diff --git a/docsite/docs/hq/licensing-and-entitlements.md b/docsite/docs/hq/licensing-and-entitlements.md
index df334e3..3a9bfbc 100644
--- a/docsite/docs/hq/licensing-and-entitlements.md
+++ b/docsite/docs/hq/licensing-and-entitlements.md
@@ -33,7 +33,7 @@ Two are per-instance toggles rather than tier bundles:
 | Feature   | What it enables                                                           |
 | --------- | ------------------------------------------------------------------------- |
 | `console` | The [browser console](../vantage/browser-console.md)                      |
-| `oidc`    | Per-instance [single sign-on](../vantage/settings.md#single-sign-on-oidc) |
+| `oidc`    | Per-instance [single sign-on](../vantage/settings.md#single-sign-on) |
 
 No tier includes them by default; you enable them on the instances that need
 them.
diff --git a/docsite/docs/reference/rest-api.md b/docsite/docs/reference/rest-api.md
index 213ebbe..107567c 100644
--- a/docsite/docs/reference/rest-api.md
+++ b/docsite/docs/reference/rest-api.md
@@ -22,7 +22,9 @@ GET  /install            /install.ps1        # dynamic agent install scripts
 GET  /update             /update.ps1
 GET  /auth/bootstrap-status
 POST /auth/bootstrap     /auth/login  /auth/logout
-GET  /auth/me            /auth/oidc/start    /auth/oidc/callback
+GET  /auth/me
+GET  /auth/providers                          # {local_enabled, providers:[{id,name,preset}]} — no issuer, client ID or secret
+GET  /auth/oidc/:providerId/start · /auth/oidc/:providerId/callback
 GET  /api/secrets/:group/values               # bearer token (ESO)
 ```
 
@@ -114,7 +116,10 @@ POST /license                                (self-hosted only)
 GET,POST   /org/users
 PUT        /org/users/:id/role
 DELETE     /org/users/:id
-GET,PUT    /org/oidc                         (owner|admin)
+GET,POST       /auth/providers                        (owner|admin)
+PUT,DELETE     /auth/providers/:id                     (owner|admin)
+POST           /auth/providers/:id/test · /auth/providers/:id/ack-notice   (owner|admin)
+GET             /auth/presets                          (owner|admin)
 ```
 
 ## Notable refusals