# Carrum Health

> Carrum Health operates a value-based Centers of Excellence (COE) platform that connects self-insured employers and their members with a curated national network of surgical, cancer and substance-use-care providers under upfront bundled payments. Founded in 2014, Carrum pairs a member-facing mobile and web application with a care-navigation team, so members move through a full episode of care with no deductibles, co-pays or surprise bills, and a 30-day warranty on each procedure.

> API status: Carrum Health publishes NO public developer program — no developer portal, no API documentation host, no OpenAPI/AsyncAPI/GraphQL definition, no SDKs, no CLI, no MCP server and no A2A agent card. Integrations with employers, health plans, TPAs and point-solution partners are arranged commercially. This file was generated by the API Evangelist enrichment pipeline from the public surface on 2026-08-01; it is not published by Carrum Health.

## Company

- [Carrum Health](https://carrumhealth.com/): Company website.
- [About](https://carrumhealth.com/about/): Mission, leadership and company background.
- [How it works](https://carrumhealth.com/how-it-works/): The bundled-payment episode-of-care model.
- [Employers](https://carrumhealth.com/employers/): The self-insured employer offering.
- [Providers](https://carrumhealth.com/providers/): The Centers of Excellence provider network.
- [Members](https://carrumhealth.com/members/): The member experience.
- [Consultants](https://carrumhealth.com/consultants/): The benefits-consultant channel.
- [Cancer care](https://carrumhealth.com/cancer-care/) and [Substance use](https://carrumhealth.com/substance-use/): Non-surgical care categories.

## Applications

- [Member portal](https://my.carrumhealth.com/): Expo/React single-page member application.
- [Member sign-in](https://my.carrumhealth.com/login): Login for enrolled members.
- [iOS app](https://apps.apple.com/us/app/carrum-health/id1403041263)
- [Android app](https://play.google.com/store/apps/details?id=com.carrumhealth.patientapp)

## Platform services (private, undocumented)

The member application calls five internet-facing REST services. They are recorded here because they were observed in Carrum Health's own publicly served application bundle, not because they are open:

- `https://core-service.carrumhealth.com` — accounts, episodes, profiles, submissions
- `https://care-service.carrumhealth.com`
- `https://message-service.carrumhealth.com`
- `https://price-service.carrumhealth.com`
- `https://upload-service.carrumhealth.com`

Each is also deployed to `staging`, `uat`, `demo`, `perf`, `compliance` and `mirror` environments. Every service exposes `/api-docs`, and every `/api-docs` answers HTTP 401 with `WWW-Authenticate: Basic` — the API documentation exists but is not public. There is no anonymous way to obtain a machine-readable contract.

## Agent surface

- `https://core-service.carrumhealth.com/.well-known/agents.json` — HTTP 200, `application/a2a+json`, `{"schema_version":"v1","agents":[]}`. A real A2A agent registry with **zero** agents registered.
- `https://core-service.carrumhealth.com/.well-known/agent-card.json` — HTTP 404, `{"error":{"message":"No agents registered"}}`. A2A-aware infrastructure is deployed; no AgentCard is published.
- No MCP server (`/mcp`, `/.well-known/mcp.json` → 404 on every host).

## Trust, security and legal

- [Trust center](https://trust.carrumhealth.com/): Vanta-hosted trust report (certification list is rendered client-side and not readable anonymously).
- [Privacy statement](https://carrumhealth.com/privacy-statement/): HIPAA/PHI and CCPA rights; contact privacy@carrumhealth.com.
- [Terms of use](https://carrumhealth.com/terms-of-use/)
- [Member registration agreement](https://carrumhealth.com/member-registration-agreement/)
- [Accessibility statement](https://carrumhealth.com/accessibility-statement/)
- No `security.txt`, no responsible-disclosure page and no bug-bounty program was found.

## News and resources

- [Blog](https://carrumhealth.com/carrum-blog/) ([RSS](https://carrumhealth.com/carrum-blog/feed/))
- [Newsroom](https://carrumhealth.com/newsroom/)
- [Resources](https://carrumhealth.com/resources/)
- [Contact](https://carrumhealth.com/contact-us/) / [Request a demo](https://carrumhealth.com/contact-demo/)
- [Careers](https://carrumhealth.com/careers/)
- [GitHub organization](https://github.com/carrumhealth): 11 public repositories, predominantly forks of infrastructure tooling (Digger, dbt-adapters, Grommet, Heroku buildpacks) plus `csec-assets`; no API or SDK source.

## API Evangelist artifacts

- `well-known/carrum-health-well-known.yml` — the probed `/.well-known/` surface across every host.
- `well-known/carrum-health-agents.json` — the A2A registry document, saved verbatim.
- `authentication/carrum-health-authentication.yml` — observed authentication posture.
- `conformance/carrum-health-conformance.yml` — standards conformance, probed.
- `lifecycle/carrum-health-lifecycle.yml` — versioning/deprecation/status-page posture.
- `security/carrum-health-domain-security.yml` — TLS/HSTS/DNSSEC/CAA/SPF/DMARC.
- `security/carrum-health-trust-center.yml` — the Vanta trust center.
- `packages/carrum-health-packages.yml` — registry search result (no first-party client libraries).