Vehicle identity, not a history report

The Australian API accepts a registration plate and state, or a 17-character VIN. The response can include year, make, model, VIN, body type, transmission and the provider's description. Availability varies by match and source.

  • Missing values: nullable fields remain null. A field's presence in the schema is not a guarantee that it will be populated.
  • Valuation fields: vehicleValueMin, vehicleValueMax and vehicleMinMarketValue are reserved and currently return null.
  • Outside this product: owner contact details, a comprehensive accident or finance history, and guaranteed vehicle valuations are not returned.

Use source and confidence metadata

CSNB normalizes responses obtained through vehicle-data providers. Its lookup response distinguishes catalogue matches, identity parsed from a provider description, and fallback or input errors using _meta. These labels describe how CSNB formed a result; they are not a government certification.

Check _meta.source, _meta.confidence and any _meta.reason before using a record. CSNB does not advertise a direct government-registry affiliation or a guaranteed match for every plate. See the response schema.

A lookup is not proof of current registration

Responses can be cached, and the upstream source's update timing is not guaranteed by the API. There is no per-record freshness timestamp in the current response. Do not infer that a vehicle is currently registered, owned by a particular person or free of encumbrances from an identity response.

If your workflow needs a current registration status or a separate history check, obtain that information from the appropriate source. Australia is the only production market currently available.

Website interaction counts

The website uses Cloudflare Web Analytics for aggregate browser activity. CSNB also records selected interaction counts, such as opening an access path or copying a code example, to understand which parts of the site are useful.

CSNB's interaction counters contain only a UTC date, a fixed page label, a fixed event label, a fixed target label and a count. They do not include form inputs, URL query strings, referrers, IP addresses, user-agent strings, wallet addresses, payment signatures or persistent visitor identifiers. They do not create cookies or link a visitor's actions into a session.

The website suppresses these optional interaction events when the browser sends Do Not Track or Global Privacy Control. Counts are not unique-visitor totals and may include automated activity. Cloudflare's analytics and edge-security records are separate; read about Cloudflare Web Analytics.

API and payment operations use separate records

The aggregate website counters do not describe all service records. API operations can record a queried vehicle and its response. API-key access uses a stored key hash and quota counters. Direct-transfer invoices retain lookup details, status and any matched transaction.

The x402 ledger retains the payment authorization, payer and nonce identity, requested resource, settlement status and saved lookup result so that a lost response can be recovered without charging again. The service does not need a payer's private key. A configured payment facilitator receives the authorization and payment requirements to verify and settle it.

Do not put private keys or payment signatures in a URL or send them by email. For an uncertain payment, retain its original authorization in your client and retry the same request as described in the payment guide.

Questions about a record or your integration?

Contact [email protected] with the endpoint and a description of the issue. For a payment question, a transaction hash or payment ID can help identify the operation; a private key is never needed.