diff --git a/server/internal/api/docs/openapi.json b/server/internal/api/docs/openapi.json
index a33f251..c081a92 100644
--- a/server/internal/api/docs/openapi.json
+++ b/server/internal/api/docs/openapi.json
@@ -811,6 +811,13 @@
                         "type": "array",
                         "uniqueItems": false
                     },
+                    "tag_selector": {
+                        "additionalProperties": {
+                            "type": "string"
+                        },
+                        "description": "TagSelector restricts this token to servers carrying every tag in the\nmap. Empty or nil means the whole fleet.\n\nImmutable after creation for the same reason as Role and Scopes: changing\nwhat a credential already deployed in CI can reach, with no record of what\nit could reach before, is worse than requiring a rotation.",
+                        "type": "object"
+                    },
                     "token_id": {
                         "type": "string"
                     },