diff --git a/skills/inkreach-teable/api-reference/rest-api.md b/skills/inkreach-teable/api-reference/rest-api.md
index 65c4e07..75fa9f3 100644
--- a/skills/inkreach-teable/api-reference/rest-api.md
+++ b/skills/inkreach-teable/api-reference/rest-api.md
@@ -11,9 +11,16 @@ the CLI. For one-off table/automation operations, prefer the CLI.
 
 ## 1. Base URL & Authentication
 
+Two origins — pick by where you run:
+
+| Origin | API (`/api/*`) | Swagger (`/docs`, `/docs-json`) |
+|---|---|---|
+| Public domain, e.g. `https://table.inkreach.cc` | ✅ works (proxied to backend) | ❌ 404 — frontend does NOT proxy swagger paths |
+| Backend origin, e.g. `http://localhost:3003` (reference deployment) | ✅ | ✅ |
+
 ```bash
-BASE=http://localhost:3003            # backend API origin (see instance-access.md)
-TOKEN=teable_xxx_yyy                   # PAT; web UI Settings → Personal Access Tokens
+BASE=https://table.inkreach.cc             # or http://localhost:3003 on the backend host
+TOKEN=teable_xxx_yyy                       # PAT; web UI Settings → Personal Access Tokens
 curl -s "$BASE/api/auth/user" -H "Authorization: Bearer $TOKEN"   # verify → 200 + user JSON
 ```
 
@@ -157,12 +164,17 @@ const res = await fetch(triggerInput._apiBaseUrl + "/api/table/tblB/record", {
 ## 5. Full Route Inventory (this guide ≠ the whole API)
 
 The backend exposes **~362 paths**; this guide documents the
-agent-operational core (what the CLI wraps). For everything else, the
-authoritative source is the live OpenAPI spec — **no auth needed**:
+agent-operational core (what the CLI wraps). The authoritative full spec is
+the live OpenAPI JSON — but it is only served on the **backend origin** (the
+public domain 404s it):
 
 ```bash
-curl -s "$BASE/docs-json" | python3 -c "import json,sys; [print(m.upper(), p) for p,o in json.load(sys.stdin)['paths'].items() for m in o]"   # full list
+# works ONLY when BASE is the backend origin (e.g. http://localhost:3003):
+curl -s "$BASE/docs-json" | python3 -c "import json,sys; [print(m.upper(), p) for p,o in json.load(sys.stdin)['paths'].items() for m in o]"
 # browsable UI: $BASE/docs
+
+# from any other machine, reach the backend origin via an ssh tunnel:
+ssh -L 3003:localhost:3003 <backend-host>   # then use http://localhost:3003/docs-json
 ```
 
 Route groups NOT detailed in this guide (see docs-json for shapes):
@@ -180,6 +192,8 @@ Route groups NOT detailed in this guide (see docs-json for shapes):
 automation webhook route), plugin UI endpoints (`/api/plugin/*` panels,
 chart, proxy), `/api/v2/integrity`, `/api/v1/ai-proxy`.
 
-When you use one of these, verify the exact param shape from docs-json
-first — do not guess key names (the automation contract lesson applies
-instance-wide).
+When you use one of these, verify the exact param shape before calling —
+from docs-json (backend origin / ssh tunnel), or from the backend source:
+`grep -rh "@Controller(\|@Get(\|@Post(\|@Patch(\|@Put(\|@Delete(" apps/nestjs-backend/src/features --include='*.controller.ts'`
+in the inkreach-teable app repo. Do not guess key names (the automation
+contract lesson applies instance-wide).
diff --git a/skills/inkreach-teable/guides/instance-access.md b/skills/inkreach-teable/guides/instance-access.md
index 58e691c..ccdd3ba 100644
--- a/skills/inkreach-teable/guides/instance-access.md
+++ b/skills/inkreach-teable/guides/instance-access.md
@@ -8,7 +8,8 @@ endpoint/ports for your own deployment.
 
 | Service | URL / Port | Mode | Purpose |
 |---------|-----------|------|---------|
-| Backend API | `http://localhost:3003` | production (`NODE_ENV=production`) | REST API, automation engine, websocket |
+| Public domain | `https://table.inkreach.cc` | — | Frontend UI + `/api/*` proxied to backend; swagger (`/docs`, `/docs-json`) NOT proxied (404) — use the backend origin for those |
+| Backend API | `http://localhost:3003` | production (`NODE_ENV=production`) | REST API, automation engine, websocket, swagger `/docs` + `/docs-json` |
 | Frontend | `http://localhost:3002` | production | End-user web UI (Next.js) |
 | PostgreSQL | `localhost:5432` | — | Database (db: `teable`, user: `teable`) |
 | Redis | `localhost:6379` | — | BullMQ queue for automation runs, distributed lock |