diff --git a/.last-synced-sha b/.last-synced-sha
index 5cfe0bd..304cd4d 100644
--- a/.last-synced-sha
+++ b/.last-synced-sha
@@ -1 +1 @@
-8efea61f918efcec56c264951f11144501043ed8
+d2fa4103b7938f30525a4a6a0897ee696cfb27ab
diff --git a/spec/open-api-spec.yaml b/spec/open-api-spec.yaml
index 9e40212..1223ca1 100644
--- a/spec/open-api-spec.yaml
+++ b/spec/open-api-spec.yaml
@@ -18851,8 +18851,10 @@ paths:
   /widgets/token:
     post:
       description: >-
-        Generate a widget token scoped to an organization and user with the
-        specified scopes.
+        Generate a widget token for a user, optionally scoped to an
+        organization. When an organization is specified, org-scoped widgets are
+        enabled; omitting it issues a user-only token for widgets like
+        `UserProfile` and `UserSecurity`.
       operationId: WidgetsPublicController_issueWidgetSessionToken
       parameters: []
       requestBody:
@@ -21714,7 +21716,11 @@ components:
       properties:
         organization_id:
           type: string
-          description: The ID of the organization to scope the widget session to.
+          description: >-
+            The ID of the organization to scope the widget session to. Required
+            when scopes are provided. Optional when issuing a token for
+            user-only widgets (e.g. `UserProfile`, `UserSecurity`) that do not
+            require organization context.
           example: org_01EHZNVPK3SFK441A1RGBFSHRT
         user_id:
           type: string
@@ -21735,8 +21741,6 @@ components:
               - widgets:pipes:manage
           example:
             - widgets:users-table:manage
-      required:
-        - organization_id
     ClientApiTokenDto:
       type: object
       properties: