# U.S. Election Assistance Commission (EAC) > The EAC is an independent, bipartisan federal commission created by the Help America Vote > Act of 2002. It adopts the Voluntary Voting System Guidelines, accredits voting system test > laboratories, certifies voting systems, administers HAVA grants, and runs the national > clearinghouse for election administration information. > GENERATED BY API EVANGELIST, NOT PUBLISHED BY THE EAC. https://www.eac.gov/llms.txt returns > HTTP 404. This file is written from live probes of the EAC's own surfaces on 2026-09-06 so > that an agent has something correct to read. Everything below was fetched and verified. ## What is machine-readable The EAC has no developer portal, no API documentation, no SDK and no API key. It nonetheless serves two real machine surfaces, neither of which it advertises: - [JSON:API content surface](https://www.eac.gov/jsonapi): live, anonymous, read-only JSON:API 1.0 generated by Drupal 10. 216 resource types advertised; 210 return HTTP 200 with `application/vnd.api+json`; 86 return real content. No key, no account, no OAuth. - [Open data catalog](https://www.eac.gov/data.json): Project Open Data / DCAT-US v1.1 catalog of 11 datasets, chiefly the Election Administration and Voting Survey (EAVS) bulk files. - [News RSS feed](https://www.eac.gov/rss.xml): RSS 2.0. The API is READ-ONLY BY CONFIGURATION. Any POST, PATCH or DELETE returns HTTP 405 with `"JSON:API is configured to accept only read operations."` There is no credential that changes this. Nothing an agent does against this surface can alter anything. ## Highest-value collections - [Certified voting systems](https://www.eac.gov/jsonapi/node/voting_system): 117 records — certification, withdrawal and termination dates, version, testing status, and relationships to manufacturer, test lab, testing standard and certification status. Side-load with `?include=field_manufacturer,field_testing_lab,field_certification_status`. - [Accredited test laboratories (VSTLs)](https://www.eac.gov/jsonapi/node/voting_system_test_lab): 8 records. - [Registered manufacturers](https://www.eac.gov/jsonapi/node/manufacturer): 20 records. - [Engineering Change Orders](https://www.eac.gov/jsonapi/node/engineering_change_order): 275 records, each carrying manufacturer-submission, VSTL-approval and EAC-approval dates. - [Notices of Clarification](https://www.eac.gov/jsonapi/node/notice_of_clarification): 27 records. - [Testing standards (VVSG versions)](https://www.eac.gov/jsonapi/node/testing_standard): 5 records. - [State registration and voting information](https://www.eac.gov/jsonapi/node/register_vote_and_contact_state): 56 records (50 states, DC and 5 territories) with upcoming election dates, registration deadlines, and each state's own registration and polling-place lookup URLs. - [State election information](https://www.eac.gov/jsonapi/node/state_election_information): 113 records including online-voter-registration status. - [NVRA state pages](https://www.eac.gov/jsonapi/node/nvra): 155 records (per state, per language). - [HAVA Election Security grants](https://www.eac.gov/jsonapi/node/es_funds): 56 records. - [HAVA state grant financials](https://www.eac.gov/jsonapi/node/state_funds): 56 records. - [Clearinghouse (Clearie) Awards](https://www.eac.gov/jsonapi/node/clearinghouse_awards): 561 records. - [News and blog articles](https://www.eac.gov/jsonapi/node/article): 495 records. - [FAQs](https://www.eac.gov/jsonapi/node/faqs): 378 records. ## How to call it - Base: `https://www.eac.gov/jsonapi` - Start at the base URL: it returns a `links` map of every valid `entity--bundle` collection. Enumerate from it rather than constructing paths — an unknown resource type returns an HTML 404, not a JSON:API error. - Media type: `application/vnd.api+json` on request and response. - Paginate with `page[limit]` (capped at 50) and `page[offset]`; follow `links.next`. No total count is returned anywhere. - Filter: `filter[label][path]=title&filter[label][operator]=CONTAINS&filter[label][value]=...` An unknown field returns HTTP 400. - Sort with `sort=-field_certification_date` (leading `-` for descending). - Reduce payloads with sparse fieldsets: `fields[node--voting_system]=title,field_version`. - Cache: responses carry `ETag`, `Last-Modified` and `cache-control: max-age=31536000`. Use conditional requests — the one-year max-age is not a guarantee the data has not changed. - Detect updates by polling `?sort=-changed`; there is no webhook, no event stream and no AsyncAPI. ## Traps an agent must know - A collection can return HTTP 200 with an empty `data` array AND a `meta.omitted` block meaning "not permitted", not "no records". 63 of 216 resource types behave this way. Always check `meta.omitted`. - Three collections (`node--event`, `user--user`, `token_custom--custom`) returned HTTP 503 persistently across retries spanning hours. Treat a 503 that survives three attempts on one collection as that collection being unavailable and move on. - `node--jurisdiction_data`, `paragraph--eavs_data` and `taxonomy_term--eavs_states` are advertised but empty. EAVS microdata is NOT in the API — it is in the bulk files listed at https://www.eac.gov/data.json. - Document relationships are doubled (`field_certification` and `field_certification_media`). Read the `_media` variants; they resolve to `media--document`, which resolves to `file--file`. - There is no versioning policy, no deprecation policy, no changelog and no status page. The contract is whatever the Drupal content model is on the day you call. - Manufacturer and test-lab records carry named individual contacts and phone numbers. They are public records, but treat them as personal data. ## Rate limits None documented, none observed. No `X-RateLimit-*`, `RateLimit-*` or `Retry-After` header was returned on roughly 300 requests. `robots.txt` does not disallow `/jsonapi` or `/data.json` and sets no `Crawl-delay`. Self-pace, and use conditional requests. ## Cost Free. No key, no account, no plan, no quota. U.S. federal government works are generally not subject to copyright in the United States (17 U.S.C. 105). ## Security - [Vulnerability Disclosure Policy](https://www.eac.gov/vulnerability-disclosure-policy) — CISA BOD 20-01 shaped, with safe-harbour authorization, a 45-day disclosure window, an in-scope list (eac.gov and subdomains, votebymail.gov, helpamericavote.gov), and a reporting form. No bug bounty. - No `/.well-known/security.txt` is served, so the policy above is not machine-discoverable. ## Human pages - [EAC home](https://www.eac.gov) - [Research and Data](https://www.eac.gov/research-and-data) - [Studies and Reports](https://www.eac.gov/research-and-data/studies-and-reports) - [Voluntary Voting System Guidelines](https://www.eac.gov/voting-equipment/voluntary-voting-system-guidelines) - [News](https://www.eac.gov/news) - [Blogs](https://www.eac.gov/blogs) - [Contact the EAC](https://www.eac.gov/contact) - [Privacy Statement](https://www.eac.gov/main/privacy-statement) - [Accessibility Statement](https://www.eac.gov/accessibility-statement) - [FOIA](https://www.eac.gov/foia/freedom-information-act-foia) ## Not available No MCP server. No A2A agent card. No GraphQL. No AsyncAPI, webhooks or events. No SDK, CLI or Postman collection. No sandbox. No `/.well-known/` document of any kind on any EAC host.