Technical University of Munich

aid: tum
name: Technical University of Munich
x-type: university
x-category: Technical University
description: 'The Technical University of Munich (TUM) is a public technical research university in Munich, Germany, and one
  of Germany''s eleven Universities of Excellence. Its programmable footprint is real but small, and almost none of it comes
  from a central IT developer program: TUM operates no public developer portal, publishes no API terms of service, and lists
  no API on www.tum.de. What it does operate, verified live on 2026-08-19, is four machine-readable surfaces. Two are OpenAPI
  contracts built and run by Open Source @ TUM e.V. (TUM-Dev), a TUM-affiliated association: the TUM Campus App backend at
  api.tum.app (19 operations, Swagger 2.0 generated from tumdev/campus_backend.proto, also served over gRPC at api-grpc.tum.app,
  listed by TUM IT as an official TUM mobile app), and NavigaTUM at nav.tum.de (room, building and campus navigation, taken
  into productive operation by TUM as the official room finder). The other two are the surfaces a university operates by definition
  and rarely catalogues: a SAML 2.0 / Shibboleth identity provider publishing DFN-AAI-registered metadata at login.tum.de
  with SIRTFI2 assurance, and an OAI-PMH 2.0 endpoint on mediaTUM, TUM''s own institutional repository, harvestable back to
  1959. Everything else is a tenant relationship on someone else''s platform: the student information system TUMonline runs
  CAMPUSonline on campus.tum.de (live unauthenticated course REST plus a full OIDC discovery document with 108 scopes), the
  research information system TUMFIS runs Elsevier Pure, and the canteen menu API eat-api is static JSON on GitHub Pages carrying
  Studierendenwerk data. No open data portal exists: data.tum.de and opendata.tum.de do not resolve.'
type: Index
accessModel:
  pricing: free
  onboarding: unknown
  trial: false
  try_now: false
  public: true
  label: Free
  confidence: medium
  source:
  - probed
  generated: '2026-08-19'
  method: probed
  note: Every institution-operated read surface answered unauthenticated on 2026-08-19 (api.tum.app/v1/news/sources, nav.tum.de/api/search,
    mediatum OAI-PMH, login.tum.de IdP metadata). No key issuance, no plan, no quota is published anywhere.
position: Provider
access: Public
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/tum.png
url: https://raw.githubusercontent.com/api-evangelist/tum/refs/heads/main/apis.yml
tags:
- University
- Higher Education
- Education
- Germany
- Technical University
- Universities of Excellence
- Campus
- Course Catalog
- Identity Federation
- Research Repository
- Open-Source
- Student Information System
tags_raw:
- University
- Higher Education
- Education
- Germany
- Technical University
- Universities of Excellence
- Campus
- Course Catalog
- Identity Federation
- Research Repository
- Open Source
- Student Information System
created: '2026-06-03'
modified: '2026-08-19'
specificationVersion: '0.23'
apis:
- aid: tum:campus-backend
  name: TUM Campus App Backend API
  x-operator: institution
  x-operator-basis: api.tum.app is a TUM-branded registrable domain serving the official TUM Campus App, which TUM IT (CIO)
    lists under its Mobile Apps. Built and operated by Open Source @ TUM e.V. (TUM-Dev), a TUM-affiliated association promoted
    by TUM IT. No vendor platform is involved — contract, code and deployment are all TUM-side.
  description: 'REST and gRPC backend behind the official TUM Campus App. 19 operations across campus news and alerts, student
    clubs, cinema listings, canteen and dish ratings, device registration and feedback. The contract is generated by grpc-gateway
    from tumdev/campus_backend.proto and is published at https://api.tum.app/swagger/swagger.json — one path level below the
    URL its own Swagger UI declares, which returns the UI HTML instead (soft 200). Reads answer unauthenticated. Contract
    defects found on probe: info.version is the generator default "version not set", no securityDefinitions are declared,
    only 200 and `default` responses exist, and GET /v1/canteen/allCanteens returns 501 "method ListCanteens not implemented"
    with a body shape the contract does not describe.'
  humanURL: https://github.com/TUM-Dev/Campus-Backend
  baseURL: https://api.tum.app/v1
  tags:
  - Campus
  - Mobile Backend
  - News
  - Dining
  - gRPC
  - Go
  properties:
  - type: OpenAPI
    url: openapi/tum-campus-backend-openapi.yml
  - type: x-openapi-original
    url: openapi/_original/tum-campus-backend-swagger.json
  - type: APIReference
    url: https://api.tum.app/
  - type: Documentation
    url: https://github.com/TUM-Dev/Campus-Backend
  - type: GitHub
    url: https://github.com/TUM-Dev/Campus-Backend
  - type: Website
    url: https://www.it.tum.de/en/it/mobile-apps/
- aid: tum:navigatum
  name: NavigaTUM
  x-operator: institution
  x-operator-basis: Runs on nav.tum.de, a TUM domain, with contact navigatum@tum.de and terms at nav.tum.de/en/about/privacy.
    Built by Open Source @ TUM e.V. (TUM-Dev) and taken into productive operation by TUM as the official room finder for all
    TUM buildings (digitalisierung.tum.de).
  description: Search and navigation API for TUM rooms, buildings and places — a Rust service over MeiliSearch, fully unauthenticated,
    documented with an OpenAPI 3 contract served live at https://nav.tum.de/api/openapi.json. Twelve operations across search,
    locations, maps, calendar, feedback and status. GET /api/status returns the exact deployed commit alongside its health,
    a build-provenance practice almost nothing else in this cohort does. Also publishes a .well-known/security.txt. The six
    OpenAPI files below are one contract split by tag by refine-openapis, not six APIs; they were repaired on 2026-08-19 after
    that split had stamped them with eat-api's title and eat-api's GitHub Pages servers block.
  humanURL: https://nav.tum.de/
  baseURL: https://nav.tum.de/api
  tags:
  - Campus
  - Navigation
  - Maps
  - Locations
  - Search
  - Rust
  properties:
  - type: OpenAPI
    url: openapi/tum-locations-api-openapi.yml
  - type: OpenAPI
    url: openapi/tum-maps-api-openapi.yml
  - type: OpenAPI
    url: openapi/tum-calendar-api-openapi.yml
  - type: OpenAPI
    url: openapi/tum-feedback-api-openapi.yml
  - type: OpenAPI
    url: openapi/tum-status-api-openapi.yml
  - type: OpenAPI
    url: openapi/tum-openapi-json-api-openapi.yml
  - type: x-openapi-original
    url: openapi/_original/tum-navigatum.yaml
  - type: APIReference
    url: https://nav.tum.de/api/openapi.json
  - type: Documentation
    url: https://github.com/TUM-Dev/NavigaTUM/blob/main/server/README.md
  - type: GitHub
    url: https://github.com/TUM-Dev/navigatum
  - type: Website
    url: https://nav.tum.de/
  - type: TermsOfService
    url: https://nav.tum.de/en/about/privacy
  - type: x-json-schema
    url: json-schema/tum-search-response-schema.json
  - type: x-json-structure
    url: json-structure/tum-search-response-structure.json
  - type: x-example
    url: examples/tum-search-example.json
- aid: tum:mediatum-oai-pmh
  name: mediaTUM OAI-PMH Repository Interface
  x-operator: institution
  x-operator-basis: mediaTUM is TUM's own institutional media and publication repository, running on ub.tum.de infrastructure
    the university library operates. The OAI-PMH responder identifies itself as "mediaTUM - The Technische Universität München
    Media Repository" with adminEmail mediatum@ub.tum.de. No vendor repository platform is in the path.
  description: 'OAI-PMH 2.0 harvesting interface over TUM''s institutional repository. Verified verbs Identify, ListMetadataFormats
    and ListSets all answer 200. Metadata prefixes: oai_dc, epicur and xMetaDissPlus (the Deutsche Nationalbibliothek dissertation
    profile). Earliest datestamp 1959-01-01, deletedRecord: no, granularity to the second. Note the asymmetry: the machine
    surface is wide open while the HTML surface at mediatum.ub.tum.de sits behind an Anubis proof-of-work anti-scraper challenge
    — a repository that is more readable to a harvester than to a browser.'
  humanURL: https://mediatum.ub.tum.de/
  baseURL: https://mediatum.ub.tum.de/oai/oai
  tags:
  - Research Repository
  - OAI-PMH
  - Metadata
  - Library
  - Dublin Core
  properties:
  - type: APIReference
    url: https://mediatum.ub.tum.de/oai/oai.py?verb=Identify
  - type: Documentation
    url: https://www.ub.tum.de/en
  - type: Website
    url: https://mediatum.ub.tum.de/
  - type: x-conformance
    url: conformance/tum-education-standards-conformance.yml
- aid: tum:identity-federation
  name: TUM Shibboleth Identity Provider (SAML 2.0 Metadata)
  x-operator: institution
  x-operator-basis: Metadata is served from TUM's own login.tum.de and asserts the tum.de Shibboleth scope with display name
    "Technical University of Munich (TUM)". The instance is hosted for TUM by the Leibniz Supercomputing Centre (canonical
    entityID https://tumidp.lrz.de/idp/shibboleth), but the federated identity being asserted is the institution's own and
    no other institution shares this entity.
  description: Machine-readable SAML 2.0 identity provider metadata — an EntityDescriptor with an IDPSSODescriptor supporting
    urn:oasis:names:tc:SAML:2.0:protocol, registered in DFN-AAI since 2009-05-26 and reachable through eduGAIN. Carries the
    REFEDS Research & Scholarship entity category and both SIRTFI and SIRTFI2 assurance certifications. This is the surface
    every university operates by definition and almost none of them get catalogued as an API; it is included here deliberately.
  humanURL: https://www.it.tum.de/en/
  baseURL: https://login.tum.de/idp
  tags:
  - Identity Federation
  - SAML
  - Shibboleth
  - eduGAIN
  - DFN-AAI
  - Single Sign-On
  properties:
  - type: APIReference
    url: https://login.tum.de/idp/shibboleth
  - type: Documentation
    url: https://www.it.tum.de/en/
  - type: x-conformance
    url: conformance/tum-education-standards-conformance.yml
  - type: x-authentication
    url: authentication/tum-authentication.yml
- aid: tum:tumonline
  name: TUMonline (CAMPUSonline) — Course Catalog and Identity
  x-operator: tenant
  x-operator-basis: 'campus.tum.de is a TUM subdomain, but everything served under /tumonline is the CAMPUSonline product:
    the Keycloak realm is literally named CAMPUSonline, the REST resource namespaces (slc.tm.cp, brm.pm.bc) are the vendor''s,
    and the scope vocabulary is shared by every CAMPUSonline customer. TUM''s students and TUM''s data; not TUM''s contract.
    Recorded as a relationship — no vendor spec is saved under this institution.'
  description: 'TUM''s student information system of record, running CAMPUSonline. Two machine-readable surfaces were verified
    live and unauthenticated on 2026-08-19: a hypermedia course catalog REST endpoint at /tumonline/ee/rest/slc.tm.cp/student/courses
    returning 185 KB of linked XML (course detail, categories, instruction languages, tags, filters, business cards), and
    a complete OpenID Connect discovery document at the CAMPUSonline Keycloak realm advertising 108 scopes, nine grant types
    and PKCE. The vendor''s own "Public REST API" documentation page at /tumonline/co/public/api/ returns 200 but is an unbootable
    Angular shell — every one of its JavaScript bundles 404s — so the contract behind these endpoints is not actually published.'
  humanURL: https://campus.tum.de/tumonline/ee/ui/ca2/app/desktop/
  baseURL: https://campus.tum.de/tumonline
  tags:
  - Course Catalog
  - Student Information System
  - CAMPUSonline
  - OpenID Connect
  - Registrar
  properties:
  - type: APIReference
    url: https://campus.tum.de/tumonline/ee/rest/slc.tm.cp/student/courses
  - type: x-openid-configuration
    url: https://campus.tum.de/tumonline/co/public/sec/auth/realms/CAMPUSonline/.well-known/openid-configuration
  - type: Website
    url: https://campus.tum.de/tumonline/ee/ui/ca2/app/desktop/
  - type: x-scopes
    url: scopes/tum-scopes.yml
  - type: x-authentication
    url: authentication/tum-authentication.yml
- aid: tum:eat-api
  name: eat-api — Munich Student Canteen Menus
  x-operator: tenant
  x-operator-basis: Published on tum-dev.github.io — GitHub Pages, not a TUM-owned domain — by Open Source @ TUM e.V. The
    menu data originates with Studierendenwerk München Oberbayern, a separate public body, not with TUM. Institution-affiliated,
    not institution-operated.
  description: Static JSON API for Munich student canteen menus, prices, dish labels and opening hours, regenerated on a schedule
    and served as flat files from GitHub Pages. Two OpenAPI files below are one contract split by tag; both were re-titled
    on 2026-08-19 after refine-openapis had labelled them "eat-api calendar <tag> API" and conflated them with NavigaTUM.
  humanURL: https://tum-dev.github.io/eat-api/
  baseURL: https://tum-dev.github.io/eat-api
  tags:
  - Dining
  - Campus
  - Open Data
  - Static API
  - Studierendenwerk
  properties:
  - type: OpenAPI
    url: openapi/tum-menu-api-openapi.yml
  - type: OpenAPI
    url: openapi/tum-static-api-openapi.yml
  - type: x-openapi-original
    url: openapi/_original/tum-eat-api.yaml
  - type: Documentation
    url: https://github.com/TUM-Dev/eat-api
  - type: GitHub
    url: https://github.com/TUM-Dev/eat-api
  - type: Website
    url: https://tum-dev.github.io/eat-api/
  - type: x-json-schema
    url: json-schema/tum-canteen-menu-schema.json
  - type: x-json-structure
    url: json-structure/tum-canteen-menu-structure.json
  - type: x-example
    url: examples/tum-canteen-menu-example.json
x-coverage:
  state: covered
  reason: institution-operated-surfaces
  detail: 'TUM is one of the minority of universities in this cohort that genuinely operates machine-readable surfaces of
    its own: two OpenAPI contracts (api.tum.app, nav.tum.de), an OAI-PMH 2.0 responder on its own repository, and DFN-AAI-registered
    SAML metadata. What it does not have is a central developer program — no developer portal, no API terms, no key issuance,
    no changelog, no open data portal (data.tum.de and opendata.tum.de do not resolve), and no API named anywhere on www.tum.de.
    Everything catalogued here was built by a student association or is a vendor platform running under a TUM subdomain. Two
    documentation surfaces are published but broken: api.tum.app''s Swagger UI points at a swagger.json that returns the UI
    HTML, and TUMonline''s Public REST API page is an Angular shell whose bundles all 404.'
  evidence:
  - url: https://api.tum.app/swagger/swagger.json
    status: 200
  - url: https://nav.tum.de/api/openapi.json
    status: 200
  - url: https://mediatum.ub.tum.de/oai/oai.py?verb=Identify
    status: 200
  - url: https://login.tum.de/idp/shibboleth
    status: 200
  - url: https://campus.tum.de/tumonline/ee/rest/slc.tm.cp/student/courses
    status: 200
  - url: https://campus.tum.de/tumonline/co/public/sec/auth/realms/CAMPUSonline/.well-known/openid-configuration
    status: 200
  - url: https://api.tum.app/swagger.json
    status: 200
    note: soft 200 — returns the Swagger UI HTML, not a spec
  - url: https://campus.tum.de/tumonline/co/public/api/main.bbddcce1a3e0d240.js
    status: 404
    note: the Public REST API docs SPA cannot boot
  - url: https://mediatum.ub.tum.de/
    status: 200
    note: Anubis proof-of-work bot challenge, not the repository page
  - url: https://www.tum.de/llms.txt
    status: 404
  - url: https://www.tum.de/.well-known/security.txt
    status: 404
  - url: https://data.tum.de/
    status: 0
    note: DNS does not resolve
  - url: https://opendata.tum.de/
    status: 0
    note: DNS does not resolve
  checked: '2026-08-19'
common:
- type: Website
  url: https://www.tum.de/en/
- type: Blog
  url: https://www.tum.de/en/news-and-events/all-news
- type: GitHubOrganization
  url: https://github.com/TUM-Dev
- type: LinkedIn
  url: https://www.linkedin.com/school/technische-universitat-munchen/
- type: TermsOfService
  url: https://www.tum.de/ueber-die-tum/kontakt-und-anfahrt/impressum
- type: PrivacyPolicy
  url: https://www.tum.de/en/privacy-policy
- type: Support
  url: https://www.it.tum.de/en/
- type: CourseCatalog
  url: https://campus.tum.de/tumonline/ee/ui/ca2/app/desktop/
- type: ResearchRepository
  url: https://mediatum.ub.tum.de/
- type: LibraryCatalog
  url: https://www.ub.tum.de/en
- type: IdentityFederation
  url: https://login.tum.de/idp/shibboleth
- type: ResearchComputing
  url: https://www.researchdata.tum.de/
- type: AIPolicy
  url: https://www.tum.de/en/news-and-events/all-news/press-releases/details/tum-issues-a-comprehensive-ai-strategy
- type: Accessibility
  url: https://www.tum.de/en/spezialseiten/accessibility
- type: x-conformance
  url: conformance/tum-education-standards-conformance.yml
- type: x-authentication
  url: authentication/tum-authentication.yml
- type: x-scopes
  url: scopes/tum-scopes.yml
- type: x-errors
  url: errors/tum-errors.yml
- type: x-lifecycle
  url: lifecycle/tum-lifecycle.yml
- type: AgenticAccess
  url: agentic-access/tum-agentic-access.yml
- type: VulnerabilityDisclosure
  url: security/tum-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/tum-domain-security.yml
- type: Plans
  url: plans/tum-plans-pricing.yml
- type: RateLimits
  url: rate-limits/tum-rate-limits.yml
- type: FinOps
  url: finops/tum-finops.yml
- type: Review
  url: review.yml
- type: x-vocabulary
  url: vocabulary/tum-vocabulary.yml
- type: x-rules
  url: rules/tum-rules.yml
- type: x-json-ld
  url: json-ld/tum-context.jsonld
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com