# Crimson Education

> Crimson Education is a multinational university admissions consultancy founded in Auckland, New Zealand in 2013. It provides college-prep and admissions consulting for US, UK, EU and Australian universities, graduate and medical school admissions support, curriculum tutoring and extracurricular mentoring, and operates the Crimson Global Academy online high school. Its student and mentor experience runs on the Crimson App.

Generated by API Evangelist on 2026-08-04. Crimson Education does not publish an llms.txt; this file is generated from the catalog profile and the artifacts in this repository. It is not a Crimson Education document.

## API surface

Crimson Education publishes **no OpenAPI, no developer portal and no public API documentation**. The Crimson App backend is reached through a first-party TypeScript SDK published on npm, which is the contract of record.

- Crimson App API (production base URL): https://api.app.crimsoneducation.io
- Crimson App API (staging base URL): https://api.staging.app.crimsoneducation.io
- GraphQL endpoint: https://api.app.crimsoneducation.io/graphql — live but auth-gated (HTTP 401 anonymously); introspection requires credentials
- Liveness: GET /health returns {"message":"SUCCESS"}
- Access model: partner/internal. There is no public signup and no self-service key. Service keys are allowlisted server-side; the OAuth 2.0 flow that would let third parties onboard is implemented in the SDK but its backend endpoints are documented as not deployed.

### REST surfaces named by the SDK

- `/roadmap/*` (unversioned): missions, action items (tasks), reflections, roadmap context, users, mission library, grade templates, file upload/download
- `/api/v1/*`: account and profile, Indigo identity, package items, tutors, bookings, student profile

### Authentication

Three mutually exclusive modes on the SDK client:

1. Bearer JWT — `Authorization: Bearer <token>`, Auth0-issued. Used by embedded iframe apps whose parent injects the token.
2. Service key — `Authorization: crimsonauthkey <key>`, trusted backend only. Bypasses per-user RBAC; requires the `x-tenant-domain` header.
3. OAuth 2.0 authorization code + PKCE — implemented in the SDK, backend endpoints **not deployed**.

## Packages

- @crimson-education/sdk — https://www.npmjs.com/package/@crimson-education/sdk (primary API client, MIT)
- @crimson-education/replit-sdk — https://www.npmjs.com/package/@crimson-education/replit-sdk (embed Replit apps into the Crimson App)
- @crimson-education/browser-logger — https://www.npmjs.com/package/@crimson-education/browser-logger
- @crimson-education/helios-editor-renderer — https://www.npmjs.com/package/@crimson-education/helios-editor-renderer

## Artifacts in this profile

- Packages / SDKs: packages/crimson-education-packages.yml
- Authentication: authentication/crimson-education-authentication.yml
- API conventions: conventions/crimson-education-conventions.yml
- Error catalog: errors/crimson-education-problem-types.yml
- Data model: data-model/crimson-education-data-model.yml
- Embedded components: components/crimson-education-components.yml
- Lifecycle: lifecycle/crimson-education-lifecycle.yml
- Changelog (SDK release history): changelog/crimson-education-changelog.yml
- Sandbox / environments: sandbox/crimson-education-sandbox.yml
- Conformance: conformance/crimson-education-conformance.yml
- Well-known discovery probes: well-known/crimson-education-well-known.yml
- Domain security: security/crimson-education-domain-security.yml

## Company links

- Website: https://www.crimsoneducation.org/us
- Blog: https://www.crimsoneducation.org/us/blog
- Privacy policy: https://www.crimsoneducation.org/us/privacy-policy
- Careers: https://jobs.crimsoneducation.org/
- Crimson App (login): https://app.crimsoneducation.org/
- GitHub organization: https://github.com/crimson-education
- Crimson Global Academy: https://www.crimsonglobalacademy.school/

## Known gaps

- No OpenAPI or AsyncAPI specification
- No developer portal, API reference, getting-started guide or public changelog
- No webhooks or event surface
- No MCP server and no A2A agent card
- No security.txt, vulnerability disclosure policy, trust center or published certifications
- No status page, SLA, versioning policy or deprecation policy
- No idempotency contract and no documented rate limits