diff --git a/src/api/src/auth_providers.rs b/src/api/src/auth_providers.rs
index 4a8371a7..aa1f257e 100644
--- a/src/api/src/auth_providers.rs
+++ b/src/api/src/auth_providers.rs
@@ -29,7 +29,7 @@ use tracing::debug;
     path = "/providers",
     tag = "providers",
     responses(
-        (status = 200, description = "OK", body = ProviderResponse),
+        (status = 200, description = "OK", body = [ProviderResponse]),
         (status = 401, description = "Unauthorized", body = ErrorResponse),
         (status = 403, description = "Forbidden", body = ErrorResponse),
     ),
diff --git a/src/api/src/clients.rs b/src/api/src/clients.rs
index 91b6e581..cadf046f 100644
--- a/src/api/src/clients.rs
+++ b/src/api/src/clients.rs
@@ -30,7 +30,7 @@ use tracing::debug;
     path = "/clients",
     tag = "clients",
     responses(
-        (status = 200, description = "Ok", body = ClientResponse),
+        (status = 200, description = "Ok", body = [ClientResponse]),
         (status = 400, description = "BadRequest"),
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Forbidden"),
diff --git a/src/api/src/oidc.rs b/src/api/src/oidc.rs
index 8242909a..32b120b6 100644
--- a/src/api/src/oidc.rs
+++ b/src/api/src/oidc.rs
@@ -360,7 +360,7 @@ pub async fn get_callback_html(principal: ReqPrincipal) -> Result<HttpResponse,
     get,
     path = "/oidc/certs",
     tag = "oidc",
-    responses((status = 200, description = "Ok")),
+    responses((status = 200, description = "Ok", body = JWKSCerts)),
 )]
 #[get("/oidc/certs")]
 pub async fn get_certs() -> Result<HttpResponse, ErrorResponse> {
@@ -369,7 +369,7 @@ pub async fn get_certs() -> Result<HttpResponse, ErrorResponse> {
     Ok(HttpResponse::Ok()
         .insert_header((
             header::ACCESS_CONTROL_ALLOW_ORIGIN,
-            HeaderValue::from_str("*").unwrap(),
+            HeaderValue::from_static("*"),
         ))
         .json(res))
 }
@@ -381,7 +381,7 @@ pub async fn get_certs() -> Result<HttpResponse, ErrorResponse> {
     get,
     path = "/oidc/certs/{kid}",
     tag = "oidc",
-    responses((status = 200, description = "Ok")),
+    responses((status = 200, description = "Ok", body = JWKSPublicKeyCerts)),
 )]
 #[get("/oidc/certs/{kid}")]
 pub async fn get_cert_by_kid(kid: web::Path<String>) -> Result<HttpResponse, ErrorResponse> {
@@ -773,7 +773,7 @@ pub async fn post_session(
     path = "/oidc/sessioninfo",
     tag = "oidc",
     responses(
-        (status = 200, description = "Ok"),
+        (status = 200, description = "Ok", body = SessionInfoResponse),
     ),
 )]
 #[get("/oidc/sessioninfo")]
@@ -833,7 +833,7 @@ pub async fn get_session_info(data: web::Data<AppState>, principal: ReqPrincipal
     path = "/oidc/sessioninfo/xsrf",
     tag = "oidc",
     responses(
-        (status = 200, description = "Ok"),
+        (status = 200, description = "Ok", body = SessionInfoResponse),
     ),
 )]
 #[get("/oidc/sessioninfo/xsrf")]
diff --git a/src/api/src/users.rs b/src/api/src/users.rs
index 1e5a50e1..f07252e6 100644
--- a/src/api/src/users.rs
+++ b/src/api/src/users.rs
@@ -160,7 +160,7 @@ pub async fn post_users(
     path = "/users/attr",
     tag = "users",
     responses(
-        (status = 200, description = "Ok", body = UserAttrConfigResponse),
+        (status = 200, description = "Ok", body = [UserAttrConfigResponse]),
         (status = 403, description = "Forbidden"),
     ),
 )]
@@ -457,7 +457,7 @@ pub async fn put_user_attr(
     path = "/users/{id}/devices",
     tag = "users",
     responses(
-        (status = 200, description = "Ok", body = DeviceResponse),
+        (status = 200, description = "Ok", body = [DeviceResponse]),
         (status = 401, description = "Unauthorized", body = ErrorResponse),
         (status = 403, description = "Forbidden", body = ErrorResponse),
     ),
@@ -699,7 +699,7 @@ pub async fn put_user_password_reset(
     path = "/users/{id}/webauthn",
     tag = "users",
     responses(
-        (status = 200, description = "Ok"),
+        (status = 200, description = "Ok", body = [PasskeyResponse]),
         (status = 401, description = "Unauthorized", body = ErrorResponse),
         (status = 403, description = "Forbidden", body = ErrorResponse),
     ),