generated: '2026-08-12'
method: probed
source: live probes of https://portal.elephasapis.com plus static analysis of the
  Elephas Portal client bundle (https://portal.elephas.com/main.1a0da60d95957905.js)
note: 'Elephas publishes no API documentation. Every convention below was OBSERVED —
  from live unauthenticated responses and from the request-building code in the
  publicly served portal JavaScript bundle. Nothing here is a provider claim, and
  absent entries mean "not observable", not "not supported".'
authentication:
  style: OAuth 2.0 Bearer (JWT) via Azure AD B2C
  header: 'Authorization: Bearer <token>'
  detail: authentication/elephas-biosciences-authentication.yml
  public_signup: false
transport:
  protocol: HTTP/2 over TLS 1.3
  server: Kestrel (ASP.NET Core)
  base_url: https://portal.elephasapis.com
url_style:
  pattern: '{base}/{resource}/{action}/{id}'
  casing: lowercase, unhyphenated segments
  observed_resource_roots: [registration, security, histology, cytokines,
    cytokinesanalysis, cutculture]
  note: Resource roots were read from the portal bundle's service classes; they are
    real strings in shipped client code, not guesses.
versioning:
  scheme: none observed
  detail: No version segment, no version header, and no media-type versioning
    appears in any observed request path. The API is unversioned as far as the
    public surface reveals.
error_envelope:
  format: custom JSON envelope, not RFC 9457
  detail: errors/elephas-biosciences-problem-types.yml
idempotency:
  supported: unknown
  evidence: none
  detail: 'No Idempotency-Key header, no idempotency parameter and no retry-safety
    guidance is observable in the client bundle or in any response. Recorded as
    UNKNOWN, not as absent — and deliberately NOT wired as a type: Idempotency
    pointer, because no idempotency contract has been demonstrated.'
pagination:
  style: page-number query parameters
  evidence: 'Portal service methods carry a default page argument (e.g.
    getCutCultureImports(page=1), getPlates(page=1)) that is serialized into the
    request.'
  parameters_observed: [page]
  response_fields: unknown (requires an authenticated response)
  confidence: medium
filtering:
  observed_parameters: [IncludeInactive]
  evidence: security/users request builder in the portal bundle.
request_tracing:
  headers_observed: [x-ms-middleware-request-id, request-context]
  detail: Azure/Application Insights correlation headers are returned on
    unauthenticated responses. These are platform-emitted, not a documented
    client-facing trace contract.
rate_limit_signaling:
  headers_observed: []
  detail: No RateLimit-*, X-RateLimit-* or Retry-After header appeared on any
    observed response. See rate-limits/elephas-biosciences-rate-limits.yml.
caching:
  headers_observed:
  - 'cache-control: no-store, max-age=0, no-transform'
  detail: The API instructs clients not to store responses, consistent with a
    protected-health-information posture.
security_headers:
  detail: security/elephas-biosciences-domain-security.yml
session:
  inactivity_timeout_minutes: 30
  source: https://portal.elephas.com/assets/config/config.json
  note: Client-enforced portal session timeout, not an API contract.
cross_links:
  authentication: authentication/elephas-biosciences-authentication.yml
  scopes: scopes/elephas-biosciences-scopes.yml
  errors: errors/elephas-biosciences-problem-types.yml
  rate_limits: rate-limits/elephas-biosciences-rate-limits.yml
  security: security/elephas-biosciences-domain-security.yml