diff --git a/openapi/SOURCE.json b/openapi/SOURCE.json
index b3c7b6d..43ac7d5 100644
--- a/openapi/SOURCE.json
+++ b/openapi/SOURCE.json
@@ -2,12 +2,12 @@
  "verification.json": {
   "url": "https://docs.didit.me/openapi-25.json",
   "sha256": "99198089e59db66a2eb3fa2a17c9475a2dafce62ee25ed8998eaf00fb2108406",
-  "fetched_at": "2026-11-10T00:24:13Z"
+  "fetched_at": "2026-11-10T07:59:42Z"
  },
  "account.json": {
   "url": "https://docs.didit.me/openapi-auth.json",
-  "sha256": "8a02e3aad37615281d42926abcfc0a10a449e02cd8c70dd6ef8633abb7185704",
-  "fetched_at": "2026-11-10T00:24:13Z"
+  "sha256": "3ebf65c9668861bcd2008c11d65be4055ef58ba5fa57945c72afe3d4ac4fb523",
+  "fetched_at": "2026-11-10T07:59:42Z"
  },
  "webhook-vectors.json": {
   "generator": "product-automations scripts/server-sdks/make_vectors.py (seeded 2026-10-17)",
@@ -16,6 +16,6 @@
  "authentication.json": {
   "url": "https://docs.didit.me/openapi-authentication.json",
   "sha256": "3987984647bfcaa4b5462c8d60cd3c53894bf7585a38109e0cc813292b2416fe",
-  "fetched_at": "2026-11-10T00:24:13Z"
+  "fetched_at": "2026-11-10T07:59:42Z"
  }
 }
\ No newline at end of file
diff --git a/openapi/account.json b/openapi/account.json
index 0847dd7..177009c 100644
--- a/openapi/account.json
+++ b/openapi/account.json
@@ -1051,7 +1051,7 @@
             }
           },
           "403": {
-            "description": "You cannot create applications in this organization. A member of the organization who is not an owner or admin gets `Only organization owners and admins can manage applications.` An owner or admin whose access to the organization is suspended gets `Your access to this organization is suspended.` A request without an `Authorization` header gets `You do not have permission to perform this action.` For 72 hours after you recovered your account the request is refused with `code` `recovery_hold` and `until`, the time the hold ends.",
+            "description": "You cannot create applications in this organization. A member of the organization who is not an owner or admin gets `Only organization owners and admins can manage applications.` An owner or admin whose access to the organization is suspended gets `Your access to this organization is suspended.` A request without an `Authorization` header gets `You do not have permission to perform this action.` For 72 hours after you recovered your account the request is refused with `code` `recovery_hold` and `until`, the time the hold ends. A token issued to an AI agent (MCP) whose consent does not include application management gets `This token's scope does not permit this action.`, and a token limited to verification cannot read or change applications or their API keys.",
             "content": {
               "application/json": {
                 "schema": {
@@ -1090,6 +1090,12 @@
                       "code": "recovery_hold",
                       "until": "2026-11-04T10:15:00+00:00"
                     }
+                  },
+                  "McpScope": {
+                    "summary": "Agent token without application management",
+                    "value": {
+                      "detail": "This token's scope does not permit this action."
+                    }
                   }
                 }
               }
@@ -1348,7 +1354,7 @@
             }
           },
           "403": {
-            "description": "You cannot list this organization's applications. A member of the organization who is not an owner or admin gets `Only organization owners and admins can manage applications.` An owner or admin whose access to the organization is suspended gets `Your access to this organization is suspended.` A request without an `Authorization` header gets `You do not have permission to perform this action.`",
+            "description": "You cannot list this organization's applications. A member of the organization who is not an owner or admin gets `Only organization owners and admins can manage applications.` An owner or admin whose access to the organization is suspended gets `Your access to this organization is suspended.` A request without an `Authorization` header gets `You do not have permission to perform this action.` A token issued to an AI agent (MCP) whose consent does not include application management gets `This token's scope does not permit this action.`, and a token limited to verification cannot read or change applications or their API keys.",
             "content": {
               "application/json": {
                 "schema": {
@@ -1372,6 +1378,12 @@
                     "value": {
                       "detail": "You do not have permission to perform this action."
                     }
+                  },
+                  "McpScope": {
+                    "summary": "Agent token without application management",
+                    "value": {
+                      "detail": "This token's scope does not permit this action."
+                    }
                   }
                 }
               }
@@ -1560,7 +1572,7 @@
             }
           },
           "403": {
-            "description": "You cannot read this application. A member of the organization who is not an owner or admin gets `Only organization owners and admins can manage applications.` An owner or admin whose access to the organization is suspended gets `Your access to this organization is suspended.` A request without an `Authorization` header gets `You do not have permission to perform this action.`",
+            "description": "You cannot read this application. A member of the organization who is not an owner or admin gets `Only organization owners and admins can manage applications.` An owner or admin whose access to the organization is suspended gets `Your access to this organization is suspended.` A request without an `Authorization` header gets `You do not have permission to perform this action.` A token issued to an AI agent (MCP) whose consent does not include application management gets `This token's scope does not permit this action.`, and a token limited to verification cannot read or change applications or their API keys.",
             "content": {
               "application/json": {
                 "schema": {
@@ -1584,6 +1596,12 @@
                     "value": {
                       "detail": "You do not have permission to perform this action."
                     }
+                  },
+                  "McpScope": {
+                    "summary": "Agent token without application management",
+                    "value": {
+                      "detail": "This token's scope does not permit this action."
+                    }
                   }
                 }
               }
@@ -1847,7 +1865,7 @@
             }
           },
           "403": {
-            "description": "You cannot update this application. A member of the organization who is not an owner or admin gets `Only organization owners and admins can manage applications.` An owner or admin whose access to the organization is suspended gets `Your access to this organization is suspended.` A request without an `Authorization` header gets `You do not have permission to perform this action.`",
+            "description": "You cannot update this application. A member of the organization who is not an owner or admin gets `Only organization owners and admins can manage applications.` An owner or admin whose access to the organization is suspended gets `Your access to this organization is suspended.` A request without an `Authorization` header gets `You do not have permission to perform this action.` A token issued to an AI agent (MCP) whose consent does not include application management gets `This token's scope does not permit this action.`, and a token limited to verification cannot read or change applications or their API keys.",
             "content": {
               "application/json": {
                 "schema": {
@@ -1871,6 +1889,12 @@
                     "value": {
                       "detail": "You do not have permission to perform this action."
                     }
+                  },
+                  "McpScope": {
+                    "summary": "Agent token without application management",
+                    "value": {
+                      "detail": "This token's scope does not permit this action."
+                    }
                   }
                 }
               }