# ChromaCode

> ChromaCode, Inc. is a Carlsbad, California molecular diagnostics company. Its High-Definition PCR (HDPCR) chemistry multiplexes more than four times the targets of conventional digital PCR on existing qPCR and dPCR instruments, and ChromaCode Cloud decodes the raw run files into interpreted variant calls and reports. ChromaCode does **not** publish a public API: there is no developer portal, no OpenAPI definition, no SDKs, and no API documentation. The ChromaCode Cloud REST API exists but is gated behind Keycloak OpenID Connect and is available only to licensed laboratory customers.

Generated by the API Evangelist enrichment pipeline on 2026-08-02 from the provider's public surface. Method: generated (from probed artifacts in this repo).

## Company

- [ChromaCode](https://www.chromacode.com/): Company home — HDPCR multiplexing technology for oncology and genomics.
- [Technology](https://www.chromacode.com/technology/): How HDPCR combines amplitude modulation and multi-spectral encoding with standard TaqMan probes.
- [ChromaCode Cloud](https://www.chromacode.com/chromacode-cloud/): The browser-based analysis platform that decodes PCR run files; also the page carrying ChromaCode's HIPAA / HITRUST / ISO 13485 compliance statement.
- [Ordering information](https://www.chromacode.com/ordering-information/): HDPCR NSCLC panel, research use only; orders@chromacode.com.
- [Contact](https://www.chromacode.com/contact/): 2292 Faraday Avenue, Suite 110, Carlsbad, CA 92008; info@chromacode.com; +1 442-244-4370.
- [Leadership team](https://www.chromacode.com/leadership-team/)
- [Press feed (RSS)](https://www.chromacode.com/feed/): Company announcements; most recent post 2024-01-26.
- [GitHub organization](https://github.com/ChromaCodeINC): Three public repositories, all hiring code challenges — no client libraries or specs.

## APIs

- [ChromaCode Cloud API](https://chromacodecloud.com/api): Customer-authenticated REST API behind ChromaCode Cloud 6.1. Every path returns HTTP 401 anonymously. No public documentation, no OpenAPI, no SDKs.
- [ChromaCode Cloud application](https://chromacodecloud.com/): The login surface for the platform.
- [Platform version endpoint](https://chromacodecloud.com/version): Unauthenticated; reports platform version 6.1.0 and regulatory mode RUO (research use only, isIVD false).

## Identity and discovery

- [OpenID Connect discovery — apps realm](https://openid.chromacodecloud.com/auth/realms/apps/.well-known/openid-configuration): Keycloak metadata for the realm the ChromaCode Cloud front end authenticates against.
- [OpenID Connect discovery — cloud realm](https://openid.chromacodecloud.com/auth/realms/cloud/.well-known/openid-configuration): The user realm.
- No security.txt, no /.well-known/api-catalog, no ai-plugin.json, no A2A agent card, and no MCP server exist on any ChromaCode host. The ChromaCode Cloud SPA answers HTTP 200 with its HTML shell for every /.well-known/* path; those are not discovery documents.

## Artifacts in this repository

- [apis.yml](apis.yml): APIs.json 0.20 index for ChromaCode.
- [authentication/chromacode-authentication.yml](authentication/chromacode-authentication.yml): OIDC/OAuth 2.0 profile derived from the Keycloak discovery documents — flows, endpoints, PKCE, PAR, CIBA, device grant, mTLS-bound tokens.
- [scopes/chromacode-scopes.yml](scopes/chromacode-scopes.yml): The scopes_supported advertised by both realms, including the provider-specific chromacloud and chromacloud:service_account scopes.
- [well-known/chromacode-well-known.yml](well-known/chromacode-well-known.yml): Full probe index with HTTP statuses for every host and path, including the SPA catch-all false positives.
- [conventions/chromacode-conventions.yml](conventions/chromacode-conventions.yml): Observed auth style, error envelope, CORS, transport, and the resource paths the front-end bundle calls.
- [errors/chromacode-problem-types.yml](errors/chromacode-problem-types.yml): The observed 401 authorization envelope and a 500 error-handling defect on unmatched /api paths.
- [lifecycle/chromacode-lifecycle.yml](lifecycle/chromacode-lifecycle.yml): Product versioning (6.1.0), RUO regulatory mode, milestones; no status page, SLA, or deprecation policy exists.
- [conformance/chromacode-conformance.yml](conformance/chromacode-conformance.yml): Verified OAuth/OIDC protocol conformance plus ChromaCode's vendor-asserted HIPAA / HITRUST / ISO 13485 / GDPR claims.
- [security/chromacode-domain-security.yml](security/chromacode-domain-security.yml): TLS, HSTS, DNSSEC, CAA, SPF and DMARC posture for chromacode.com and chromacodecloud.com.

## What ChromaCode does not publish

- No OpenAPI, Swagger, GraphQL, AsyncAPI, or Protobuf definition.
- No developer portal, API reference, getting-started guide, or changelog (release notes are behind the login).
- No SDKs or client libraries on npm, PyPI, RubyGems, Maven Central, NuGet, crates.io, or pkg.go.dev.
- No MCP server, no A2A agent card, no llms.txt of their own.
- No security.txt, vulnerability disclosure program, bug bounty, or trust center.
- No status page, SLA, pricing page, or self-serve sign-up — the company sells through direct contact.