How we tested which automakers publish window stickers
We probed 21 US automakers for a public Monroney label endpoint using real VINs. Sixteen return an original factory PDF — roughly 53% of US registrations. The five that do not are Toyota, Honda, Nissan, Mazda and Volkswagen. Every row was tested rather than taken from anyone’s published coverage table, which matters more than it sounds like it should.
Last updated
The full dataset is on GitHub as coverage.json, in the public domain, no attribution required. It carries the test VIN and response size for every make. The live checks behind it re-run on request at /status — if that page and the dataset ever disagree, the page is right.
What “not found” looks like
This is the part nobody else publishes, and the part that took the longest. Every one of these services answers a VIN it has no label for, and almost none of them answer with an error. A client that trusts the status code will serve its users a sentinel document and call it a window sticker.
| Makes | Signal | What it actually returns |
|---|---|---|
| Ford, Lincoln | Byte-identical PDF | Exactly 1,650,766 bytes, same sha256 every time, delivered as HTTP 200 with content-type application/pdf. It renders as a page reading “we are sorry”. Detected by hashing the response, because nothing in the status line distinguishes it from a real label. |
| Subaru | Byte-identical PDF | The same pattern at 16,483 bytes. The VIN is a path segment here — the ?vin= query form returns HTTP 500 rather than a useful error. |
| Chevrolet, GMC, Buick, Cadillac | Empty body | An empty body means either “no label” or “ask again”. We measured four empty responses followed by a success on the fifth, for a VIN that does have a label. Every lookup is retried three times before a negative is believed. |
| Jeep, Ram, Dodge, Chrysler, Fiat, Alfa Romeo | Stub body | A roughly 1.1 KB stub. The fastest of the major services, and the least ambiguous. |
| Kia | JSON body | HTTP 200 carrying a 25-byte JSON body, “VIN not found in Monroney”. Detected by content-type, so no sentinel hash is needed. |
| Hyundai, Genesis | HTTP 500 | A 10,497-byte HTML error page. It has to be treated as a definitive miss rather than an outage — otherwise every unlabelled VIN reports the service as down. |
Three findings that cost the most time
A 403 is not evidence of anything. automobiles.honda.com returns 403 to a plain HTTP client on every path, including paths that do not exist. That is an Akamai WAF answering, not Honda. Send realistic headers and the same request reaches Honda’s own handler, which returns a clean 404. The block looked like a locked door. It was a receptionist who says no to everyone.
Read where competitors link out to. Subaru’s endpoint was public and undocumented the whole time. It was not discoverable from Subaru’s own inventory pages. It was recovered from an outbound link on a competitor’s Subaru page, which turned out to be far faster than rendering manufacturer DOMs and grepping them.
A live endpoint can still be a dead end. Mazda’s /api/vehicles/{VIN}/windowsticker answers status: success with a null body — for genuine and fabricated VINs alike — and carries a recaptcha field. GET, POST, the query form and a /pdf suffix were all tested. It is reachable and it yields nothing.
The claim we got wrong
For two weeks this site said Kia had no public window sticker service. It was never tested. It was read off a competitor’s coverage page — a company that sells this commercially, whose table said Toyota, Lexus and Kia had all retired public access in 2026 — and written down as fact.
Kia’s endpoint was public the entire time. It is declared in plaintext in kia.com’s own inventory configuration, beside an API key that is not required. One request would have caught it. Hyundai was the same shape of error: marked “certified pre-owned only” after a single failed probe against a CPO document service, when the new-vehicle labels come off a servlet that fronts both Hyundai and Genesis. The exact VIN filed as unsupported returns a 221 KB new-vehicle Monroney.
A competitor’s marketing page is not a test result. Every row in the dataset is now a response we opened and read, and the ones we cannot get are listed as plainly as the ones we can.
Reproducing it
- Render the manufacturer’s inventory or search page with headless Chrome. The search pages carry more service metadata than the landing pages do.
- Grep the DOM for monroney and window-sticker. Adobe Experience Manager sites declare endpoints in <meta name="service:*"> tags; others leave them in an inventory config blob.
- Probe for the parameter name. The error messages are informative, and case matters more often than you would expect.
- Validate against real VINs harvested from dealer sitemap.xml files. A fabricated VIN and a genuine unlabelled one produce the same response, so fabricated VINs prove nothing.
Endpoint URLs are deliberately not published, here or in the dataset. Which manufacturers serve labels is useful to know and costs them nothing. The exact URLs invite enough automated traffic to get them switched off, and then nobody has them — including the person trying to find out what their own car came with.