diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 36b888f400..deed7cb205 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -3684,6 +3684,7 @@ paths:
               properties:
                 refresh_token:
                   type: string
+                  description: "OAuth refresh token. For authorization_code flow, this contains the actual refresh token. For client_credentials flow, this must be set to an empty string."
                 expires_in:
                   type: integer
                 client:
@@ -3701,6 +3702,7 @@ paths:
                   type: string
                   description: "OAuth token URL override for resource-level authentication (client_credentials flow only)"
               required:
+                - refresh_token
                 - expires_in
                 - client
       responses: