Skip to main content
Publication is blocked until an authorized Mintlify administrator completes this checklist and records redacted evidence. Repository checks cannot prove deployed authentication behavior.

​
Preconditions

  • Use one partially authenticated Mintlify project with content path /docs.
  • Use a Mintlify subdomain or custom domain. Do not use an authenticated custom basepath.
  • Enable Partial Authentication before connecting the release branch to an externally reachable documentation URL.
  • Configure OAuth or JWT user data so authorized engineers receive the exact group value engineering.
  • Prepare three sessions: anonymous, authenticated without the engineering claim, and authenticated with the engineering claim.
  • Use non-production test identities and redact personal data, cookies, access tokens, API keys, and complete JWTs from evidence.

​
Configuration evidence

​
TS-006 access acceptance

Record an HTTP status, screenshot or trace link, and executor for every row.

​
Content and release acceptance

  • Anonymous and engineering mint validate checks passed for the release commit.
  • OpenAPI drift, typed examples, content boundaries, Secretlint, links, anchors, redirects, snippets, accessibility, and operations-assets checks passed.
  • Generated OpenAPI and AsyncAPI operation/channel pages are reachable by the intended audience.
  • The API playground does not prefill or store Tayho credentials.
  • No documentation page contains a resolved secret or credential-bearing URL.
  • The exact release commit and CI run are linked below.
  • The TS-006 table has no Pending entry.
  • The authorized administrator has signed off.

​
Release decision

Keep the site private and do not announce its URL while any item is pending or failed. A failed protected-page, search, assistant, MCP, or export check is an access-control failure: remove public exposure first, correct the dashboard or content classification, redeploy, and repeat every TS-006 row.
Last modified on July 23, 2026