diff --git a/output/schema/schema-serverless.json b/output/schema/schema-serverless.json
index 1e3155480b..911bde3990 100644
--- a/output/schema/schema-serverless.json
+++ b/output/schema/schema-serverless.json
@@ -8542,8 +8542,10 @@
           "stability": "stable"
         }
       },
-      "description": "Check user privileges.\nDetermines whether the specified user has a specified list of privileges.",
+      "description": "Check user privileges.\n\nDetermine whether the specified user has a specified list of privileges.",
       "docUrl": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-has-privileges.html",
+      "extDocId": "security-privileges",
+      "extDocUrl": "https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/security-privileges.html",
       "name": "security.has_privileges",
       "request": {
         "name": "Request",
@@ -8588,7 +8590,7 @@
           "stability": "stable"
         }
       },
-      "description": "Invalidate API keys.\nInvalidates one or more API keys.\nThe `manage_api_key` privilege allows deleting any API keys.\nThe `manage_own_api_key` only allows deleting API keys that are owned by the user.\nIn addition, with the `manage_own_api_key` privilege, an invalidation request must be issued in one of the three formats:\n- Set the parameter `owner=true`.\n- Or, set both `username` and `realm_name` to match the user’s identity.\n- Or, if the request is issued by an API key, i.e. an API key invalidates itself, specify its ID in the `ids` field.",
+      "description": "Invalidate API keys.\n\nThis API invalidates API keys created by the create API key or grant API key APIs.\nInvalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted.\nThe `manage_api_key` privilege allows deleting any API keys.\nThe `manage_own_api_key` only allows deleting API keys that are owned by the user.\nIn addition, with the `manage_own_api_key` privilege, an invalidation request must be issued in one of the three formats:\n- Set the parameter `owner=true`.\n- Or, set both `username` and `realm_name` to match the user’s identity.\n- Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the `ids` field.",
       "docUrl": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-invalidate-api-key.html",
       "name": "security.invalidate_api_key",
       "privileges": {
@@ -8631,8 +8633,10 @@
           "stability": "stable"
         }
       },
-      "description": "Create or update roles API.\n\nCreate or update roles in the native realm.",
+      "description": "Create or update roles.\n\nThe role management APIs are generally the preferred way to manage roles in the native realm, rather than using file-based role management.\nThe create or update roles API cannot update roles that are defined in roles files.\nFile-based role management is not available in Elastic Serverless.",
       "docUrl": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role.html",
+      "extDocId": "defining-roles",
+      "extDocUrl": "https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/defining-roles.html",
       "name": "security.put_role",
       "privileges": {
         "cluster": [
@@ -8675,7 +8679,7 @@
           "stability": "stable"
         }
       },
-      "description": "Query API keys.\nRetrieves a paginated list of API keys and their information. You can optionally filter the results with a query.",
+      "description": "Find API keys with a query.\n\nGet a paginated list of API keys and their information. You can optionally filter the results with a query.",
       "docUrl": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-query-api-key.html",
       "name": "security.query_api_keys",
       "privileges": {
@@ -8720,7 +8724,7 @@
           "stability": "stable"
         }
       },
-      "description": "Update an API key.\nUpdates attributes of an existing API key.\nUsers can only update API keys that they created or that were granted to them.\nUse this API to update API keys created by the create API Key or grant API Key APIs.\nIf you need to apply the same update to many API keys, you can use bulk update API Keys to reduce overhead.\nIt’s not possible to update expired API keys, or API keys that have been invalidated by invalidate API Key.\nThis API supports updates to an API key’s access scope and metadata.\nThe access scope of an API key is derived from the `role_descriptors` you specify in the request, and a snapshot of the owner user’s permissions at the time of the request.\nThe snapshot of the owner’s permissions is updated automatically on every call.\nIf you don’t specify `role_descriptors` in the request, a call to this API might still change the API key’s access scope.\nThis change can occur if the owner user’s permissions have changed since the API key was created or last modified.\nTo update another user’s API key, use the `run_as` feature to submit a request on behalf of another user.\nIMPORTANT: It’s not possible to use an API key as the authentication credential for this API.\nTo update an API key, the owner user’s credentials are required.",
+      "description": "Update an API key.\n\nUpdates attributes of an existing API key.\nUsers can only update API keys that they created or that were granted to them.\nUse this API to update API keys created by the create API Key or grant API Key APIs.\nIf you need to apply the same update to many API keys, you can use bulk update API Keys to reduce overhead.\nIt’s not possible to update expired API keys, or API keys that have been invalidated by invalidate API Key.\nThis API supports updates to an API key’s access scope and metadata.\nThe access scope of an API key is derived from the `role_descriptors` you specify in the request, and a snapshot of the owner user’s permissions at the time of the request.\nThe snapshot of the owner’s permissions is updated automatically on every call.\nIf you don’t specify `role_descriptors` in the request, a call to this API might still change the API key’s access scope.\nThis change can occur if the owner user’s permissions have changed since the API key was created or last modified.\nTo update another user’s API key, use the `run_as` feature to submit a request on behalf of another user.\nIMPORTANT: It’s not possible to use an API key as the authentication credential for this API.\nTo update an API key, the owner user’s credentials are required.",
       "docUrl": "https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-update-api-key.html",
       "name": "security.update_api_key",
       "privileges": {
@@ -39155,7 +39159,7 @@
           }
         ]
       },
-      "description": "Check user privileges.\nDetermines whether the specified user has a specified list of privileges.",
+      "description": "Check user privileges.\n\nDetermine whether the specified user has a specified list of privileges.",
       "inherits": {
         "type": {
           "name": "RequestBase",
@@ -39182,7 +39186,7 @@
         }
       ],
       "query": [],
-      "specLocation": "security/has_privileges/SecurityHasPrivilegesRequest.ts#L25-L44"
+      "specLocation": "security/has_privileges/SecurityHasPrivilegesRequest.ts#L25-L46"
     },
     {
       "body": {
@@ -39358,7 +39362,7 @@
           }
         ]
       },
-      "description": "Invalidate API keys.\nInvalidates one or more API keys.\nThe `manage_api_key` privilege allows deleting any API keys.\nThe `manage_own_api_key` only allows deleting API keys that are owned by the user.\nIn addition, with the `manage_own_api_key` privilege, an invalidation request must be issued in one of the three formats:\n- Set the parameter `owner=true`.\n- Or, set both `username` and `realm_name` to match the user’s identity.\n- Or, if the request is issued by an API key, i.e. an API key invalidates itself, specify its ID in the `ids` field.",
+      "description": "Invalidate API keys.\n\nThis API invalidates API keys created by the create API key or grant API key APIs.\nInvalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted.\nThe `manage_api_key` privilege allows deleting any API keys.\nThe `manage_own_api_key` only allows deleting API keys that are owned by the user.\nIn addition, with the `manage_own_api_key` privilege, an invalidation request must be issued in one of the three formats:\n- Set the parameter `owner=true`.\n- Or, set both `username` and `realm_name` to match the user’s identity.\n- Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the `ids` field.",
       "inherits": {
         "type": {
           "name": "RequestBase",
@@ -39372,7 +39376,7 @@
       },
       "path": [],
       "query": [],
-      "specLocation": "security/invalidate_api_key/SecurityInvalidateApiKeyRequest.ts#L23-L67"
+      "specLocation": "security/invalidate_api_key/SecurityInvalidateApiKeyRequest.ts#L23-L69"
     },
     {
       "body": {
@@ -39554,7 +39558,7 @@
           }
         ]
       },
-      "description": "Create or update roles API.\n\nCreate or update roles in the native realm.",
+      "description": "Create or update roles.\n\nThe role management APIs are generally the preferred way to manage roles in the native realm, rather than using file-based role management.\nThe create or update roles API cannot update roles that are defined in roles files.\nFile-based role management is not available in Elastic Serverless.",
       "inherits": {
         "type": {
           "name": "RequestBase",
@@ -39594,7 +39598,7 @@
           }
         }
       ],
-      "specLocation": "security/put_role/SecurityPutRoleRequest.ts#L31-L92"
+      "specLocation": "security/put_role/SecurityPutRoleRequest.ts#L31-L95"
     },
     {
       "body": {
@@ -39719,7 +39723,7 @@
           }
         ]
       },
-      "description": "Query API keys.\nRetrieves a paginated list of API keys and their information. You can optionally filter the results with a query.",
+      "description": "Find API keys with a query.\n\nGet a paginated list of API keys and their information. You can optionally filter the results with a query.",
       "inherits": {
         "type": {
           "name": "RequestBase",
@@ -39790,7 +39794,7 @@
           }
         }
       ],
-      "specLocation": "security/query_api_keys/QueryApiKeysRequest.ts#L26-L100"
+      "specLocation": "security/query_api_keys/QueryApiKeysRequest.ts#L26-L101"
     },
     {
       "body": {
@@ -39925,7 +39929,7 @@
           }
         ]
       },
-      "description": "Update an API key.\nUpdates attributes of an existing API key.\nUsers can only update API keys that they created or that were granted to them.\nUse this API to update API keys created by the create API Key or grant API Key APIs.\nIf you need to apply the same update to many API keys, you can use bulk update API Keys to reduce overhead.\nIt’s not possible to update expired API keys, or API keys that have been invalidated by invalidate API Key.\nThis API supports updates to an API key’s access scope and metadata.\nThe access scope of an API key is derived from the `role_descriptors` you specify in the request, and a snapshot of the owner user’s permissions at the time of the request.\nThe snapshot of the owner’s permissions is updated automatically on every call.\nIf you don’t specify `role_descriptors` in the request, a call to this API might still change the API key’s access scope.\nThis change can occur if the owner user’s permissions have changed since the API key was created or last modified.\nTo update another user’s API key, use the `run_as` feature to submit a request on behalf of another user.\nIMPORTANT: It’s not possible to use an API key as the authentication credential for this API.\nTo update an API key, the owner user’s credentials are required.",
+      "description": "Update an API key.\n\nUpdates attributes of an existing API key.\nUsers can only update API keys that they created or that were granted to them.\nUse this API to update API keys created by the create API Key or grant API Key APIs.\nIf you need to apply the same update to many API keys, you can use bulk update API Keys to reduce overhead.\nIt’s not possible to update expired API keys, or API keys that have been invalidated by invalidate API Key.\nThis API supports updates to an API key’s access scope and metadata.\nThe access scope of an API key is derived from the `role_descriptors` you specify in the request, and a snapshot of the owner user’s permissions at the time of the request.\nThe snapshot of the owner’s permissions is updated automatically on every call.\nIf you don’t specify `role_descriptors` in the request, a call to this API might still change the API key’s access scope.\nThis change can occur if the owner user’s permissions have changed since the API key was created or last modified.\nTo update another user’s API key, use the `run_as` feature to submit a request on behalf of another user.\nIMPORTANT: It’s not possible to use an API key as the authentication credential for this API.\nTo update an API key, the owner user’s credentials are required.",
       "inherits": {
         "type": {
           "name": "RequestBase",
@@ -39952,7 +39956,7 @@
         }
       ],
       "query": [],
-      "specLocation": "security/update_api_key/Request.ts#L26-L66"
+      "specLocation": "security/update_api_key/Request.ts#L26-L67"
     },
     {
       "body": {