# U.S. Department of Transportation

> The federal transportation regulator for the United States. DOT publishes no
> departmental OpenAPI and its own web tier (transportation.gov, dot.gov, bts.gov)
> returns HTTP 403 to every automated client — but the data surfaces underneath it are
> open, unmetered, public domain and fully bulk-exportable. Four FAA OpenAPI 3.0
> documents, two FRA WSDL contracts, two Socrata SODA 2.1 tenancies, a CKAN catalog and
> the NHTSA vehicle APIs all answer anonymously. Generated by the API Evangelist
> enrichment pipeline on 2026-07-28; no provider-published llms.txt exists
> (/llms.txt returns 404 on every DOT, FAA and BTS host probed).

## Start here

- [DOT Developer Resources](https://www.transportation.gov/developer): the departmental
  index of operating-administration APIs. Note: 403 to automated clients.
- [FAA API Portal](https://api.faa.gov/s/): Gravitee developer portal; the public catalog
  is enumerable without login at
  https://apim-api.apic4e.faa.gov/portal/environments/DEFAULT/apis?page=1&size=200
- [DOT Data Hub](https://data.transportation.gov/): 1,542 datasets, Socrata SODA 2.1.
- [BTS Open Data](https://data.bts.gov/): 420 datasets — the authoritative record of US
  commercial aviation economics.
- [TranStats bulk downloads](https://www.transtats.bts.gov/): T-100 and Form 41 as files.

## APIs that answer anonymously

- [FAA Airport Status Web Service (ASWS)](https://external-api.faa.gov/asws/api): live
  National Airspace System ground delays, ground stops, arrival/departure delays and
  closures for ~40 major US airports. 2 operations. No key.
- [FAA Aeronautic Product Release API (APRA)](https://external-api.faa.gov/apra): 34
  operations over FAA chart and airspace products — NASR 28-day subscription, dTPP, CIFP,
  IFR enroute, VFR sectionals, oceanic routes, Digital Obstacle File. No key.
- [DOT Data Hub SODA API](https://datahub.transportation.gov/resource): Consumer Airfare
  Report city-pair fares, Airline Quarterly Financial Review, international seat and
  passenger reports. No key.
- [BTS Open Data SODA API](https://data.bts.gov/resource): T-100 segment traffic, Form 41
  financials, average air fares, denied boardings, mishandled baggage. No key.
- [FAA Data Catalog (CKAN Action API v3)](https://catalog.data.faa.gov/api/3): CKAN 2.11.4.
- [NHTSA vPIC API](https://vpic.nhtsa.dot.gov/api/): VIN decoding and the vehicle product
  information catalog. 12,306 makes. No key.
- [NHTSA Safety API](https://api.nhtsa.gov/): recalls, complaints, safety ratings. No key.

## APIs behind a gate

- [FAA Air Carrier PRD API](https://external.apic4e.faa.gov): Pilot Records Database
  submission. Restricted to operators under 14 CFR Part 121, 135, 125, 91K, Air Tour,
  Public Aircraft or Part 91 Corporate. client_id + client_secret headers.
- [FAA Safety Assurance System (SAS) API](https://external.apic4e.faa.gov/axh-sasp-api/sas):
  passenger hazmat discrepancy reporting. X-API-KEY + X-APP-ID. Carries passenger PII.
- [FMCSA QCMobile API](https://mobile.fmcsa.dot.gov/QCDevsite/): motor-carrier safety
  data. Free self-serve key via a Login.gov account — the only self-serve credential in
  the department.
- [FRA Safety Data APIs](https://safetydata.fra.dot.gov/MasterWebService/FRASafetyDataAPIs.aspx):
  SOAP/WSDL. Rail Equipment Accident (Form 54), Highway-Rail Grade Crossing (Form 57),
  casualty, enforcement and summary series. Account by email to RsisSupport@dot.gov.

## Machine-readable contracts in this repository

- openapi/us-dot-faa-airport-status-web-service-openapi.yml — OpenAPI 3.0.1, 2 operations
- openapi/us-dot-faa-aeronautic-product-release-api-openapi.yml — OpenAPI 3.0.1, 34 operations
- openapi/us-dot-faa-air-carrier-prd-api-openapi.yml — OpenAPI 3.0.0, 8 operations, no operationIds
- openapi/us-dot-faa-safety-assurance-system-api-openapi.yml — OpenAPI 3.0.0, 1 operation
- openapi/us-dot-its-jpo-ode-rest-api-openapi.yml — Swagger 2.0, 8 operations (self-hosted)
- wsdl/us-dot-fra-datadownload-service.wsdl — WSDL 1.1, 30 operations
- wsdl/us-dot-fra-lite-api-service.wsdl — WSDL 1.1, 5 operations
- asyncapi/us-dot-its-jpo-ode-asyncapi.yml — AsyncAPI 3.0.0, 35 Kafka channels (derived)
- grpc/us-dot-ode-geoRoutedMsg.proto, grpc/us-dot-ode-geoHashRoutedMsg.proto — proto3
- json-schema/us-dot-wzdx-4.2-*.json — Work Zone Data Exchange 4.2 schemas

## How to use these APIs correctly

- authentication/us-dot-authentication.yml — every credential model in the department
- conventions/us-dot-conventions.yml — pagination, SoQL, tracing, caching, error envelopes
- errors/us-dot-problem-types.yml — the three different error shapes and what to do
- lifecycle/us-dot-lifecycle.yml — versioning, deprecation, status pages, release cadence
- sandbox/us-dot-sandbox.yml — there is no sandbox; production is anonymous instead
- data-model/us-dot-data-model.yml — entities and the one cross-surface join key
- conformance/us-dot-conformance.yml — which standards actually hold
- agentic-access/us-dot-agentic-access.yml — per-operation agent execution contracts
- skills/_index.yml — five packaged agent skills grounded in real operationIds

## Things an agent should know before calling

- No idempotency key exists anywhere in the department. The read surfaces are safe GETs;
  the write surfaces (FAA PRD, FAA SAS, ITS ODE TIM/PDM deposit) are not safe to retry.
- Three unrelated error envelopes coexist: the FAA gateway returns
  {"message":..., "http_status_code":...}; the FAA services return an empty body; Socrata
  returns {"code":..., "error":true, "message":..., "data":{}}. Nothing uses RFC 9457.
- No Sunset or Deprecation header is emitted anywhere. The FAA signals a retired chart
  product only in a 404 response *description*.
- No rate-limit headers are emitted and no numeric limit is published. Socrata's optional
  X-App-Token moves you off the shared anonymous throttle pool.
- No /.well-known/ document exists on any host. What DOT publishes instead is a DCAT-US
  1.1 catalog at /data.json on all three data platforms.
- Socrata SODA returns a bare array with no total and no next-link. Always page with an
  explicit $order (use :id) or you will duplicate and drop rows.

## Security

- DOT Vulnerability Disclosure Policy: https://www.transportation.gov/vulnerability-disclosure-policy
  Submissions: https://bugcrowd.com/engagements/usdot-vdp — DOT-VDP@dot.gov
- FAA Vulnerability Disclosure Policy: https://www.faa.gov/web_policies/vulnerability_disclosure_policy
  Submissions: vulnerabilitydisclosure@faa.gov — 90-day embargo, anonymous accepted
- No RFC 9116 security.txt is published on any host.

## Licence

Public Domain U.S. Government (USGOV_WORKS) on the Socrata datasets; Creative Commons
Zero 1.0 declared in both public FAA OpenAPI documents; Apache 2.0 on the ITS JPO code
estate. No attribution requirement, no commercial restriction, no lock-in.