API Reference

The ExChek API exposes two surfaces from a single base URL — a traditional REST API and a Model Context Protocol (MCP) server — both free, no-auth, and edge-cached at Cloudflare. REST is for direct HTTP integrations, Postman, and SDK codegen. MCP is for LLM-driven agents that want to discover and call tools natively. They share the same backend; pick whichever fits your client.

Machine-readable spec

Full OpenAPI 3.1 spec at https://api.exchek.us/openapi.json — import into Postman/Insomnia or feed to openapi-generator /openapi-typescript for SDK codegen. The https://api.exchek.us/.well-known/mcp document is the MCP equivalent (protocol version, endpoint URL, capabilities). The RFC 9727 catalog is at exchek.us/.well-known/api-catalog.

Service

Regulatory Structure (eCFR)

These endpoints return the hierarchical structure of specific parts of the Code of Federal Regulations. Responses include section identifiers, labels, and child nodes. Data is sourced live from the eCFR API and cached at Cloudflare’s edge for 1 hour with stale-while-revalidate. A daily Cloudflare Worker cron warms the cache for all 12 supported parts.

Full-Text Search (eCFR)

Search endpoints proxy the eCFR Search API and return real regulatory text with highlighted matches, relevance scores, and section references. Results are filtered to the current version of the CFR only.

Enforcement Actions (live feed)

Recent U.S. export-control enforcement, aggregated from public sources and normalized to one record shape: BIS denial/settlement orders and DDTC ITAR notices (Federal Register), DOJ National Security Division criminal cases, BIS charging letters, and DDTC civil consent agreements. Newest first, edge-cached, and free with no auth. Every source fails soft. For full notice PDFs + keyword search over the archived BIS export-violations docket, use the document datalake endpoints below. Public information only; do not send CUI or classified information.

Free vs. Pro. The live feed (GET /api/enforcement), datalake routes, and MCP tools get_enforcement_actions, search_enforcement_documents, and get_enforcement_document are free. check_party_enforcement — screen a named counterparty against live sources (plus the trade.gov Denied Persons List when configured) — is an Enterprise (Pro) MCP tool gated by an API key.

Enforcement document datalake

Nightly-updated archive of non-Federal-Register enforcement PDFs — primarily the full BIS /enforcement/export-violations catalog (~1,100 Case IDs → /media/documents/*.pdf), plus DDTC attachments when snapshotted and DOJ metadata. Metadata + FTS in D1; PDF + Firecrawl-parsed markdown in R2. Free, no auth. Agents should prefer file_url when giving users a clickable notice PDF. See the full guide: Enforcement actions & document datalake.

Denied-Party Screening

Screen a party or entity name against the U.S. Consolidated Screening List (Trade.gov) — the consolidated denied/restricted-party lists: BIS Entity, Denied Persons, and Unverified lists; OFAC SDN and consolidated sanctions; State DTC debarred; and more. Free with no auth, edge-cached, and served through ExChek’s platform-managed Trade.gov key — you don’t need your own. Party names are not logged. A name match is not a determination — surface hits for human adjudication and re-screen at ship time. The MCP equivalent is the search_csl tool.

Legal & Regulatory Intel

Read-only research primitives over public legal data sources — the general search surface behind the curated eCFR / radar / enforcement feeds. All free, no auth, edge-cached, and fail-soft: a broken or blocked upstream returns a soft result ({ results: [], error }) rather than a 5xx. The two GovInfo / Regulations.gov endpoints use a server-side DATA_GOV_KEY; when it is not configured they return { configured: false, error } (never a 5xx, never a 401). Public information only; do not send CUI or classified information.

Free vs. Enterprise. These six read endpoints (and their MCP tools) are free. Three additional court-records tools — search_court_records, find_court_case, and get_court_case_documents (CourtListener / RECAP) — are Enterprise (Pro) MCP tools that run under your own CourtListener token (BYOK, per-user rate limits) — add it in app.exchek.us settings (a free token from courtlistener.com); they have no REST equivalent. See the MCP guide.

Skills

The 20 ExChek skills (classification, screening, license determination, etc.) are addressable over HTTP — useful when your agent platform can’t install the local plugin. The skill content is mirrored live from exchekinc/exchekskills and edge-cached for 6h. Push to the skills repo → cache expires → clients see the new version automatically. See Install the ExChek skills for the local plugin install path, or the MCP guide for connecting LLM agents.

Documents Enterprise

Render a completed compliance analysis into one of ExChek’s branded, audit-ready PDF documents. The flagship is the classification memorandum (~28 pages: executive summary, Order of Review, license determination, screening record, red-flag checklist, signature chain, per-sheet page numbers); the same surface also renders a seven-document suite (see the list below). The analysis itself stays free — run the skills, then these endpoints typeset the result. Rendering is stateless: your payload is processed in memory and discarded — never stored, never logged. Payloads must not contain CUI or classified information. Enterprise API keys: matt@exchek.us.

Every document exposes the same endpoint pair as classification, shown below: GET /pdf/<slug>/contract for the payload contract and POST /pdf/<slug> to render (add ?draft=1 for a free, watermarked preview). Available documents:

• classification — Classification Memorandum.
• license-determination — License Determination Memorandum.
• restricted-party-screening — Restricted-Party Screening Certificate. Renders free — no credit consumed.
• transaction-compliance-file — Transaction Compliance File.
• emcp-manual — Export Management & Compliance Program (EMCP) Manual.
• tcp — Technology Control Plan / Deemed-Export Memorandum.
• encryption-report — Encryption Self-Classification Report.

MCP server

For LLM-driven agents, the same API also speaks the Model Context Protocol over Streamable HTTP. Point your MCP-capable client at https://api.exchek.us/mcp; the server exposes 18 free tools (skill + eCFR lookups — including get_ecfr_text and get_eccn for full section and ECCN control text — get_enforcement_actions, search_csl for free denied-party screening, and the six legal & regulatory research tools) plus 25 Enterprise tools — the seven-document PDF suite (a contract + renderer for each), dashboard transaction sync, the products registry, regulatory notes, the Screening Center, check_party_enforcement, and the three CourtListener court-records tools, disclosed to authenticated callers — and 147 resources (every SKILL.md, template, reference, and prompt). See the MCP guide for full setup, examples, and the tool catalog.

Deprecated

Error handling

Caching

All data responses include Cache-Control: public, max-age=3600, stale-while-revalidate=86400 (1h for eCFR, 6h for skill content). Responses are cached at Cloudflare’s global edge, so repeat requests resolve in under 50ms from any region without invoking the Worker. A Cloudflare Worker cron runs daily at 00:00 UTC to re-fetch every supported eCFR part, keeping the edge cache warm.

Fallbacks

If the ExChek API returns 503, you can hit the upstream sources directly (no auth):

• GET https://www.ecfr.gov/api/versioner/v1/structure/current/title-15.json — Title 15 (EAR, Subchapter C)
• GET https://www.ecfr.gov/api/versioner/v1/structure/current/title-22.json — Title 22 (ITAR, Subchapter M)
• GET https://raw.githubusercontent.com/exchekinc/exchekskills/main/skills/{folder}/SKILL.md — Skill content (replace {folder} with e.g. exchek-skill-csl)