Vehicle Recall API: Free NHTSA Endpoints + the Gotchas
Recall data is free and public — NHTSA's recalls API covers every brand sold in the US, keyless. Two things trip up every integration: the model-name-variant gotcha that silently returns 0 campaigns for vehicles that have them, and the difference between campaigns (public, queryable) and per-VIN repair status (dealer service records — not an open API for any provider). Both explained below with real responses.
By the CarWhere Engineering team · Updated October 2026 · Example responses re-verified against the live NHTSA API
Query recalls free: NHTSA
curl "https://api.nhtsa.gov/recalls/recallsByVehicle?make=honda&model=pilot&modelYear=2023" # Real response: "Count": 5. First campaign: # "NHTSACampaignNumber": "23V735000", # "Component": "STEERING:RACK AND PINION:RACK", # "Summary": "Honda (American Honda Motor Co.) is recalling certain # 2023-2024 Pilot vehicles..."
# All vehicles covered by one campaign number: curl "https://api.nhtsa.gov/recalls/campaignNumber?campaignNumber=23V735000"
Note it's keyed by make/model/year strings, not VIN — recalls-by-VIN means decoding the VIN first (free via vPIC — see the vPIC tutorial), then normalizing the decoded model name to the strings campaigns are filed under. That normalization is where integrations silently break.
The false-negative gotcha
Campaigns are filed against manufacturer model strings, which sometimes split by body style, cab configuration, or variant. Query the plain model name and the API happily returns a shorter list — or zero — for a vehicle with open campaigns. There is no error, no warning; the results just look clean. Production integrations must enumerate a make/year's model-name variants and union the campaigns by NHTSACampaignNumber. We hit this in production building CarWhere's recall pages; the union step is not optional.
The production shapes
Two patterns cover most products: recalls per vehicle (bundle them into the decode — one call) and recalls per brand (a newest-first campaign feed for monitoring/alerts, with the do-not-drive and park-outside severity flags surfaced). Both are on the CarWhere key, with the variant-union handling built in:
# Production shapes on the CarWhere key: # 1. Recalls bundled into the VIN decode — one call per vehicle curl -H "x-api-key: YOUR_KEY" \ "https://www.carwhere.com/api/dealer/v1/decode?vin=1GTPHGE80TZ138393" # 2. Current campaigns across a whole brand, newest first, with # do-not-drive / park-outside flags — for monitoring and alerts curl -H "x-api-key: YOUR_KEY" \ "https://www.carwhere.com/api/dealer/v1/recalls?make=Honda"
FAQ
Is there a free recall API?
Yes — NHTSA's recalls API (api.nhtsa.gov/recalls) is free and keyless: query by make + model + model year, get every campaign with its NHTSA campaign number, component, summary, consequence, and remedy. It covers every brand sold in the US.
Can an API tell me if a specific VIN has an open, unrepaired recall?
Mostly no — and it's worth being precise. Public APIs return the campaigns applicable to that vehicle's year/make/model. Whether an individual car already had the recall work done lives in dealer service records; NHTSA's own VIN-lookup web tool shows incomplete-repair status for many brands, but it is not an open API, and manufacturers gate their own VIN-status endpoints. Any API claiming per-VIN repair status for all brands is overstating what's public.
Why does the NHTSA recalls API return 0 results for a car that has recalls?
The model-name-variant gotcha: campaigns are filed against specific model strings, which sometimes split by body style or variant. Query the plain model name and you can miss campaigns filed under the variants. Production code enumerates the model-name variants for a make/year and unions the campaigns by NHTSA campaign number — this is the single biggest source of silent false-negatives in recall integrations.
What is a "do-not-drive" or "park-outside" recall flag?
NHTSA marks the most severe campaigns with advisories: do-not-drive (stop driving immediately) and park-outside (fire risk — don't park in a garage). If you surface recalls to users, these two flags are the ones worth promoting to the top; CarWhere's per-brand feed includes both.
How fresh is recall data?
NHTSA publishes campaigns as manufacturers file them, typically within days of a recall announcement. If you're building alerts, poll a per-brand feed (newest-first) rather than re-querying every vehicle — one brand-level call catches new campaigns across every model.