NHTSA Vehicle Recalls, Complaints & Safety Ratings API

For dealers, used-car marketplaces, fleet and safety teams, insurers and automotive researchers: safety recalls, consumer complaints and NCAP crash-test star ratings for any US-market vehicle, taken from NHTSA's own public API. Give it a list of vehicles and get flat rows back.

Measured against the live API on 2026-09-10, not read from documentation. NHTSA lists 332 makes for model year 2020, 244 for 2024 and 154 for 2026, and one make can have dozens of models in a single year. A 2021 Ford F-150 returned 29 recalls; a 2021 Honda Accord returned 226 complaints. There is no pagination — one request returns the whole result.

NHTSA's two date formats disagree with each other, and this Actor proved which is which. Recalls use DD/MM/YYYY (30 of 39 values had a first part above 12; none had a second part above 12); complaints use MM/DD/YYYY (1,038 of 1,834 values had a second part above 12; none had a first part above 12). Both are converted to ISO (2021-12-16) and the original string is kept, so nothing rests on a guess.

A vehicle NHTSA does not know answers HTTP 400 with a body that says "success" — and /SafetyRatings/ answers HTTP 200 with Count: 0 both for a car it has not tested and for a make that does not exist. Neither is passed to you as "no records": a rejected input gets a row saying the input was rejected, and a genuine empty result gets a different one. Spelling matters too, and there is no one spelling that works on all three endpoints — for the 2021 Ford, F-150 returned 29 recalls and nothing else, while F-150 SUPER CREW returned 1,000 complaints and 2 ratings; this Actor asks each endpoint the way that endpoint wants.

Crash and fire flags are rare, which is why filtering on them is worth it — measured across 4,793 complaints on five vehicles. VINs come back as the 11 characters NHTSA actually publishes (measured: 221 of 221 complaints), not padded out to a fake 17.

No API key, no scraping, no proxy. Export as JSON, CSV or Excel.

Give it a list of vehicles:

{
  "vehicles": [
    { "make": "Toyota", "model": "Camry",  "modelYear": 2022 },
    { "make": "Honda",  "model": "Accord", "modelYear": 2021 }
  ],
  "datasets": ["recalls", "complaints"]
}

What this fixes about the raw API

Everything below was measured against the live API on 2026-09-10, not read from documentation.

1. The two endpoints use opposite date formats

NHTSA returns recall dates as DD/MM/YYYY and complaint dates as MM/DD/YYYY. Reading both the same way puts a record up to eleven months away from where it belongs.

Endpoint	Field	Format	How it was established
Recalls	ReportReceivedDate	DD/MM/YYYY	30 of 39 values had a first part above 12; none had a second part above 12
Complaints	dateOfIncident, dateComplaintFiled	MM/DD/YYYY	1,038 of 1,834 values had a second part above 12; none had a first part above 12

Both are converted to ISO (2021-12-16) and the original string is kept in reportReceivedDateRaw and dateOfIncidentRaw, so you can check the conversion yourself.

2. A vehicle NHTSA does not know answers HTTP 400 - with a body that says "success"

The rejection looks like this:

HTTP 400
{"Count":0,"Message":"Results returned successfully","results":[]}

Read the body alone and you conclude the car has no recalls. This Actor reads the status first and returns a row that says the input was rejected, never "no records". A genuine empty result (HTTP 200, zero rows) gets a different row that does say so. Neither row is charged.

3. Complaint VINs are truncated, and the column name says so

NHTSA publishes 11 characters, not the full 17 (measured: 221 of 221 complaints). The last characters, which identify the individual vehicle, are not there. The column is called vinPrefix rather than vin so it is not mistaken for a full VIN.

4. Star ratings distinguish "not rated" from zero

OverallRating comes back as the string "Not Rated" for body styles NHTSA has not crash-tested. That becomes null, never 0, and the original string is kept in overallRatingRaw.

What you get

One row per record. recordType says which kind it is.

Recalls: campaignNumber, manufacturer, component, reportReceivedDate, summary, consequence, remedy, notes, and NHTSA's three warning flags parkItAway, parkOutside, fixedByOverTheAirUpdate.

Complaints: odiNumber, components, crash, fire, numberOfInjuries, numberOfDeaths, dateOfIncident, dateComplaintFiled, vinPrefix, summary.

Safety ratings: overallRating, overallFrontCrashRating, overallSideCrashRating, rolloverRating, complaintsCount, recallsCount, investigationCount, vehicleDescription.

5. The three endpoints do not share a model vocabulary

Recalls, complaints and crash-test ratings each keep their own list of model names, and for some vehicles there is no spelling that works on all three. Measured for the 2021 Ford:

model	recalls	complaints	NCAP ratings
F-150	29	0	0
F-150 SUPER CREW	0	1,000	2

Plain model names - Camry, Accord, Civic, RAV4, Altima, Corolla, Malibu, Model 3 - work on all three; all eight were checked. When a vehicle returns nothing from the ratings endpoint, this Actor asks the recall endpoint about the same vehicle and uses the answer to tell you which of the two it is (see next).

6. The ratings endpoint never says no

/SafetyRatings/... answers HTTP 200 with Count: 0 for a car it has not tested and for a make that does not exist - I asked it for make/Zorblax/model/Nope and got exactly the same body as for a real untested car. On its own it cannot tell you which happened.

So when the ratings come back empty, this Actor puts the same vehicle to the recall endpoint, which does answer 400 for an unknown vehicle. A 400 there means your input was wrong; a 200 means the car is real and simply has no NCAP rating. Those are two different rows, and neither is charged.

7. Two more things measured on the live API

NHTSA's own model list and its recall endpoint disagree. MUSTANG MACH-E appears in /products/vehicle/models?modelYear=2022&make=ford&issueType=r, yet the recall endpoint answers HTTP 400 for it under every spelling tried. When that happens you get a rejected-input row saying so, not a silent blank.

Crash and fire flags are rare, which is why filtering on them is worth it. Across 4,793 complaints on five vehicles, 2.2 per cent carried NHTSA's crash flag and 3.7 per cent its fire flag. onlyCrashOrFire filters the whole result and then applies your row limit, so asking for 60 crash reports gives you up to 60 crash reports - not the crash reports that happened to fall in the first 60 complaints.

Input

Field	What it does
vehicles	The list to look up. Each entry needs make, model and modelYear. A spelling NHTSA does not have comes back as a rejected input, not as "no recalls".
datasets	Any of recalls, complaints, safety-ratings. Default is recalls and complaints.
maxRecordsPerVehicle	Upper limit of rows per vehicle per dataset. You are charged only for rows you actually receive.
componentContains	Keep records whose component text matches, e.g. AIR BAG, POWER TRAIN. NHTSA writes components in capitals. Crash-test ratings carry no component, so this filter is not applied to them.
onlyCrashOrFire	Complaints where NHTSA's own crash or fire flag is set - the flag from the filing, not a word search.
onlyWithInjuriesOrDeaths	Complaints stating at least one injury or death.
maxRetries	Attempts per request when NHTSA does not answer. HTTP 400 is permanent and is never retried.

Scale

Measured on 2026-09-10: NHTSA lists 332 makes for model year 2020, 244 for 2024 and 154 for 2026, and a single make can have dozens of models in one year. A 2021 Ford F-150 returned 29 recalls; a 2021 Honda Accord returned 226 complaints. There is no pagination - one request returns the whole result.

Source and licence

NHTSA public API (api.nhtsa.gov). Works of the US federal government are in the public domain. This Actor makes plain HTTPS requests to the documented JSON endpoints; it does not scrape any web page and needs no API key or proxy.