US Electronic Code of Federal Regulations (eCFR)
Reads named parts of the US Code of Federal Regulations from the eCFR, the Office of the Federal Register’s continuously updated edition, through its public versioner API. Each section (and each appendix) becomes one document, so a citation names the section, not “somewhere in Part 121”.
At a glance
Section titled “At a glance”| Collector | US Electronic Code of Federal Regulations (eCFR), version 1.0.0 |
|---|---|
| Reads | US Office of the Federal Register: eCFR versioner API (the vendor's documentation) |
| Family | Regulation |
| Kind | Regulation |
| Ways to connect | None (no credential) |
| Scopes |
|
| Read only | Yes |
| Vendor's API can move money | No |
| Personal data | None |
| Hosts it may contact | www.ecfr.gov |
| Vendor API versions | eCFR versioner API v1 |
| Lowest engine version | 0.45.0 |
What it reads
Section titled “What it reads”- The parts you name of one CFR title (title 14, Aeronautics and Space, by
default): for example
121and135. - For each part: every section and appendix in the current text, with its heading, its number and a link to it on www.ecfr.gov.
- A part is read again only when the eCFR records a new amendment date for it. A section the amendment removed is withdrawn from the knowledge base.
It never reads a whole title: you name the parts.
How to connect
Section titled “How to connect”- In LightHouse, open Connectors and choose eCFR.
- Name the title (14 unless you say otherwise) and the parts to read.
- Choose a label (normally
regulation) and how often to read. The eCFR is updated daily; a daily read costs one small request per part when nothing has changed.
No credential is needed.
Permissions
Section titled “Permissions”None. The collector sends only GET requests, without credentials, to
www.ecfr.gov. Its read-only test proves it on every change, and the
certification run recorded every request it made against the live eCFR.
Limits
Section titled “Limits”- One title per source; add a source per title.
- Reserved sections (“[Reserved]”) are kept with their heading and an empty body, so a question about them is answered with “reserved”, not silence.
- The eCFR is an editorial compilation, not the official legal edition (the annual CFR and the Federal Register are). Each record says where it came from and when.
- Requests are paced (one second apart by default) and back off when the
eCFR asks (
Retry-After).
Data handling
Section titled “Data handling”- The text is public and in the public domain (17 U.S.C. 105); it carries no personal data.
- The raw XML is cached in your deployment, named by its SHA-256, so any passage can be traced to what was served.
- Nothing leaves your deployment: the collector runs inside it, and only the counts of sections read reach LightHouse.
- XML is parsed with
defusedxml, which refuses entity expansion and external entities.
Troubleshooting
Section titled “Troubleshooting”| What you see | What it means | What to do |
|---|---|---|
not CFR part numbers |
A part is not a number (optionally with a letter) | Use the part number alone, for example 121 |
the eCFR lists no versions |
The part does not exist in that title | Check the title and part |
no sections in the eCFR XML |
The eCFR returned the part with no sections | Retry later; if it persists, report it to us |
HTTPStatusError 429 |
The eCFR is rate-limiting | It backs off by itself; read less often |
| Read succeeded, 0 written | No part has been amended since the last read | Nothing to do |
Certification
Section titled “Certification”Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.
| Date | Collector | Engine | Vendor API | Method | Expires |
|---|---|---|---|---|---|
| 7 November 2026 | 1.0.0 | 0.45.0 | eCFR versioner API v1 | Vendor's sandbox (a real run) | 7 May 2027 |
| 7 November 2026 | 1.0.0 | 0.45.0 | eCFR versioner API v1 | Fixtures only: built, not certified | Not applicable |
Security posture
Section titled “Security posture”From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.
| Last scanned | 10 November 2026 |
|---|---|
| Critical findings | 0 |
| High findings | 0 |
| Medium findings | 0 |
| Low findings | 0 |
| Info findings | 0 |
| Release blocked | No |
| Network allow-list check | Pass |
| Read-only behavioural test | Pass |
| SBOM (CycloneDX) | Produced |
| Dependency licences | Pass |
| Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only |