CarVector vs NHTSA

CarVector decodes VINs and license plates into specs, images, recall notices, and OBD-II DTC codes for vehicles spanning model years 1925 to 2029. A live unauthenticated GET against its real API host, api.carvector.io/v1/vehicles/{id}, returned a 401 "missing_api_key" JSON error over HTTPS — reconfirming auth "API Key" and https true — with no Access-Control-Allow-Origin header on either that request or a follow-up OPTIONS preflight, resolving the stored "yes" cors to "no". Its pricing page lists a $0 Free tier alongside paid $39/mo and $79/mo plans plus a custom Enterprise tier — freemium.

NHTSA's vPIC (vehicle Product Information Catalog) API decodes VINs and looks up makes, models, and manufacturer/WMI data straight from the US government's own vehicle registry, with no signup required. A fresh live fetch of the vPIC operation index in this run lists 24 `/api/vehicles/*` operations and confirms none of them is a recall lookup — that's a separate NHTSA product (nhtsa.gov/recalls), not part of this API, correcting a prior run's summary. A live GET and OPTIONS preflight against vpic.nhtsa.dot.gov/api/vehicles/getallmakes both returned access-control-allow-origin: *, reconfirming cors "yes"; auth "None" and https were reconfirmed on the same calls. Responses are available in both JSON and XML via a format query parameter (XML is the live-confirmed default) — free, unlimited US government open data.