Anatomy of the VIN under ISO 3779
The Vehicle Identification Number (VIN) is a unique 17-character alphanumeric identifier defined by ISO 3779. Each position has a meaning and is used with two algorithms: the check digit (position 9 in the US and Canada) and the modular calculation over the standard's weights.
The first three positions form the World Manufacturer Identifier (WMI) and tell you who built the vehicle and where. Positions 4 to 9 form the Vehicle Descriptor Section (VDS) and describe the platform: body type, engine, transmission, brake system and model attributes. Positions 10 to 17 form the Vehicle Identifier Section (VIS) and include model year, assembly plant and serial number.
For a sales department, reading the WMI and model year is usually enough. For a parts department, what decides the correct part lives inside the VDS. And decoders that only process the first 5 characters of the VDS leave out — precisely — the character that differentiates trims and options that change the part.
NHTSA vPIC: the free API everyone uses first
vPIC (Vehicle Product Information Catalog) is the public API of the US National Highway Traffic Safety Administration. It's free, requires no authentication and returns responses in JSON, XML or CSV. The main call is DecodeVin/{vin}?format=json and, depending on the vehicle, returns between 80 and 140 attributes.
What vPIC does well: it covers virtually every vehicle sold in the US since 1981, returning make, model, year, body type, displacement, cylinder count, engine configuration, manufacturing plant and safety data such as belt restraints and airbags.
What vPIC does NOT do: it does not return the OEM part number for any component. It has no parts catalog. It does not know supersessions (when the manufacturer replaces one part number with another). It does not cover the LatAm market at the same level of detail (Mexican, Brazilian or Argentine VINs not homologated for the US return partial responses).
- Main endpoint: vpic.nhtsa.dot.gov/api/vehicles/DecodeVin/{vin}?format=json
- No authentication, no documented hard quotas (reasonable use).
- Covers US fleets 1981+; uneven coverage outside the US.
- No part numbers, no supersessions, no stock — vehicle data, not parts data.
Commercial APIs: when you need the parts catalog
Commercial APIs (DataOne, vinAudit, Carfax, Polk, plus the proprietary APIs from Toyota Tech Stream, Ford OASIS, Mopar EPC, etc.) cover what vPIC does not: cross-referencing the VIN against the manufacturer's electronic parts catalog (EPC).
An official EPC responds, given a VIN, with the list of current part numbers for each assembly of the vehicle. The difference vs a generic decoder is that the EPC already applies supersessions (SSPL): if Toyota replaced brake pad 04465-02220 with 04465-02230 in September 2023, an EPC query on January 4, 2026 returns the new one, not the discontinued one.
Pricing changes the model: NHTSA is 0 USD per query. A LatAm-coverage commercial API costs between 0.05 and 0.40 USD per query depending on the plan, and the official OEM EPCs require an authorized dealer account. That's why a well-designed agent typically chains a free vPIC call first to validate the VIN, and only then pays for the expensive call to the right manufacturer's EPC.
When to use each type of API
If your product is insurance, used-car valuation or theft verification, vPIC is enough. Vehicle information is what matters.
If your product involves quoting, selling, shipping or installing a part, vPIC is not enough. You need the EPC layer because the customer doesn't want to know which engine their 2018 Toyota Hilux has — they want to know the exact part number for the front brake pad and whether it's in stock today.
If you sell to dealers and distributors in LatAm, on top of the EPC you need an API that understands VINs from Mexican, Brazilian and Argentine plants with local homologations that don't appear in vPIC. And you need to connect everything to your ERP/DMS to answer with real stock, not theoretical catalog.
The AI agent as a layer over the API
An API is just the engine. What the end customer sees is the conversation. AutoParts AI Agent wraps that chain of APIs (NHTSA vPIC + official OEM EPC + SSPL table + your own ERP) inside a single WhatsApp conversation where the customer pastes the VIN and, in under two minutes, gets the exact part number, price from your ERP, stock availability, and a button to confirm the order.
The agent automatically decides which APIs to call based on the WMI brand, what to do when the VIN returns a supersession, and when to escalate to a human (for example, when the customer asks about a component that requires visual validation, or when the VIN is not homologated in any available catalog).
This turns a 4-to-6 API technical integration into a simple customer experience: send VIN, get quote, confirm order. No forms, no app, no waiting until Monday.