Mercedes-Benz vs NHTSA

Mercedes-Benz's connected-vehicle API platform exposes telematics data, remote vehicle commands, a car configurator, and dealer-locator lookups behind an OAuth2 client-credentials/authorization-code flow — its own docs describe exchanging a Base64-encoded Client ID/Secret for a bearer token, correcting the stored auth from "API Key" to "OAuth". A live unauthenticated GET against the real api.mercedes-benz.com gateway returned no Access-Control-Allow-Origin header on any endpoint tested, reconfirming cors "no" — consistent with Mercedes-Benz's own documentation that the API doesn't support direct browser calls; https was reconfirmed. The platform offers a free sandbox/BYOCAR tier for testing against simulated and real vehicles, plus paid production tiers per API product — freemium.

NHTSA's vPIC (vehicle Product Information Catalog) API decodes VINs and looks up makes, models, and manufacturer/WMI data straight from the US government's own vehicle registry, with no signup required. A fresh live fetch of the vPIC operation index in this run lists 24 `/api/vehicles/*` operations and confirms none of them is a recall lookup — that's a separate NHTSA product (nhtsa.gov/recalls), not part of this API, correcting a prior run's summary. A live GET and OPTIONS preflight against vpic.nhtsa.dot.gov/api/vehicles/getallmakes both returned access-control-allow-origin: *, reconfirming cors "yes"; auth "None" and https were reconfirmed on the same calls. Responses are available in both JSON and XML via a format query parameter (XML is the live-confirmed default) — free, unlimited US government open data.