Skip to main content

​
Docs Development

This repository is the public SpaceMedia docs site. It should only describe external organization and user workflows.

​
Local validation

Run these checks before shipping changes: 
node -e "JSON.parse(require('fs').readFileSync('docs.json','utf8')); JSON.parse(require('fs').readFileSync('api-reference/openapi.json','utf8')); console.log('json ok')"
npx.cmd mint validate

​
Public API audit rules

RuleRequired behavior
Organization scopedExamples must resolve organization context from authentication, not cross-organization request parameters.
Role scopedEach endpoint description must state whether it is for end users, organization admins, or users with a specific permission.
No system routesDo not publish platform-only organization directories, system add-on administration, provider balances, wallet adjustments, approval/rejection routes, or internal downloads.
Code-derived examplesRequest bodies must match validators and response bodies must match resources or controller envelopes.
Safe demo dataUse deterministic fake IDs, emails, URLs, and payment intents. Never copy real customer data or secrets.

​
OpenAPI maintenance

The OpenAPI file keeps the interactive playground enabled, but examples must not prefill secrets. Use placeholders for Authorization, X-Api-Key, and X-Api-Secret. When a controller supports extra parameters only for SpaceMedia system users, omit those parameters from the public spec.