diff --git a/specs/policy/attributes/attributes.openapi.yaml b/specs/policy/attributes/attributes.openapi.yaml
index 19415e3c..3588e95d 100644
--- a/specs/policy/attributes/attributes.openapi.yaml
+++ b/specs/policy/attributes/attributes.openapi.yaml
@@ -1880,6 +1880,52 @@ components:
         - obligationValue
         - action
       additionalProperties: false
+    policy.attributes.AttributeValueSubjectMappingRequest:
+      type: object
+      properties:
+        actions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Action'
+          title: actions
+          minItems: 1
+          description: |+
+            Required. The actions permitted by subjects in this mapping.
+            Action name or ID must not be empty if provided:
+            ```
+            this.all(item, item.name != '' || item.id != '')
+            ```
+
+        existingSubjectConditionSetId:
+          type: string
+          title: existing_subject_condition_set_id
+          format: uuid
+          description: Reuse an existing SubjectConditionSet.
+        newSubjectConditionSet:
+          title: new_subject_condition_set
+          description: Create a new SubjectConditionSet.
+          $ref: '#/components/schemas/policy.subjectmapping.SubjectConditionSetCreate'
+        namespaceId:
+          type: string
+          title: namespace_id
+          format: uuid
+        namespaceFqn:
+          type: string
+          title: namespace_fqn
+          minLength: 1
+          format: uri
+        metadata:
+          title: metadata
+          description: Optional. Common metadata for the subject mapping.
+          $ref: '#/components/schemas/common.MetadataMutable'
+      title: AttributeValueSubjectMappingRequest
+      additionalProperties: false
+      description: |+
+        Exactly one of existing_subject_condition_set_id or new_subject_condition_set must be provided:
+        ```
+        (this.existing_subject_condition_set_id != '') != has(this.new_subject_condition_set)
+        ```
+
     policy.attributes.AttributesSort:
       type: object
       properties:
@@ -1981,6 +2027,15 @@ components:
           description: |-
             Optional
              Existing obligation values to trigger for the newly created attribute value.
+        subjectMappings:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.attributes.AttributeValueSubjectMappingRequest'
+          title: subject_mappings
+          maxItems: 250
+          description: |-
+            Optional
+             Subject mappings to associate with the newly created attribute value.
         metadata:
           title: metadata
           description: |-
@@ -2632,6 +2687,24 @@ components:
           description: Required
       title: ValueKeyAccessServer
       additionalProperties: false
+    policy.subjectmapping.SubjectConditionSetCreate:
+      type: object
+      properties:
+        subjectSets:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SubjectSet'
+          title: subject_sets
+          minItems: 1
+          description: Required
+        metadata:
+          title: metadata
+          description: |-
+            Optional
+             Common metadata
+          $ref: '#/components/schemas/common.MetadataMutable'
+      title: SubjectConditionSetCreate
+      additionalProperties: false
     connect-protocol-version:
       type: number
       title: Connect-Protocol-Version
diff --git a/specs/policy/keymanagement/key_management.openapi.yaml b/specs/policy/keymanagement/key_management.openapi.yaml
index 61a3e433..cf5977d8 100644
--- a/specs/policy/keymanagement/key_management.openapi.yaml
+++ b/specs/policy/keymanagement/key_management.openapi.yaml
@@ -480,16 +480,47 @@ components:
               type: string
               title: name
               minLength: 1
+              description: |-
+                DEPRECATED, please use the NameManager and specify manager + name together.
+                 Using this without manager could result in non-deterministic responses.
+              deprecated: true
           title: name
           required:
             - name
+        - properties:
+            nameManager:
+              title: name_manager
+              description: Search by name and manager.
+              $ref: '#/components/schemas/policy.keymanagement.GetProviderConfigRequest.NameManager'
+          title: name_manager
+          required:
+            - nameManager
       properties:
         manager:
           type: string
           title: manager
-          description: Optional - filter by manager type when searching by name
+          description: |-
+            DEPRECATED, please use the NameManager and specify manager + name together.
+             Not populating manager when searching by name could result in non-deterministic responses.
+             Optional - filter by manager type when searching by name
+          deprecated: true
       title: GetProviderConfigRequest
       additionalProperties: false
+    policy.keymanagement.GetProviderConfigRequest.NameManager:
+      type: object
+      properties:
+        name:
+          type: string
+          title: name
+          minLength: 1
+          description: The name of the key provider
+        manager:
+          type: string
+          title: manager
+          minLength: 1
+          description: The type of key manager.
+      title: NameManager
+      additionalProperties: false
     policy.keymanagement.GetProviderConfigResponse:
       type: object
       properties: