# Cox Automotive > Cox Automotive is one of the world's largest providers of products and services spanning the > automotive ecosystem — Manheim wholesale auctions, Kelley Blue Book valuations, Autotrader, > Dealertrack, vAuto, VinSolutions, Xtime, Dealer.com and HomeNet. Its public API surface is split > across three developer properties with three different authentication models and three different > error envelopes. Five machine-readable contracts are published, all Swagger 2.0, all Kelley Blue > Book. Access to every environment is granted after human review; nothing here is self-serve. > > Generated by API Evangelist from public sources on 2026-09-13. This is an independent third-party > profile; see https://apievangelist.com/about/where-our-data-comes-from ## APIs with a published contract - [Kelley Blue Book IDWS 4.0 Vehicle Service](https://developer.kbb.com/idws/1-Default): 25 paths. VIN decode, vehicle taxonomy (years/makes/models/trims/body styles), options, specifications, typicals, CPO programs, cost-to-own and Blue Book values. Base https://idws.datasolutions.coxautoinc.com - [Kelley Blue Book IDWS 4.0 Editorial Service](https://developer.kbb.com/idws/1-Default): 6 paths. Consumer ratings and reviews, expert ratings and reviews, Top Ten lists. - [Kelley Blue Book Advertising Data API](https://developer.kbb.com/data/1-Default): 20 paths. Pricing, cost-to-own, ratings, reviews, vehicle links, fuel cost, specs, MPG and awards for dynamic advertising. - [Kelley Blue Book Instant Cash Offer API](https://developer.kbb.com/ico/1-Default): 21 paths. Vehicle configuration, plate-to-VIN, prospect creation with history/condition/contact questionnaires, and offer generation. Base https://api.kbb.com/ico/v1 - [Kelley Blue Book Batch VIN API](https://developer.kbb.com/batchvin/1-Default): 6 paths. Asynchronous batch VIN decode and valuation jobs with input/output file retrieval and cancellation. ## APIs documented but with no machine-readable contract - [Manheim Hypermedia API Suite](https://developer.manheim.com/): auction locations, inventory units and consignments, marketplace offerings, searches, purchases, transactions, titles, Manheim Market Report valuations and forecasts, condition reports, images, and user profiles/contexts/preferences. Every resource carries its own `href`. Base https://api.manheim.com - [Manheim Event Notifications](https://developer.manheim.com/apis/events/index.html): publish/subscribe NOUN.VERB auction lifecycle events with resource/type/VIN/richFilter subscriptions and response expansion. Closed to new onboarding; superseded by Eventer on the API Storefront. - [Cox Automotive Integration Platform / API Storefront](https://developer.coxautoinc.com/): the company-wide partner catalogue. 72 runtime components are visible on the public status page — Dealertrack Credit Application, Reg & Title Transaction, DealXG, Order API 2.x, MMR 1.x, Listings Search, Quotes API 2.x, Eventer Publishing, Taxonomy, Expander and more. Reference is behind an Okta / Entra ID sign-in. ## Specs - openapi/cox-automotive-kbb-idws-vehicle-openapi.yml (Swagger 2.0, 25 paths) - openapi/cox-automotive-kbb-idws-editorial-openapi.yml (Swagger 2.0, 6 paths) - openapi/cox-automotive-kbb-advertising-data-openapi.yml (Swagger 2.0, 20 paths) - openapi/cox-automotive-kbb-instant-cash-offer-openapi.yml (Swagger 2.0, 21 paths) - openapi/cox-automotive-kbb-batch-vin-openapi.yml (Swagger 2.0, 6 paths) - openapi/_original/ — the five contracts exactly as fetched from developer.kbb.com ## Artifacts - authentication/cox-automotive-authentication.yml — api_key on the query string for Kelley Blue Book; OAuth 2.0 client_credentials and password grants for Manheim; both gated behind human review. - scopes/cox-automotive-scopes.yml — OAuth scopes are enforced but the vocabulary is unpublished. - conventions/cox-automotive-conventions.yml — hypermedia, versioning, dry-run, reversibility. **Idempotency coverage: none.** - errors/cox-automotive-problem-types.yml — three vendor error envelopes; no RFC 9457. - errors/cox-automotive-error-codes.yml — the 44-code Instant Cash Offer result-code registry. - lifecycle/cox-automotive-lifecycle.yml — versioning, the in-flight Events/Eventer deprecation, status page. - conformance/cox-automotive-conformance.yml — OAuth2, hypermedia, RFC 9116; no domain standard declared. - rate-limits/cox-automotive-rate-limits.yml — 1,000 QPS and 2,000,000/day per key, with response headers. - plans/cox-automotive-plans-pricing.yml — no published plans or pricing anywhere. - sandbox/cox-automotive-sandbox.yml — six environments; sandbox valuations are six months stale by design. - data-model/cox-automotive-data-model.yml — 122 entities, 71 relationships, three separate cores. - asyncapi/cox-automotive-manheim-events-webhooks.yml — the event surface catalogue. - packages/cox-automotive-packages.yml — no first-party API client SDK is published. - mcp/cox-automotive-mcp.yml — candidate tool list only; Cox Automotive ships no MCP server. - skills/ — four packaged Agent Skills grounded in real operations. - security/ — domain security probe and the responsible-disclosure programme. - well-known/ — 12 hosts probed; two RFC 9116 security.txt documents found. ## Docs - Developer portal: https://developer.coxautoinc.com/ - Manheim developer portal: https://developer.manheim.com/ - Kelley Blue Book developer portal: https://developer.kbb.com/ - Authentication: https://developer.manheim.com/pages/authentication.html - Hypermedia guide: https://developer.manheim.com/pages/hypermedia.html - Errors: https://developer.manheim.com/pages/errors.html - Usage limits: https://developer.manheim.com/pages/apiUsage.html - Access and environments: https://developer.manheim.com/pages/accessAndEnvironments.html - Status: https://coxautoapi.statuspage.io/ - Responsible disclosure: https://www.coxautoinc.com/responsible-disclosure - GitHub: https://github.com/Cox-Automotive ## Known gaps - No OpenAPI 3.x anywhere — all five contracts are Swagger 2.0. - No machine-readable contract at all for Manheim or for the Integration Platform storefront. - No idempotency key across a substantial write surface. - No AsyncAPI for a real publish/subscribe event service. - No published OAuth scope vocabulary, no deprecation policy, no SLA, no pricing. - No first-party SDK, CLI, MCP server or agent card. - A GraphQL surface exists (VinSolutions Call Details API, on the Mashery developer network) but its SDL download is behind sign-in, so the schema could not be read.