Helipaddy sites vs NHTSA

Helipaddy's Partner API returns nearby helicopter, EVTOL, and drone landing sites — hotels, aerodromes, pubs, and B&Bs with helipads — as JSON, gated to a per-partner category allow-list. A live GET and OPTIONS preflight against its real API host, helipaddy.com/wp-json/hp-partner/v1/sites, both echoed access-control-allow-origin back with the request Origin, resolving the stored "unknown" cors to "yes"; the GET returned a "hp_partner_api_invalid_key" 401 error, reconfirming auth "API Key" over HTTPS. Partner tokens are issued manually via WhatsApp/email under a negotiated agreement with no public self-serve tier — paid.

NHTSA's vPIC (vehicle Product Information Catalog) API decodes VINs and looks up makes, models, and manufacturer/WMI data straight from the US government's own vehicle registry, with no signup required. A fresh live fetch of the vPIC operation index in this run lists 24 `/api/vehicles/*` operations and confirms none of them is a recall lookup — that's a separate NHTSA product (nhtsa.gov/recalls), not part of this API, correcting a prior run's summary. A live GET and OPTIONS preflight against vpic.nhtsa.dot.gov/api/vehicles/getallmakes both returned access-control-allow-origin: *, reconfirming cors "yes"; auth "None" and https were reconfirmed on the same calls. Responses are available in both JSON and XML via a format query parameter (XML is the live-confirmed default) — free, unlimited US government open data.