From 2bfdb0de6db65f4fac46bde8bb921a2cbef63a04 Mon Sep 17 00:00:00 2001
From: Olivier 'reivilibre <oliverw@matrix.org>
Date: Fri, 20 Feb 2026 11:04:55 +0000
Subject: [PATCH 1/3] Add 404 to /auth_metadata

---
 data/api/client-server/oauth_server_metadata.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/data/api/client-server/oauth_server_metadata.yaml b/data/api/client-server/oauth_server_metadata.yaml
index 719a1e16..e5533271 100644
--- a/data/api/client-server/oauth_server_metadata.yaml
+++ b/data/api/client-server/oauth_server_metadata.yaml
@@ -195,6 +195,21 @@ paths:
                     "org.matrix.cross_signing_reset",
                   ],
                 }
+        "404":
+          description: |-
+            With `M_UNRECOGNIZED`: the homeserver does not support the OAuth 2.0 API.
+            (See [Authentication API discovery](/client-server-api/#authentication-api-discovery).)
+          content:
+            application/json:
+              schema:
+                $ref: definitions/errors/error.yaml
+              examples:
+                response:
+                  value:
+                    {
+                      "errcode": "M_UNRECOGNIZED",
+                      "error": "Legacy authentication is in use on this homeserver.",
+                    }
       tags:
         - Session management
 servers:

From d107a8e6ea89f0633be6784893f3e223c449e409 Mon Sep 17 00:00:00 2001
From: Olivier 'reivilibre <oliverw@matrix.org>
Date: Fri, 20 Feb 2026 11:06:50 +0000
Subject: [PATCH 2/3] Add 404 to GET /login

---
 data/api/client-server/login.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/data/api/client-server/login.yaml b/data/api/client-server/login.yaml
index 7251d4ff..00827ce6 100644
--- a/data/api/client-server/login.yaml
+++ b/data/api/client-server/login.yaml
@@ -70,6 +70,21 @@ paths:
                       }
                     ]
                   }
+        "404":
+          description: |-
+            With `M_UNRECOGNIZED`: the homeserver does not support the legacy authentication API.
+            (See [Authentication API discovery](/client-server-api/#authentication-api-discovery).)
+          content:
+            application/json:
+              schema:
+                $ref: definitions/errors/error.yaml
+              examples:
+                response:
+                  value:
+                    {
+                      "errcode": "M_UNRECOGNIZED",
+                      "error": "OAuth 2.0 authentication is in use on this homeserver.",
+                    }
         "429":
           description: This request was rate-limited.
           content:

From 76c1c71267214b9561306ac1b0efc47d8b2547ac Mon Sep 17 00:00:00 2001
From: Olivier 'reivilibre <oliverw@matrix.org>
Date: Fri, 20 Feb 2026 11:10:34 +0000
Subject: [PATCH 3/3] Newsfile

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
---
 changelogs/client_server/newsfragments/2316.clarification | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelogs/client_server/newsfragments/2316.clarification

diff --git a/changelogs/client_server/newsfragments/2316.clarification b/changelogs/client_server/newsfragments/2316.clarification
new file mode 100644
index 00000000..4b71e37a
--- /dev/null
+++ b/changelogs/client_server/newsfragments/2316.clarification
@@ -0,0 +1 @@
+Add 404 responses to the OpenAPI of `GET /login` and `GET /auth_metadata` endpoints. The responses were already defined in text but not written in OpenAPI.