VIN Lookup API: The Free Option and the Production One
Short version: VIN decoding is free. The U.S. government publishes every vehicle's build data through NHTSA's vPIC API — no key, no signup, and it's the source every commercial decoder reads from. The code below calls it directly. Paid VIN APIs earn their money on what free decoding doesn't cover: recalls in the same response, original window stickers and factory options, full spec sheets, market values, and a production lane with real rate limits and support.
By the CarWhere Engineering team · Updated October 2026
Decode a VIN for free: NHTSA vPIC, three ways
One GET request, no auth. The example VIN is a real 2026 GMC Sierra Denali, and the commented output is the actual vPIC response:
cURL
curl "https://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/1GTPHGE80TZ138393?format=json" # Returns (key fields from the real response): # ModelYear: 2026 Make: GMC Model: Sierra Trim: Denali # DisplacementL: 3.0 EngineCylinders: 6 FuelType: Diesel DriveType: 4x2 # BodyClass: Pickup Plant: FORT WAYNE, INDIANA # GVWR: Class 2E: 6,001 - 7,000 lb
Python
import requests
vin = "1GTPHGE80TZ138393"
r = requests.get(f"https://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/{vin}",
params={"format": "json"})
spec = r.json()["Results"][0]
print(spec["ModelYear"], spec["Make"], spec["Model"], spec["Trim"])
# 2026 GMC Sierra DenaliJavaScript
const vin = "1GTPHGE80TZ138393";
const res = await fetch(
`https://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/${vin}?format=json`
);
const spec = (await res.json()).Results[0];
console.log(spec.ModelYear, spec.Make, spec.Model, spec.Trim);
// 2026 GMC Sierra DenaliGotchas worth knowing before you build: vPIC signals failure through an in-band ErrorCode field (HTTP 200 either way), leaves fields blank where the manufacturer didn't file data, and keeps recalls on a separate API entirely. The full tutorial with batch decoding and the error-code table is in our NHTSA vPIC API guide.
What no VIN decode returns — and where that data lives
| You want | A decode gives you | The actual source |
|---|---|---|
| Factory options & original MSRP | Trim level only | The original window sticker (Monroney) — fetchable and parseable by VIN for 12 brands |
| Open safety recalls | Nothing (separate NHTSA API) | NHTSA recalls API, queried by year/make/model — or bundled into the decode response on production APIs |
| Current market value | Nothing | Live listing data — medians by model year |
| Accident / title history | Nothing | Commercial databases (NMVTIS, insurers) — paid per lookup everywhere, no exceptions |
When you outgrow free: one key, six endpoints
CarWhere's production API keeps the honest architecture — NHTSA stays the decode source of truth — and adds what vPIC can't: recalls in the same response, original window-sticker PDFs, sticker parsing to structured JSON (MSRP, destination, every option with its price), per-configuration specs back to 1984, recall feeds by brand, and used-market values. Flat $49/month for 1,000 calls, 7-day free trial, key emailed at checkout.
curl -H "x-api-key: YOUR_KEY" \ "https://www.carwhere.com/api/dealer/v1/decode?vin=1GTPHGE80TZ138393" # One response: the full NHTSA decode PLUS the vehicle's open recall campaigns
FAQ
Is there a free VIN lookup API?
Yes — the U.S. government's NHTSA vPIC API (vpic.nhtsa.dot.gov/api) is completely free, needs no key, and is the primary source every commercial VIN decoder is built on. If a vendor charges for a basic decode with nothing added, they are reselling free public data.
What does a VIN API return?
The build identity encoded in the 17 characters plus NHTSA's registration data: model year, make, model, trim, engine displacement and cylinders, fuel type, transmission, drive type, body class, GVWR class, restraint systems, and the assembly plant. What it does NOT return: factory options, original MSRP, vehicle history, or current value — those come from other sources (the window sticker, market listings, and commercial history databases respectively).
What are vPIC's limits for production use?
vPIC publishes no hard rate limit, but it is a government service with no SLA: latency is variable, it has scheduled maintenance windows, errors are returned as in-band ErrorCode fields rather than HTTP statuses, recalls live on a completely separate API, and field coverage varies by manufacturer (some leave transmission or HP blank). Fine for a hobby project; the reason paid VIN APIs exist is packaging, reliability, and the adjacent data.
What does a production VIN API add over free NHTSA?
Depends on the vendor — evaluate what is bundled. CarWhere's $49/month key pairs the decode with the VIN's open recall campaigns in one response, and the same key covers original window-sticker PDFs (12 brands), sticker parsing to structured JSON, full specs for every US model year since 1984, per-brand recall feeds, and used-market values by model year. 1,000 calls/month with a 7-day free trial.
Can an API return vehicle history (accidents, title brands) by VIN?
Not from NHTSA, and not for free from anyone. Accident and title records live in commercial databases (NMVTIS-sourced and insurer data) that charge per lookup. Any "free VIN history API" is marketing — check what database it actually reads before building on it.
Can I look up a VIN from a license plate via API?
Plate-to-VIN requires state DMV data, which is access-restricted under the DPPA; the APIs that offer it are paid and require a permissible-use attestation. Decode-from-VIN has no such restriction because the VIN encodes only build data.