diff --git a/docs/channels/mattermost.md b/docs/channels/mattermost.md
index dba5da77265..8a0713ce543 100644
--- a/docs/channels/mattermost.md
+++ b/docs/channels/mattermost.md
@@ -423,6 +423,7 @@ External scripts and webhooks can post buttons directly via the Mattermost REST
4. Action `id` must be **alphanumeric only** (`[a-zA-Z0-9]`). Hyphens and underscores break Mattermost's server-side action routing (returns 404). Strip them before use.
5. `context.action_id` must match the button's `id` so the confirmation message shows the button name (e.g., "Approve") instead of a raw ID.
6. `context.action_id` is required — the interaction handler returns 400 without it.
+
**HMAC token generation**
diff --git a/docs/gateway/heartbeat.md b/docs/gateway/heartbeat.md
index 20ef427df33..f17e225349d 100644
--- a/docs/gateway/heartbeat.md
+++ b/docs/gateway/heartbeat.md
@@ -246,21 +246,27 @@ Use `accountId` to target a specific account on multi-account channels like Tele
Controls direct/DM delivery behavior. `allow`: allow direct/DM heartbeat delivery. `block`: suppress direct/DM delivery (`reason=dm-blocked`).
+
Optional recipient override (channel-specific id, e.g. E.164 for WhatsApp or a Telegram chat id). For Telegram topics/threads, use `:topic:`.
+
Optional account id for multi-account channels. When `target: "last"`, the account id applies to the resolved last channel if it supports accounts; otherwise it is ignored. If the account id does not match a configured account for the resolved channel, delivery is skipped.
+
Overrides the default prompt body (not merged).
+
Max chars allowed after `HEARTBEAT_OK` before delivery.
+
When true, suppresses tool error warning payloads during heartbeat runs.
+
Restricts heartbeat runs to a time window. Object with `start` (HH:MM, inclusive; use `00:00` for start-of-day), `end` (HH:MM exclusive; `24:00` allowed for end-of-day), and optional `timezone`.