Carfax and AutoCheck by API: how vehicle history report APIs work

Is there a Carfax API for developers

Not in the way there is a maps or a payments API. Carfax does provide integrations, but to businesses it has a contract with: dealer software, dealer websites, listing sites, lenders and insurers. Those integrations come with commercial terms, minimum volumes and rules on where the report may be shown. Experian works the same way with AutoCheck. At the time of writing, neither publishes a signup page where a developer gets a key and pays per call.

That gap is what report resellers fill. They hold the commercial relationship, and you get a simple HTTP endpoint: send a VIN, get a report. Prices, coverage and terms vary between resellers, so compare them on three points: whether there is a free record check before payment, what happens when a report comes back empty, and in which formats the report is delivered (HTML, PDF, raw data).

Carfax and AutoCheck: what they are

Carfax is the best known vehicle history report in the US and Canada. It compiles records about a VIN from state motor vehicle agencies, insurers, police reports, repair and service shops, dealers, auctions and other sources, and presents them as one report with a timeline. Consumers buy it before purchasing a used car; dealers often attach it to their listings.

AutoCheck is Experian's vehicle history report. It covers similar ground and adds the AutoCheck Score, which compares the vehicle with others of the same make, model and year. It is widely used in the dealer and auction trade. The two reports draw on overlapping but not identical sources, which is why the same VIN can show an accident in one and not the other.

Both rely partly on title data from US states. The federal title database, NMVTIS, is the official source for title brands, odometer readings at title events and total-loss reports from insurers; its consumer reports are sold by approved providers listed on the NMVTIS website↗.

What a vehicle history report contains

A report is a list of events that somebody reported. A clean report means nothing was reported, not that nothing happened. For a car that went through Copart or IAAI, you usually already know the important event: it was damaged and sold at a salvage auction. What the report adds is what came before (owners, mileage, earlier accidents, service) and the title brands across states. Our guide to salvage title brands explains the brands you will see.

How vehicle history report APIs work

Almost every report API follows the same two-step pattern, because a report costs money and a VIN without records produces an expensive empty page.

Two practical details matter more than they look. Report generation is slow compared with a normal API call, especially when a PDF is rendered, so use a long timeout and never fire the same request twice in parallel. And keep your own record of every report you bought: the second customer who asks about the same VIN next week should not cost you another report if your terms allow you to reuse it.

Designing the report feature

In an import business the report usually sits inside a larger flow: a customer sends a lot or a VIN, a manager decides whether the car is worth pursuing, and somewhere in between someone buys a report. A few design choices keep the cost predictable:

• Run the free check automatically for every VIN that enters your system, and show the record counts next to the lot. Managers then decide with the numbers in front of them.
• Make buying a report an explicit action with a confirmation, never a side effect of opening a page. A crawler or an impatient double click should not spend money.
• Store the report id, provider, VIN, date and links in your own table, and look there before you call the paid endpoint.
• Decide per provider. When one provider shows far more records than the other for a VIN, that one is usually the report worth buying first.
• Log who requested each report, so the monthly bill can be matched to customers or deals.

Coverage outside the US and Canada

Carfax and AutoCheck are built on North American records. For a car that spent its life in the US they are the reference; for a car first registered in Europe, Korea or the Gulf they have little or nothing to say. Korean cars, for example, have their own insurance and inspection history, which Korean marketplaces publish with the listing. Match the report to where the car actually lived.

Carfax and AutoCheck reports through our API

Our reports endpoints implement exactly this pattern for both providers, with one balance for billing. All requests are GET with the x-api-key header, under the same base URL as the auction data.

curl 'https://auctionsapi.com/api/reports/check-records/7FARW2H56JE022576' \  -H 'x-api-key: YOUR_API_KEY' \  -H 'accept: application/json'

{  "vin": "7FARW2H56JE022576",  "autocheck": 17,  "carfax": 13,  "vehicle": "HONDA CR-V EX 2018"}

The report request has three useful options. pdf=1 adds a PDF link and can take 40 to 60 seconds. days=N returns a report you already generated for that VIN in the last N days instead of generating a new one. exclude_base_64=1 drops the encrypted report body from the response when the links are all you need.

const BASE = 'https://auctionsapi.com/api'const headers = {  'x-api-key': process.env.AUCTIONS_API_KEY ?? 'YOUR_API_KEY',  accept: 'application/json'}const VIN = /^[A-HJ-NPR-Z0-9]{17}$/ async function getJson (path) {  const res = await fetch(BASE + path, { headers })  const body = await res.json().catch(() => null)  return { status: res.status, retryAfter: res.headers.get('retry-after'),    body }} // Free step first, billed step only when the records justify it.export async function carfaxIfWorthIt (rawVin, minRecords = 3) {  const vin = String(rawVin ?? '').trim().toUpperCase()  if (!VIN.test(vin)) throw new Error('A VIN has exactly 17 characters')   const check = await getJson(`/reports/check-records/${vin}`)  if (check.status !== 200) throw new Error(`check: HTTP ${check.status}`)  const records = Number(check.body?.carfax) || 0  if (records < minRecords) return { bought: false, records }   // Billed on success. days=30 reuses a report you generated recently.  const report = await getJson(    `/reports/carfax/${vin}?days=30&exclude_base_64=1`)  switch (report.status) {    case 200:      return { bought: true, records, id: report.body?.id,        html: report.body?.html, balanceAfter: report.body?.balance_after }    case 402: // insufficient funds: nothing was charged      return { bought: false, records, reason: 'top up the balance' }    case 409: // the same report is still being generated      return { bought: false, records, retryAfter: report.retryAfter }    default:  // 400 "records not found for this vin number" is not billed      throw new Error(`report: HTTP ${report.status}`)  }}

Errors that cost nothing

• 400 records not found for this vin number: the provider has no history for the VIN. Nothing is charged.
• 400 length of vin number should be 17 characters: fix the input.
• 402 insufficient funds: the balance is too low for a report. Nothing is charged.
• 409 generation already in progress: the same report is still being built. Wait for the Retry-After header (180 seconds) and ask again, instead of sending a second request.

The full reference, with every field and a free tester, is on the Carfax and AutoCheck reports page of the documentation.

Reselling and showing reports: read the terms

This is where report projects get into trouble, and it is not a technical problem. Report providers set rules on who may see a report and how it may be shared. Typical restrictions forbid publishing full reports on public pages, building your own database out of report contents, or reselling reports outside an agreement. Resellers pass those rules on to their customers in their own terms.

We are not lawyers and the rules differ by provider, by agreement and by country, so treat this as a list of questions to ask, not as advice:

• May you give the report to your customer as a file or a link, and may you charge for it?
• May you show parts of it (for example, the number of owners) on a public page?
• May you store the report, and for how long?
• Does the report carry the provider's branding, and are you allowed to remove or keep it?
• Which privacy rules apply to personal data that could appear in a report in your market?

An import business that buys a report for a specific customer and sends it to that customer is the common, simple case. A public website that shows Carfax data on every VIN page is a different case and needs explicit permission.

Vehicle history report or auction history by VIN

For a car bought at Copart or IAAI, a history report answers "what happened to this car before it was damaged". The auction record answers "what did the car look like and what did it sell for, each time it went through an auction". Importers usually need both.

Auction records come from a different place than history reports: the auctions' own listings, collected and kept after the sale. That is what our Pay per VIN service sells one VIN at a time: /local-exists/{vin} checks for free whether we have the vehicle, and /local-report/{vin} returns the full record with every lot and is charged as one report from the same balance. Nothing is charged when there is no record. Auction history by VIN covers how to read such a record.

How to start

Decide first how you will use reports: for your own buying decisions, sent to customers, or shown on a site, and check the terms for that use. Then build the free check into your flow, add a threshold rule, and store every report id you receive. With the test VIN you can build and test the whole loop without spending anything. If your customers buy at Copart and IAAI, add the auction record next to the report: the Pay per VIN reference lists free test VINs for that part as well, so both halves can be built before the first paid request.