⚡ Developer REST API ● Cloudflare Global Edge

Automotive Intelligence & VIN REST API

High-performance automotive data APIs running on Cloudflare Global Edge. Integrate ISO 3779 VIN decoding, official NHTSA safety recalls, and OBD-II trouble diagnostics directly into your dealership SaaS, marketplace, or mobile apps.

Explore Endpoints ↓ 📄 OpenAPI 3.1 Spec (JSON) ↗

Global Rate Limit

10,000 req/day

Free tier • No API key required

Edge Infrastructure

Edge V8

Distributed across 330+ locations

Official Government Sources

NHTSA • VPIC

ISO 3779 / 3780 Modulus-11

Core REST API Endpoints

GET /api/v1/decode-vin

NHTSA + Modulus 11 Check Digit

Decodes any 17-character VIN into authentic OEM specifications including Make, Model, Year, Body Style, Engine Cylinders, Displacement, Fuel Type, Plant Country, and AI-synthesized inspection brief.

Parameters

vin *string (required) — 17-digit alphanumeric VIN (e.g. 5YJ3E1EB8NF123456)

cURL JavaScript / TypeScript Python PHP

curl -X GET "https://carchecktools.com/api/v1/decode-vin?vin=5YJ3E1EB8NF123456"

GET /api/v1/recalls

NHTSA Safety Recalls DB

Retrieves active government safety recall campaigns, federal defect investigations, safety risk summaries, and free dealer remedy mandates by vehicle make, model, and year.

Parameters

make *string (required) — Vehicle Manufacturer (e.g. tesla, ford, toyota)

model string (optional) — Vehicle Model (e.g. model-3, f-150, camry)

year number (optional) — 4-digit Model Year (e.g. 2024)

curl -X GET "https://carchecktools.com/api/v1/recalls?make=tesla&model=model-3&year=2024"

GET /api/v1/obd2

SAE J2012 Diagnostic DTC Database

Lookup standard SAE OBD-II diagnostic trouble codes (DTCs), symptoms, common mechanical causes, DIY fix guide, and estimated repair cost breakdown.

Parameters

code *string (required) — Standard 5-character OBD-II DTC code (e.g. P0300, P0420, P0171)

curl -X GET "https://carchecktools.com/api/v1/obd2?code=P0300"

🛡️ Enterprise Integration & CORS

All API endpoints include permissive Cross-Origin Resource Sharing (CORS) headers (Access-Control-Allow-Origin: *), making them directly callable from client-side JavaScript, single-page applications (React, Vue, Svelte), iOS/Android native apps, and server-side runtimes (Node.js, Python, Go, PHP).

Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=86400
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload