diff --git a/SPEC.md b/SPEC.md
index 5e0a4ff..5317d49 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -48,7 +48,7 @@ CLI (click)
 
 ## DSM API Endpoints
 
-All requests use `GET /webapi/entry.cgi` with query parameters unless noted.
+All requests use `POST /webapi/entry.cgi` with `application/x-www-form-urlencoded` body unless noted.
 
 | API | Version | Methods used |
 |-----|---------|--------------|
@@ -466,7 +466,7 @@ pagination hint when more results are available.
 | 401 | Guest or disabled account | "DSM account is disabled." |
 | 403 | 2FA required | "Two-factor authentication required — run setup." |
 | 404 | 2FA failed | "OTP code incorrect." |
-| 408 | Device token required | "Device token required — run setup again." |
+| 408 | Non-supported additional field | "DSM rejected additional fields — check parameter format." |
 | 599 | Background service not ready | (handled by `_start_and_poll_oneshot` — restart task) |
 | 1800 | File not found | "File or folder not found: {path}" |
 | 1801 | No write permission | "No write permission for: {path}" |