We ship every week. Here’s the receipts.

Liveness probe. GET /health answers publicly on api.carvector.io with nothing but a status and a timestamp — no version, no build id, no dependency status, no row counts. It sits outside the paywall and outside key authentication on purpose, so a monitor polling it every minute can never book an authentication failure against your account. It is deliberately boring: a health check that is also reconnaissance is worse than none.

Pay-per-call is live on Base mainnet. You no longer need an account to buy data. An API call without a key now returns HTTP 402 with a signed price quote instead of a rejection — $0.01 in USDC on Base, quoted as 10,000 atomic units against the token's own EIP-712 domain so your wallet can verify what it is signing. Pay the quote, repeat the call with the payment attached, and the data comes back. Seven endpoints are priced this way: /v1/vehicles, /v1/vehicles/{id}, and that vehicle's /recalls, /tsbs, /complaints and /investigations, plus /v1/dtc/{code}. Quotes hold for 60 seconds. Every settled payment returns the payer their own receipt, and one payment buys exactly one call — replay protection is enforced at the ledger with a unique index, not by a time window, because a window alone was half a fix and we measured it.

The payment rail, built and deliberately switched off. Verification, settlement and serving all worked end to end before the flag was ever turned on, against testnet first and with the ledger reconciled after every round trip. Three things were wrong in the wire format and one of them was fatal, which is the argument for shipping it dark. We also taught the intrusion alarm what an attack looks like once payments exist: before this, a request with no API key was a probe, and afterwards it is the ordinary opening move of a paying customer. Counting those as attacks would have paged us about roughly a hundred customers per fifteen minutes. Key-guessing is still counted; arriving without a key is not.

Failure Intelligence — our biggest data expansion since launch: 4.4 million new records across three new per-vehicle endpoints. GET /v1/vehicles/{id}/complaints surfaces 1.7M federal owner-complaint filings with symptoms, components, and crash/fire/injury flags (Pro plan and up). /tsbs indexes 2.5M manufacturer technical service bulletins — the fix the dealer already knows about (Business plan and up). /investigations covers 20,651 federal defect-investigation records, active and closed, with status and disposition (Business plan and up). Recall objects gain an optional completion_rate field — the share of recalled vehicles actually repaired — drawn from 73,731 quarterly records across 14,359 campaigns. Existing responses stay fully backward compatible: vehicle objects gain optional complaint_count, tsb_count, and investigation_count as free counts. Complaints, recalls, and investigations refresh daily; completion rates quarterly.

Cleaned up the DTC reference — every code now returns a real title, not just the raw code — and added the most-looked-up generic OBD-II codes (P0420, P0171, P0455, P0128, and more). 1,200+ codes, each with category, severity, and safety/emissions flags.

New endpoint: GET /v1/vehicles/{id}/images returns image URLs for a vehicle. Vehicle images are representative illustrations. Thousands of vehicles now have images.

400+ corrections applied across 2017–2021 Honda models. Primary issue: CVT transmission variants were conflated with conventional automatic entries.