diff --git a/docs/cloud-security/api-reference.md b/docs/cloud-security/api-reference.md
index 364e7c906..a91dd1440 100644
--- a/docs/cloud-security/api-reference.md
+++ b/docs/cloud-security/api-reference.md
@@ -51,7 +51,7 @@ Shared behaviors:
 | `GET /ciem/facets` | `{facets}` — identity facet counts. |
 | `GET /ciem/identities` | `{principals, next_cursor}` — the same per-principal effective-access rows `public-access` carries, but server-filtered and keyset-paginated instead of a top-N. Takes the same selectors as `/ciem/facets`, so the rail's counts always describe the population in the list. Ranked by risk score by default, so a walk that spans a projector rebuild can move a row across the cursor — use it for browsing, and `/inventory` with `type=Identity` and the default `urn` sort for an exact export. |
 | `GET /ciem/identity?urn=` | `{identity}` — the Identity 360 single-identity rollup for one principal URN: its grants, reachable sensitive resources, access levels, and escalation paths. |
-| `GET /code/repos`, `/code/status`, `/code/capabilities`, `/code/fixes`, `/code/repos/{repo}/sbom`, `/code/images`, `/code/image-repos` | Code Security reads: repositories, run status, GitHub capabilities, the dependency fix queue, SBOM links and container images. See [Code Security API routes](code-security/reference.md#api-routes). |
+| `GET /code/repos`, `/code/status`, `/code/capabilities`, `/code/fixes`, `/code/sbom?repo=`, `/code/images`, `/code/image-repos` | Code Security reads: repositories, run status, GitHub capabilities, the dependency fix queue, SBOM links and container images. See [Code Security API routes](code-security/reference.md#api-routes). |
 | `GET /inventory` | `{resources, next_cursor}`. Filters: `type`, `provider`, `account`, `region`, `q`, `account_unscoped` (drop the account scoping and walk the whole estate), `sort` (`urn`, the default and the safe order for a full walk or export; `risk` with `type=Identity`; `last_seen` with `type=ThirdPartyAsset`), paging. With `type=Identity`, `provider`/`source`, `account`, and `region` become repeatable and the identity cross-filter applies: `kind`, `criticality`, `risk_band`, `mfa` (`on`/`off`/`unknown`), and the tri-state `admin`, `external`, `public`, `disabled`, `crown_jewel`, `can_escalate`, `dormant_90d`, `with_sensitive`. Pages served from the materialized view also carry `served_from` and `data_as_of` (the snapshot's build time) so a client can render "as of" instead of implying live. |
 | `GET /inventory/facets` | Inventory facet counts by type/account/region. |
 | `GET /data-security/facets` | `{facets}` — DSPM data-store rollup. |
diff --git a/docs/cloud-security/code-security/reference.md b/docs/cloud-security/code-security/reference.md
index 7b450f816..69d65c3ae 100644
--- a/docs/cloud-security/code-security/reference.md
+++ b/docs/cloud-security/code-security/reference.md
@@ -159,7 +159,7 @@ subscribed to `ext-cloud-security`.
 | `GET /code/status` | `code status` | Run status per connection. |
 | `GET /code/capabilities` | `code capabilities` | What each GitHub connection can do, and its webhook status. Optional `repo`. |
 | `GET /code/fixes` | `code fixes` | Open dependency findings grouped by the upgrade that fixes them. |
-| `GET /code/repos/{repo}/sbom` | `code sbom` | A short-lived download link for the repository's SBOM. |
+| `GET /code/sbom` | `code sbom` | A short-lived download link for one repository's SBOM. Params: `repo` (required, `<owner>/<name>` as `/code/repos` returns it), `provider`. |
 | `GET /code/images`, `GET /code/images/{digest}` | | Container images and one image's detail. |
 | `GET /code/image-repos`, `GET /code/image-repos/facets` | | Image repositories and their filter counts. |
 | `POST /code/scan` | `code rescan` | Rescan one repository. Body: `{repo, ref?, provider?}`. |