What it is

A single JSON envelope over Q-omics's curated, consensus-validated cancer multi-omics warehouse — tissue (TCGA), cell line (CCLE), and proteomics (CPTAC) cohorts, ~38,000 genes across 34+20+10 lineages. Every endpoint accepts the same request shape and returns one of four response envelopes.

Base URL & authentication

Request envelope

POST /qomics/api/plot
Authorization: Bearer <token>
Content-Type: application/json

{
  "class_name": "box_plot",
  "q_data": {
    "sample_type": "Tissue",
    "lin_code": "BRCA",
    "x_type": "rna",
    "x_symbol": "TP53"
  }
}

Response envelope

{
  "chart_type": "box",
  "error": null,
  "meta": { "group_labels": {"group1":"Low","group2":"High"}, "lineage": "Breast", "..." : "..." },
  "stats": { "p_value": 3.1e-08, "fold_change": -1.842, "pcc": null,
             "x_axis_title": "TP53, log2(RNA expression)", "y_axis_title": "...", "extra": {} },
  "data": { "counts": {"group1":274,"group2":273}, "groups": { "...": "..." } },
  "criteria": "Comparison: Group1 (Low) vs Group2 (High) rna — median split; Welch t-test",
  "save_data": { "columns": [...], "rows": [...] }
}

Three other envelope shapes exist for non-plot endpoints (row lists, nested summaries, subtype drill-downs) — see the full reference for all four.

Endpoint map

Operating limits

Data coverage at a glance

Full coverage detail, valid data-type combinations, and known limitations: see the Data Dictionary.

Access & authentication

Today, programmatic access runs through the Q-omics MCP connector — the interface AI agents (Claude, ChatGPT, and other MCP-compatible clients) use to query Q-omics. It authenticates with OAuth 2.1 with PKCE, dynamic client registration, and asymmetric RS256-signed JWTs — Q-omics signs, clients verify with the public key only; no shared secret to leak.

The direct REST API (this document's other half) supports two authentication methods:

We recommend OAuth for production workloads once it's available on the REST API. Until then, API keys are fully supported — just protect them like credentials.

Access is read-only

No write, DDL, or upload operation exists anywhere in the tool registry or the API surface. Every operation reads from the curated warehouse; nothing a client sends can modify stored data.

Query execution guard

Every query — whether from an AI agent or the flexible PQL query layer — compiles and runs under a locked execution policy that cannot be relaxed by the caller:

PQL — the flexible query layer behind natural-language questions the fixed analyses don't cover — has no write verb in its grammar at all. An unsafe query isn't just blocked; it can't be expressed.

Data protection — Q-omics's own data

What you send us

Do not submit patient-identifiable or raw sequencing data. Q-omics is built for querying its own curated cohorts by gene/drug/lineage — not for uploading private patient data or raw sequencing files (consistent with the existing Terms of Service and Privacy Policy).

Your query text is processed by third-party LLM providers to resolve entities and route requests. Current providers include Google (Gemini/Vertex AI) and OpenAI; the full list is maintained in our Privacy Policy and updated as integrations change. Do not include sensitive data in queries.

Account & billing data follow the existing consumer Privacy Policy — the API reuses the same Q-omics account system rather than a separate one. Card details are handled by our payment processor directly; Q-omics does not store card numbers.

Uploaded analysis files (Qcanvas / NetCrafter import) are not persisted. The uploaded file is parsed in memory for that request only — no disk or database write of the raw content occurs. The computed result is cached in your session (server-side cookie-backed storage) and automatically cleared when your session expires (24 hours maximum).

Note: This assessment covers application-level code paths. Web-server access logs and PHP session storage sit outside this review scope.

Operations

Logging. Broader than "queries are logged for abuse prevention" implies — request parameters and the free-text intent fields are logged in full, alongside the caller identity, client, and result, to support abuse detection, debugging, and usage analytics.

Rate limiting. Not yet enforced during developer preview. This will change before general availability — build clients that handle a 429 gracefully regardless.

Training-data use. [Pending a product/legal decision — do not represent either way until confirmed.]

Shared responsibility

Q-omics secures the platform, the data pipeline, and the query engine. You're responsible for protecting your own API key or OAuth token, for not submitting data you're not permitted to share (see "What you send us"), and for whatever your application does with the statistics it receives.

Scope note

Q-omics is not a source of medical advice, and results are not validated for clinical decision-making. This platform surfaces candidate biomarkers and research signals from public consortium data — appropriate for hypothesis generation, not patient care.

Contact