# US Electronic Code of Federal Regulations (eCFR) > US Electronic Code of Federal Regulations (eCFR): what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Certified Certified by Atlantic Agentic Labs on 7 November 2026, against eCFR versioner API v1; expires 7 May 2027. Reads named parts of the US Code of Federal Regulations from the eCFR, the Office of the Federal Register’s continuously updated edition, through its public versioner API. Each section (and each appendix) becomes one document, so a citation names the section, not “somewhere in Part 121”. ## At a glance | Collector | US Electronic Code of Federal Regulations (eCFR), version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Reads | US Office of the Federal Register: eCFR versioner API ([the vendor's documentation](https://www.ecfr.gov/developers/documentation/api/v1)) | | Family | Regulation | | Kind | Regulation | | Ways to connect | None (no credential) | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `www.ecfr.gov` | | Vendor API versions | eCFR versioner API v1 | | Lowest engine version | `0.45.0` | ## What it reads - The parts you name of one CFR title (title 14, Aeronautics and Space, by default): for example `121` and `135`. - For each part: every section and appendix in the current text, with its heading, its number and a link to it on [www.ecfr.gov](http://www.ecfr.gov). - A part is read again only when the eCFR records a new amendment date for it. A section the amendment removed is withdrawn from the knowledge base. It never reads a whole title: you name the parts. ## How to connect 1. In LightHouse, open **Connectors** and choose **eCFR**. 2. Name the title (14 unless you say otherwise) and the parts to read. 3. Choose a label (normally `regulation`) and how often to read. The eCFR is updated daily; a daily read costs one small request per part when nothing has changed. No credential is needed. ## Permissions None. The collector sends only `GET` requests, without credentials, to `www.ecfr.gov`. Its read-only test proves it on every change, and the certification run recorded every request it made against the live eCFR. ## Limits - One title per source; add a source per title. - Reserved sections (“\[Reserved]”) are kept with their heading and an empty body, so a question about them is answered with “reserved”, not silence. - The eCFR is an editorial compilation, not the official legal edition (the annual CFR and the Federal Register are). Each record says where it came from and when. - Requests are paced (one second apart by default) and back off when the eCFR asks (`Retry-After`). ## Data handling - The text is public and in the public domain (17 U.S.C. 105); it carries no personal data. - The raw XML is cached in your deployment, named by its SHA-256, so any passage can be traced to what was served. - Nothing leaves your deployment: the collector runs inside it, and only the counts of sections read reach LightHouse. - XML is parsed with `defusedxml`, which refuses entity expansion and external entities. ## Troubleshooting | What you see | What it means | What to do | | ----------------------------- | ------------------------------------------------- | -------------------------------------------- | | `not CFR part numbers` | A part is not a number (optionally with a letter) | Use the part number alone, for example `121` | | `the eCFR lists no versions` | The part does not exist in that title | Check the title and part | | `no sections in the eCFR XML` | The eCFR returned the part with no sections | Retry later; if it persists, report it to us | | `HTTPStatusError 429` | The eCFR is rate-limiting | It backs off by itself; read less often | | Read succeeded, 0 written | No part has been amended since the last read | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | --------------- | --------- | -------- | --------------------- | ----------------------------------- | -------------- | | 7 November 2026 | `1.0.0` | `0.45.0` | eCFR versioner API v1 | Vendor's sandbox (a real run) | 7 May 2027 | | 7 November 2026 | `1.0.0` | `0.45.0` | eCFR versioner API v1 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/ecfr/