A public-health team is about to cut over clinic traffic to a new online endpoint. What should they do first?

Smoke-testing the new online endpoint with synthetic clinic payloads before cutover is correct because public-health cutovers must prove the endpoint authenticates, accepts expected schemas, returns sane outputs, and meets basic latency before clinic traffic arrives. Synthetic payloads exercise the path without exposing real patient or clinic operational data unnecessarily, catching wiring and contract defects early. Promoting the staging endpoint to production on offline evaluation metrics before cutover does not validate serving configuration. Running shadow validation on the new online endpoint with synthetic payloads before cutover is not the first step because shadow validation assumes the endpoint already passes basic smoke checks for authentication, schema, and latency, and running extended validation before that quick prove-out delays catching wiring defects. Promoting the staging endpoint to production on offline evaluation metrics before cutover fails conceptually: training success does not prove endpoint routing, scaling, serialization, or authentication correctness. Enabling Application Insights on the new endpoint with synthetic payloads before cutover is not the right first step because it only adds observability for the test calls and does not itself verify authentication, schema, outputs, and latency the way a smoke test does. Exam caveat: smoke tests should include both happy-path and invalid payloads, and should run against the production-like configuration (auth, network isolation, model version) planned for cutover—not only a developer laptop. Synthetic data must still respect privacy policies. Operational check: send synthetic clinic payloads to the new online endpoint, verify status codes and schema, compare scores to a golden set where appropriate, and only then shift clinic traffic.