diff --git a/src/Controller/ResqAPI/CustomerController.php b/src/Controller/ResqAPI/CustomerController.php
index dc1c260a..378e0e57 100644
--- a/src/Controller/ResqAPI/CustomerController.php
+++ b/src/Controller/ResqAPI/CustomerController.php
@@ -17,6 +17,8 @@ use App\Ramcar\APIResult;
 
 use App\Entity\MobileUser;
 
+use App\Service\RisingTideGateway;
+
 use Catalyst\APIBundle\Access\Generator as ACLGenerator;
 
 class CustomerController extends APIController
@@ -306,9 +308,177 @@ class CustomerController extends APIController
         return $res->getReturnResponse();
     }
 
+    // TODO: needs to be modified for mobile user
+    public function resendCode(Request $req, RisingTideGateway $rt, EntityManagerInterface $em)
+    {
+        $required_params = [];
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res->getReturnResponse();
 
+        // already confirmed
+        if ($this->session->isConfirmed())
+        {
+            $res->setError(true)
+                ->setErrorMessage('User is already confirmed.');
+            return $res->getReturnResponse();
+        }
+
+        // have sent code before
+        if ($this->session->getDateCodeSent() != null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('Can only send confirm code every 5 mins.');
+            return $res->getReturnResponse();
+        }
+
+
+        // TODO: send via sms
+                $phone_number = $this->session->getPhoneNumber();
+            $code = $this->session->getConfirmCode();
+        $this->sendConfirmationCode($rt, $phone_number, $code);
+
+
+        return $res->getReturnResponse();
+    }
+
+    // TODO: modify the return or the result if we change what we return
+    public function versionCheck(Request $req)
+    {
+        $res = new APIResult();
+
+        $required_params = [
+            'version',
+        ];
+
+        $missing = $this->checkMissingParameters($req, $required_params);
+        if (count($missing) > 0)
+        {
+            $params = implode(', ', $missing);
+            $res->setError(true)
+                ->setErrorMessage('Missing parameter(s): ' . $params);
+            return $res->getReturnResponse();
+        }
+
+        $need_update = false;
+        $msg = 'Version is up to date.';
+
+        $api_version = $this->getParameter('api_version');
+
+        $app_version = $req->query->get('version');
+
+        $api_v = explode('.', $api_version);
+        $app_v = explode('.', $app_version);
+
+        if ($api_v[0] < $app_v[0])
+        {
+            $res->setError(true)
+                ->setErrorMessage('Invalid application version: ' . $app_version);
+            return $res->getReturnResponse();
+        }
+
+        if ($api_v[0] > $app_v[0])
+        {
+            $need_update = true;
+            $msg = 'Your version is outdated and needs an update to use the latest features RES-Q has to offer.';
+        }
+
+
+        $data = [
+            'need_update' => $need_update,
+            'message' => $msg,
+        ];
+
+        $res->setData($data);
+
+        return $res->getReturnResponse();
+    }
+
+    // TODO: needs to be modified for mobile user
+    public function updateDeviceID(Request $req, EntityManagerInterface $em)
+    {
+        $required_params = [
+            'device_id',
+        ];
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res->getReturnResponse();
+
+        $device_id = $req->request->get('device_id');
+        $this->session->setDevicePushID($device_id);
+
+        $em->flush();
+
+        // response
+        return $res->getReturnResponse();
+    }
+
+    // TODO: needs to be modified for mobile user
+    public function privacySettings(Request $req, EntityManagerInterface $em)
+    {
+        $required_params = [
+            'priv_third_party',
+            // 'priv_promo',
+        ];
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res->getReturnResponse();
+
+        // get customer
+        $cust = $this->session->getCustomer();
+        if ($cust == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('No customer information found');
+            return $res->getReturnResponse();
+        }
+
+        // set privacy settings
+        $priv_promo = $req->request->get('priv_promo', false);
+        $priv_third_party = $req->request->get('priv_third_party');
+        $cust->setPrivacyThirdParty($priv_third_party)
+            ->setPrivacyPromo($priv_promo);
+
+        // get the policy ids from .env
+        $dotenv = new Dotenv();
+        $dotenv->loadEnv(__DIR__.'/../../.env');
+
+        $policy_promo_id = $_ENV['POLICY_PROMO'];
+        $policy_third_party_id = $_ENV['POLICY_THIRD_PARTY'];
+
+        // check if privacy settings are true
+        // if true, set the private policy for the customer
+        if ($priv_promo)
+        {
+            // find the promo policy
+            $policy = $em->getRepository(PrivacyPolicy::class)->find($policy_promo_id);
+
+            // set policy id
+            if ($policy != null)
+            {
+                $cust->setPrivacyPolicyPromo($policy);
+            }
+        }
+
+        if ($priv_third_party)
+        {
+            // find the third party policy
+            $policy = $em->getRepository(PrivacyPolicy::class)->find($policy_third_party_id);
+
+            // set policy id
+            if ($policy != null)
+            {
+                $cust->setPrivacyPolicyThirdParty($policy);
+            }
+        }
+
+        $em->flush();
+
+        return $res->getReturnResponse();
+    }
 
     // TODO: this might not be needed if we use APIController's checkRequiredParameters
+    // or we put this into a service?
     protected function checkMissingParameters(Request $req, $params = [])
     {
         $missing = [];
diff --git a/src/Controller/ResqAPI/CustomerVehicleController.php b/src/Controller/ResqAPI/CustomerVehicleController.php
new file mode 100644
index 00000000..5ce7ab6b
--- /dev/null
+++ b/src/Controller/ResqAPI/CustomerVehicleController.php
@@ -0,0 +1,319 @@
+<?php
+
+namespace App\Controller\ResqAPI;
+
+use Symfony\Bundle\FrameworkBundle\Controller\Controller;
+use Symfony\Component\HttpFoundation\Request;
+
+use Doctrine\ORM\Query;
+use Doctrine\ORM\EntityManagerInterface;
+
+use Catalyst\APIBundle\Controller\APIController;
+// TODO: what do we use for response? APIResponse or APIResult?
+// APIResult is what is used by APIController. APIResponse is what is used by CAPI
+use Catalyst\APIBundle\Response\APIResponse;
+use App\Ramcar\APIResult;
+
+use App\Entity\VehicleManufacturer;
+use App\Entity\Vehicle;
+use App\Entity\CustomerVehicle;
+
+use Catalyst\APIBundle\Access\Generator as ACLGenerator;
+
+class CustomerVehicleController extends APIController
+{
+    protected $acl_gen;
+
+    public function __construct(ACLGenerator $acl_gen)
+    {
+        $this->acl_gen = $acl_gen;
+    }
+
+    public function addVehicle(Request $req, EntityManagerInterface $em)
+    {
+        // check requirements
+        $res = $this->checkVehicleRequirements($req, $em);
+        if ($res->isError())
+            return $res->getReturnResponse();
+
+        // customer vehicle
+        $cv = new CustomerVehicle();
+
+        $res = $this->setCustomerVehicleObject($req, $res, $cv, $em);
+
+        return $res->getReturnResponse();
+    }
+
+    // TODO: needs to be modified for mobile user
+    public function updateVehicle(Request $req, $id, EntityManagerInterface $em)
+    {
+        // check requirements
+        $res = $this->checkVehicleRequirements($req, $em);
+        if ($res->isError())
+            return $res->getReturnResponse();
+
+        // get customer vehicle
+        $cv = $em->getRepository(CustomerVehicle::class)->find($id);
+
+        // check if it exists
+        if ($cv == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('Vehicle does not exist');
+            return $res->getReturnResponse();
+        }
+
+        // check if it's owned by customer
+        if ($cv->getCustomer()->getID() != $this->session->getCustomer()->getID())
+        {
+            $res->setError(true)
+                ->setErrorMessage('Invalid vehicle');
+            return $res->getReturnResponse();
+        }
+
+        $res = $this->setCustomerVehicleObject($req, $res, $cv, $em);
+
+        return $res->getReturnResponse();
+    }
+
+    // TODO: needs to be modified for mobile user
+    public function listVehicles(Request $req, EntityManagerInterface $em)
+    {
+        // check required parameters and api key
+        $required_params = [];
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res->getReturnResponse();
+
+        // customer
+        $cust = $this->session->getCustomer();
+        if ($cust == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('No customer information found');
+            return $res->getReturnResponse();
+        }
+
+        // vehicles
+        $cv_list = [];
+        $cvs = $cust->getVehicles();
+        foreach ($cvs as $cv)
+        {
+            $battery_id = null;
+            if ($cv->getCurrentBattery() != null)
+                $battery_id = $cv->getCurrentBattery()->getID();
+
+            $wty_ex = null;
+            if ($cv->getWarrantyExpiration() != null)
+                $wty_ex = $cv->getWarrantyExpiration()->format('Y-m-d');
+
+            $warranty = $this->findWarranty($cv->getPlateNumber());
+
+            $cv_name = '';
+            if ($cv->getName() != null)
+                $cv_name = $cv->getName();
+
+            $cv_list[] = [
+                'cv_id' => $cv->getID(),
+                'mfg_id' => $cv->getVehicle()->getManufacturer()->getID(),
+                'make_id' => $cv->getVehicle()->getID(),
+                'name' => $cv_name,
+                'plate_num' => $cv->getPlateNumber(),
+                'model_year' => $cv->getModelYear(),
+                'color' => $cv->getColor(),
+                'condition' => $cv->getStatusCondition(),
+                'fuel_type' => $cv->getFuelType(),
+                'wty_code' => $cv->getWarrantyCode(),
+                'wty_expire' => $wty_ex,
+                'curr_batt_id' => $battery_id,
+                'is_motolite' => $cv->hasMotoliteBattery() ? 1 : 0,
+                'is_active' => $cv->isActive() ? 1 : 0,
+                'warranty' => $warranty,
+            ];
+        }
+
+        // data
+        $data = [
+            'vehicles' => $cv_list
+        ];
+        $res->setData($data);
+
+        return $res->getReturnResponse();
+    }
+
+    protected function checkVehicleRequirements(Request $req, EntityManagerInterface $em)
+    {
+        // check required parameters and api key
+        $required_params = [
+            'make_id',
+            'name',
+            'plate_num',
+            'model_year',
+            'color',
+            'condition',
+            'fuel_type',
+        ];
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res;
+
+        // TODO: check valid plate number
+        // TODO: check valid fuel type (gas / diesel)
+        // TODO: check current battery id
+        // TODO: check condition (brand new / second-hand)
+        // TODO: check is_motolite and is_active (1 or 0)
+        // TODO: check warranty expiration date (YYYYMMDD)
+        // TODO: check model year coverage if it fits in between
+
+        return $res;
+    }
+
+
+    protected function setCustomerVehicleObject(Request $req, APIResult $res, 
+                                                CustomerVehicle $cv, EntityManagerInterface $em)
+    {
+        // check customer
+        $cust = $this->session->getCustomer();
+        if ($cust == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('No customer information found');
+            return $res;
+        }
+
+        // get vehicle
+        $vehicle = $em->getRepository(Vehicle::class)->find($req->request->get('make_id'));
+        if ($vehicle == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('Invalid vehicle make id');
+            return $res;
+        }
+
+        $cv->setCustomer($cust)
+            ->setVehicle($vehicle)
+            ->setName($req->request->get('name'))
+            ->setPlateNumber($req->request->get('plate_num'))
+            ->setModelYear($req->request->get('model_year'))
+            ->setColor($req->request->get('color'))
+            ->setFuelType($req->request->get('fuel_type'))
+            ->setStatusCondition($req->request->get('condition'));
+
+        // set warranty code and expiration
+        // TODO: check warranty requirements
+        if (!empty($req->request->get('wty_code')))
+            $cv->setWarrantyCode($req->request->get('wty_code'));
+        if (!empty($req->request->get('wty_expire')))
+            $cv->setWarrantyExpiration(new DateTime($req->request->get('wty_expire')));
+
+        // TODO: get current battery
+
+        // is motolite
+        if ($req->request->get('is_motolite') == 0)
+            $cv->setHasMotoliteBattery(false);
+        else
+            $cv->setHasMotoliteBattery(true);
+
+        // is active
+        if ($req->request->get('is_active') == 0)
+            $cv->setActive(false);
+        else
+            $cv->setActive(true);
+
+        // save
+        $em->persist($cv);
+        $em->flush();
+
+        // data
+        $data = [
+            'cv_id' => $cv->getID()
+        ];
+        $res->setData($data);
+
+        return $res;
+    }
+
+    // TODO: since we broke the functions into separate files, we need
+    // to figure out how to make this accessible to all ResqAPI controllers
+    protected function checkParamsAndKey(Request $req, $em, $params)
+    {
+        // TODO: depends on what we decide to return
+        // returns APIResult object
+        $res = new APIResult();
+
+        // check for api_key in query string
+        $api_key = $req->query->get('api_key');
+        if (empty($api_key))
+        {
+            $res->setError(true)
+                ->setErrorMessage('Missing API key');
+            return $res;
+        }
+
+        // check missing parameters
+        $missing = $this->checkMissingParameters($req, $params);
+        if (count($missing) > 0)
+        {
+            $miss_string = implode(', ', $missing);
+            $res->setError(true)
+                ->setErrorMessage('Missing parameter(s): ' . $miss_string);
+            return $res;
+        }
+
+        // check api key
+        $mobile_user = $this->checkAPIKey($em, $req->query->get('api_key'));
+        if ($mobile_user == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('Invalid API Key');
+            return $res;
+        }
+
+        // store session
+        $this->session = $sess;
+
+        return $res;
+    }
+
+    // TODO: this might not be needed if we use APIController's checkRequiredParameters
+    // or we put this into a service?
+    protected function checkMissingParameters(Request $req, $params = [])
+    {
+        $missing = [];
+
+        // check if parameters are there
+        foreach ($params as $param)
+        {
+            if ($req->getMethod() == 'GET')
+            {
+                $check = $req->query->get($param);
+                if (empty($check))
+                    $missing[] = $param;
+            }
+            else if ($req->getMethod() == 'POST')
+            {
+                $check = $req->request->get($param);
+                if (empty($check))
+                    $missing[] = $param;
+            }
+            else
+                return $params;
+        }
+
+        return $missing;
+    }
+
+    // TODO: type hint entity manager
+    // TODO: since we broke the functions into separate files, we need
+    // to figure out how to make this accessible to all ResqAPI controllers
+    protected function checkAPIKey($em, $api_key)
+    {
+        // find the api key (session id)
+        // TODO: user validation needs to be changed
+        $m_user = $em->getRepository(MobileUser::class)->find($api_key);
+        if ($m_user == null)
+            return null;
+
+        return $m_user;
+    }
+}
diff --git a/src/Controller/ResqAPI/VehicleController.php b/src/Controller/ResqAPI/VehicleController.php
new file mode 100644
index 00000000..bbb8f5d0
--- /dev/null
+++ b/src/Controller/ResqAPI/VehicleController.php
@@ -0,0 +1,190 @@
+<?php
+
+namespace App\Controller\ResqAPI;
+
+use Symfony\Bundle\FrameworkBundle\Controller\Controller;
+use Symfony\Component\HttpFoundation\Request;
+
+use Doctrine\ORM\Query;
+use Doctrine\ORM\EntityManagerInterface;
+
+use Catalyst\APIBundle\Controller\APIController;
+// TODO: what do we use for response? APIResponse or APIResult?
+// APIResult is what is used by APIController. APIResponse is what is used by CAPI
+use Catalyst\APIBundle\Response\APIResponse;
+use App\Ramcar\APIResult;
+
+use App\Entity\VehicleManufacturer;
+use App\Entity\Vehicle;
+
+use Catalyst\APIBundle\Access\Generator as ACLGenerator;
+
+class VehicleController extends APIController
+{
+    protected $acl_gen;
+
+    public function __construct(ACLGenerator $acl_gen)
+    {
+        $this->acl_gen = $acl_gen;
+    }
+
+    public function listVehicleManufacturers(Request $req, EntityManagerInterface $em)
+    {
+        // check required parameters and api key
+        $required_params = [];
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res->getReturnResponse();
+
+        // get manufacturer list
+        $mfgs = $em->getRepository(VehicleManufacturer::class)->findBy(['flag_mobile' => true], ['name' => 'asc']);
+        $mfg_list = [];
+        foreach ($mfgs as $mfg)
+        {
+            $mfg_list[] = [
+                'id' => $mfg->getID(),
+                'name' => $mfg->getName(),
+            ];
+        }
+
+        $data = [
+            'manufacturers' => $mfg_list
+        ];
+        $res->setData($data);
+
+        return $res->getReturnResponse();
+    }
+
+    public function listVehicleMakes(Request $req, $mfg_id, EntityManagerInterface $em)
+    {
+        // check required parameters and api key
+        $required_params = [];
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res->getReturnResponse();
+
+        // get manufacturer
+        $mfg = $em->getRepository(VehicleManufacturer::class)->find($mfg_id);
+        if ($mfg == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('Invalid vehicle manufacturer id');
+            return $res->getReturnResponse();
+        }
+
+        // get makes
+        $vehicles = $em->getRepository(Vehicle::class)->findBy(
+            [
+                'flag_mobile' => true,
+                'manufacturer' => $mfg_id,
+            ],
+            ['make' => 'asc']
+        );
+        // $vehicles = $mfg->getVehicles();
+        $vlist = [];
+        foreach ($vehicles as $v)
+        {
+            $vlist[] = [
+                'id' => $v->getID(),
+                'make' => trim($v->getMake() . ' ' . $v->getModelYearFormatted(false)),
+                // 'make' => $v->getMake() . ' ' . $v->getModelYearFrom() . '-' . $v->getModelYearTo(),
+            ];
+        }
+
+        $data = [
+            'manufacturer' => [
+                'id' => $mfg->getID(),
+                'name' => $mfg->getName(),
+            ],
+            'makes' => $vlist,
+        ];
+
+        $res->setData($data);
+
+        return $res->getReturnResponse();
+    }
+
+    // TODO: since we broke the functions into separate files, we need
+    // to figure out how to make this accessible to all ResqAPI controllers
+    protected function checkParamsAndKey(Request $req, $em, $params)
+    {
+        // TODO: depends on what we decide to return
+        // returns APIResult object
+        $res = new APIResult();
+
+        // check for api_key in query string
+        $api_key = $req->query->get('api_key');
+        if (empty($api_key))
+        {
+            $res->setError(true)
+                ->setErrorMessage('Missing API key');
+            return $res;
+        }
+
+        // check missing parameters
+        $missing = $this->checkMissingParameters($req, $params);
+        if (count($missing) > 0)
+        {
+            $miss_string = implode(', ', $missing);
+            $res->setError(true)
+                ->setErrorMessage('Missing parameter(s): ' . $miss_string);
+            return $res;
+        }
+
+        // check api key
+        $mobile_user = $this->checkAPIKey($em, $req->query->get('api_key'));
+        if ($mobile_user == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('Invalid API Key');
+            return $res;
+        }
+
+        // store session
+        $this->session = $sess;
+
+        return $res;
+    }
+
+    // TODO: this might not be needed if we use APIController's checkRequiredParameters
+    // or we put this into a service?
+    protected function checkMissingParameters(Request $req, $params = [])
+    {
+        $missing = [];
+
+        // check if parameters are there
+        foreach ($params as $param)
+        {
+            if ($req->getMethod() == 'GET')
+            {
+                $check = $req->query->get($param);
+                if (empty($check))
+                    $missing[] = $param;
+            }
+            else if ($req->getMethod() == 'POST')
+            {
+                $check = $req->request->get($param);
+                if (empty($check))
+                    $missing[] = $param;
+            }
+            else
+                return $params;
+        }
+
+        return $missing;
+    }
+
+    // TODO: type hint entity manager
+    // TODO: since we broke the functions into separate files, we need
+    // to figure out how to make this accessible to all ResqAPI controllers
+    protected function checkAPIKey($em, $api_key)
+    {
+        // find the api key (session id)
+        // TODO: user validation needs to be changed
+        $m_user = $em->getRepository(MobileUser::class)->find($api_key);
+        if ($m_user == null)
+            return null;
+
+        return $m_user;
+    }
+}