diff --git a/mintlify/openapi.yaml b/mintlify/openapi.yaml
index 501f49403..9e355e0d8 100644
--- a/mintlify/openapi.yaml
+++ b/mintlify/openapi.yaml
@@ -8350,6 +8350,8 @@ paths:
 
         Request the reveal right before rendering the iframe and render the returned `panEmbedUrl` immediately; it expires at `expiresAt` (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor's iframe and never crosses Grid's or your servers.
 
+        Requires a token with the `MANAGE` permission; `VIEW` alone is not sufficient to mint a reveal URL.
+
         Every reveal is audit-logged with the requesting actor.
       operationId: revealCard
       tags:
@@ -8370,7 +8372,7 @@ paths:
               schema:
                 $ref: '#/components/schemas/Error401'
         '403':
-          description: Forbidden. The session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session).
+          description: Forbidden. The token lacks the `MANAGE` permission, or the session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session).
           content:
             application/json:
               schema:
diff --git a/openapi.yaml b/openapi.yaml
index 501f49403..9e355e0d8 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -8350,6 +8350,8 @@ paths:
 
         Request the reveal right before rendering the iframe and render the returned `panEmbedUrl` immediately; it expires at `expiresAt` (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor's iframe and never crosses Grid's or your servers.
 
+        Requires a token with the `MANAGE` permission; `VIEW` alone is not sufficient to mint a reveal URL.
+
         Every reveal is audit-logged with the requesting actor.
       operationId: revealCard
       tags:
@@ -8370,7 +8372,7 @@ paths:
               schema:
                 $ref: '#/components/schemas/Error401'
         '403':
-          description: Forbidden. The session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session).
+          description: Forbidden. The token lacks the `MANAGE` permission, or the session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session).
           content:
             application/json:
               schema:
diff --git a/openapi/paths/cards/cards_{id}_reveal.yaml b/openapi/paths/cards/cards_{id}_reveal.yaml
index b5d8c33f1..8f1872a3c 100644
--- a/openapi/paths/cards/cards_{id}_reveal.yaml
+++ b/openapi/paths/cards/cards_{id}_reveal.yaml
@@ -21,6 +21,10 @@ post:
     iframe and never crosses Grid's or your servers.
 
 
+    Requires a token with the `MANAGE` permission; `VIEW` alone is not
+    sufficient to mint a reveal URL.
+
+
     Every reveal is audit-logged with the requesting actor.
   operationId: revealCard
   tags:
@@ -42,8 +46,9 @@ post:
             $ref: ../../components/schemas/errors/Error401.yaml
     '403':
       description: >-
-        Forbidden. The session has no attributable actor to audit the reveal
-        against (for example, an impersonated dashboard session).
+        Forbidden. The token lacks the `MANAGE` permission, or the session has
+        no attributable actor to audit the reveal against (for example, an
+        impersonated dashboard session).
       content:
         application/json:
           schema: