BMW-Power Client API
Developer API
Automate BMW service orders
One API for services, automatic balance charging, statuses, result files, and signed webhook notifications.
9API services
WebhookSigned events
https://bmw-power.com.ua/api/v2/index.phpDeveloper ready
Ready for integration
After registration, the API account and personal key are created automatically. No manual administrator setup is required.
API CoreOne endpointProfile, order creation, and status checks through one URL.
↗
EventsWebhookInstant signed events for completion, cancellation, or failure.
↻
BillingSafe billingStandard or individual pricing. One personal account for all payments.
1Create an accountYour personal API key appears automatically in the account page.
2Fund the balanceThe price is fixed and charged when the order is created.
3Send a requestUse X-API-Key and a new Idempotency-Key.
4Receive the resultThe webhook reports completion; the result is available in the status.
Service catalog
Available services
Detailed fields, variants, and ready-to-use examples for every service are available in the complete API guide.
01
NCD 2.0NCD calculation from FA and SVT.
02
CBB ValidationAutomated CBB request validation.
03
KDSKDS order creation and processing.
04
Factory FAFactory FA retrieval by VIN.
05
SFA Debug TokensDebug Token for a selected feature and ECU.
06
OEM SFAOEM SFA orders for a full VIN.
07
FSC RepairFSC repair using a full VIN.
08
Feature InstallerKeys for head units, maps, and optional features.
09
DME FSCSupported DME FSC codes in one request.
Start with a ready example
The guide includes cURL, Python, PHP, JavaScript, and C# code.
Complete BMW-Power API guide
General workflow
Sign in or register before sending requests. Your personal API key will appear automatically on this page after sign-in.
- Read the profile, balance, and enabled prices.
- Create an order with POST and a new
Idempotency-Key. - Store the returned API order ID.
- Use the signed webhook as the primary completion signal; use status GET for reconciliation and recovery.
- Read the key from JSON or download the file from the protected URL.
Authentication and profile
Send the personal key in the header X-API-Key: YOUR_API_KEY.
curl -sS "https://bmw-power.com.ua/api/v2/index.php" \
-H "X-API-Key: YOUR_API_KEY"
import requests
response = requests.get("https://bmw-power.com.ua/api/v2/index.php", headers={"X-API-Key": "YOUR_API_KEY"}, timeout=60)
response.raise_for_status()
print(response.json())
$ch = curl_init('https://bmw-power.com.ua/api/v2/index.php');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['X-API-Key: YOUR_API_KEY'],
]);
$response = curl_exec($ch);
if ($response === false) throw new RuntimeException(curl_error($ch));
curl_close($ch);
echo $response;const response = await fetch("https://bmw-power.com.ua/api/v2/index.php", { headers: { "X-API-Key": "YOUR_API_KEY" } });
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-API-Key", "YOUR_API_KEY");
var json = await client.GetStringAsync("https://bmw-power.com.ua/api/v2/index.php");
Console.WriteLine(json);
The response contains the current balance and effective prices. An individual price takes priority; otherwise the general price is used. price_source identifies the source. Successful creation returns HTTP 201, the charged price, and remaining balance.
Idempotency-Key
Generate a new 8–128 character UUID for each logical order or payment. After a network failure, retry the identical request to the same endpoint with the same key—no duplicate will be created. Never reuse a key with different input.
Order status
curl -sS "https://bmw-power.com.ua/api/v2/index.php?order_id=API_ORDER_ID" \
-H "X-API-Key: YOUR_API_KEY"
import requests
response = requests.get("https://bmw-power.com.ua/api/v2/index.php?order_id=API_ORDER_ID", headers={"X-API-Key": "YOUR_API_KEY"}, timeout=60)
response.raise_for_status()
print(response.json())
$ch = curl_init('https://bmw-power.com.ua/api/v2/index.php?order_id=API_ORDER_ID');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['X-API-Key: YOUR_API_KEY'],
]);
$response = curl_exec($ch);
if ($response === false) throw new RuntimeException(curl_error($ch));
curl_close($ch);
echo $response;const response = await fetch("https://bmw-power.com.ua/api/v2/index.php?order_id=API_ORDER_ID", { headers: { "X-API-Key": "YOUR_API_KEY" } });
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-API-Key", "YOUR_API_KEY");
var json = await client.GetStringAsync("https://bmw-power.com.ua/api/v2/index.php?order_id=API_ORDER_ID");
Console.WriteLine(json);
pending — processing; completed — ready; cancel — cancelled; failed — failed.
Automatic refund: When an API order becomes cancel or failed, the full charged amount is returned to the balance exactly once with the note Invalid request or server error. Check order.refunded and order.refund in status responses and webhooks.
Webhook
Configure a public HTTPS URL on this page. The server sends order.completed, order.cancelled, order.failed, payment.completed, and webhook.test. payment.completed is emitted only after LiqPay confirmation and the actual balance credit. Return HTTP 2xx quickly, verify the signature against the raw body, and deduplicate by event_id.
X-BMW-Power-Event: order.completed
X-BMW-Power-Delivery: EVENT_UUID
X-BMW-Power-Timestamp: UNIX_TIMESTAMP
X-BMW-Power-Signature: v1=HMAC_SHA256(TIMESTAMP + "." + RAW_BODY, WEBHOOK_SECRET)
Downloading a result
curl -L "DOWNLOAD_URL" \
-H "X-API-Key: YOUR_API_KEY" \
-o result.zip
import requests
response = requests.get("DOWNLOAD_URL", headers={"X-API-Key": "YOUR_API_KEY"}, timeout=60)
response.raise_for_status()
with open("result.zip", "wb") as output:
output.write(response.content)
$ch = curl_init('DOWNLOAD_URL');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['X-API-Key: YOUR_API_KEY'],
]);
$response = curl_exec($ch);
if ($response === false) throw new RuntimeException(curl_error($ch));
curl_close($ch);
file_put_contents(__DIR__ . '/result.zip', $response);import { writeFile } from "node:fs/promises";
const response = await fetch("DOWNLOAD_URL", { headers: { "X-API-Key": "YOUR_API_KEY" } });
if (!response.ok) throw new Error(await response.text());
await writeFile("result.zip", new Uint8Array(await response.arrayBuffer()));using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-API-Key", "YOUR_API_KEY");
var bytes = await client.GetByteArrayAsync("DOWNLOAD_URL");
await File.WriteAllBytesAsync("result.zip", bytes);
Common errors
401 invalid_api_key— key missing, invalid, rotated, or disabled.402 insufficient_balance— insufficient funds.403 service_not_enabled— no active price.409 idempotency_conflict— the same key was used with different input.422— invalid input.
Security: keep the API key and webhook secret server-side. Never embed them in a public mobile/desktop application or write them to logs.
Balance top-up through API
Create a payment with a separate POST request. Store payment.id and open payment.payment_url in the user’s browser. Card details never pass through your server or BMW-Power API; they are collected by the secure LiqPay checkout.
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?action=topup" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-H "Content-Type: application/json" \
--data '{"amount":100,"payment_method":"liqpay","language":"en"}'
import uuid
import requests
response = requests.post(
"https://bmw-power.com.ua/api/v2/index.php?action=topup",
headers={
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": str(uuid.uuid4()),
},
json={"amount": 100, "payment_method": "liqpay", "language": "en"},
timeout=60,
)
response.raise_for_status()
print(response.json())
$url = 'https://bmw-power.com.ua/api/v2/index.php?action=topup';
$payload = json_encode(['amount' => 100, 'payment_method' => 'liqpay', 'language' => 'en']);
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: YOUR_API_KEY',
'Idempotency-Key: ' . bin2hex(random_bytes(16)),
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => $payload,
]);
$response = curl_exec($ch);
if ($response === false) throw new RuntimeException(curl_error($ch));
curl_close($ch);
echo $response;
import { randomUUID } from "node:crypto";
const response = await fetch("https://bmw-power.com.ua/api/v2/index.php?action=topup", {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify({ amount: 100, payment_method: "liqpay", language: "en" }),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?action=topup");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
request.Content = new StringContent("{\"amount\":100,\"payment_method\":\"liqpay\",\"language\":\"en\"}", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());
Fields: amount is the amount, payment_method is liqpay, and language is ru, uk, or en. Use a new Idempotency-Key for every payment.
Payment status
curl -sS "https://bmw-power.com.ua/api/v2/index.php?payment_id=API_PAYMENT_ID" \
-H "X-API-Key: YOUR_API_KEY"
import requests
response = requests.get("https://bmw-power.com.ua/api/v2/index.php?payment_id=API_PAYMENT_ID", headers={"X-API-Key": "YOUR_API_KEY"}, timeout=60)
response.raise_for_status()
print(response.json())
$ch = curl_init('https://bmw-power.com.ua/api/v2/index.php?payment_id=API_PAYMENT_ID');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['X-API-Key: YOUR_API_KEY'],
]);
$response = curl_exec($ch);
if ($response === false) throw new RuntimeException(curl_error($ch));
curl_close($ch);
echo $response;const response = await fetch("https://bmw-power.com.ua/api/v2/index.php?payment_id=API_PAYMENT_ID", { headers: { "X-API-Key": "YOUR_API_KEY" } });
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-API-Key", "YOUR_API_KEY");
var json = await client.GetStringAsync("https://bmw-power.com.ua/api/v2/index.php?payment_id=API_PAYMENT_ID");
Console.WriteLine(json);
pending — awaiting payment or confirmation; completed — payment confirmed and funds credited to the balance.
NCD 2.0
Creates an NCD 2.0 order from two vehicle XML files.
Request fields
| Field | Description |
|---|---|
fa_file | FA XML; the VIN is extracted from this file. |
svt_file | SVT_IST XML for the same vehicle. |
XML only. Both files must belong to the same vehicle.
Pricing
A standard or individual price per order.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=ncd" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-F "fa_file=@mCM_FA.xml" \
-F "svt_file=@mCM_SVT_IST.xml"
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=ncd"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
files = {
"fa_file": open("mCM_FA.xml", "rb"),
"svt_file": open("mCM_SVT_IST.xml", "rb"),
}
try:
response = requests.post(url, headers=headers, files=files, timeout=60)
finally:
for handle in files.values():
handle.close()
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=ncd';
$form = [
'fa_file' => new CURLFile(__DIR__ . '/mCM_FA.xml', 'application/xml', 'mCM_FA.xml'),
'svt_file' => new CURLFile(__DIR__ . '/mCM_SVT_IST.xml', 'application/xml', 'mCM_SVT_IST.xml'),
];
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
],
CURLOPT_POSTFIELDS => $form,
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
import { readFile } from "node:fs/promises";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=ncd";
const form = new FormData();
form.append("fa_file", new Blob([await readFile("./mCM_FA.xml")], { type: "application/xml" }), "mCM_FA.xml");
form.append("svt_file", new Blob([await readFile("./mCM_SVT_IST.xml")], { type: "application/xml" }), "mCM_SVT_IST.xml");
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
},
body: form,
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=ncd");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
using var form = new MultipartFormDataContent();
using var file1Stream = File.OpenRead("mCM_FA.xml");
using var file1Content = new StreamContent(file1Stream);
file1Content.Headers.ContentType = new MediaTypeHeaderValue("application/xml");
form.Add(file1Content, "fa_file", "mCM_FA.xml");
using var file2Stream = File.OpenRead("mCM_SVT_IST.xml");
using var file2Content = new StreamContent(file2Stream);
file2Content.Headers.ContentType = new MediaTypeHeaderValue("application/xml");
form.Add(file2Content, "svt_file", "mCM_SVT_IST.xml");
request.Content = form;
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result is a file. Download order.result.download_url using the same API key.
CBB Validation
Validates a CBB request file containing a VIN.
Request fields
| Field | Description |
|---|---|
request_file | XML, JSON, or TXT containing a 17-character VIN. |
Pricing
A standard or individual price per order.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=cbb" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-F "request_file=@request.xml"
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=cbb"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
files = {
"request_file": open("request.xml", "rb"),
}
try:
response = requests.post(url, headers=headers, files=files, timeout=60)
finally:
for handle in files.values():
handle.close()
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=cbb';
$form = [
'request_file' => new CURLFile(__DIR__ . '/request.xml', 'application/xml', 'request.xml'),
];
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
],
CURLOPT_POSTFIELDS => $form,
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
import { readFile } from "node:fs/promises";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=cbb";
const form = new FormData();
form.append("request_file", new Blob([await readFile("./request.xml")], { type: "application/xml" }), "request.xml");
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
},
body: form,
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=cbb");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
using var form = new MultipartFormDataContent();
using var file1Stream = File.OpenRead("request.xml");
using var file1Content = new StreamContent(file1Stream);
file1Content.Headers.ContentType = new MediaTypeHeaderValue("application/xml");
form.Add(file1Content, "request_file", "request.xml");
request.Content = form;
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result is a file with an authenticated download URL.
KDS
Creates a KDS order from a request file containing a VIN.
Request fields
| Field | Description |
|---|---|
request_file | XML, JSON, or TXT containing a 17-character VIN. |
Pricing
A standard or individual price per order.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=kds" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-F "request_file=@request.xml"
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=kds"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
files = {
"request_file": open("request.xml", "rb"),
}
try:
response = requests.post(url, headers=headers, files=files, timeout=60)
finally:
for handle in files.values():
handle.close()
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=kds';
$form = [
'request_file' => new CURLFile(__DIR__ . '/request.xml', 'application/xml', 'request.xml'),
];
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
],
CURLOPT_POSTFIELDS => $form,
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
import { readFile } from "node:fs/promises";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=kds";
const form = new FormData();
form.append("request_file", new Blob([await readFile("./request.xml")], { type: "application/xml" }), "request.xml");
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
},
body: form,
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=kds");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
using var form = new MultipartFormDataContent();
using var file1Stream = File.OpenRead("request.xml");
using var file1Content = new StreamContent(file1Stream);
file1Content.Headers.ContentType = new MediaTypeHeaderValue("application/xml");
form.Add(file1Content, "request_file", "request.xml");
request.Content = form;
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result is a file with an authenticated download URL.
Factory FA
Requests the factory FA for a full VIN.
Request fields
| Field | Description |
|---|---|
vin | Full 17-character VIN. |
Pricing
A standard or individual price per order.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=factory_fa" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-H "Content-Type: application/json" \
--data '{"vin":"5UX73GP07S9Z07376"}'
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=factory_fa"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
payload = {
"vin": "5UX73GP07S9Z07376"
}
response = requests.post(url, headers=headers, json=payload, timeout=60)
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=factory_fa';
$payload = json_decode('{"vin":"5UX73GP07S9Z07376"}', true);
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_SLASHES),
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=factory_fa";
const payload = {
"vin": "5UX73GP07S9Z07376"
};
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify(payload),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=factory_fa");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
request.Content = new StringContent("{\"vin\":\"5UX73GP07S9Z07376\"}", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result is an FA file.
SFA Debug Tokens
Creates an SFA Debug Token for a selected function and ECU.
Request fields
| Field | Description |
|---|---|
request_file | XML, JSON, or TXT containing a 17-character VIN. |
feature_code | An allowed SFA code, for example 0x005DF1. |
ecu_address | Required ECU address, for example 0x12. |
ecu_uid | Required ECU UID, maximum 160 characters. |
token_mode | Optional: LCS or SecOC, only for LCS features. |
token_edit_tag / token_edit_value | Optional token editing for LCS features only: send token_mode=LCS or SecOC, a numeric token_edit_tag (for example 1), and token_edit_value without the 0x prefix. The value is 01 or 02; for example 01. |
Pricing
The exact feature_code price is used first; standard is the fallback.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=sfa_debug" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-F "request_file=@request.xml" \
-F "feature_code=0x000100" \
-F "ecu_address=0x12" \
-F "ecu_uid=YOUR_ECU_UID" \
-F "token_mode=LCS" \
-F "token_edit_tag=1" \
-F "token_edit_value=01"
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=sfa_debug"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
files = {
"request_file": open("request.xml", "rb"),
}
data = {
"feature_code": "0x000100",
"ecu_address": "0x12",
"ecu_uid": "YOUR_ECU_UID",
"token_mode": "LCS",
"token_edit_tag": "1",
"token_edit_value": "01"
}
try:
response = requests.post(url, headers=headers, files=files, data=data, timeout=60)
finally:
for handle in files.values():
handle.close()
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=sfa_debug';
$form = [
'request_file' => new CURLFile(__DIR__ . '/request.xml', 'application/xml', 'request.xml'),
'feature_code' => '0x000100',
'ecu_address' => '0x12',
'ecu_uid' => 'YOUR_ECU_UID',
'token_mode' => 'LCS',
'token_edit_tag' => '1',
'token_edit_value' => '01',
];
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
],
CURLOPT_POSTFIELDS => $form,
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
import { readFile } from "node:fs/promises";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=sfa_debug";
const form = new FormData();
form.append("request_file", new Blob([await readFile("./request.xml")], { type: "application/xml" }), "request.xml");
form.append("feature_code", "0x000100");
form.append("ecu_address", "0x12");
form.append("ecu_uid", "YOUR_ECU_UID");
form.append("token_mode", "LCS");
form.append("token_edit_tag", "1");
form.append("token_edit_value", "01");
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
},
body: form,
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=sfa_debug");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
using var form = new MultipartFormDataContent();
using var file1Stream = File.OpenRead("request.xml");
using var file1Content = new StreamContent(file1Stream);
file1Content.Headers.ContentType = new MediaTypeHeaderValue("application/xml");
form.Add(file1Content, "request_file", "request.xml");
form.Add(new StringContent("0x000100"), "feature_code");
form.Add(new StringContent("0x12"), "ecu_address");
form.Add(new StringContent("YOUR_ECU_UID"), "ecu_uid");
form.Add(new StringContent("LCS"), "token_mode");
form.Add(new StringContent("1"), "token_edit_tag");
form.Add(new StringContent("01"), "token_edit_value");
request.Content = form;
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result is a Debug Token file.
Allowed SFA feature_code values
0x005DF1— 0x005DF1 - Secure Diag Function Group Level 10x005DF2— 0x005DF2 - Secure Diag Function Group Level 20x005DF3— 0x005DF3 - Secure Diag Function Group Level 30x000FBD— 0x000FBD - FBD Pairing0x00A50C— 0x00A50C - Reuse Counter / IDR Individual Data Rescue0x000100— 0x000100 - LCS-SP2018/20210x000101— 0x000101 - LCS-SecOC by-pass0x000102— 0x000102 - LCS-TimeSupreme0x000103— 0x000103 - LCS Switch for Activation/Deactivation Integrity Protection OC0x000104— 0x000104 - LCS Switch to set luK cluster configuration0x00151D— 0x00151D - IPSec Link Deactivation
OEM SFA
Creates an OEM SFA order for a full VIN.
Request fields
| Field | Description |
|---|---|
vin | Full 17-character VIN. |
Pricing
A standard or individual price per order.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=oemsfa" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-H "Content-Type: application/json" \
--data '{"vin":"5UX73GP07S9Z07376"}'
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=oemsfa"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
payload = {
"vin": "5UX73GP07S9Z07376"
}
response = requests.post(url, headers=headers, json=payload, timeout=60)
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=oemsfa';
$payload = json_decode('{"vin":"5UX73GP07S9Z07376"}', true);
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_SLASHES),
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=oemsfa";
const payload = {
"vin": "5UX73GP07S9Z07376"
};
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify(payload),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=oemsfa");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
request.Content = new StringContent("{\"vin\":\"5UX73GP07S9Z07376\"}", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result is an OEM SFA file.
FSC Repair
Creates an FSC repair order for a full VIN.
Request fields
| Field | Description |
|---|---|
vin | Full 17-character VIN. |
Pricing
A standard or individual price per order.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=fsc_repair" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-H "Content-Type: application/json" \
--data '{"vin":"5UX73GP07S9Z07376"}'
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=fsc_repair"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
payload = {
"vin": "5UX73GP07S9Z07376"
}
response = requests.post(url, headers=headers, json=payload, timeout=60)
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=fsc_repair';
$payload = json_decode('{"vin":"5UX73GP07S9Z07376"}', true);
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_SLASHES),
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=fsc_repair";
const payload = {
"vin": "5UX73GP07S9Z07376"
};
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify(payload),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=fsc_repair");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
request.Content = new StringContent("{\"vin\":\"5UX73GP07S9Z07376\"}", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result is an FSC repair file.
Feature Installer
Creates a Feature Installer key for a head unit, map region, and selected options.
Request fields
| Field | Description |
|---|---|
vin | Full 17-character VIN. |
head_unit | Head-unit code. It determines the multimedia type, mandatory features, and allowed options. See the complete explained list below. |
map_region | Navigation map-region code. Submit one exact value from the region table below. |
options | JSON array of additional options for the selected head_unit, for example ["region_unlock","vo_coding"]. It may be empty []. Do not submit mandatory features. |
Allowed head_unit values
| head_unit | Multimedia type | Mandatory features — already included, do not submit in options |
|---|---|---|
nbt_evo_56 | NBT EVO ID 5/6 Select for an NBT EVO head unit running the ID5 or ID6 interface. | Full-screen Apple CarPlay, Screen Mirroring, Video-in-Motion, Navigation Maps |
nbt_evo_4 | NBT EVO ID 4 Select for an NBT EVO head unit running the ID4 interface. | Navigation Maps |
entrynav2 | EntryNav2 (EntryEVO) Select for an EntryNav2 head unit, also known as EntryEVO. | Full-screen Apple CarPlay, Screen Mirroring, Navigation Maps |
Allowed options values
Submit only additional options supported by the selected head_unit. If no additional options are needed, submit [].
| option | What it does | Allowed head_unit values |
|---|---|---|
region_unlockRegion Unlock (Black Screen fix) | Removes the regional restriction and is used to fix a black screen caused by a region mismatch. | nbt_evo_56, nbt_evo_4 |
vo_codingVO Coding Fix | Fixes or restores the head unit VO coding. | nbt_evo_56, nbt_evo_4 |
component_protectionComponent Protection | Used for component-protection handling after a unit is installed or replaced. | nbt_evo_56, entrynav2 |
open_sshOpen SSH access | Enables SSH access on a supported head unit. | nbt_evo_4, entrynav2 |
head_unit_replacementHead-unit Replacement | Select this when the head unit has been replaced or a replacement is being prepared. | nbt_evo_56, nbt_evo_4 |
rhd_vehicleRight-hand-drive vehicle (RHD) | Indicates that the vehicle is right-hand drive. | nbt_evo_56 |
Allowed map_region values
Submit exactly one region code. It selects the navigation-map region but does not change the order price.
| map_region | Navigation map region |
|---|---|
argentina | Argentina |
australia_nz | Australia and New Zealand |
china | China, Hong Kong, and Macau |
europe | Europe |
india | India |
israel | Israel |
japan | Japan |
korea | Korea |
middle_east | Middle East |
north_africa | North Africa |
north_america | North America |
russia | Russia |
south_africa | South Africa |
south_america | South America |
southeast_asia | Southeast Asia |
taiwan | Taiwan |
turkey | Turkey |
Pricing
Total: head-unit base price plus every selected option price. Each component uses its individual price first and the general price as fallback. Mandatory functions are included; map region does not change the price.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=feature_installer" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-H "Content-Type: application/json" \
--data '{"vin":"5UX73GP07S9Z07376","head_unit":"nbt_evo_56","map_region":"europe","options":["region_unlock","vo_coding"]}'
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=feature_installer"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
payload = {
"vin": "5UX73GP07S9Z07376",
"head_unit": "nbt_evo_56",
"map_region": "europe",
"options": [
"region_unlock",
"vo_coding"
]
}
response = requests.post(url, headers=headers, json=payload, timeout=60)
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=feature_installer';
$payload = json_decode('{"vin":"5UX73GP07S9Z07376","head_unit":"nbt_evo_56","map_region":"europe","options":["region_unlock","vo_coding"]}', true);
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_SLASHES),
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=feature_installer";
const payload = {
"vin": "5UX73GP07S9Z07376",
"head_unit": "nbt_evo_56",
"map_region": "europe",
"options": [
"region_unlock",
"vo_coding"
]
};
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify(payload),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=feature_installer");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
request.Content = new StringContent("{\"vin\":\"5UX73GP07S9Z07376\",\"head_unit\":\"nbt_evo_56\",\"map_region\":\"europe\",\"options\":[\"region_unlock\",\"vo_coding\"]}", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result key is returned directly in order.result.value; no file download is needed.
DME FSC
Creates a DME FSC order for one or more supported FSC codes.
Request fields
| Field | Description |
|---|---|
vin | A 7- or 17-character VIN. |
fsc_codes | Non-empty JSON array of supported codes, for example ["0x17C","0x180"]. |
Pricing
A standard or individual price per order, regardless of the number of submitted codes.
Request example
curl -sS -X POST "https://bmw-power.com.ua/api/v2/index.php?service=dme_fsc" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: YOUR_UNIQUE_UUID" \
-H "Content-Type: application/json" \
--data '{"vin":"9Z07376","fsc_codes":["0x17C","0x180"]}'
import uuid
import requests
API_KEY = "YOUR_API_KEY"
url = "https://bmw-power.com.ua/api/v2/index.php?service=dme_fsc"
headers = {
"X-API-Key": API_KEY,
"Idempotency-Key": str(uuid.uuid4()),
}
payload = {
"vin": "9Z07376",
"fsc_codes": [
"0x17C",
"0x180"
]
}
response = requests.post(url, headers=headers, json=payload, timeout=60)
response.raise_for_status()
print(response.json())
$apiKey = 'YOUR_API_KEY';
$idempotencyKey = bin2hex(random_bytes(16));
$url = 'https://bmw-power.com.ua/api/v2/index.php?service=dme_fsc';
$payload = json_decode('{"vin":"9Z07376","fsc_codes":["0x17C","0x180"]}', true);
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'X-API-Key: ' . $apiKey,
'Idempotency-Key: ' . $idempotencyKey,
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_SLASHES),
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status . PHP_EOL . $response;
import { randomUUID } from "node:crypto";
const url = "https://bmw-power.com.ua/api/v2/index.php?service=dme_fsc";
const payload = {
"vin": "9Z07376",
"fsc_codes": [
"0x17C",
"0x180"
]
};
const response = await fetch(url, {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Idempotency-Key": randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify(payload),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://bmw-power.com.ua/api/v2/index.php?service=dme_fsc");
request.Headers.Add("X-API-Key", "YOUR_API_KEY");
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
request.Content = new StringContent("{\"vin\":\"9Z07376\",\"fsc_codes\":[\"0x17C\",\"0x180\"]}", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
response.EnsureSuccessStatusCode();
Console.WriteLine(body);
Result
The result is a DME FSC file.
Supported FSC codes
0x17C— DME1: Remote engine start activation0x180— DME2: Remote engine start activation0x095— Vmax - DME1 (M vehicles)0x07B— Vmax - DME2 (M vehicles)0x1A4— 8.6.S (F97/F98 + G80/G82/G83) Competition (Werk)0x1C1— 8.6.S (G8x) M-Drive Professional0x1DE— 8.6.S G80 CS / G82 CSL - Pmax/Vmax (Werk)0x1E8— 8.6.S (G8x AWD LCI) Competition (Werk)0x1EC— 8.6.S G87 CS (Werk)0x188— M-Driver package (DME-86T0)0x1AB— DME1 Competition package0x1AC— DME2 Competition package