Kartos Therapeutics Oembed API

openapi: 3.2.0
info:
  title: Kartos Therapeutics Content Oembed API
  version: '2'
  summary: The anonymously readable WordPress REST content surface behind kartosthera.com.
  description: 'Kartos Therapeutics publishes no developer program, no developer portal and no API documentation. The only machine-readable API surface reachable on kartosthera.com without credentials is the WordPress REST API the site registers at `/wp-json/`, which is documented upstream by the WordPress REST API Handbook rather than by Kartos Therapeutics.


    This document is DERIVED by the API Evangelist enrichment pipeline from the route index the site itself publishes at https://kartosthera.com/wp-json/ (183 routes across the namespaces `oembed/1.0`, `yoast/v1`, `wp/v2`, `wp-site-health/v1`, `wp-block-editor/v1` and `wp-abilities/v1`; generator reported WordPress 7.0.2). ONLY the operations that were verified to return data anonymously on 2026-08-04 are modelled here. Write operations, and the many routes that answer `401 rest_cannot_view` / `rest_forbidden` without credentials, are deliberately excluded — see `x-anonymous-denied` on this object for the observed denials.


    The interesting part of this surface is not stock WordPress: Kartos registers two custom post types that carry the company''s actual scientific and corporate record — `presentation` (5 published congress abstracts and posters for navtemadlin, each linked to a PDF in the media library) and `team` (15 leadership, board and advisor bios, each with structured ACF fields for job title, credentials and biography). Both are REST-enabled and anonymously readable. The `posts` collection is registered but empty (`X-WP-Total: 0`) — Kartos authors no blog and no press-release archive as posts.'
  contact:
    name: Kartos Therapeutics
    email: info@kartosthera.com
    url: https://kartosthera.com/contact/
  license:
    name: Not published
  x-derived-by: API Evangelist enrichment pipeline
  x-derived-from: https://kartosthera.com/wp-json/
  x-verified: '2026-08-04'
  x-upstream-contract: https://developer.wordpress.org/rest-api/
  x-not-a-provider-published-spec: true
  x-anonymous-denied:
  - path: /wp/v2/settings
    status: 401
    code: rest_forbidden
  - path: /wp/v2/menus
    status: 401
    code: rest_cannot_view
  - path: /wp/v2/menu-items
    status: 401
    code: rest_cannot_view
  - path: /wp/v2/menu-locations
    status: 401
    code: rest_cannot_view
  - path: /wp/v2/themes
    status: 401
    code: rest_cannot_view_themes
  - path: /wp/v2/plugins
    status: 401
    code: rest_cannot_view_plugins
  - path: /wp/v2/block-types
    status: 401
    code: rest_block_type_cannot_view
  - path: /wp/v2/sidebars
    status: 401
    code: rest_cannot_manage_widgets
  - path: /wp/v2/templates
    status: 401
    code: rest_cannot_manage_templates
  - path: /wp/v2/font-collections
    status: 401
    code: rest_cannot_read
  - path: /wp/v2/icons
    status: 401
    code: rest_cannot_view
  - path: /wp-abilities/v1/abilities
    status: 401
    code: rest_forbidden
  - path: /wp-abilities/v1/categories
    status: 401
    code: rest_forbidden
  - path: /wp-block-editor/v1/url-details
    status: 401
    code: rest_cannot_view_url_details
  - path: /yoast/v1/statistics
    status: 401
    code: rest_forbidden
  - path: /wp-site-health/v1/tests/background-updates
    status: 401
    code: rest_forbidden
servers:
- url: https://kartosthera.com/wp-json
  description: Production WordPress REST API for kartosthera.com
security: []
tags:
- name: oembed
  description: The oEmbed 1.0 provider endpoint for kartosthera.com URLs.
paths:
  /oembed/1.0/embed:
    get:
      tags:
      - oembed
      operationId: getOembed
      summary: Get an oEmbed response for a kartosthera.com URL
      description: The oEmbed 1.0 provider endpoint. Returns provider name, author, title and embeddable HTML for any published kartosthera.com URL. Verified against the /science/ page.
      parameters:
      - name: url
        in: query
        required: true
        description: The kartosthera.com URL to embed.
        schema:
          type: string
          format: uri
        example: https://kartosthera.com/science/
      - name: format
        in: query
        schema:
          type: string
          enum:
          - json
          - xml
          default: json
      - name: maxwidth
        in: query
        schema:
          type: integer
          default: 600
      responses:
        '200':
          description: An oEmbed response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OEmbed'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  responses:
    NotFound:
      description: No object found with that identifier.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Invalid parameter.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    OEmbed:
      type: object
      properties:
        version:
          type: string
        provider_name:
          type: string
        provider_url:
          type: string
          format: uri
        author_name:
          type: string
        author_url:
          type: string
          format: uri
        title:
          type: string
        type:
          type: string
        width:
          type: integer
        height:
          type: integer
        html:
          type: string
    Error:
      type: object
      description: The WordPress REST error envelope. NOT RFC 9457 — the media type is `application/json` and the shape is `{code, message, data:{status}}`.
      properties:
        code:
          type: string
          description: Machine-readable error code (e.g. `rest_post_invalid_id`, `rest_forbidden`).
        message:
          type: string
          description: Human-readable message.
        data:
          type: object
          properties:
            status:
              type: integer
            params:
              type: object
            details:
              type: object
      required:
      - code
      - message
  securitySchemes:
    applicationPassword:
      type: http
      scheme: basic
      description: WordPress application passwords, advertised by the site's own route index at `/wp-json/` (`authentication.application-passwords.endpoints.authorization` → https://kartosthera.com/wp-admin/authorize-application.php). Application passwords are issued to existing WordPress accounts only; there is no public sign-up, no developer registration and no self-service credential issuance. Every operation modelled in this document is readable ANONYMOUSLY — this scheme is documented because the site advertises it, not because any catalogued operation requires it.