Document /server/health authentication breaking change in 12.0

[ChristopherJennings]

Summary

Directus 12.0.0 (directus/directus#27160) restricted /server/health to authenticated users. The GitHub release listed it as breaking, but the Version 12 breaking changes page didn't. A customer upgrading from 11.17.4 had an unauthenticated health probe fail, which triggered an automatic rollback.

Changes

• Breaking changes → Version 12 (12.0.0): new section, "/server/health Requires Authentication", covering:
  • the 403 for unauthenticated requests, and using /server/ping for liveness checks
  • sending a static token when you need dependency checks; non-admins get only status, admins get the full report
  • results are cached (HEALTHCHECK_CACHE_TTL, default 5m) and shared across instances
  • cache, rateLimiter and rateLimiterGlobal checks replaced by one redis: check
  • new HEALTHCHECK_ENABLED / HEALTHCHECK_SERVICES variables
  • also added this and the existing IP_TRUST_PROXY section to the 12.0.0 "Jump to" list
• Breaking changes → Version 12 (12.2.0): notes that TinyMCE is no longer bundled (custom plugins, skins, content CSS, global tinymce object).
• Self-hosting → Deploying: Health Checks section now puts /server/ping first and explains /server/health auth and response shape.
• Configuration → Health Check: adds the auth note and fixes an "edis" → "Redis" typo.

Reviewer notes

• Status code: the release note says unauthenticated requests get a 404, but ServerService.health() throws ForbiddenError (403), and the e2e tests expect "You don't have permission to access this." The docs say 403. The GitHub release text may need a correction.
• Sweep: I checked the 12.0.0–12.4.1 release notes against the breaking changes page. 12.1, 12.3, 12.4 and the patch releases match. Two 12.0.0 items are deliberately left out and need a decision:
  • The release note lists AI Translations as license-gated. The licensing docs don't mention it, so it needs confirming first.
  • The BUSL-1.1 → MSCL-1.0-GPL relicense is marked breaking in the release.
• Anchors and links were checked on the local dev server.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 24, 2026 9:15pm UTC