Comdata App API integration services (fleet OpenFinance & fuel transaction OpenData)

Deliverables checklist

• OpenAPI / Swagger specification for every exposed endpoint
• Authorization flow report mapped against Comdata Web Services 2.1 WS-Security and the new mobile token chain
• Runnable source for login, statement, balance, and locator APIs (Python / Node.js / Go on request)
• Webhook receivers for posting events and EV charging session callbacks
• Postman collection plus pytest / vitest harness
• Compliance pack: PCI DSS 4.0 scope notes, data-minimization checklist, retention guidance

API example: Comdata transaction statement (pseudocode)

POST /api/v1/comdata/statement
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>

{
  "account_code": "ABC123",
  "card_numbers": ["55670012********"],
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "include":   ["fuel", "non_fuel", "ev_session"]
}

200 OK
{
  "transactions": [
    {
      "txn_id": "CD-2026-0312-0098",
      "posted_at": "2026-03-12T14:08:11Z",
      "merchant": { "id": "TS-9182", "name": "Pilot #392", "lat": 36.15, "lng": -86.78 },
      "card_last4": "1234", "driver_id": "D00041", "unit_id": "U207",
      "product": "ULSD", "gallons": 142.31, "ppg": 3.689, "amount": 524.97,
      "odometer": 412998, "currency": "USD", "status": "POSTED"
    }
  ],
  "next_cursor": "eyJvZmYiOjUwfQ=="
}

API example: Comdata mobile login (token bind, pseudocode)

POST /api/v1/comdata/auth/login
Content-Type: application/json

{
  "username": "fleetadmin@example.com",
  "password": "<REDACTED>",
  "device_id": "ios-7E2B-...",
  "biometric": "face_id"
}

200 OK
{
  "access_token": "eyJraWQ...",
  "refresh_token": "rt_8c91...",
  "expires_in": 1800,
  "user_type": "FLEET_ADMIN",
  "scopes": ["transactions.read", "cards.manage", "wallet.transfer"]
}

API example: posting webhook (pseudocode)

POST https://your-host/webhooks/comdata
X-Comdata-Signature: t=1711899...,v1=8a91...
Content-Type: application/json

{
  "event": "txn.posted",
  "txn_id": "CD-2026-0412-1551",
  "card_last4": "1234",
  "amount": 312.40,
  "gallons": 84.10,
  "merchant_id": "TS-2207",
  "occurred_at": "2026-04-12T17:51:09Z"
}

1. IFTA & fuel-tax automation

Mid-sized OTR carriers must aggregate every diesel transaction by jurisdiction. We expose the Comdata transaction API with state, gallons, and odometer fields and stream events into an IFTA reporting service. This eliminates manual CSV exports from iConnectData and shrinks quarterly close from days to minutes — mapping cleanly onto the OpenFinance pattern of consented, standardized financial data sharing.

2. ERP / AP reconciliation

Finance teams want every Comdata invoice line item posted directly into NetSuite, SAP, or QuickBooks. We hook the ReportIQ statement endpoint, normalize line items into a canonical schema (txn_id, gl_account, cost_center, amount, tax), and push them to the ERP through a JSON-RPC bridge — closing the loop between fleet card spend and the chart of accounts.

3. Real-time fraud & spend control

Pair the posting webhook with a rules engine to detect anomalies (off-route purchases, gallons exceeding tank capacity, after-hours activity). When a rule fires, the bridge calls the card-management API to lock the card and notifies dispatch via Slack or Teams within seconds — a true OpenFinance-style consented control plane on top of the Comdata App backend.

4. Mixed diesel + EV fleet analytics

For fleets piloting electric trucks, we merge Comdata diesel transactions with Hubject-powered EV charging sessions in a single time-series store. Cost-per-mile becomes comparable across powertrains, and the data feeds sustainability dashboards used for SEC climate disclosures and customer ESG reporting.

5. Driver mobile companion & locator

Some carriers embed Comdata's fuel/amenities locator inside their own driver app. We wrap the locator endpoint with caching and lane-availability logic, then expose it as a clean REST endpoint so internal apps can recommend the cheapest, closest in-network site without re-implementing Corpay's UI.

Authorization & transport

The mobile Comdata App uses bearer tokens issued after a username/password (plus optional biometric) login. The legacy Comdata Web Services 2.1 (Fleet Credit) channel uses WS-Security with username/password in the SOAP header over TLS. Our integrations normalize both into a single OAuth-2.0-style facade with refresh tokens, scope claims, and PKCE for any mobile-originated flows.

Pagination, throttling, retries

Statement endpoints return cursor-paginated results; we recommend polling with exponential backoff and idempotency keys. Webhooks include an HMAC signature header so the receiver can verify origin. Rate limits in production typically tolerate a few requests per second per fleet account, so we batch reconciliation jobs accordingly.

Error handling

We map upstream faults to a stable error envelope: 4xx for caller mistakes (auth, validation), 409 for stale state (duplicate webhook), 5xx for upstream Corpay outages. Every error carries a trace_id that ties through to the studio's observability stack so support tickets can be triaged in minutes.

About our studio

We are an independent technical service studio focused on App interface integration and authorized API integration. Our engineers come from fintech, payments, fleet telematics, and protocol-analysis backgrounds, and have shipped production integrations against Comdata Web Services 2.1, iConnectData, WEX, and several Corpay partner platforms.

• Fleet payments, fuel-tax recovery, IFTA automation, ERP/TMS bridges
• EV charging data integration (Hubject, OCPI, OCPP) and mixed-fuel analytics
• Custom Python / Node.js / Go SDKs with CI test harnesses
• End-to-end pipeline: protocol analysis → build → validation → compliance
• Source code delivery from $300 — runnable API source code plus full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted endpoints and pay only for the calls you make, no upfront cost

Contact

For quotes, sandbox access, or to submit your Comdata App scope, please open our contact page:

Contact page

Typical response time: under one business day. NDAs and DPAs available on request.

Engagement workflow

1. Scope confirmation — which Comdata data (transactions, statements, balances, locator, EV sessions) and which downstream system.
2. Protocol analysis & API design (2–5 business days, complexity-dependent).
3. Build and internal validation against a fleet administrator sandbox account (3–8 business days).
4. Documentation, OpenAPI spec, sample code, Postman collection (1–2 business days).
5. Acceptance test with the customer's data, then handover or hosted-API onboarding (typical first delivery: 5–15 business days).

FAQ

What do you need from me to start?

How long does delivery take?

How do you handle compliance?

Do you support both source-code delivery and hosted API?