@@ -7231,7 +7231,7 @@ components:
         workspace_id: '550e8400-e29b-41d4-a716-446655440000'
       properties:
         allowed_api_key_hashes:
-          description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction.'
+          description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction. A workspace-scoped management key can only name API keys in its own workspace.'
           example:
             - 'f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943'
           items:
@@ -10297,7 +10297,7 @@ components:
         provider: 'openai'
       properties:
         allowed_api_key_hashes:
-          description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.'
+          description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400; for a workspace-scoped management key, so do hashes of API keys outside its own workspace.'
           example:
             - 'f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943'
           items:
@@ -10374,7 +10374,7 @@ components:
         provider:
           $ref: '#/components/schemas/BYOKProviderSlug'
         workspace_id:
-          description: 'Optional workspace ID to scope the credential to. When omitted, the credential is created in the account''s default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.'
+          description: 'Optional workspace ID to scope the credential to. When omitted, a workspace-scoped management key creates it in its own workspace. An organization management key creates it in the account''s default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.'
           example: '550e8400-e29b-41d4-a716-446655440000'
           format: 'uuid'
           type: 'string'
@@ -36093,7 +36093,7 @@ components:
         name: 'Updated OpenAI Key'
       properties:
         allowed_api_key_hashes:
-          description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` clears the restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.'
+          description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` clears the restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400; for a workspace-scoped management key, so do hashes of API keys outside its own workspace.'
           example:
             - 'f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943'
           items:
@@ -41199,7 +41199,7 @@ paths:
         - 'Benchmarks'
   /byok:
     get:
-      description: 'List the bring-your-own-key (BYOK) provider credentials for the authenticated entity''s default workspace. Use the `workspace_id` query parameter to scope the result to a different workspace, or the `provider` query parameter to filter by upstream provider. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
+      description: 'List the bring-your-own-key (BYOK) provider credentials for the authenticated entity''s default workspace, or a workspace-scoped management key''s own workspace. Use the `workspace_id` query parameter to scope the result to a different workspace, or the `provider` query parameter to filter by upstream provider. A workspace-scoped management key can only list its own workspace; any other `workspace_id` returns 403. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
       operationId: 'listBYOKKeys'
       parameters:
         - description: 'Number of records to skip for pagination'
@@ -41225,12 +41225,12 @@ paths:
             maximum: 100
             minimum: 1
             type: 'integer'
-        - description: 'Optional workspace ID to filter by. When omitted, resolves to the account’s default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.'
+        - description: 'Optional workspace ID to filter by. When omitted, a workspace-scoped management key uses its own workspace. An organization management key uses the account’s default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.'
           in: 'query'
           name: 'workspace_id'
           required: false
           schema:
-            description: 'Optional workspace ID to filter by. When omitted, resolves to the account’s default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.'
+            description: 'Optional workspace ID to filter by. When omitted, a workspace-scoped management key uses its own workspace. An organization management key uses the account’s default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.'
             example: '550e8400-e29b-41d4-a716-446655440000'
             format: 'uuid'
             type: 'string'
@@ -41449,7 +41449,7 @@ paths:
           results: '$.data'
         type: 'offsetLimit'
     post:
-      description: 'Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
+      description: 'Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. A workspace-scoped management key creates the credential in its own workspace when `workspace_id` is omitted, and any other `workspace_id` returns 403. Treat the raw key as write-only; it is never returned after creation. Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
       operationId: 'createBYOKKey'
       requestBody:
         content:
@@ -41532,7 +41532,7 @@ paths:
       x-speakeasy-name-override: 'create'
   /byok/{id}:
     delete:
-      description: 'Delete (soft-delete) a bring-your-own-key (BYOK) provider credential by its `id`. The encrypted key material is wiped and the record is marked as deleted. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
+      description: 'Delete (soft-delete) a bring-your-own-key (BYOK) provider credential by its `id`. The encrypted key material is wiped and the record is marked as deleted. A workspace-scoped management key only reaches credentials in its own workspace; any other `id` returns 404. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
       operationId: 'deleteBYOKKey'
       parameters:
         - description: 'The BYOK credential ID (UUID).'
@@ -41598,7 +41598,7 @@ paths:
         - 'BYOK'
       x-speakeasy-name-override: 'delete'
     get:
-      description: 'Get a single bring-your-own-key (BYOK) provider credential by its `id`. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
+      description: 'Get a single bring-your-own-key (BYOK) provider credential by its `id`. A workspace-scoped management key only reaches credentials in its own workspace; any other `id` returns 404. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
       operationId: 'getBYOKKey'
       parameters:
         - description: 'The BYOK credential ID (UUID).'
@@ -41680,7 +41680,7 @@ paths:
         - 'BYOK'
       x-speakeasy-name-override: 'get'
     patch:
-      description: 'Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). [Management key](/docs/guides/overview/auth/management-api-keys) required.'
+      description: 'Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). A workspace-scoped management key only reaches credentials in its own workspace; any other `id` returns 404. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
       operationId: 'updateBYOKKey'
       parameters:
         - description: 'The BYOK credential ID (UUID).'