Skip to main content
Xquik publishes its API documentation source under the MIT License. You can inspect, test, fork, and improve these docs. This license does not make the hosted Xquik platform open source. It does not grant rights to Xquik brands either. Use this page to verify the exact boundary. It covers documentation, OpenAPI, SDKs, security reporting, dependencies, and OpenSSF evidence.

​
Distinguish the Public Sources

Documentation Source

The xquik-docs repository uses the MIT License. It contains MDX pages, docs.json, tests, and build policy.

OpenAPI Contract

The public openapi.yaml describes REST paths, parameters, schemas, and responses.

SDK Source

Published SDKs use separate repositories. Start from the SDK documentation or browse the Xquik-dev organization.

Hosted Xquik Service

The API, dashboard, workers, and private platform code are not licensed by this repository.
Public documentation and a public API contract do not expose a hosted service’s implementation. They let developers audit the promised interface instead.

​
Inspect the Open Source API Documentation

1

Read the Repository License

Review LICENSE. It grants the standard MIT permissions for this repository’s source.
2

Check SPDX Coverage

Review REUSE.toml and LICENSES/MIT.txt. REUSE metadata assigns an SPDX license and copyright statement to committed files.
3

Inspect the Public Contract

Compare endpoint pages with openapi.yaml. Confirm methods, parameters, request bodies, and every response status.
4

Review Change History

Inspect commits and pull requests. Read discussions, checks, approvals, and resolved review threads before trusting a change.
5

Run the Same Checks

Clone the repository. Install the lockfile without lifecycle scripts. Run the documented verification commands.
Run commands against a reviewed commit. A passing local build does not prove the hosted platform uses that commit.

​
Understand What Each Check Proves

Dependency Policy

check:dependencies requires exact direct versions. It checks approved registry URLs, SHA-512 integrity, and allowed package licenses.

Response Contract

check:response-examples compares every API response widget with the canonical OpenAPI status set.

Documentation Tests

test:agent-docs checks metadata, navigation, contracts, accessibility, agent readability, and protected content invariants.

Mintlify Validation

docs:validate validates the OpenAPI document and Mintlify build. docs:links rejects broken internal links.

Repository Licensing

reuse lint verifies SPDX coverage. The repository also stores the complete MIT license text.

Security Automation

GitHub Actions runs dependency checks, CodeQL, OpenSSF Scorecard, audits, validation, and license verification.
The workflows pin third-party actions to commit hashes. Checkout disables persisted credentials. The main docs job uses read-only repository access. These controls provide reproducible evidence. They cannot guarantee zero vulnerabilities. They also do not disclose private platform code.

​
Understand the OpenSSF Badge Scope

OpenSSF assigns badges to FLOSS projects. A shared project site does not automatically need a separate badge. See the official project terminology. xquik-docs supports multiple independently released projects. It has no separate badge entry today. Create one if this repository independently releases software. The organization evidence register maps standalone projects to live bestpractices.dev entries. Open each entry for its current status and evidence. Do not copy dated percentages into a permanent claim. Passing does not mean Silver or Gold. Each level adds criteria. Read the current Gold criteria before evaluating a project.

​
Review Current OpenSSF Gaps

The public evidence register identifies human requirements separately from automated checks. Current tracked areas include:
  • Maintainer and release continuity after one member becomes unavailable
  • A bus factor supported by public role and contribution evidence
  • Significant work from unassociated human contributors
  • A scoped human security review for each affected project
Use the public trackers for current evidence: Automated scans can support a human review. They cannot replace the reviewer. Open pull requests also cannot prove a default-branch control. Do not claim Gold until each project has verified public evidence. Recheck badge entries after evidence reaches their default branches.

​
Apply the MIT License Correctly

The MIT License lets you use, copy, modify, merge, and publish this documentation source. It also permits distribution. Preserve its copyright and permission notice. The repository-wide REUSE annotation applies MIT metadata to committed files. Third-party packages still retain their own licenses. Review the dependency policy before redistributing a complete development environment. The docs license does not cover the Xquik product, brand, or hosted platform. It also does not promise self-hosting instructions for the service. Hosted API access follows each route’s authentication, payment, and account requirements. Start with the X API quickstart for authenticated requests.

​
Contribute to the API Documentation

1

Choose One Verifiable Change

Fix a contract error, example, broken link, accessibility issue, or unclear workflow. Avoid search-only pages and unsupported claims.
2

Follow the Contribution Guide

Read CONTRIBUTING.md. Match its writing, OpenAPI, dependency, and MDX rules.
3

Add Regression Coverage

Protect corrected contracts, metadata, navigation, or content with the nearest test.
4

Run Every Check

Run the complete command block above. Fix failures before requesting review.
5

Sign and Submit

Add the Developer Certificate of Origin sign-off. Open one focused pull request against main.
6

Resolve Review Feedback

Address every applicable comment. Wait for required checks and an independent approval.
Use git commit --signoff for the DCO trailer. The shared review policy defines approval expectations.

​
Report Documentation Security Issues Privately

Use GitHub private vulnerability reporting for security findings. Email security@xquik.com if GitHub is unavailable. Do not open a public issue for authentication, webhook, contract, or credential vulnerabilities. Remove API keys, tokens, cookies, and personal information from every sample. The docs security scope covers this Mintlify site and dangerous contract errors. Product vulnerabilities follow the routing in the security reporting guide.

​
Open Source API Documentation Questions

​
Is the Xquik API Open Source?

The documentation, OpenAPI contract, and listed SDK repositories are public. The hosted Xquik platform is not open source.

​
Can I Self-Host Xquik From This Repository?

No. This repository builds documentation. It does not contain the hosted API, dashboard, workers, or private platform code.

​
Can I Fork the Xquik Documentation?

Yes. Follow the MIT License and preserve its notice. Do not imply affiliation or endorsement.

​
Is the Public OpenAPI File the Server Source?

No. openapi.yaml defines the supported public interface. It does not contain server implementation code.

​
Does xquik-docs Have an OpenSSF Badge?

No separate entry exists. The repository is a shared project site for independently released projects.

​
Where Can I Verify Current OpenSSF Status?

Use the organization evidence register. Then open each linked bestpractices.dev entry for live status.

​
How Do I Report a Vulnerability?

Use private vulnerability reporting. Never publish secrets or exploitable details in an issue or pull request.

​
Evidence Sources

Xquik is an independent third-party service. Not affiliated with X Corp. “Twitter” and “X” are trademarks of X Corp.