diff --git a/DEPLOY.md b/DEPLOY.md
index 8ddb1b1..fac67c8 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -79,6 +79,24 @@ docker run -d -p 3000:3000 \
 | `INF0_BASE_URL` | Nej | — | INF0 AI-URL |
 | `N0D_BASE_URL` | Nej | — | N0D beräknings-URL |
 
+## Migrationer
+
+- SQL: [`apps/api/migrations/`](apps/api/migrations/) — idempotenta (CREATE TABLE IF NOT EXISTS)
+- Tillämpa (server6): `docker cp apps/api/migrations/001_*..sql qhucpjjpv3mx9jupqkbyf5uh:/tmp/ && docker exec qhucpjjpv3mx9jupqkbyf5uh psql -U c0py -d c0py -f /tmp/001_*.sql`
+- Postgres: app-uuid `qhucpjjpv3mx9jupqkbyf5uh` (postgres:16-alpine, db/user `c0py`)
+
+## API-endpoints (alla fail-closed, owner-scoped via introspected subject)
+
+| Metod | Path | Svar |
+|---|---|---|
+| GET | `/health` | 200 (exempt från auth) |
+| GET | `/v1/c0py/registries` | ägarens registries |
+| POST | `/v1/c0py/registries` | 201 / 400 (name+url krävs) |
+| GET | `/v1/c0py/registries/:id` | 200 / 404 (främmande = 404) |
+| POST | `/v1/c0py/scans` | 201 / 400 / 404 (registry-ägarskap verifieras i SQL) |
+| GET | `/v1/c0py/scans?registryId=` | ägarens scans, valbar filter |
+| GET | `/v1/c0py/scans/:id` | 200 / 404 |
+
 ## Hälsocheck
 
 ```