Carnegie Mellon University

aid: carnegie-mellon-university
name: Carnegie Mellon University
description: 'Carnegie Mellon University is a private research university in Pittsburgh, Pennsylvania, ranked 49th in the
  QS World University Rankings. It operates no central developer portal, no API gateway and no institution-wide developer
  program — api.cmu.edu and data.cmu.edu do not exist as developer surfaces — but unlike most of this cohort it does genuinely
  engineer public APIs, in three unrelated units that share no identifier, envelope or error model. The Delphi research group
  runs the Delphi Epidata API for real-time epidemiological surveillance; the CERT Coordination Center at the Software Engineering
  Institute runs the Vulnerability Notes API, the machine-readable record of coordinated vulnerability disclosure; and University
  Libraries self-hosts the Library Publishing Service, five open-access journals behind a REST API and a conformant OAI-PMH
  2.0 provider on CMU''s own hardware. None of the three publishes an OpenAPI, a changelog on the API host, a status page
  or a deprecation policy, and both research APIs return errors with HTTP 200. Everything else that carries CMU''s name is
  a tenancy: KiltHub is figshare, Canvas is Instructure, and the eleven figshare-derived contracts this profile held until
  2026-08-19 were a vendor''s engineering credited to the university.'
type: Index
accessModel:
  pricing: free
  onboarding: none
  trial: false
  try_now: true
  public: true
  label: Free · No registration
  confidence: high
  source:
  - authentication
  - openapi
  generated: '2026-08-19'
  method: probed
position: Producer
access: Public
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/carnegie-mellon-university.png
url: https://raw.githubusercontent.com/api-evangelist/carnegie-mellon-university/refs/heads/main/apis.yml
tags:
- University
- Higher Education
- Education
- United States
- Private Research University
- Research
- Epidemiology
- Public Health
- Cybersecurity
- Vulnerability Disclosure
- Scholarly Publishing
- Institutional Repository
- Identity Federation
- Open Access
- Open Data
created: '2026-06-03'
modified: '2026-08-19'
specificationVersion: '0.23'
x-type: university
x-category: Private Research University
apis:
- aid: carnegie-mellon-university:delphi-epidata
  name: Delphi Epidata API
  description: 'Public, anonymously accessible HTTP/JSON API operated by the Delphi research group at Carnegie Mellon University,
    serving real-time and historical epidemiological surveillance data — COVIDcast indicator signals, CDC FluView influenza-like-illness
    records, and Delphi''s own nowcasts and forecasts. Revision-aware: every record carries the issue and lag that describe
    when it was reported versus when it was observed. Verified live on five endpoints 2026-08-19; /epidata/version returned
    4.1.44. Errors are returned with HTTP 200 and signalled only in the body''s `result` field.'
  humanURL: https://cmu-delphi.github.io/delphi-epidata/
  baseURL: https://api.delphi.cmu.edu/epidata
  tags:
  - Epidemiology
  - Public Health
  - Health Data
  - Research
  - Open Data
  x-operator: institution
  properties:
  - type: OpenAPI
    url: openapi/carnegie-mellon-university-delphi-epidata-openapi.yml
  - type: Documentation
    url: https://cmu-delphi.github.io/delphi-epidata/
  - type: APIReference
    url: https://cmu-delphi.github.io/delphi-epidata/api/README.html
  - type: SourceCode
    url: https://github.com/cmu-delphi/delphi-epidata
  - type: JSONSchema
    url: json-schema/carnegie-mellon-university-delphi-epidata-envelope.json
- aid: carnegie-mellon-university:cert-vulnerability-notes
  name: CERT/CC Vulnerability Notes API
  description: 'Public read API for the CERT Coordination Center''s Vulnerability Notes database, operated by the CERT Division
    of the Software Engineering Institute — a federally funded research and development center operated by Carnegie Mellon
    University. Returns the full Note record, the CVEs a coordination case covers, and the per-vendor status statements CERT/CC
    collected during disclosure. The vendor-statement collection is the machine-readable trace of the coordination process
    itself and has no equivalent anywhere else. kb.cert.org is not a cmu.edu host, which is why the cohort audit could not
    see it: cert.org 301s to sei.cmu.edu, and the sibling Atom feed declares its author uri as https://www.sei.cmu.edu.'
  humanURL: https://www.kb.cert.org/vuls/
  baseURL: https://kb.cert.org/vuls/api
  tags:
  - Cybersecurity
  - Vulnerability Disclosure
  - CVE
  - Research
  - Open Data
  x-operator: institution
  properties:
  - type: OpenAPI
    url: openapi/carnegie-mellon-university-cert-vulnerability-notes-openapi.yml
  - type: Documentation
    url: https://certcc.github.io/
  - type: APIReference
    url: https://www.kb.cert.org/vuls/
  - type: SourceCode
    url: https://github.com/CERTCC
  - type: JSONSchema
    url: json-schema/carnegie-mellon-university-cert-vulnerability-note.json
- aid: carnegie-mellon-university:library-publishing
  name: CMU Library Publishing Service API + OAI-PMH
  description: REST API and conformant OAI-PMH 2.0 provider for the Carnegie Mellon University Library Publishing Service,
    the open-access publishing programme run by University Libraries. Exposes five journals (Language Development Research,
    Encyclopedia of the History of Science, MAJAL, Negotiation and Conflict Management Research, Tolstoy Studies Journal),
    their issues, 379 articles, keywords and preprint objects. Self-hosted at 128.2.24.32 — inside Carnegie Mellon's own /16
    — so unlike almost every research surface in this cohort it is the institution's own machine, not a vendor tenancy. The
    OAI-PMH Identify response names the repository as Carnegie Mellon University Library Publishing Service and the administrator
    as librarypublishing@andrew.cmu.edu, and advertises oai_dc and jats.
  humanURL: https://lps.library.cmu.edu/
  baseURL: https://lps.library.cmu.edu/api
  tags:
  - Scholarly Publishing
  - Open Access
  - Library
  - OAI-PMH
  - Research
  x-operator: institution
  properties:
  - type: OpenAPI
    url: openapi/carnegie-mellon-university-library-publishing-openapi.yml
  - type: Documentation
    url: https://lps.library.cmu.edu/
- aid: carnegie-mellon-university:web-login-sso
  name: CMU Web Login (Shibboleth SAML 2.0 Identity Provider)
  description: Carnegie Mellon's campus-wide single sign-on identity provider, running Shibboleth on CMU's own host and address
    space (login.cmu.edu, 128.2.42.22). Its SAML 2.0 metadata is publicly readable at the canonical /idp/shibboleth location,
    and it is a registered InCommon — and thereby eduGAIN — entity carrying the Research & Scholarship entity category, which
    is a machine-readable commitment to release a defined attribute bundle to R&S service providers. An authentication service
    for relying service providers, not a data API, and the single most unambiguously institution-operated machine-readable
    surface CMU publishes.
  humanURL: https://www.cmu.edu/computing/services/security/identity-access/authentication/sso-provider.html
  baseURL: https://login.cmu.edu/idp/shibboleth
  tags:
  - Identity Federation
  - Authentication
  - SSO
  - Shibboleth
  - SAML
  - InCommon
  x-operator: institution
  properties:
  - type: Documentation
    url: https://www.cmu.edu/computing/services/security/identity-access/authentication/sso-provider.html
  - type: Metadata
    url: https://mdq.incommon.org/entities/https%3A%2F%2Flogin.cmu.edu%2Fidp%2Fshibboleth
- aid: carnegie-mellon-university:kilthub-figshare-tenant
  name: KiltHub Institutional Repository (figshare) — tenant
  description: KiltHub is Carnegie Mellon's institutional repository for research data and scholarly output. The data, the
    collections and the DOIs are CMU's; the platform, the API and the OAI-PMH endpoint are figshare's. kilthub.cmu.edu is
    a CNAME to FIGSHARE.COM and answers HTTP 202 with an empty body to non-browser clients; its records are harvestable only
    from figshare's own shared host at https://api.figshare.com/v2/oai using set=portal_231, whose Identify response names
    the repository as "figshare". Recorded as a tenant relationship, which is what it is. The eleven figshare-derived contracts
    this repo carried until 2026-08-19 — altmetric/articles/authors/collections/institutions/oauth/other/profiles/projects/symplectic
    — were the same vendor document split by tag and credited to CMU eleven times over. They have been removed; the relationship
    has not.
  humanURL: https://kilthub.cmu.edu/
  baseURL: https://api.figshare.com/v2
  tags:
  - Institutional Repository
  - Research Data
  - Open Access
  - Tenant
  x-operator: tenant
  x-vendor: figshare
  x-vendor-evidence: kilthub.cmu.edu CNAME FIGSHARE.COM (dig, 2026-08-19). OAI-PMH Identify at https://api.figshare.com/v2/oai
    returns repositoryName "figshare"; CMU's content is addressed as set=portal_231.
  properties:
  - type: Documentation
    url: https://kilthub.cmu.edu/
- aid: carnegie-mellon-university:canvas-lti-tenant
  name: Canvas LTI 1.3 Advantage (Instructure) — tenant
  description: CMU's learning management system serves an LTI 1.3 / LTI Advantage JWKS at canvas.cmu.edu/api/lti/security/jwks,
    so the LTI standard is genuinely in play in CMU's teaching environment. It is recorded as a tenancy rather than a CMU
    surface because canvas.cmu.edu is a CNAME to CMU-VANITY.INSTRUCTURE.COM — the LTI implementation, key rotation and contract
    are Instructure's, running under a CMU vanity hostname. The courses and tool deployments behind it are CMU's; the engineering
    is not. Included because the tenancy is a real institutional fact and because it is the only `lti` conformance point on
    a CMU name.
  humanURL: https://canvas.cmu.edu/
  baseURL: https://canvas.cmu.edu/api/lti
  tags:
  - Learning Management
  - LTI
  - Tenant
  x-operator: tenant
  x-vendor: Instructure
  x-vendor-evidence: canvas.cmu.edu CNAME CMU-VANITY.INSTRUCTURE.COM (dig, 2026-08-19).
  properties:
  - type: Documentation
    url: https://canvas.cmu.edu/
- aid: carnegie-mellon-university:cmu-eats-scottylabs
  name: CMU Eats API (ScottyLabs) — student-operated
  description: 'A public JSON API for Carnegie Mellon dining locations, hours and menus, built and run by ScottyLabs, a CMU
    student organization, at api.cmueats.com. It exists because CMU''s own dining surface does not: apps.studentaffairs.cmu.edu/dining/conceptinfo
    is a Blazor Server app whose catch-all route returns the SPA shell with HTTP 200 for every path, including deliberate
    nonsense, so there is no institutional JSON endpoint to call. Recorded as `tenant` rather than `institution` because the
    domain is not CMU''s and no cmu.edu endorsement of the service was found; the data it serves is CMU''s, the software is
    not. The older ScottyLabs host dining.apis.scottylabs.org still answers but its payload now instructs callers to migrate.'
  humanURL: https://cmueats.com/
  baseURL: https://api.cmueats.com/v2
  tags:
  - Campus Life
  - Dining
  - Student Built
  - Tenant
  x-operator: tenant
  x-endorsement: unverified
  properties:
  - type: SourceCode
    url: https://github.com/ScottyLabs
common:
- type: Website
  url: https://www.cmu.edu/
- type: Documentation
  url: https://cmu-delphi.github.io/delphi-epidata/
- type: Documentation
  url: https://www.kb.cert.org/vuls/
- type: APIReference
  url: https://cmu-delphi.github.io/delphi-epidata/api/README.html
- type: GitHubOrganization
  url: https://github.com/cmu-delphi
- type: GitHubOrganization
  url: https://github.com/CERTCC
- type: SourceCode
  url: https://github.com/cmu-sei
- type: SourceCode
  url: https://github.com/cmu-lib
- type: IdentityFederation
  url: https://login.cmu.edu/idp/shibboleth
- type: IdentityFederation
  url: https://mdq.incommon.org/entities/https%3A%2F%2Flogin.cmu.edu%2Fidp%2Fshibboleth
- type: ResearchRepository
  url: https://lps.library.cmu.edu/
- type: ResearchRepository
  url: https://kilthub.cmu.edu/
- type: LibraryCatalog
  url: https://www.library.cmu.edu/
- type: CourseCatalog
  url: https://enr-apps.as.cmu.edu/open/SOC/SOCServlet
- type: ResearchComputing
  url: https://www.cmu.edu/computing/services/research/
- type: AIPolicy
  url: https://www.cmu.edu/teaching/technology/aitools/
- type: Authentication
  url: https://www.cmu.edu/computing/services/security/identity-access/authentication/sso-provider.html
- type: PrivacyPolicy
  url: https://www.cmu.edu/legal/privacy-notice
- type: TermsOfService
  url: https://www.cmu.edu/legal/
- type: Support
  url: https://www.cmu.edu/computing/support/
- type: Blog
  url: https://www.cmu.edu/news/
- type: Blog
  url: https://insights.sei.cmu.edu/
- type: LinkedIn
  url: https://www.linkedin.com/school/carnegie-mellon-university/
- type: Conformance
  url: conformance/carnegie-mellon-university-education-standards-conformance.yml
- type: Authentication
  url: authentication/carnegie-mellon-university-authentication.yml
- type: OAuthScopes
  url: scopes/carnegie-mellon-university-scopes.yml
- type: ErrorCatalog
  url: errors/carnegie-mellon-university-errors.yml
- type: Lifecycle
  url: lifecycle/carnegie-mellon-university-lifecycle.yml
- type: Vocabulary
  url: vocabulary/carnegie-mellon-university-vocabulary.yml
- type: DataModel
  url: json-ld/carnegie-mellon-university-context.jsonld
- type: Examples
  url: examples/carnegie-mellon-university-delphi-fluview-example.json
- type: Examples
  url: examples/carnegie-mellon-university-cert-vulnerability-note-example.json
- type: Rules
  url: rules/carnegie-mellon-university-rules.yml
- type: Rules
  url: rules/carnegie-mellon-university-jsonschema-spectral-rules.yml
- type: AgenticAccess
  url: agentic-access/carnegie-mellon-university-agentic-access.yml
- type: DomainSecurity
  url: security/carnegie-mellon-university-domain-security.yml
- type: Plans
  url: plans/carnegie-mellon-university-plans-pricing.yml
- type: RateLimits
  url: rate-limits/carnegie-mellon-university-rate-limits.yml
- type: FinOps
  url: finops/carnegie-mellon-university-finops.yml
- type: Review
  url: review.yml
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
x-coverage:
  state: covered
  reason: institution_operated_surfaces_verified
  generated: '2026-08-19'
  method: probed
  detail: 'Seven surfaces were settled by live probe on 2026-08-19 before anything was saved: four institution-operated and
    three tenancies. The operator axis is the whole finding. CMU''s previous profile scored 41.1 with agent readiness 38.9
    — the figshare fingerprint shared by the eight top-scoring universities in the catalog — on eleven tag-split copies of
    one vendor contract for KiltHub. Those were removed, along with twenty derived Postman/OpenCollection files whose every
    request URL was api.figshare.com. What replaced them is smaller and real: the Delphi Epidata API, the CERT/CC Vulnerability
    Notes API at the Software Engineering Institute, and the Library Publishing Service''s REST API and OAI-PMH provider self-hosted
    at 128.2.24.32 inside CMU''s own /16. The CERT/CC surface is a first-time find for this cohort and the cohort audit could
    not have seen it, because it lives on cert.org rather than cmu.edu. Real absences confirmed rather than assumed: api.cmu.edu
    does not resolve; data.cmu.edu redirects to a marketing page; www.cmu.edu/llms.txt and /.well-known/security.txt both
    404; status.cmu.edu does not resolve; no OpenAPI exists for any CMU surface (/epidata/openapi.json, .yaml, /openapi and
    /swagger.json all 404, and no spec file exists in cmu-delphi/delphi-epidata); no deprecation policy exists, demonstrated
    by api.heinz.cmu.edu/courses_api which retired into an HTML page with no notice; and CMU''s own dining application is
    a soft-200 Blazor catch-all that returns the SPA shell for a deliberate nonsense path, which is why the only dining API
    is a student organization''s. Every OpenAPI, schema, ruleset and context in this repo is marked `derived` and attributed
    to API Evangelist, not to Carnegie Mellon University.'
  evidence:
  - url: https://api.delphi.cmu.edu/epidata/version
    status: 200
  - url: https://api.delphi.cmu.edu/epidata/fluview/?regions=nat&epiweeks=202001
    status: 200
  - url: https://kb.cert.org/vuls/api/421644/
    status: 200
  - url: https://kb.cert.org/vuls/api/421644/vendors/
    status: 200
  - url: https://kb.cert.org/vuls/atomfeed/
    status: 200
  - url: https://lps.library.cmu.edu/api/journals/
    status: 200
  - url: https://ncmr.lps.library.cmu.edu/api/oai/?verb=Identify
    status: 200
  - url: https://login.cmu.edu/idp/shibboleth
    status: 200
  - url: https://mdq.incommon.org/entities/https%3A%2F%2Flogin.cmu.edu%2Fidp%2Fshibboleth
    status: 200
  - url: https://api.datacite.org/repositories/cmu.lps
    status: 200
  - url: https://kilthub.cmu.edu/
    status: 202
    note: figshare tenancy; bot challenge, graded live.
  - url: https://canvas.cmu.edu/api/lti/security/jwks
    status: 200
    note: Instructure tenancy.
  - url: https://apps.studentaffairs.cmu.edu/dining/conceptinfo/zzz-nonsense-xyz
    status: 200
    note: Soft-200 negative probe — SPA shell returned for a nonsense path. No API here.
  - url: https://api.cmu.edu/
    status: 0
    note: NXDOMAIN.
  - url: https://www.cmu.edu/llms.txt
    status: 404
  - url: https://api.crossref.org/members?query=carnegie+mellon
    status: 200
    note: total-results 0 — CMU is not a Crossref member.
  removed: 10
  removed_detail: Ten figshare-derived OpenAPIs plus their _original, and twenty derived collection files, all attributed
    to a vendor host.