NHTSA vs Smartcar

NHTSA's vPIC (vehicle Product Information Catalog) API decodes VINs and looks up makes, models, and manufacturer/WMI data straight from the US government's own vehicle registry, with no signup required. A fresh live fetch of the vPIC operation index in this run lists 24 `/api/vehicles/*` operations and confirms none of them is a recall lookup — that's a separate NHTSA product (nhtsa.gov/recalls), not part of this API, correcting a prior run's summary. A live GET and OPTIONS preflight against vpic.nhtsa.dot.gov/api/vehicles/getallmakes both returned access-control-allow-origin: *, reconfirming cors "yes"; auth "None" and https were reconfirmed on the same calls. Responses are available in both JSON and XML via a format query parameter (XML is the live-confirmed default) — free, unlimited US government open data.

Smartcar's Vehicle API lets apps lock/unlock vehicles and read odometer, location, and other telematics data from most late-model cars through a single OAuth2 integration across dozens of automaker backends. A live unauthenticated GET and OPTIONS preflight against api.smartcar.com/v2.0/vehicles both returned no Access-Control-Allow-Origin header — resolving the stored "yes" cors to "no", consistent with Smartcar's own docs, which say API calls must be made from a backend, never a browser; auth "OAuth" and https were reconfirmed via a 401 AUTHENTICATION error. Its pricing page offers a Free plan (1 connected vehicle, no credit card) alongside paid Growth/Enterprise tiers — freemium.