The ShieldVIN Check API

One POST before you fund tells you whether a VIN or HIN is already pledged at another institution. A single call runs the decode, the cross-lender lien-collision check, and the fraud-registry lookup, and returns one of four risk levels with the signals behind it. A REST API with code examples — no seat, search, or call caps.

POST /v1/verify

Authenticate with your API key in the x-api-key header. Your production base URL is issued with your key — contact us for access. One POST entrypoint; there are no sub-paths.

POST {base-url}/v1/verify
x-api-key: svk_live_…
Content-Type: application/json

{
  "vin": "1HGBH41JXMN109186"   // 17-char VIN or 12-char HIN (US- prefix allowed)
}

The response

{
  "schema_version": 1,
  "request_id": "b3f1c2a7-…",
  "vin": "1HGBH41JXMN109186",
  "identifier_type": "vin",              // "vin" | "hin"
  "risk_level": "high",                  // "clear" | "informational" | "moderate" | "high"
  "risk_message": "Open lien conflict and a fraud-registry hit.",
  "signals": {
    "decoder":        { "valid": true, "make": "Honda", "model": "Accord", "year": 2020 },
    "lien_check":     { "conflict": true, "institutions_count": 1 },
    "fraud_registry": { "flagged": true, "source": "leo", "reason_codes": ["ACTIVE_INVESTIGATION"] },
    "marketplace":    { "listed": true, "listings_count": 2, "most_recent_listing_at": "2026-05-01" }
  },
  "cross_org_matches": [
    {
      "fraud_category": "synthetic",     // first_party | stolen | synthetic
      "report_timestamp": "2026-04-01",
      "reporter_industry": "financial_services",
      "contact_reference": "v2:4oF7m8JdQW…",
      "match_type": "peer_lien"          // peer_lien | leo_registry | self_flag
    }
  ],
  "timestamp": "2026-05-08T20:47:00.000Z"
}

cross_org_matches is de-identified: you learn that another network member reported the identifier, its fraud category, and a contact_reference you can use to request a consent-gated contact channel — never who they are or anything about their customer.

Webhooks

Register a webhook and every completed verification is delivered as verify.verification.completed, signed with your webhook secret (HMAC-SHA256, Stripe-style t=…,v1=… signature header). Verify the signature and the timestamp before trusting a delivery, and accept it if any v1 matches — two appear during secret rotation.

X-ShieldVIN-Event:          verify.verification.completed
X-ShieldVIN-Severity:       informational | moderate | high
X-ShieldVIN-Schema-Version: 1
X-ShieldVIN-Timestamp:      <unix seconds>
X-ShieldVIN-Signature:      t=<unix>,v1=<hex>[,v1=<hex>]
User-Agent:                 ShieldVIN-Webhooks/1.0

Errors

Get an API key