CMS (U.S. Centers for Medicare & Medicaid Services)v2.1 current; 1.0/2.0 retiredVerified 2026-10-28

free NPI lookup API for AI agents, no key

The official, free, read-only API over the US National Provider Identifier registry: look up a provider by NPI number, name, specialty, city, state or ZIP and get JSON back. No key; an hourly cap with no published number.

CompareDocs

Verified factsChecked 2026-10-28

PriceFree. CMS says there is no charge to view the registry or download the files.3 [Verified 2026-10-28]
API key / authNone. Our keyless GET requests on 2026-10-28 returned HTTP 200.1 [Verified 2026-10-28]
Rate limitSince June 25, 2024, NPPES limits how many registry queries can run per hour, but publishes no number; bulk lookups must use the downloadable file. Our responses carried no rate-limit headers.4 [Verified 2026-10-28]
Result capsUp to 200 results per request (limit, default 10) and skip up to 1,000, so at most 1,200 records for one search over six requests.1 [Verified 2026-10-28]
License / termsThe data is FOIA-disclosable public record that CMS is required to publish; providers with active NPIs cannot opt out. CMS publishes no separate API terms or data license.3 [Verified 2026-10-28]
Version statusVersion 2.1 is current with no planned phase-out date; 1.0, 2.0 and calls without a version flag no longer work.1 [Verified 2026-10-28]
Search rulesstate cannot be the only criterion (error 07 “requires additional search criteria” in our test), enumeration_type needs another field, and names allow a trailing * after two characters.1 [Verified 2026-10-28]

FeaturesChecked 2026-10-28

YesNoN/ANot published
CapabilityValueNote
StatusVersion 2.1 has no planned phase-out date; calls without a version flag no longer work.v2.1 current; 1.0/2.0 retired1 [Verified 2026-10-28 on https://npiregistry.cms.hhs.gov/api-page]Version 2.1 has no planned phase-out date; calls without a version flag no longer work.
API key requiredNo key. Keyless GET returned HTTP 200 on 2026-10-28.No2 [Verified 2026-10-28 by test request to https://npiregistry.cms.hhs.gov/api/?version=2.1&number=1003000126]No key. Keyless GET returned HTTP 200 on 2026-10-28.
Free tierFree. CMS says there is no charge to view the registry or download the files.Yes3 [Verified 2026-10-28 on https://www.cms.gov/medicare/regulations-guidance/administrative-simplification/data-dissemination]Free. CMS says there is no charge to view the registry or download the files.
Rate limitHourly query cap since June 25, 2024, number not published; bulk use must use the download files. 200 results per request, skip up to 1,000.Not published4 [Not published by vendor: checked 2026-10-28 on https://npiregistry.cms.hhs.gov/help-api]Hourly query cap since June 25, 2024, number not published; bulk use must use the download files. 200 results per request, skip up to 1,000.
Official MCP serverNo MCP server from CMS; only the REST API and downloadable files.Not published1 [Not published by vendor: checked 2026-10-28 on https://npiregistry.cms.hhs.gov/api-page]No MCP server from CMS; only the REST API and downloadable files.
Official SDKNo official SDK; the API is plain HTTPS GET with query fields.Not published1 [Not published by vendor: checked 2026-10-28 on https://npiregistry.cms.hhs.gov/api-page]No official SDK; the API is plain HTTPS GET with query fields.
Data license / termsCMS must disclose this data under FOIA; no separate API terms or data license is published.FOIA public record3 [Verified 2026-10-28 on https://www.cms.gov/medicare/regulations-guidance/administrative-simplification/data-dissemination]CMS must disclose this data under FOIA; no separate API terms or data license is published.
Commercial use allowedNo commercial-use rule is published; the data is public record released at no charge.Not published3 [Not published by vendor: checked 2026-10-28 on https://www.cms.gov/medicare/regulations-guidance/administrative-simplification/data-dissemination]No commercial-use rule is published; the data is public record released at no charge.
CORS / browser useNo CORS header. GET and preflight with a third-party Origin on 2026-10-28 returned no Access-Control-Allow-Origin.No2 [Verified 2026-10-28 by test request to https://npiregistry.cms.hhs.gov/api/?version=2.1&number=1003000126]No CORS header. GET and preflight with a third-party Origin on 2026-10-28 returned no Access-Control-Allow-Origin.
Freshness / coverageThe API retrieves data from NPPES daily; search pages cap at the first 2,100 results.Daily from NPPES1 [Verified 2026-10-28 on https://npiregistry.cms.hhs.gov/api-page]The API retrieves data from NPPES daily; search pages cap at the first 2,100 results.

What it does

Every US health care provider that bills electronically has a 10-digit National Provider Identifier (NPI), assigned through CMS’s National Plan and Provider Enumeration System (NPPES). CMS publishes the public part of each record, such as the name, credential, specialty (taxonomy), license numbers, practice and mailing addresses and phone numbers, in the NPI Registry and through this read-only JSON API. An agent can verify that an NPI is real and active, find a provider’s specialty and address, or search by name, organization, taxonomy, city, state or postal code. Version 2.1 is the only working version; versions 1.0 and 2.0 are retired. The API reads from NPPES daily. CMS does not publish dates of birth, Social Security numbers or taxpayer IDs, and an NPI by itself does not prove a provider is licensed or credentialed.

Working exampleRun 2026-10-28

ShellRequest
curl -sS "https://npiregistry.cms.hhs.gov/api/?version=2.1&number=1003000126"

Response (trimmed)

HTTP responseResponse
HTTP 200 (run 2026-10-28, no key)
{"result_count":1,
 "results":[{"number":"1003000126","enumeration_type":"NPI-1",
   "basic":{"first_name":"ARDALAN","last_name":"ENKESHAFI","credential":"M.D.",
            "status":"A","enumeration_date":"2007-08-31","last_updated":"2025-05-28", ...},
   "addresses":[{"address_purpose":"LOCATION","city":"BETHESDA","state":"MD", ...},
                {"address_purpose":"MAILING", ...}],
   "taxonomies":[{"code":"208M00000X","desc":"Hospitalist","primary":true,"state":"DC", ...}, ...],
   "practiceLocations":[...], "identifiers":[], "endpoints":[]}]}

Agent setup

Prompt to give your agent

Prompt
Use the NPPES NPI Registry API (https://npiregistry.cms.hhs.gov/api/?version=2.1, no key). For each NPI I give you, call it with number=<NPI> and report the name or organization name, whether status is A (active), the primary taxonomy description and the primary practice city and state. If result_count is 0, say the NPI was not found. Do not guess missing fields and do not claim the provider is licensed: an NPI does not prove that. NPIs: 1003000126.

Agent / MCP-style tool snippet

JSONTool snippet
// Tool definition for Claude, OpenAI or any function-calling agent
{
  "name": "npi_lookup",
  "description": "Look up US health care providers in the CMS NPPES NPI Registry (read-only, no key). Give an NPI number, or a name plus a state or city.",
  "input_schema": {
    "type": "object",
    "properties": {
      "number": { "type": "string", "description": "Exactly 10 digits" },
      "first_name": { "type": "string" },
      "last_name": { "type": "string" },
      "organization_name": { "type": "string" },
      "taxonomy_description": { "type": "string" },
      "city": { "type": "string" },
      "state": { "type": "string", "description": "2-letter code; never the only field" },
      "limit": { "type": "integer", "maximum": 200 }
    }
  }
}
// Implementation: GET https://npiregistry.cms.hhs.gov/api/?version=2.1&<fields>

Fit and safety

Good for

  • Checking that an NPI on a claim, referral or form is real and active
  • Finding a provider’s specialty and practice address from a name
  • Filling provider fields in a health-care intake or billing agent

Watch out

  • Do not treat a found NPI as proof of a license or credential. CMS says plainly that issuing an NPI does not validate either; check the state licensing board.
  • Do not crawl it to build a full provider database. CMS caps hourly queries and asks bulk users to download the monthly and weekly NPI files instead.
  • Do not call it from browser code. Our requests with a third-party Origin got no Access-Control-Allow-Origin header, so call it from your server or agent runtime.
  • Do not expect exclusion, sanction or payment data. The registry has none; those live in separate government datasets.

Alternatives

NPPES downloadable filesCMS’s free monthly full and weekly incremental NPI files, the sanctioned route for bulk use.
SEC EDGAR APIAnother free, keyless U.S. government API, for company filings instead of providers.
Official MCP Registry APITo find community MCP servers that wrap provider data, and check who publishes them.

FAQ

Does the NPI Registry API need an API key?

No. It is free and keyless; send GET requests to https://npiregistry.cms.hhs.gov/api/?version=2.1 with your search fields.

What is the NPI Registry API rate limit?

CMS says it limits queries per hour (since June 25, 2024) but does not publish the number. Each request returns at most 200 results, and skip goes up to 1,000.

Can I search NPIs by state only?

No. state must be combined with at least one other field such as a name, city, postal code or taxonomy.

Compare

Put NPPES NPI Registry API side by side with other free agent tools on keys, limits, MCP support, licensing and CORS. Open the comparison grid →

SourcesFootnotes

  1. 1npiregistry.cms.hhs.gov/api-pageVerified 2026-10-28
  2. 2npiregistry.cms.hhs.gov/api/?version=2.1&number=1003000126Tested 2026-10-28
  3. 3cms.gov/medicare/regulations-guidance/administrative-simplification/dataVerified 2026-10-28
  4. 4npiregistry.cms.hhs.gov/help-apiVerified 2026-10-28