Helipaddy sites vs Smartcar

Helipaddy's Partner API returns nearby helicopter, EVTOL, and drone landing sites — hotels, aerodromes, pubs, and B&Bs with helipads — as JSON, gated to a per-partner category allow-list. A live GET and OPTIONS preflight against its real API host, helipaddy.com/wp-json/hp-partner/v1/sites, both echoed access-control-allow-origin back with the request Origin, resolving the stored "unknown" cors to "yes"; the GET returned a "hp_partner_api_invalid_key" 401 error, reconfirming auth "API Key" over HTTPS. Partner tokens are issued manually via WhatsApp/email under a negotiated agreement with no public self-serve tier — paid.

Smartcar's Vehicle API lets apps lock/unlock vehicles and read odometer, location, and other telematics data from most late-model cars through a single OAuth2 integration across dozens of automaker backends. A live unauthenticated GET and OPTIONS preflight against api.smartcar.com/v2.0/vehicles both returned no Access-Control-Allow-Origin header — resolving the stored "yes" cors to "no", consistent with Smartcar's own docs, which say API calls must be made from a backend, never a browser; auth "OAuth" and https were reconfirmed via a 401 AUTHENTICATION error. Its pricing page offers a Free plan (1 connected vehicle, no credit card) alongside paid Growth/Enterprise tiers — freemium.