Why our TikTok API posts were private, and what TikTok’s audit changes

At the end of September 2026 we started publishing reels to TikTok through Mellow Hub, our own publishing product. TikTok said every one of them was published and public. Nobody but the account owner could see any of them. This is how we found out why, and what TikTok’s app audit does and does not have to do with it.

The situation: “published”, and invisible

Mellow Hub reaches TikTok through its publishing provider’s TikTok app. On 29 and 30 September 2026 we sent our first reels through it to two of our founder’s accounts, @wlad_kowalski and a second, older account. Both had been registered with ties to Russia.

What TikTok told us was all good news:

• the publish request was accepted with the privacy level PUBLIC_TO_EVERYONE;
• the status check answered PUBLISH_COMPLETE;
• the creator information TikTok returns before a post offered public posting as an option;
• in the app, each video’s privacy read “Everyone”.

What other people saw was nothing. Logged out, the profile grid did not show the videos. TikTok’s oEmbed endpoint, which describes a public video for embedding, refused them. A silent test clip had 0 views after 36 minutes, against 63 for a video the same account had uploaded from the phone.

What TikTok’s audit does, and why it was not our cause

The first suspect for any developer is TikTok’s audit. TikTok’s Direct Post reference and its content sharing guidelines (pages updated 4 August 2026, read by us on 11 October 2026) say:

• everything an unaudited app posts is restricted to private viewing until the app passes an audit for compliance with TikTok’s terms;
• only the privacy level SELF_ONLY is accepted from such an app;
• at most 5 users can post through it in a 24-hour window, and their accounts must be private when they post;
• a blocked attempt answers unaudited_client_can_only_post_to_private_accounts;
• to make such a post public later, the owner first makes the account public, then changes each post to “Everyone”.

The pages give no timeline for an audit. Passing it lifts the private-only rule and nothing else: the person still chooses the privacy setting, with no default, and a creator can post about 15 times a day through the API, a cap shared by every app posting to that account.

Our posts did not fit that picture. An unaudited app cannot post with PUBLIC_TO_EVERYONE at all, and the creator information would not have offered it. The provider’s app was audited. So the audit explains one kind of “private” TikTok post, and we had the other kind.

What we did, step by step

1. Read the video’s own page. A TikTok video page carries a data block named webapp.video-detail with a status code. For every API upload it answered statusCode 10204 with statusMsg ru_create_block. That is a different answer from TikTok’s moderation, private and geo statuses (status_reviewing, status_audit_not_pass, status_self_see, 10231).
2. Find the real video id. Our provider’s “published” means “handed over to TikTok”, and it stores TikTok’s publish id, not the video id; TikTok returns a post’s id only once a public post has passed moderation. We read the ids from the logged-out profile grid instead.
3. Change one thing at a time.

- The first reels carried a song baked into the file. A silent copy was blocked the same way, so the song was not the cause. - To rule out repeated content, on 1 October at 21:33 UTC we sent a reel that had never been published anywhere, AI-made and labelled as AI-generated through the API, to the second account only. Its page answered 10204 ru_create_block at 21:35 and again at 21:38, and oEmbed answered 400. - The provider’s API runs on AWS in Singapore, so no Russian server or address was involved. - The same accounts’ uploads from a phone in Thailand were public, with locationCreated: "TH", and had 122 and 155 plays.

1. Form a hypothesis. An API upload has no device behind it, so TikTok falls back to the account’s registration region, and TikTok has not published new content created in Russia since 2022. Our founder disputed this at first, since his posts from the phone worked; the phone is exactly why they did. Many accounts registered in Russia, his included, have no “Account region” item to change.
2. Run the decisive test. On 3 October 2026 we connected a third TikTok account, created on 17 June 2026 outside Russia, and sent one post through the same route. Within a minute its page answered statusCode 0 with locationCreated: "US", oEmbed answered 200 with the caption, a logged-out viewer in Thailand saw it in the grid and played it, and the account’s public video count went from 0 to 1.

Results

TikTok never told us in words why the videos were held. What the tests show is consistent: seven API uploads from two Russia-registered accounts were invisible, every one with ru_create_block, while one upload from an account registered elsewhere was public within a minute, through the same app, the same provider and the same code.

What changed in Mellow Hub:

• since 30 September a TikTok post reads “Sent to TikTok”, not “Published”, until there is a video to link to, because a handover is not a public post;
• before sending, the agent’s guide and the validator warn that an account whose region is Russia cannot publish through an app, and offer the draft route: the video lands in the TikTok inbox and is posted from the phone;
• since 1 October Hub carries TikTok’s “Disclose commercial content” switch (below).

What did not work, and what we changed

• We blamed the song first. It was the obvious difference between our uploads and the founder’s phone uploads. The silent copy disproved it the same evening, and we said so.
• We posted a test without asking. One silent test copy went to a real account without the owner’s yes. Only the owner can delete such a video in the TikTok app. Test posts now go only where the owner has agreed.
• TikTok flagged a video nobody could see. About 4.5 hours after a copy with a link to our own product in the caption went out, TikTok showed the owner “Video may require content disclosure”, marked it “Undisclosed” in the grid, and gave 24 hours to disclose it or its For You distribution “may be affected”. The provider sends TikTok’s brand flags as false unless it is told otherwise. Hub now exposes both flags, and its validator notes a TikTok caption with a web address and no disclosure.
• TikTok on hold. On 14 October our founder paused TikTok for his personal brand until he connects an account registered outside Russia.

How to do it yourself

1. Know whether your app is audited. If you built your own app on TikTok’s Content Posting API and it has not passed the audit, every post will be private, by design.
2. Ask TikTok before every post. Query the creator information, show the privacy options it returns, and let the person choose; there is no default. Our answer on scheduling TikTok posts lists what else TikTok checks.
3. Do not trust “published”. Poll the status, get the video’s own id, and check the video page and oEmbed while logged out.
4. Read the page’s status code. 10204 with ru_create_block means the region, not your code. Check Settings and privacy → Account → User information → Account region; if there is no such item, send the video as an inbox draft and post it from the phone.
5. Disclose promotion. Set “Your brand” or “Branded content” on any video that promotes something.
6. Or let a tool carry it. In Mellow Hub a TikTok post goes through an audited app, reads “Sent to TikTok” until it is live, and offers the draft route and the disclosure switch.

Numbers at a glance