NexGenData

Posted on Jun 1 • Originally published at thenextgennexus.com

SEC 8-K Filings API: Build a Material Events Tracker (2026 Guide)

#8k #api #compliance #edgar

TL;DR. SEC Form 8-K is the four-business-day disclosure US public companies must file when something material happens — M&A, CEO departures, bankruptcy, cyber incidents (Item 1.05), or material agreements. The SEC publishes every 8-K on EDGAR for free in real time. The hard part is parsing the item codes and the unstructured body text into something queryable. This guide covers: (1) EDGAR's official endpoints and the recent JSON submissions API at data.sec.gov, (2) the 8-K item taxonomy that matters for event-driven workflows, (3) a working Python tracker using the SEC EDGAR 8-K Filings actor that returns structured JSON with item codes already parsed, and (4) how 8-K data compares to commercial feeds like Bloomberg and Refinitiv.

What an 8-K actually contains

Form 8-K is governed by SEC rules under Section 13 of the Securities Exchange Act. Filers must report within four business days of a triggering event. The form is structured by item codes — each code maps to a category of material event. The codes that matter most for trading, compliance, and research workflows:

Item 1.01 — Entry into a Material Definitive Agreement (M&A LOIs, supply contracts, financing)
Item 1.05 — Material Cybersecurity Incidents (added by the SEC in July 2023)
Item 2.01 — Completion of Acquisition or Disposition of Assets
Item 2.02 — Results of Operations and Financial Condition (earnings)
Item 4.02 — Non-Reliance on Previously Issued Financial Statements (restatements)
Item 5.02 — Departure / Election of Directors or Principal Officers
Item 7.01 — Regulation FD Disclosure
Item 8.01 — Other Events (catch-all — read carefully)

The full list lives on the SEC Form 8-K instructions PDF. Knowing the item taxonomy is half the battle — most useful 8-K analytics filter on a small set of codes.

Official EDGAR routes for 8-K data

EDGAR exposes 8-K filings through several free endpoints. None of them is a one-call "give me parsed 8-Ks" API, but together they cover most needs:

Full-text search — https://efts.sec.gov/LATEST/search-index?q=%228-K%22&forms=8-K. Returns JSON with accession numbers, dates, and filer CIKs. Rate-limited to 10 requests per second per IP per SEC's fair access policy.
Submissions API — https://data.sec.gov/submissions/CIK{cik}.json. Per-company submission history. Useful if you already know which issuers to track.
RSS / Atom feeds — https://www.sec.gov/cgi-bin/browse-edgar?action=getcurrent&type=8-K&output=atom. Latest filings as they hit EDGAR. Cheap to poll but limited to recent filings.
Raw filing index — daily index files at https://www.sec.gov/Archives/edgar/full-index/{year}/QTR{q}/form.idx.

Caveats: EDGAR requires a descriptive User-Agent header with a real contact email per the SEC's policy. Filings older than the current quarter sometimes return slower from the archive. And — critically — none of these endpoints parses 8-K item codes for you. The codes are inside the filing body text. You have to extract them.

The parsing problem

A typical 8-K filing is an HTML or plain-text document with sections like "Item 1.01 Entry into a Material Definitive Agreement". Filers format item headers inconsistently — some bold them, some use different casing, some include the item code only in a table of contents. A naive regex like r"Item\s+(\d+\.\d+)" works most of the time but misses ~3–5% of filings without additional logic. For exhibit detection (the press release attached as Exhibit 99.1 to most 8-Ks), you need to walk the filing index XML.

If you only need a handful of filings, doing this yourself is fine. If you need every 8-K filed in real time with structured item-code arrays, dedupe by accession number, and a stable JSON schema — that's where a pre-built actor saves a week of work.

Working Python example

The SEC EDGAR 8-K Filings actor returns parsed JSON with the item codes already extracted and the exhibit links resolved. Curl version:


    curl -X POST "https://api.apify.com/v2/acts/nexgendata~sec-edgar-8k-filings/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"itemCodes": ["1.05", "5.02"], "since": "2026-05-01", "maxResults": 200}'

Python version, filtering for cyber-incident filings and exec departures:


    import os, json, urllib.request

    APIFY_TOKEN = os.environ["APIFY_TOKEN"]
    ACTOR = "nexgendata~sec-edgar-8k-filings"

    payload = json.dumps({
        "itemCodes": ["1.05", "5.02"],
        "since": "2026-05-01",
        "maxResults": 500,
        "includeExhibits": True,
    }).encode("utf-8")

    url = f"https://api.apify.com/v2/acts/{ACTOR}/run-sync-get-dataset-items?token={APIFY_TOKEN}"
    req = urllib.request.Request(url, data=payload, method="POST",
                                  headers={"Content-Type": "application/json"})

    with urllib.request.urlopen(req, timeout=600) as r:
        filings = json.loads(r.read())

    for f in filings:
        print(f["filedAt"], "|", f["companyName"], "|", f["items"])
        print("  ", f["filingUrl"])

Returned shape per filing:


    {
      "accessionNumber": "0001193125-26-123456",
      "cik": "0000320193",
      "companyName": "APPLE INC",
      "ticker": "AAPL",
      "filedAt": "2026-05-15T16:32:00-04:00",
      "items": ["2.02", "9.01"],
      "itemDescriptions": ["Results of Operations and Financial Condition",
                            "Financial Statements and Exhibits"],
      "filingUrl": "https://www.sec.gov/Archives/edgar/data/320193/...",
      "exhibits": [{"type": "99.1", "url": "..."}]
    }

Comparison: official EDGAR vs commercial feeds

Source	Latency	Item parsing	Historical	Cost
EDGAR raw (DIY parser)	Real-time (seconds)	None — you build it	Back to 1993	Free (eng time)
Bloomberg Terminal CHRT/CN	Sub-second	Yes, proprietary taxonomy	Full	~$2,000/mo per seat
Refinitiv Eikon Filings	Real-time	Yes	Full	~$1,800/mo per seat
S&P Global Capital IQ	Real-time	Yes	Full	Enterprise quote
EDGAR 8-K actor (Apify)	~1–5 min after EDGAR	Yes, item-code arrays	~12 months default, configurable	PPE — pay per filing

For most non-HFT use cases — RegTech monitoring, equity research, M&A surveillance, cyber-incident tracking — the EDGAR-derived feed is sufficient and dramatically cheaper than terminal access.

Common workflows this enables

Cyber incident tracker — filter Item 1.05 across all CIKs to log every SEC-reported material cyber incident since the July 2023 rule.
M &A radar — Item 1.01 + Item 2.01 with body-text keyword filters for "merger," "acquisition," "definitive agreement."
Restatement screen — Item 4.02 hits flag companies with non-reliance disclosures, a strong audit-risk signal.
Exec turnover dashboard — Item 5.02 with named-entity extraction on the body.
Event-study pipeline — pair the 8-K timestamp with intraday price data to measure abnormal returns around disclosure.

Timing notes that matter for trading use

The "four business days" rule sets the outer bound but most 8-Ks file faster — within a day or two of the triggering event. Two timing subtleties matter for any time-sensitive workflow:

Filed-at vs accepted-at — EDGAR distinguishes between filed time (what the issuer sent) and accepted time (when EDGAR accepted it). Public availability tracks accepted time. The lag is usually seconds but can be several minutes during EDGAR maintenance windows.
After-hours filings — issuers commonly file 8-Ks after market close. The press release in Exhibit 99.1 typically goes out on the wires roughly simultaneously, but the 8-K filing timestamp is the authoritative "this is public" mark for compliance and event-study purposes.

The cyber-incident disclosure rule

Item 1.05 was added in July 2023 and requires disclosure of material cybersecurity incidents within four business days of materiality determination. The rule changed the public-disclosure landscape for cyber risk substantially — there's now a single canonical source for every material US public-company cyber incident. As of 2026, Item 1.05 filings remain a small fraction of total 8-K volume (under 1%) but each one is a high-signal event for cyber-insurance underwriters, IR teams benchmarking peer disclosure, and security researchers tracking the threat landscape.

Where to go next

If 8-K event tracking is part of a broader compliance or research stack, you'll likely want adjacent feeds: SEC enforcement actions, insider Form 4 filings, and 13F holdings. Each has the same EDGAR-as-source / parsing-as-bottleneck shape.

Get started: Pull your first 100 8-K filings for free at the SEC EDGAR 8-K actor page. No credit card. Filter by item code, ticker, or CIK.

DEV Community