CFR API: 222,311 Federal Regulation Sections, Refreshed Daily

A CFR API returns one section of the Code of Federal Regulations as structured JSON, addressed by a stable id rather than by a URL you scraped. The Vaquill AI corpus carries 222,311 CFR sections, refreshed daily, inside a federal set of over 1.5 million sections. The part that trips people up is the hierarchy: the CFR is scoped by part, the US Code is scoped by chapter, and an API filter that mixes them up gets rejected. This post walks the hierarchy, three real queries, the CFR-versus-Federal-Register split that causes most "your data is wrong" tickets, and how point-in-time lookups work.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice.

TL;DR

• The CFR's useful scoping unit is the part. 17 C.F.R. Part 240 is the Exchange Act rules. Pass titleNumber: 17, part: "240" and you have scoped a search to exactly that body of rules.
• An unpaired chapter or part is rejected with a 422. Part numbers repeat across titles, so the API refuses the ambiguous call and says why in the error message.
• The CFR is the codified snapshot. The Federal Register is the amendment stream. A rule can be final and legally effective while the CFR text hasn't caught up. Model both or you will ship a bug.
• statutoryAuthority links a regulation up to its enabling statute, and implementingRegulations runs the same link in reverse from a USC section down to the CFR parts that implement it.
• Versioning has two layers. On a current CFR section, asOf=YYYY-MM-DD rebuilds earlier text from the changes we observed (asOf.engine is observed_change). GPO's published annual editions are a separate corpus, CFR_ANNUAL, where the same parameter returns the printed edition. Alongside both you get lastAmendedYear, a captured change log per section, and before/after diffs on a watched board.
• CFR data is refreshed daily. GET /boards is free and reports each source's cadence and lastRetrievedAt. GET /us/statutes/coverage is free and reports what we hold.

This post belongs to our US primary law corpus series, which walks the corpus one source at a time.

Two posts pair directly with this one: the Federal Register API guide covers the amendment stream that the codified text lags behind, and the FAR and DFARS API guide covers the Title 48 chapter split. For the state-level analogue, see the State Regulations API guide.

A short history: an oil case, a deleted paragraph, and 50 titles

The CFR exists because in 1934 nobody could say for sure what the federal rules were.

The case that made the point was Panama Refining Co. v. Ryan, argued at the Supreme Court in December 1934 and decided on January 7, 1935. It was a fight over a provision of a petroleum code issued under the National Industrial Recovery Act. Trouble was, an executive order had deleted that provision on September 13, 1933 (it was put back on September 25, 1934). Chief Justice Hughes wrote that the persons affected, "the prosecuting authorities, and the courts, were alike ignorant of the alteration." Read that again as a developer. Lawyers on both sides, and judges, argued over text that wasn't there. You can read the opinion on the Library of Congress site.

The National Archives calls the Federal Register the legacy of a "perfect storm" of events that peaked as a public policy concern in December 1934. Congress responded with the Federal Register Act, approved on July 26, 1935 (Public Law 74-220). Its rule survives in the statute today: under 44 U.S.C. 1507, a document that must be published in the Federal Register is not valid as against a person who has not had actual knowledge of it until the document has been filed with the Office of the Federal Register and made available for public inspection. The first issue came out on March 14, 1936, and it ran sixteen pages.

A daily journal fixes the notice problem. It doesn't tell you what the rulebook says today, because a 1936 rule may have been amended five times since. So in 1937 Congress amended the Act (Public Law 75-158, June 19, 1937) to require a codification: each agency had to file a complete set of its documents in force on June 1, 1938. On October 11, 1938, the President authorized the Code of Federal Regulations, built from 50 titles. That is the same 50-title structure you query now. All of this comes from the Office of the Federal Register's own brief history, which is worth a skim. (It gives the first issue date as March 14 on the cover and March 16 in one paragraph. The cover date is the one we use.)

The hierarchy you have to model

The CFR is 50 titles. Under a title, the structure goes chapter, subchapter, part, subpart, section. Every one of those levels appears on a result, and each one answers a different question.

Here is the thing most developers get backwards on their first integration. In the US Code, chapter is the meaningful container: 42 U.S.C. Chapter 21 is the civil rights chapter, and USC_T42_C21_S1983 encodes it. In the CFR, chapter tells you which agency writes the rules, which you usually already know, and part is what a compliance team actually reasons about.

Nobody says "we have an obligation under 17 CFR Chapter II." They say "we have an obligation under Part 240." So the API takes both chapter and part, and which one you reach for depends on the corpus you are querying.

Worked query 1: scope to 17 C.F.R. Part 240

Insider trading sits in the Exchange Act rules. To search only there:

curl -X POST https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "affirmative defense trading plan adopted in good faith",
    "corpusType": "CFR",
    "titleNumber": 17,
    "part": "240",
    "limit": 10
  }'

The top hit is 17 C.F.R. 240.10b5-1, whose actId is CFR_T17_P240_S240_10b5_1. Note the shape: title, part, then the section number with dots and hyphens flattened to underscores. (The curl above needs a key, so we did not run it as written. The same parameters returned that top hit through our MCP client on 12 October 2026, for 4 credits.)

Do not build that id by hand. It looks derivable and mostly is for the CFR, which is exactly what makes it dangerous. Across the rest of the corpus the container segments aren't recoverable from a citation, so a hand-assembled id 404s and the failure reads like a coverage gap. Take the id from the search response, and see the section id reference for why the shape isn't guessable.

Every result also carries a parent object. Pass it straight back to GET /us/statutes/divisions and you get the section's siblings, which is how you walk a part without knowing its shape in advance. The browse-hierarchy recipe works a title down to its parts.

Worked query 2: scope to a whole title

Drop part and you get the title. This is the query for "what do the SEC's regulations say about X" when you don't yet know which part the answer lives in.

-d '{
  "query": "material nonpublic information",
  "corpusType": "CFR",
  "titleNumber": 17,
  "limit": 25
}'

limit maxes at 50 and offset at 70, so one ranking gives you up to 120 results. Paging is cut from a single ranking rather than re-run per page, so results never repeat or vanish between pages, and a later page costs the same 4 credits as the first. The pagination rules cover both ceilings.

Worked query 3: matchType=phrase for a defined term

Default search is hybrid, semantic plus keyword. That is right for a natural-language question and wrong for a defined term, where you want the literal string and nothing adjacent to it.

-d '{
  "query": "qualified financial contract",
  "corpusType": "CFR",
  "matchType": "phrase",
  "limit": 20
}'

matchType takes any (hybrid, the default), all (every query term must appear), and phrase (exact phrase). Use phrase when you are hunting a term of art across titles and semantic neighbors would bury it.

The CFR is a snapshot, the Federal Register is the stream

This is the relationship compliance engineers keep getting wrong, and it produces a specific, repeatable bug.

An agency publishes a final rule in the Federal Register. That document has an effective date. On that date the rule is law. The CFR is the codified restatement, and the codified text is updated on its own schedule, which isn't the effective date.

So there can be a window where the rule is in force and the CFR text you are reading does not reflect it. The eCFR's own site policy page says as much: it tells readers relying on it for legal research to verify their results against the most current official edition of the CFR, the daily Federal Register and the List of CFR Sections Affected. If your compliance product answers only from CFR text, it will confidently serve superseded language during that window and give you no signal that it did.

The fix is to query both corpora and reconcile. The Federal Register corpus holds over 196,000 agency rule documents (final and proposed) from 1994 to the present, filterable by documentType set to final or proposed, by agency, and by a publishedFrom/publishedTo window. The filters and paging rules for that side are in the Federal Register API guide.

A practical pattern for a compliance check on 17 C.F.R. Part 240:

1. Retrieve the CFR sections in the part.
2. Search corpusType: "FEDERAL_REGISTER" with documentType: "final", the issuing agency, and publishedFrom set to a few months back.
3. Any final rule touching that part and not yet reflected in the codified text is your pending-amendment set. Surface it next to the answer.

That third step is the one teams skip, and it is the whole difference between a tool a compliance officer trusts and one they stop opening.

Which copy of the CFR are you reading?

There isn't just one. The official annual edition is posted on govinfo as PDF files. The National Archives says the CFR is "updated once each calendar year and is issued on a quarterly basis": titles 1 to 16 on January 1, 17 to 27 on April 1, 28 to 41 on July 1, and 42 to 50 on October 1. Take Title 17, the SEC's home. In September, the official volume is five months old. GovInfo points readers to a tool for the gap, the List of CFR Sections Affected, which tracks proposed, new and amended regulations published in the Federal Register since a title's most recent revision date. The National Archives page has the quarterly schedule.

The eCFR fills that gap. Its help page describes it as a web version of the CFR "that we update daily to better reflect its current status," an editorial compilation of CFR material and the amendments published in the daily Federal Register. The same page says the Office of the Federal Register and GPO maintain it as an informational resource, with the objective of eventually establishing it as a publication officially recognized by the Administrative Committee of the Federal Register. GovInfo calls the eCFR an unofficial editorial compilation, and the Archives calls it unofficial but endorsed by the Administrative Committee. So the fresh copy is the convenient one, and the dated PDF is the official one. Know which you cited. If you need an exact version for a past date, the CFR annual editions guide covers it.

A story about not knowing

Here's what it costs when someone doesn't know. In Federal Crop Insurance Corp. v. Merrill (1947), Idaho wheat farmers applied for federal crop insurance and told the local committee acting as the Corporation's agent that 400 of their 460 acres of spring wheat were being reseeded on winter wheat acreage. They were told the entire crop was insurable. A regulation published in the Federal Register said spring wheat reseeded on winter wheat acreage was not insurable. Drought destroyed most of the crop on the reseeded acreage and the Corporation refused to pay. The farmers had no actual knowledge of that regulation, and the Supreme Court sided with the government. Justice Frankfurter wrote: "Just as everyone is charged with knowledge of the United States Statutes at Large, Congress has provided that the appearance of rules and regulations in the Federal Register gives legal notice of their contents." The regulations bound everyone "regardless of actual knowledge of what is in the Regulations or of the hardship resulting from innocent ignorance." Read the full opinion.

Nobody expects your users to be wheat farmers. The takeaway is for the person building the tool: if the Register is where the law gets noticed, a product that only reads the compiled CFR is a step behind the legal clock.

What developers say

People who build on these free government sources have opinions, and they aren't all complaints. Here are two from Hacker News.

On the praise side, a commenter pointing another developer to govinfo wrote that "regulatory material (both Federal Register and CFR) is also published in XML" (dragonwriter, Hacker News, October 2021), through GPO's bulk data repository. If you plan to parse the CFR yourself, that's the starting point.

And on how the code actually changes, another commenter, arguing about whether laws should expire, put it this way: "Often times those bills are collections of amendments which do things like add a phrase or swap out a word or add a bullet point to a list. They're like diffs." (krferriter, Hacker News, June 2026). That comment is about statutes, but the mental model carries over: the Register hands you the diffs, and the CFR is what you get after someone applies them.

What "daily refresh" and "current through" actually mean

The CFR corpus refreshes daily. That means a job pulls from the government publisher, compares against the copy we hold, and writes what moved. It doesn't mean the publisher regenerated everything that day.

Three separate facts, and you want all of them:

• What we hold. GET /us/statutes/coverage is free and returns, per jurisdiction, how many sections sit in each corpusType, plus totalPassages and a measuredAt timestamp. It reports what we hold, not how recently it was refreshed.
• Our refresh cadence is when we last looked. GET /boards is free and carries cadence and lastRetrievedAt for every watchable source. On 12 October 2026 the cfr board showed a daily cadence and a lastRetrievedAt of that day. It records when we last checked, not when the law last changed.
• The publisher's own currency is what the source says it is current through. Where a publisher states one, it rides on the section itself as currentThrough. On 12 October 2026 the record for 42 U.S.C. 1983 carried currentThrough: "2026-09-18", while the CFR section we pulled (16 C.F.R. 444.1) carried none.

Sources differ. The US Code is a codified statute compiled from enacted law, and the CFR is a codified regulation that can change daily, so a UI that presents them with identical freshness is overstating one of them. Read the board and the per-section currentThrough instead of assuming a single cadence. The full breakdown lives in the coverage docs.

Following the authority chain

A regulation is only valid because a statute authorized it. Two fields carry that link, and they are the reason a regulation lookup can answer a question a plain text search can't.

statutoryAuthority is populated on CFR sections. It parses the section's Authority note into structured citations. The entries are mostly USC citations, and can also be Public Law or Statutes at Large citations. A broad part carries a long list: the 17 C.F.R. 240.10b5-1 record we pulled on 12 October 2026 listed dozens of them. Each entry looks like this:

"statutoryAuthority": [
  { "type": "usc", "title": 15, "section": "78o", "display": "15 U.S.C. 78o" }
]

implementingRegulations is the reverse, on USC sections. It is derived from every CFR section's own statutoryAuthority, so from a statute you can see which CFR parts implement it. It is null where nothing in the CFR cites the section: the record for 15 U.S.C. 78j came back null on 12 October 2026. Where it is populated, each entry looks like this:

"implementingRegulations": [
  { "cfrTitle": 17, "part": "240", "partName": "...", "display": "17 CFR Part 240" }
]

Alongside those, crossReferencesUsc and crossReferencesCfr carry references parsed out of the running text, not the authority note. A USC reference comes back as "42:1983", and "self:<section>" marks a pointer to another section of the same title. The 42 U.S.C. 1983 record returned ["28:1343", "8:43"] on 12 October 2026.

The difference matters. statutoryAuthority answers "what lets this agency do this." crossReferencesUsc answers "what else does this text point at." A regulatory-graph feature needs both edges, and conflating them produces a graph that looks dense and means nothing.

The versioning model, stated precisely

The CFR is served in two forms. corpusType=CFR is the regulation as it stands today. corpusType=CFR_ANNUAL is GPO's published annual editions, 31 of them from 1996 to 2026, as a separate corpus with its own ids (CFRANN_2002_T16_P444_S444_1 is the 2002 edition of 16 C.F.R. 444.1).

asOf=YYYY-MM-DD on the section body endpoint behaves differently on each. On 12 October 2026 we asked a current CFR id (CFR_T16_P444_S444_1) for asOf=2020-06-01, and asOf.engine came back observed_change: text rebuilt from changes our refreshes observed, bounded by when capture began. We asked the CFR_ANNUAL id for asOf=2003-06-01, and asOf.engine came back stored_edition with resolvedEditionYear: 2003: GPO's own printing. Do not expect a published edition from a plain CFR id. The CFR annual editions guide covers that corpus.

Say that plainly to your users. A tool that implies more historical retrieval than it has is worse than one that states its versioning model and lets you design around it. Here is what sits alongside the editions, and for most compliance work it covers the real question.

Three things to be careful about here.

detectedAt is when we saw it, not when it took effect. It is an upper bound on the effective date. For the publisher's own dates, read amendmentHistory. The two are complements and neither substitutes for the other.

An empty change list means "no captured change", not "never amended". Change capture started long after the corpus did, it is per-source, and the 16 C.F.R. 444.1 response on 12 October 2026 said events are retained for 5 years. Every response carries a coverage field saying so. Render that, don't render an empty list as "unchanged". How We Know a Law Changed: Boards, Diffs, and the False Positives Nobody Talks About goes through what the detector can and can't see.

yearFrom/yearTo excludes sections with no amendment credit. The API reference says about a fifth of sections carry none, because some publishers print none. Set either bound and those drop out. That is correct behavior and a nasty surprise if you assume the filter is only narrowing by date.

A repealed or removed section still answers. When the newest captured change is a removed, the section is gone from the corpus and section comes back null with a successful, charged response. Learning that a provision was repealed is the point, so it isn't a 404.

Where the CFR sits in the wider federal set

CFR is the largest federal corpus we carry, but the compliance answer often needs its neighbors. Every token in the corpusType column is defined in the corpus types reference.

Each source refreshes on its own schedule, and GET /boards reports it.

Inside CFR, source splits Title 48 into the FAR (far, 3,118 sections) and the DFARS (dfars, 1,705 sections). That is a chapter split of data already in the CFR count, not extra sections. If you build for government contractors, the companion post on the FAR and DFARS API covers the clause-lookup and flow-down patterns in detail.

SESSION_LAW items are worth one caution. They carry actStatus: "enacted" and goodLawStatus: "unknown" on purpose. They are law as enacted, a historical record of what Congress passed, not a statement of what is currently in force. Do not present a session law as current law.

FAQ

Is there an official CFR API from the government?

The government publishes the CFR through eCFR and govinfo, and both offer developer access to their own copies of the data. What that doesn't give you is one query surface across the CFR, the US Code, the Federal Register, and 56 state and territory jurisdictions with a single schema and a stable id per section. That join is the work a commercial API is doing.

What is the difference between the CFR and the Federal Register?

The Federal Register is the daily stream: proposed rules, final rules, notices, presidential documents. The CFR is the codified restatement of the final rules, organized by subject into 50 titles. A rule appears in the Federal Register first and is folded into the CFR afterward, so during that window the CFR text can lag a rule that is already in force.

How do I search only one CFR part?

Send corpusType: "CFR" with both titleNumber and part, for example titleNumber: 17 and part: "240". Both are required together. An unpaired part is rejected with a 422 because part numbers repeat across titles and a wrong-title answer is worse than an error.

Can I get the CFR text as it read on a past date?

Yes, with a caveat about which corpus you ask. Pass asOf=YYYY-MM-DD to the section body endpoint. On a CFR_ANNUAL id the date resolves to the published GPO annual edition that governed it, with asOf.engine reporting stored_edition, which is the publisher's own printed text. On a current CFR id the engine is observed_change, a reconstruction from changes we observed. The amendment record adds lastAmendedYear, the change events our refreshes captured for a section, and before/after diffs on a watched board, which answer "has this moved" between editions.

How often is the CFR data updated?

Daily. GET /boards reports the cadence and lastRetrievedAt for every watchable source. Where a publisher states what its text is current through, that is on the section as currentThrough. GET /boards and GET /us/statutes/coverage are free.

What is statutoryAuthority on a CFR section?

It is the structured version of the section's Authority note: the USC citations that authorize the rule, as objects with type, title, section, and a display string. On a USC section the reverse field implementingRegulations lists the CFR parts that implement it, derived from every CFR section's own authority note.

Can I build a CFR actId from a citation?

You can for the CFR, and you should not. CFR_T17_P240_S240_10b5_1 is derivable from 17 C.F.R. 240.10b5-1, but the same habit fails across the rest of the corpus where container segments don't appear in the citation, and a hand-built id 404s in a way that reads like missing coverage. Take ids from a search response, or go from a citation with /us/statutes/resolve.

How do I get alerted when a CFR section changes?

Create a watch with POST /watches against the CFR board, optionally scoped to a specific actId. Change events land as your watch's refreshes observe them, and the watch's own diff endpoint returns the before and after text. GET /boards lists every watchable source for free before you subscribe.

Does the API cover state regulations too?

Yes, under corpusType: "REGULATION", over 1.5 million rules across 56 jurisdictions. State administrative codes are structured differently from the CFR, and titleNumber only applies to USC and CFR, so state codes are scoped with code instead. Check GET /us/statutes/divisions for a jurisdiction before assuming a shape, and see the State Regulations API guide for the per-state shapes.

Start with the free endpoints

The honest way to evaluate a primary-law dependency is to read what it declares about itself before you spend a credit. GET /us/statutes/coverage and GET /boards are both free, and between them they tell you every corpus count plus each source's cadence and last retrieval time.

We build Vaquill AI, the API described in this post. The collection layer behind it is published at open-us-law, so the sourcing is readable rather than asserted.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.