Vehicle — entry 007 of 10
NHTSA
NHTSA's vPIC (vehicle Product Information Catalog) API decodes VINs and looks up makes, models, and manufacturer/WMI data straight from the US government's own vehicle registry, with no signup required. A fresh live fetch of the vPIC operation index in this run lists 24 `/api/vehicles/*` operations and confirms none of them is a recall lookup — that's a separate NHTSA product (nhtsa.gov/recalls), not part of this API, correcting a prior run's summary. A live GET and OPTIONS preflight against vpic.nhtsa.dot.gov/api/vehicles/getallmakes both returned access-control-allow-origin: *, reconfirming cors "yes"; auth "None" and https were reconfirmed on the same calls. Responses are available in both JSON and XML via a format query parameter (XML is the live-confirmed default) — free, unlimited US government open data.
NHTSA's vPIC (vehicle Product Information Catalog) exposes 24 keyless `/api/vehicles/*` operations for decoding VINs and looking up makes, models, and manufacturer data straight from the US government's own vehicle registry. A live GET to `DecodeVinValues` for a partial VIN returned a full 200 JSON decode in this run, and `access-control-allow-origin: *` was present whenever the request carried an `Origin` header — normal CORS behavior for a browser client, confirmed live rather than assumed.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/nhtsa/"><img src="https://greatapis.com/badge/nhtsa.svg" alt="Scored 80 on greatapis.com"></a>Auth quickstart
- No API key or signup required — every operation is keyless. The only thing to get right is the `format` query parameter: it isn't required, but a request that omits it gets XML back, not JSON (confirmed live in this run).
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Decode a (partial) VIN to JSON
GEThttps://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/5UXWX7C5*BA?format=json
{"Count":1,"Message":"Results returned successfully. NOTE: Any missing decoded values should be interpreted as NHTSA does not have data on the specific variable. Missing value should NOT be interpreted as an indication that a feature or technology is unavailable for a vehicle.","SearchCriteria":"VIN(s): 5UXWX7C5*BA","Results":[{"Make":"BMW","Model":"X3","ModelYear":"2011","Trim":"xDrive35i","BodyClass":"Sport Utility Vehicle [SUV]/Multipurpose Vehicle [MPV]","EngineCylinders":"6","EngineHP":"300","DisplacementL":"3.0","DriveType":"AWD/All-Wheel Drive","ErrorCode":"6","ErrorText":"6 - Incomplete VIN","VehicleType":"MULTIPURPOSE PASSENGER VEHICLE (MPV)"}]}Trimmed to 12 fields for readability from a live 200 response carrying 154 decoded fields, 116 of them empty strings for this vehicle; the full field list is unabridged in the actual API response.
Developer reference
https://vpic.nhtsa.dot.gov/apiGotchas & limits
- Dropping `format=json` doesn't error — a live GET to the same `DecodeVinValues` path with no `format` param returned HTTP 200 `content-type: application/xml` with an equivalent `<Response>...</Response>` XML document instead of JSON. XML is the default, not JSON.
- A partial VIN with a wildcard (`5UXWX7C5*BA`, an 11-character prefix) still decodes successfully rather than erroring — the response's own `"ErrorCode":"6","ErrorText":"6 - Incomplete VIN"` fields flag the partial match inline in a 200 response, so a caller checking only the HTTP status won't catch it.
- `/api/vehicles/getallmakes?format=json` is a real live example of the unpaginated bulk endpoints being large: this run's GET returned `"Count":12306` in a ~610 KB body — fine for a one-off pull, but not something to poll on every request; `DecodeVinValues` is the better worked example for that reason.
- The stored catalog summary for this API previously said vPIC "looks up... manufacturer recalls," but a live fetch of the vPIC operation index (vpic.nhtsa.dot.gov/api/) lists 24 `/api/vehicles/*` operations and none of them decodes or looks up recalls — the page's own "Recalls" nav link points to a completely separate site, nhtsa.gov/recalls, not a vPIC endpoint. Recall data isn't available from this API at all.
- `access-control-allow-origin: *` is only present on responses to requests that actually carry an `Origin` header (confirmed live with and without one) — normal for cross-origin browser calls, since every browser-issued cross-origin request always sends `Origin`, but worth knowing if you're diffing raw curl output without one.