Carnegie Mellon University Agentic Access

generated: '2026-08-19'
method: derived
source: openapi/carnegie-mellon-university-delphi-epidata-openapi.yml, openapi/carnegie-mellon-university-cert-vulnerability-notes-openapi.yml,
  openapi/carnegie-mellon-university-library-publishing-openapi.yml — each itself derived from live probes
  on 2026-08-19
x-operator: institution
description: 'Recommended x-agentic-access execution contracts for the API surfaces Carnegie Mellon University
  actually operates. Rewritten 2026-08-19. The file this replaces described 157 operations (/altmetric/institutions,
  /articles, /projects, /symplectic...) classified 76 connected / 81 acting, with 79 writes and 2 safety-critical
  operations requiring a human in the loop. Not one of those operations was Carnegie Mellon''s — every
  one came from the figshare v2 contract, and the governance posture it recommended was governance of
  a vendor''s product under a university''s name. The real posture is far simpler and far duller: every
  institution-operated CMU endpoint is a public, anonymous, read-only GET. There are no writes, no credentials,
  no subjects and nothing safety-critical, so there is nothing here for an agent to do irreversibly. The
  genuine agent hazard on these surfaces is not consequence but MISREADING: both research APIs return
  errors with HTTP 200, so an agent that branches on status will treat a malformed query as an empty success.
  See errors/carnegie-mellon-university-errors.yml.'
summary:
  operations: 16
  by_action_class:
    connected: 16
    acting: 0
  by_consequence:
    read: 16
    write: 0
    safety-critical: 0
  human_in_the_loop_required: 0
  surfaces: 3
agent_hazards:
- hazard: error-in-200
  surfaces:
  - https://api.delphi.cmu.edu/epidata
  - https://kb.cert.org/vuls/api
  detail: Delphi returns {"epidata":[],"message":"missing parameter...","result":-1} with HTTP 200; CERT/CC
    returns {"error":"Content requested either does not exist or you do not have permissions to view it!"}
    with HTTP 200 for an unknown identifier AND for every unimplemented path. An agent must validate the
    body. Neither API can be safely explored by probing, because a not-found is indistinguishable from
    a not-implemented and from a not-authorized.
- hazard: no-versioning-boundary
  surfaces:
  - https://api.delphi.cmu.edu/epidata
  - https://kb.cert.org/vuls/api
  detail: Neither API has a versioned base path or media-type version. Delphi exposes a service version
    at /epidata/version (4.1.44 on 2026-08-19) but nothing to pin a contract to. A response shape can
    change without a boundary an agent can detect.
- hazard: unannounced-retirement
  surfaces:
  - https://api.heinz.cmu.edu/courses_api/
  detail: CMU publishes no deprecation policy. api.heinz.cmu.edu/courses_api retired into an HTML page
    with no Sunset header, no notice and no successor. An agent holding a cached CMU endpoint has no signal
    that it has stopped being an API.
operations:
- aid: carnegie-mellon-university:delphi-epidata
  server: https://api.delphi.cmu.edu/epidata
  path: /version
  method: get
  operationId: getVersion
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:delphi-epidata
  server: https://api.delphi.cmu.edu/epidata
  path: /covidcast_meta/
  method: get
  operationId: getCovidcastMeta
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:delphi-epidata
  server: https://api.delphi.cmu.edu/epidata
  path: /covidcast/
  method: get
  operationId: getCovidcast
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:delphi-epidata
  server: https://api.delphi.cmu.edu/epidata
  path: /fluview/
  method: get
  operationId: getFluview
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:delphi-epidata
  server: https://api.delphi.cmu.edu/epidata
  path: /delphi/
  method: get
  operationId: getDelphiForecast
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:cert-vulnerability-notes
  server: https://kb.cert.org
  path: /vuls/api/{idnumber}/
  method: get
  operationId: getVulnerabilityNote
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:cert-vulnerability-notes
  server: https://kb.cert.org
  path: /vuls/api/{idnumber}/vuls/
  method: get
  operationId: listNoteVulnerabilities
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:cert-vulnerability-notes
  server: https://kb.cert.org
  path: /vuls/api/{idnumber}/vendors/
  method: get
  operationId: listNoteVendors
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:cert-vulnerability-notes
  server: https://kb.cert.org
  path: /vuls/atomfeed/
  method: get
  operationId: getVulnerabilityNotesFeed
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:library-publishing
  server: https://lps.library.cmu.edu
  path: /api/
  method: get
  operationId: getApiRoot
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:library-publishing
  server: https://lps.library.cmu.edu
  path: /api/journals/
  method: get
  operationId: listJournals
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:library-publishing
  server: https://lps.library.cmu.edu
  path: /api/issues/
  method: get
  operationId: listIssues
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:library-publishing
  server: https://lps.library.cmu.edu
  path: /api/articles/
  method: get
  operationId: listArticles
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:library-publishing
  server: https://lps.library.cmu.edu
  path: /api/preprints/
  method: get
  operationId: listPreprints
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:library-publishing
  server: https://lps.library.cmu.edu
  path: /api/keywords/
  method: get
  operationId: listKeywords
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
- aid: carnegie-mellon-university:library-publishing
  server: https://lps.library.cmu.edu
  path: /api/oai/
  method: get
  operationId: oaiPmh
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: none
    token: none
    human-in-the-loop: false
    rationale: Public, anonymous, read-only GET on an institution-operated host.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com