Issue Nº 33 — Sep 14, 2026
A wrong VIN still gets a 200, and a wrong path names NHTSA's own backend
Issue thirty-three covers NHTSA's vPIC, the US government's keyless vehicle-data API. This session queried it live. Leaving out the format parameter switches the whole response to XML. Feeding it a broken VIN returns success at the top level, with the real complaint buried inside the result row. A path that does not exist returns a 404 that names the internal host running behind the public one.
XML is the default, not an equal option
GET /api/vehicles/GetAllMakes with no format parameter, queried live this session, returned 1,221,093 bytes of application/xml listing 12,361 makes. Adding ?format=json to the same call returned the same Count of 12,361, in a JSON body that reads as one array of {Make_ID, Make_Name} pairs instead of a nested XML tree.
A live GET with an Origin header set against the same endpoint returned access-control-allow-origin: *. Auth, HTTPS, and cross-origin access all stay the same in either format. The query parameter is the only thing that changes.
The catalogue entry already notes XML as the confirmed default. This session's fetch reconfirms it and measures the cost: 612,133 bytes of JSON against 1,221,093 bytes of XML for the same 12,361 rows. A caller who forgets the query parameter moves about twice the payload.
A malformed VIN returns success, not an error
GET /api/vehicles/DecodeVinValues/NOTAVIN?format=json, queried live this session, returned 200 with a top-level Message reading "Results returned successfully. NOTE: Any missing decoded values should be interpreted as NHTSA does not have data on the specific variable...". Read on its own, that line says the call worked.
The actual complaint sits one level down, inside the single row in Results. That row carried ErrorCode "6,7,11,400" and AdditionalErrorText "Invalid character(s): 2:O, 6:I.", flagging the letters O and I at VIN positions 2 and 6, both barred from real VINs because they are too easy to confuse with 0 and 1.
A caller who checks only the HTTP status and the top-level Message field sees a clean success. Finding out the VIN was garbage means reading ErrorCode or AdditionalErrorText inside each result row, a field a quick integration is likely to skip.
An unknown path answers with NHTSA's backend hostname
GET /api/vehicles/NoSuchOperation?format=json, queried live this session, returned 404 with a JSON body: "No HTTP resource was found that matches the request URI 'https://backend-vpic-api.nhtsa.dot.gov/api/vehicles/NoSuchOperation?format=json'."
The public host for every other call in this issue is vpic.nhtsa.dot.gov. The 404 body names a different host, backend-vpic-api.nhtsa.dot.gov, the internal service that actually handles requests behind the public one.
vPIC needs no key and returns only public vehicle data, so this costs nothing here. It is still a reminder that a generic routing error can leak infrastructure detail, in this case an internal hostname, that a provider might otherwise keep off a public error page.