API Reference

The ExChek API exposes two surfaces from a single base URL — a traditional REST API and a Model Context Protocol (MCP) server — both free, no-auth, and edge-cached at Cloudflare. REST is for direct HTTP integrations, Postman, and SDK codegen. MCP is for LLM-driven agents that want to discover and call tools natively. They share the same backend; pick whichever fits your client.

Machine-readable spec

Full OpenAPI 3.1 spec at https://api.exchek.us/openapi.json — import into Postman/Insomnia or feed to openapi-generator /openapi-typescript for SDK codegen. The https://api.exchek.us/.well-known/mcp document is the MCP equivalent (protocol version, endpoint URL, capabilities). The RFC 9727 catalog is at exchek.us/.well-known/api-catalog.

Service

Regulatory Structure (eCFR)

These endpoints return the hierarchical structure of specific parts of the Code of Federal Regulations. Responses include section identifiers, labels, and child nodes. Data is sourced live from the eCFR API and cached at Cloudflare’s edge for 1 hour with stale-while-revalidate. A daily Cloudflare Worker cron warms the cache for all 12 supported parts.

Full-Text Search (eCFR)

Search endpoints proxy the eCFR Search API and return real regulatory text with highlighted matches, relevance scores, and section references. Results are filtered to the current version of the CFR only.

Skills

The 20 ExChek skills (classification, screening, license determination, etc.) are addressable over HTTP — useful when your agent platform can’t install the local plugin. The skill content is mirrored live from exchekinc/exchekskills and edge-cached for 6h. Push to the skills repo → cache expires → clients see the new version automatically. See Install the ExChek skills for the local plugin install path, or the MCP guide for connecting LLM agents.

Documents Enterprise

Render a completed classification analysis into ExChek’s branded, audit-ready PDF memorandum (~28 pages: executive summary, Order of Review, license determination, screening record, red-flag checklist, signature chain, per-sheet page numbers). The analysis itself stays free — run the classify skill, then this endpoint typesets the result. Rendering is stateless: your payload is processed in memory and discarded — never stored, never logged. Payloads must not contain CUI or classified information. Enterprise API keys: matt@exchek.us.

MCP server

For LLM-driven agents, the same API also speaks the Model Context Protocol over Streamable HTTP. Point your MCP-capable client at https://api.exchek.us/mcp; the server exposes 14 tools (skill + eCFR lookups, plus the Enterprise PDF contract, memorandum renderer, dashboard transaction sync, regulatory notes, and the Screening Center) and 147 resources (every SKILL.md, template, reference, and prompt). See the MCP guide for full setup, examples, and the tool catalog.

Deprecated

Error handling

Caching

All data responses include Cache-Control: public, max-age=3600, stale-while-revalidate=86400 (1h for eCFR, 6h for skill content). Responses are cached at Cloudflare’s global edge, so repeat requests resolve in under 50ms from any region without invoking the Worker. A Cloudflare Worker cron runs daily at 00:00 UTC to re-fetch every supported eCFR part, keeping the edge cache warm.

Fallbacks

If the ExChek API returns 503, you can hit the upstream sources directly (no auth):

• GET https://www.ecfr.gov/api/versioner/v1/structure/current/title-15.json — Title 15 (EAR, Subchapter C)
• GET https://www.ecfr.gov/api/versioner/v1/structure/current/title-22.json — Title 22 (ITAR, Subchapter M)
• GET https://raw.githubusercontent.com/exchekinc/exchekskills/main/skills/{folder}/SKILL.md — Skill content (replace {folder} with e.g. exchek-skill-csl)