diff --git a/openapi/SPEC_COMMIT b/openapi/SPEC_COMMIT
index 333cb2c..adcd5bf 100644
--- a/openapi/SPEC_COMMIT
+++ b/openapi/SPEC_COMMIT
@@ -1 +1 @@
-e3ee3e3875c65499e5b9daad5f56c329d18ff36e
+05b8317c466daafb9fa4e7be2a6aad0909dda7a4
diff --git a/openapi/openapi.yaml b/openapi/openapi.yaml
index 5171a5d..17110fa 100644
--- a/openapi/openapi.yaml
+++ b/openapi/openapi.yaml
@@ -13,6 +13,11 @@ info:
     CI status), open issues, and per-forge reachability. The backend holds
     both forges' credentials; the frontend only ever calls the endpoints
     below.
+
+    A request body is capped at 1 MiB, except the forges' own webhook
+    deliveries (5 MiB). A body whose declared length is over the cap is
+    answered `413` with an `Error` before it is read; one with no declared
+    length is cut off at the cap and answered as an invalid body.
   version: 1.0.0
   contact:
     name: forge-dashboard