding a key “requires a trusted user-in-the-loop, preventing even Tesla’s backend from accessing these capabilities” (developer.tesla.com). If your vendor’s demo skips this step, ask which car they were demoing on.

Which scopes does a custody use case actually need?

vehicle_device_data for vehicle state, vehicle_location for anything geofenced, vehicle_cmds for lock and unlock style commands, vehicle_charging_cmds for charging, and offline_access for refresh tokens across a multi-day visit. Applications cannot self-escalate — a wider scope requires the owner to grant again.

• ◐vehicle_device_data — state of charge, odometer, climate, doors.
• ◐vehicle_location — mandatory for geofences. No location grant means no lot watch, and a product should say so rather than degrade quietly.
• ◐vehicle_cmds and vehicle_charging_cmds — command surfaces.
• ◐offline_access — refresh tokens. Token lifetime is separate from the owner’s app authorization.
• ✕No self-escalation. Widening scope means the owner authorizes again (authentication overview).

Those five scopes, and where the owner revokes them, are summarised under Tesla third-party app authorization.

Is Fleet Telemetry cheaper than polling the REST API?

Tesla prices streaming signals and REST data requests separately. As reviewed September 4, 2026, its published rates are 150,000 streaming signals per dollar and 500 data requests per dollar, with commands and wakes billed separately. The cheaper approach depends on how many signals and requests the application actually uses; a fixed percentage saving is not a general guarantee.

• Fleet Telemetry compared with REST polling

• Model

  REST polling

  Ask the car repeatedly

  Fleet Telemetry

  Car pushes when a value changes

• Granularity

  REST polling

  Whatever your poll interval is

  Fleet Telemetry

  Data bucketed every 500 ms

• Published rate, September 4, 2026

  REST polling

  500 data requests / $1

  Fleet Telemetry

  150,000 streaming signals / $1

• Availability

  REST polling

  Depends on vehicle state; wake requests are separate

  Fleet Telemetry

  Depends on vehicle support and configured streaming

• Concurrency

  REST polling

  Per-application requests

  Fleet Telemetry

  Up to 5 third-party apps at once

Tesla publishes usage rates on the Fleet API site: streaming signals, data requests, commands, and wakes are billed separately. The total depends on actual usage; no fixed hourly saving applies to every configuration. See the Fleet Telemetry overview for streaming requirements, and Fleet Telemetry for the short definition and its provisioning caveat.

How many apps can stream from one Tesla at once?

A vehicle can stream Fleet Telemetry to five third-party applications simultaneously. In practice that means a shop's custody app does not have to displace whatever the owner already uses; both can be connected during the same visit.

What can the Fleet API never do?

It cannot enter or exit Service Mode — no such command exists in the vehicle-commands list. It cannot wipe an NFC key card. It cannot recover a scope the owner revoked, and revoking a scope automatically removes telemetry configurations that depended on it. Anything a vendor claims beyond the published command list should be treated as marketing.

On Service Mode specifically, the API is asymmetric in a way shops should understand: Fleet Telemetry streams a read-only ServiceMode boolean (available data reference), so software can see the state but never set it. Entry is a touchscreen sequence or a cabled Toolbox 3 session — see Valet Mode vs Service Mode.

Revocation belongs to the owner and works from either end: Tesla Account > Security > Third-Party Apps, or delete the virtual key from the car’s Locks screen (Fleet API FAQ).

What are the privacy obligations around connected-car data?

Regulators have moved from guidance to enforcement. The FTC finalized its order against GM and OnStar in January 2026 — a twenty-year order with a five-year ban on sharing geolocation data with consumer reporting agencies. California's Attorney General settled with GM for $12.75 million, and the California Privacy Protection Agency's first CCPA settlement, with Honda, landed at $632,500 in March 2025. The defensible posture is to collect only what the job requires and to end collection when the job ends.

The FTC’s finalized GM and OnStar order is the clearest signal (ftc.gov). The through-line across all three actions is not “connected car data is illegal” — it is that collection without meaningful consent, and retention past the purpose, is what gets punished. A shop that turns collection on at check-in and off at pickup is on the right side of that line by construction. Our own version is on the privacy page: collect only what the custody job needs, never sell vehicle data, end the consent window at pickup.

Why this matters commercially

There are roughly 105,000 auto body shops in the United States running a $67.7 billion industry (IBISWorld, 2026), and the Teslas rolling into them are the part those shops are least equipped for. A 2025 PartsTech and OEC survey of 752 shops found only about 3% of technicians proficient in EV maintenance, under 10% qualified for battery work, and 25% of general shops doing no EV work at all (PartsTech).

• The shops that can take Tesla work are competing on confidence, not just capacity.
• Owners arriving at an independent shop are unusually attentive to what happens to their car.
• The Fleet API is the only sanctioned way to answer that attention with something better than a promise.