diff --git a/schema/openapi.yaml b/schema/openapi.yaml
index e5c381664..85ed2d981 100644
--- a/schema/openapi.yaml
+++ b/schema/openapi.yaml
@@ -598,6 +598,23 @@ components:
         - labels
         - annotations
       type: object
+    TargetStub:
+      properties:
+        alias:
+          type: string
+        connectUrl:
+          format: uri
+          type: string
+        credential:
+          allOf:
+            - $ref: '#/components/schemas/Credential'
+          nullable: true
+          type: object
+        password:
+          type: string
+        username:
+          type: string
+      type: object
     Target_Flat:
       properties:
         agent:
@@ -666,6 +683,9 @@ openapi: 3.0.3
 paths:
   /api/beta/diagnostics/targets/{targetId}/gc:
     post:
+      description: |
+        Request the remote target to perform a garbage collection. The target JVM is free to ignore this
+        request. This is generally equivalent to a System.gc() call made within the target JVM.
       parameters:
         - in: path
           name: targetId
@@ -682,6 +702,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Initiate a garbage collection on the specified target
       tags:
         - Diagnostics
   /api/beta/fs/recordings:
@@ -701,6 +722,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List all archived recordings grouped by target
       tags:
         - Archived Recordings
   /api/beta/fs/recordings/{jvmId}:
@@ -726,6 +748,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List all archived recordings belonging to the specified target
       tags:
         - Archived Recordings
   /api/beta/fs/recordings/{jvmId}/{filename}:
@@ -750,12 +773,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Delete an archived recording by name belonging to the specified target
       tags:
         - Archived Recordings
   /api/beta/recordings/{connectUrl}/{filename}:
     delete:
       parameters:
-        - in: path
+        - description: the connection URL associated with the target
+          in: path
           name: connectUrl
           required: true
           schema:
@@ -774,6 +799,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Delete an archived recording belonging to the specified target
       tags:
         - Archived Recordings
   /api/beta/recordings/{jvmId}:
@@ -799,9 +825,13 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List archived recordings belonging to the specified target
       tags:
         - Archived Recordings
     post:
+      description: |
+        Upload a JFR binary file into the archives, associating the archived recording with a particular
+        target JVM. This is primarily used by the Cryostat Agent for pushing harvested recording files.
       parameters:
         - in: path
           name: jvmId
@@ -830,10 +860,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Upload a JFR binary file to archives, associated with a particular target
       tags:
         - Archived Recordings
   /api/v4.1/metrics/reports:
     get:
+      description: |
+        Retrieve the latest aggregate report data across all targets with recent automated analysis reports
+        scores. These are multi-dimensional metrics in Prometheus format.
       responses:
         "200":
           content:
@@ -849,10 +883,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Retrieve the latest aggregate report data
       tags:
         - Analysis Report Aggregator
   /api/v4.1/metrics/reports/{jvmId}:
     get:
+      description: |
+        Retrieve the latest aggregate report data for a given target's recent automated analysis reports
+        scores. These are multi-dimensional metrics in Prometheus format.
       parameters:
         - in: path
           name: jvmId
@@ -872,10 +910,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Retrieve the latest aggregate report data for the specified target
       tags:
         - Analysis Report Aggregator
   /api/v4.1/targets/{targetId}/reports:
     get:
+      description: |
+        Get the current cached automated analysis report for the specified target, if any. If no such
+        report currently exists for the specified target then the response will be an HTTP 404 Not Found,
+        and automated analysis report generation will not be triggered.
       parameters:
         - in: path
           name: targetId
@@ -898,9 +941,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Retrieve current automated analysis report for a target
       tags:
         - Reports
     post:
+      description: |
+        Composite action that 1) creates a Snapshot active recording on the specified target, 2) archives
+        that Snapshot immediately, 3) performs automated analysis report generation on the archived file.
+        The response will include a Location header pointing the client to an endpoint where the report can
+        be retrieved, which may require the client to wait for a Job UUID notification.
       parameters:
         - in: path
           name: targetId
@@ -927,10 +976,16 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Perform "target analysis" on the specified target
       tags:
         - Reports
   /api/v4/activedownload/{id}:
     get:
+      description: |
+        Given a recording ID and a remote recording ID within that target, Cryostat will open a remote
+        connection to the target and pipe back a data stream containing the Flight Recording binary file
+        format for that recording. The client can feed this data to other tooling which ingests the JFR
+        binary file format.
       parameters:
         - in: path
           name: id
@@ -952,10 +1007,18 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Download a Flight Recording binary file
       tags:
         - Active Recordings Download
   /api/v4/auth:
     post:
+      description: |
+        In modern Cryostat deployments it is customary to deploy Cryostat behind an authenticating reverse
+        proxy, so authentication is not actually handled by Cryostat itself. This endpoint is used by the
+        Cryostat Web UI client to send an authenticated client request, including some authentication
+        headers, to the Cryostat server so that it can extract information about the logged-in user. The
+        response contains the current user's username if it can be determined, or else an empty string.
+        This is only used for display in the Web UI. API clients do not need to use this endpoint.
       responses:
         "200":
           content:
@@ -963,10 +1026,15 @@ paths:
               schema:
                 $ref: '#/components/schemas/AuthResponse'
           description: OK
+      summary: Authenticate to the Cryostat server
       tags:
         - Auth
   /api/v4/credentials:
     get:
+      description: |
+        Returns a list of match results. A match result includes the Stored Credential's ID,
+        its Match Expression, and a list of currently discovered Targets which match that expression
+        and are therefore candidates for Cryostat to select this Credential.
       responses:
         "200":
           content:
@@ -982,9 +1050,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List information about all of the available Stored Credentials.
       tags:
         - Credentials
     post:
+      description: |
+        Define a new Stored Credential. Requires a match expression which defines which targets require
+        this credential, and the username and password to use to pass authentication checks on those
+        targets. Stored Credentials are stored in an encrypted keyring using symmetric encryption and an
+        encryption key configured on the Cryostat database.
       requestBody:
         content:
           application/x-www-form-urlencoded:
@@ -1010,6 +1084,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Define a new Stored Credential
       tags:
         - Credentials
   /api/v4/credentials/test/{targetId}:
@@ -1044,6 +1119,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Test if the supplied username/password are valid credentials for the specified target.
       tags:
         - Credentials
   /api/v4/credentials/{id}:
@@ -1064,9 +1140,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Delete a Stored Credential
       tags:
         - Credentials
     get:
+      description: |
+        Get match result information about a specific Stored Credential. A match result includes the Stored
+        Credential's ID, its Match Expression, and a list of currently discovered Targets which match that
+        expression and are therefore candidates for Cryostat to select this Credential.
       parameters:
         - in: path
           name: id
@@ -1087,6 +1168,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get information about a Stored Credential
       tags:
         - Credentials
   /api/v4/discovery:
@@ -1104,9 +1186,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Retrieve the entire discovery tree.
       tags:
         - Discovery
     post:
+      description: |
+        Register a new discovery plugin, or refresh an existing plugin's registration and generate a new
+        token. New registrations require the realm and callback fields. Registration refreshers
+        additionally require the id and token fields, which are supplied in the response to the original
+        registration.
       requestBody:
         content:
           application/json:
@@ -1125,10 +1213,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Register as a new discovery plugin or refresh existing registration
       tags:
         - Discovery
   /api/v4/discovery/{id}:
     delete:
+      description: |
+        Delete the plugin's registration along with its discovery Realm node and all of its children. This
+        is used when a discovery plugin is shutting down.
       parameters:
         - in: path
           name: id
@@ -1142,9 +1234,13 @@ paths:
       responses:
         "204":
           description: No Content
+      summary: Delete the given plugin's registration
       tags:
         - Discovery
     get:
+      description: |
+        Endpoint for discovery plugins to check their own current registration status, ie. whether their
+        registration ID is still known and their current token is still valid.
       parameters:
         - in: path
           name: id
@@ -1164,9 +1260,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Endpoint for discovery plugins to check their own registration status
       tags:
         - Discovery
     post:
+      description: |
+        Using its plugin ID and current token, a discovery plugin uses this endpoint to publish a JSON
+        request body containing a list of discovery nodes. The discovery plugin itself is a Realm node in
+        the overall discovery tree, so the published list of nodes here will replace the plugin Realm
+        node's list of children.
       parameters:
         - in: path
           name: id
@@ -1187,10 +1289,13 @@ paths:
       responses:
         "201":
           description: Created
+      summary: Publish updated target discovery information
       tags:
         - Discovery
   /api/v4/discovery_plugins:
     get:
+      description: |
+        Retrieve a list of currently registered discovery plugins only, not including their subtrees.
       parameters:
         - in: query
           name: realm
@@ -1211,10 +1316,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List currently registered discovery plugins
       tags:
         - Discovery
   /api/v4/discovery_plugins/{id}:
     get:
+      description: |
+        Retrieve information about a specific discovery plugin, including its discovery Realm node and
+        subtree.
       parameters:
         - in: path
           name: id
@@ -1234,10 +1343,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Retrieve a specific discovery plugin
       tags:
         - Discovery
   /api/v4/download/{encodedKey}:
     get:
+      description: |
+        Get a download URL for an archived recording. The response will be an HTTP redirect with a Location
+        header pointing to the location where the client can download the recording JFR binary file.
       parameters:
         - in: path
           name: encodedKey
@@ -1260,10 +1373,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get a download URL for an archived recording
       tags:
         - Archived Recordings
   /api/v4/event_templates:
     get:
+      description: |
+        Retrieve a list of templates available on this Cryostat server. These templates can be applied to
+        recordings started on any discovered target, but any event configurations within the template which
+        reference events that do not exist on the target will be ignored.
       responses:
         "200":
           content:
@@ -1279,9 +1397,12 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List server event templates
       tags:
         - Event Templates
     post:
+      description: |
+        Upload a new custom event template to the server. This must be in OpenJDK .jfc (XML) format.
       requestBody:
         content:
           application/x-www-form-urlencoded:
@@ -1303,10 +1424,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Upload a custom event template
       tags:
         - Event Templates
   /api/v4/event_templates/{templateName}:
     delete:
+      description: |
+        Delete a custom event template from the server. Only previously uploaded custom event templates can
+        be deleted.
       parameters:
         - in: path
           name: templateName
@@ -1322,6 +1447,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Delete a custom event template
       tags:
         - Event Templates
   /api/v4/event_templates/{templateType}:
@@ -1347,10 +1473,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List server event templates of the given type
       tags:
         - Event Templates
   /api/v4/event_templates/{templateType}/{templateName}:
     get:
+      description: |
+        Get the .jfc (XML) file definition for the given server event template. This is the same type of
+        event configuration file that ships with OpenJDK distributions.
       parameters:
         - in: path
           name: templateName
@@ -1375,10 +1505,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get a specific event template
       tags:
         - Event Templates
   /api/v4/grafana/{encodedKey}:
     post:
+      description: |
+        Upload an archived recording to the jfr-datasource for later online analysis in the associated
+        Grafana dashboard.
       parameters:
         - in: path
           name: encodedKey
@@ -1403,10 +1537,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Upload an archived recording to Grafana for online analysis
       tags:
         - Archived Recordings
   /api/v4/grafana_dashboard_url:
     get:
+      description: |
+        Returns the URL for the associated Grafana dashboard instance. If there is an internally-accessible
+        (for Cryostat) URL and an externally-accessible URL (for users) URL, the externally-accessible URL
+        is preferred. If neither are configured then the response is an HTTP 400 Bad Request.
       responses:
         "200":
           content:
@@ -1414,10 +1553,15 @@ paths:
               schema:
                 $ref: '#/components/schemas/DashboardUrl'
           description: OK
+      summary: Return the URL which users can visit to access the associated Grafana dashboard instance.
       tags:
         - Health
   /api/v4/grafana_datasource_url:
     get:
+      description: |
+        Returns the URL for the jfr-datasource instance which Cryostat is configured to use. This datasource
+        accepts JFR file uploads from Cryostat and allows the Grafana dashboard to perform queries on the
+        data within the recording file.
       responses:
         "200":
           content:
@@ -1425,6 +1569,7 @@ paths:
               schema:
                 $ref: '#/components/schemas/DatasourceUrl'
           description: OK
+      summary: Return the URL to the associated jfr-datasource instance.
       tags:
         - Health
   /api/v4/logout:
@@ -1435,10 +1580,15 @@ paths:
             application/json:
               schema: {}
           description: OK
+      summary: OAuth2 sign out. Invalidate the current user session
       tags:
         - Auth
   /api/v4/matchExpressions:
     get:
+      description: |
+        Retrieve a list of all currently defined Match Expressions. These objects cannot be created
+        independently in the current API definition, so each of these expressions will be associated with
+        an Automated Rule or Stored Credential.
       responses:
         "200":
           content:
@@ -1455,9 +1605,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Retrieve a list of all currently defined Match Expressions
       tags:
         - Match Expressions
     post:
+      description: |
+        Given a list of Target IDs, retrieve each Target instance from the database, then return the list
+        filtered by the Targets which satisfy the Match Expression. If a given ID does not exist in the
+        database then the whole request will fail. The expression must evaluate to a boolean value for each
+        target. The match expression will not be stored.
       requestBody:
         content:
           application/json:
@@ -1476,6 +1632,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Test a MatchExpression against a list of Targets
       tags:
         - Match Expressions
   /api/v4/matchExpressions/{id}:
@@ -1500,6 +1657,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Retrieve a single Match Expression
       tags:
         - Match Expressions
   /api/v4/probes:
@@ -1513,9 +1671,15 @@ paths:
                   $ref: '#/components/schemas/ProbeTemplateResponse'
                 type: array
           description: OK
+      summary: List defined probe templates
       tags:
         - JMC Agent Templates
     post:
+      description: |2
+            Create a probe template. This requires a probe template file upload in XML format. See
+            https://github.com/openjdk/jmc/blob/master/agent/README.md and
+            https://github.com/openjdk/jmc/blob/master/agent/src/main/resources/org/openjdk/jmc/agent/impl/jfrprobes_schema.xsd
+            for more information about this file format.
       requestBody:
         content:
           application/x-www-form-urlencoded:
@@ -1533,6 +1697,7 @@ paths:
               schema:
                 $ref: '#/components/schemas/ProbeTemplate'
           description: OK
+      summary: Create a probe template
       tags:
         - JMC Agent Templates
   /api/v4/probes/{probeTemplateName}:
@@ -1546,10 +1711,13 @@ paths:
       responses:
         "204":
           description: No Content
+      summary: Delete the specified probe template
       tags:
         - JMC Agent Templates
   /api/v4/recordings:
     get:
+      description: |
+        List all archived recordings from all targets, including (re-)uploaded files.
       responses:
         "200":
           content:
@@ -1565,9 +1733,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List all archived recordings
       tags:
         - Archived Recordings
     post:
+      description: |
+        (Re-)upload a JFR binary file into the archives. This allows for the restoration of archived files
+        after they have been otherwise removed, or for portability across Cryostat instances or between
+        Cryostat version upgrades. This can also be used to upload JFR files which were not collected by
+        Cryostat, so that Cryostat can be used to perform online analysis of the file.
       requestBody:
         content:
           application/x-www-form-urlencoded:
@@ -1592,10 +1766,12 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Upload a JFR binary file to archives
       tags:
         - Archived Recordings
   /api/v4/recordings/{filename}:
     delete:
+      deprecated: true
       parameters:
         - in: path
           name: filename
@@ -1611,10 +1787,19 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Delete an archived recording by filename
       tags:
         - Archived Recordings
   /api/v4/reports/{encodedKey}:
     get:
+      description: |
+        Given an encoded key from another endpoint, request an actual automated analysis report. If the
+        requested report already exists in one of the tiered caching layers then the report will be
+        directly returned as a JSON response body. If the report does not yet exist then the response will
+        contain a Job UUID as a plain text response body. Cryostat will emit a WebSocket notification later
+        using the same Job UUID to indicate that the report generation has been completed and the document
+        is now available. The client may then re-issue a request to this endpoint with the same encoded key
+        to retrieve the report document.
       parameters:
         - in: path
           name: encodedKey
@@ -1635,6 +1820,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get an automated analysis report
       tags:
         - Reports
   /api/v4/rules:
@@ -1654,6 +1840,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List all Automated Rules
       tags:
         - Rules
     post:
@@ -1739,6 +1926,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Create a new Automated Rule
       tags:
         - Rules
   /api/v4/rules/{name}:
@@ -1762,6 +1950,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Delete an Automated Rule by name
       tags:
         - Rules
     get:
@@ -1784,9 +1973,12 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get an Automated Rule by name
       tags:
         - Rules
     patch:
+      description: |
+        Update Automated Rule parameters, such as whether the rule is currently active or not.
       parameters:
         - in: path
           name: name
@@ -1815,10 +2007,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Update an Automated Rule
       tags:
         - Rules
   /api/v4/targets:
     get:
+      description: |
+        Get a list of the currently discovered targets. These are essentialy the same as the leaf nodes of
+        the discovery tree. See 'GET /api/v4/discovery'.
       responses:
         "200":
           content:
@@ -1834,9 +2030,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List currently discovered targets
       tags:
         - Targets
     post:
+      description: |
+        Create a target definition given a JSON request body target stub. The target stub must contain the
+        connectUrl and alias, and optionally contain a username and password to create a Stored Credential
+        associated with this target. The dryrun parameter can be used to perform this operation as a check,
+        to verify if such a target could be created (no connectUrl conflict and acceptable credentials).
       parameters:
         - in: query
           name: dryrun
@@ -1850,7 +2052,7 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/Target'
+              $ref: '#/components/schemas/TargetStub'
           application/x-www-form-urlencoded:
             schema:
               properties:
@@ -1890,10 +2092,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Create a target definition
       tags:
         - Custom Discovery
   /api/v4/targets/{id}:
     delete:
+      description: |
+        Delete the specified target by ID. Only allows deletion of targets that were defined by the same
+        Custom Target discovery API. Other targets must be removed by the discovery mechanisms which
+        discovered them.
       parameters:
         - in: path
           name: id
@@ -1910,9 +2117,12 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Delete the specified target
       tags:
         - Custom Discovery
     get:
+      description: |
+        Get details about a particular target given its ID.
       parameters:
         - in: path
           name: id
@@ -1933,10 +2143,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get a target by ID
       tags:
         - Targets
   /api/v4/targets/{id}/event_templates:
     get:
+      description: |
+        Retrieve a list of event templates available on the given target when starting recordings on the
+        same target. This includes all of the server's available templates, plus the templates available
+        specifically from the target (ex. within /usr/lib/jvm/java/lib/jfr).
       parameters:
         - in: path
           name: id
@@ -1959,10 +2174,13 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Retrieve a list of event templates available on the given target
       tags:
         - Target Event Templates
   /api/v4/targets/{id}/event_templates/{templateType}/{templateName}:
     get:
+      description: |
+        Get the .jfc (XML) file definition for the given target event template.
       parameters:
         - in: path
           name: id
@@ -1993,10 +2211,16 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get a specific event template
       tags:
         - Target Event Templates
   /api/v4/targets/{id}/events:
     get:
+      description: |
+        Retrieve a list of JFR event types registered within the given target. This will include all
+        built-in JFR types emitted by the target JVM, as well as custom event types specific to that
+        target JVM if they are correctly registered. Custom event types, or event types emitted by plugins
+        and extensions, may not always appear in this list.
       parameters:
         - in: path
           name: id
@@ -2023,6 +2247,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List JFR event types registered within the given target
       tags:
         - Events
   /api/v4/targets/{id}/probes:
@@ -2037,6 +2262,7 @@ paths:
       responses:
         "204":
           description: No Content
+      summary: Remove all loaded probes from the specified target
       tags:
         - JMC Agent Probes
     get:
@@ -2056,10 +2282,13 @@ paths:
                   $ref: '#/components/schemas/ProbeResponse'
                 type: array
           description: OK
+      summary: List loaded probes on the specified target
       tags:
         - JMC Agent Probes
   /api/v4/targets/{id}/probes/{probeTemplateName}:
     post:
+      description: |
+        Activate a probe template (specified by template name) on the specified target (specified by ID).
       parameters:
         - in: path
           name: id
@@ -2075,10 +2304,13 @@ paths:
       responses:
         "201":
           description: Created
+      summary: Activate a probe template on the specified target
       tags:
         - JMC Agent Probes
   /api/v4/targets/{targetId}/recordingOptions:
     get:
+      description: |
+        Retrieve a map of the current options for the specified target.
       parameters:
         - in: path
           name: targetId
@@ -2100,9 +2332,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get the current set of options for the specified target
       tags:
         - Recording Options
     patch:
+      description: |
+        Set default recording options for the specified target. These options will be applied to any
+        recordings started on this target if no override values are specified when the recording is
+        created.
       parameters:
         - in: path
           name: targetId
@@ -2136,10 +2373,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Update the recording options for the specified target
       tags:
         - Recording Options
   /api/v4/targets/{targetId}/recordings:
     get:
+      description: |
+        Retrieve a list of active recordings currently present on the specified target. This may initiate
+        a new remote connection to the target to update Cryostat's model of available recordings.
       parameters:
         - in: path
           name: targetId
@@ -2162,9 +2403,17 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: List active recordings on the specified target
       tags:
         - Active Recordings
     post:
+      description: |
+        Create a new Flight Recording on the specified target. The recording will be immediately started
+        and begin capturing Flight Recording data.
+        The recording must be given a name (unique within the
+        target). An event specifier string must be included, which follows the format
+        "template={name},(type={type})". The type parameter is optional and the template name is required.
+        See the Event Templates API for more information about the values that can be used here.
       parameters:
         - in: path
           name: targetId
@@ -2223,10 +2472,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Start a new recording on the specified target
       tags:
         - Active Recordings
   /api/v4/targets/{targetId}/recordings/{remoteId}:
     delete:
+      description: |
+        Delete a recording from the specified target. This will remove it both from Cryostat's database
+        as well as remove the recording and release all resources in the remote target JVM.
       parameters:
         - in: path
           name: remoteId
@@ -2249,9 +2502,15 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Delete a recording from the specified target
       tags:
         - Active Recordings
     get:
+      description: |
+        Given a recording ID and a remote recording ID within that target, Cryostat will open a remote
+        connection to the target and pipe back a data stream containing the Flight Recording binary file
+        format for that recording. The client can feed this data to other tooling which ingests the JFR
+        binary file format.
       parameters:
         - in: path
           name: remoteId
@@ -2279,9 +2538,13 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Download a Flight Recording binary file
       tags:
         - Active Recordings
     patch:
+      description: |
+        Remote recordings can be stopped by sending the request body "stop", or copied to archives by
+        sending the request body "save". The body is case-insensitive.
       parameters:
         - in: path
           name: remoteId
@@ -2313,10 +2576,14 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Update a remote recording on the specified target
       tags:
         - Active Recordings
   /api/v4/targets/{targetId}/recordings/{remoteId}/upload:
     post:
+      description: |
+        Upload the current data stream of the specified recording to the jfr-datasource for online analysis
+        in the associated Grafana dashboard.
       parameters:
         - in: path
           name: remoteId
@@ -2348,10 +2615,16 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Upload a recording for analysis in Grafana dashboard
       tags:
         - Active Recordings
   /api/v4/targets/{targetId}/reports/{recordingId}:
     get:
+      description: |
+        Request an automated analysis report for a particular active recording on the specified target. If
+        such a report already exists it will be returned directly as a JSON response body. If the report
+        does not yet exist then an asynchronous task for it will be started, and a Job UUID will be
+        sent as the plaintext response body.
       parameters:
         - in: path
           name: recordingId
@@ -2379,6 +2652,7 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Get an automated analysis report for a particular recording on the specified target
       tags:
         - Reports
   /api/v4/targets/{targetId}/snapshot:
@@ -2403,10 +2677,16 @@ paths:
           description: Not Allowed
       security:
         - SecurityScheme: []
+      summary: Create a JFR Snapshot on the specified target
       tags:
         - Snapshots
   /api/v4/tls/certs:
     get:
+      description: |
+        In addition to the standard system/OpenJDK certificate trust store, Cryostat can be configured to
+        trust additional certificates which may be presented by target JVM JMX servers or by Cryostat Agent
+        HTTPS servers. This endpoint returns a list of local file paths to additional certificate files,
+        which Cryostat will have loaded into an additional trust store at startup.
       responses:
         "200":
           content:
@@ -2416,10 +2696,16 @@ paths:
                   type: string
                 type: array
           description: OK
+      summary: List additional trusted SSL/TLS certificates
       tags:
         - Trust Store
   /health:
     get:
+      description: |
+        Returns a map indicating whether various external components (ex.
+            jfr-datasource, grafana-dashboard) are configured and whether those
+            components can be reached by the Cryostat application. Also includes
+            application semantic version and build information.
       responses:
         "200":
           content:
@@ -2427,12 +2713,26 @@ paths:
               schema:
                 $ref: '#/components/schemas/ApplicationHealth'
           description: OK
+      summary: Check the overall status of the application
       tags:
         - Health
   /health/liveness:
     get:
+      description: |
+        Performs a no-op on a worker thread. This is a simply check to determine if
+        the application has available threads to service requests. HTTP 204 No Content
+        is the only expected response. If the application is not live and no worker
+        threads are available, then the client will never receive a response.
       responses:
         "204":
           description: No Content
+      summary: Check if the application is able to accept and respond to requests.
       tags:
         - Health
+tags:
+  - description: |
+      Endpoints for Discovery Plugins to register with a Cryostat instance, refresh their registration
+      token, publish information about known targets, and unregister themselves.
+
+      The reference implementation of a Discovery Plugin is the Cryostat Agent.
+    name: Discovery
diff --git a/schema/schema.graphql b/schema/schema.graphql
index 28f05aeaa..c9595a134 100644
--- a/schema/schema.graphql
+++ b/schema/schema.graphql
@@ -50,7 +50,9 @@ type Annotations {
 
 type ArchivedRecording {
   archivedTime: BigInteger!
+  "Delete an archived recording"
   doDelete: ArchivedRecording!
+  "Update the metadata associated with an archived recording"
   doPutMetadata(metadataInput: MetadataLabelsInput): ArchivedRecording!
   downloadUrl: String
   jvmId: String
@@ -160,6 +162,7 @@ type OperatingSystemMetrics {
 
 "Query root"
 type Query {
+  "List archived recordings"
   archivedRecordings(filter: ArchivedRecordingsFilterInput): ArchivedRecordings
   "Get all environment nodes in the discovery tree with optional filtering"
   environmentNodes(filter: DiscoveryNodeFilterInput): [DiscoveryNode]
@@ -177,7 +180,9 @@ type RecordingAggregateInfo {
 }
 
 type Recordings {
+  "List and optionally filter active recordings belonging to a Target"
   active(filter: ActiveRecordingsFilterInput): ActiveRecordings
+  "List and optionally filter archived recordings belonging to a Target"
   archived(filter: ArchivedRecordingsFilterInput): ArchivedRecordings
 }
 
@@ -226,10 +231,12 @@ type Suggestion {
 }
 
 type Target {
+  "Retrieve a list of active recordings currently available on the target"
   activeRecordings(filter: ActiveRecordingsFilterInput): ActiveRecordings
   agent: Boolean!
   alias: String!
   annotations: Annotations!
+  "Retrieve a list of archived recordings belonging to the target"
   archivedRecordings(filter: ArchivedRecordingsFilterInput): ArchivedRecordings
   connectUrl: String!
   "Create a new Flight Recorder Snapshot on the specified Target"
@@ -246,6 +253,12 @@ type Target {
   mbeanMetrics: MBeanMetrics
   "Get the active and archived recordings belonging to this target"
   recordings: Recordings
+  """
+  Retrieve an automated analysis report from the selected target(s). If there is no report currently
+  available then this request will not cause a report to be generated, and instead it will return an empty
+  result. Report generation may be an expensive operation, especially if many reports are to be generated at
+  once, and should not be triggered by broad GraphQL selections.
+  """
   report: Report
 }
 
diff --git a/src/main/java/io/cryostat/BuildInfo.java b/src/main/java/io/cryostat/BuildInfo.java
index 36343cb23..06f9cd2ba 100644
--- a/src/main/java/io/cryostat/BuildInfo.java
+++ b/src/main/java/io/cryostat/BuildInfo.java
@@ -25,6 +25,7 @@
 import jakarta.inject.Inject;
 import org.jboss.logging.Logger;
 
+/** Describes the current build of the application. Contains information about the VCS commit. */
 @ApplicationScoped
 public class BuildInfo {
 
diff --git a/src/main/java/io/cryostat/ConfigProperties.java b/src/main/java/io/cryostat/ConfigProperties.java
index f78921829..929f7f128 100644
--- a/src/main/java/io/cryostat/ConfigProperties.java
+++ b/src/main/java/io/cryostat/ConfigProperties.java
@@ -15,6 +15,7 @@
  */
 package io.cryostat;
 
+/** Java constants corresponding to configuration keys set in application.properties. */
 public class ConfigProperties {
     public static final String AWS_BUCKET_NAME_ARCHIVES = "storage.buckets.archives.name";
     public static final String AWS_BUCKET_NAME_EVENT_TEMPLATES =
diff --git a/src/main/java/io/cryostat/Cryostat.java b/src/main/java/io/cryostat/Cryostat.java
index 09b3ce8c2..01832ed48 100644
--- a/src/main/java/io/cryostat/Cryostat.java
+++ b/src/main/java/io/cryostat/Cryostat.java
@@ -23,6 +23,10 @@
 import io.quarkus.runtime.QuarkusApplication;
 import io.quarkus.runtime.annotations.QuarkusMain;
 
+/**
+ * Main application entrypoint. Perform any required early initialization tasks, then kick off the
+ * webserver.
+ */
 @QuarkusMain
 public class Cryostat {
 
diff --git a/src/main/java/io/cryostat/ExceptionMappers.java b/src/main/java/io/cryostat/ExceptionMappers.java
index 03139f07b..dba1b2ea8 100644
--- a/src/main/java/io/cryostat/ExceptionMappers.java
+++ b/src/main/java/io/cryostat/ExceptionMappers.java
@@ -37,6 +37,14 @@
 import software.amazon.awssdk.services.s3.model.NoSuchKeyException;
 import software.amazon.awssdk.services.s3.model.S3Exception;
 
+/**
+ * Map uncaught exceptions at the endpoint level to REST responses. For example, without a
+ * corresponding exception mapper, an uncaught jakarta.persistence.NoResultException would result in
+ * the web server responding with an HTTP 500 Internal Server Error (the default behaviour for all
+ * uncaught exceptions). Defining a mapper for NoResultException allows the global behaviour to be
+ * overridden to an HTTP 404 Not Found response. Individual endpoints may still use standard
+ * try-catch handling to deal with NoResultExceptions in other ways as needed.
+ */
 public class ExceptionMappers {
 
     @Inject Logger logger;
diff --git a/src/main/java/io/cryostat/Health.java b/src/main/java/io/cryostat/Health.java
index b9a867753..bb6f74d1e 100644
--- a/src/main/java/io/cryostat/Health.java
+++ b/src/main/java/io/cryostat/Health.java
@@ -37,8 +37,10 @@
 import jakarta.ws.rs.core.MediaType;
 import org.apache.commons.lang3.StringUtils;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 
+/** Status and configuration verification for the application. */
 @Path("")
 class Health {
 
@@ -70,6 +72,15 @@ class Health {
     @Blocking
     @Path("/health")
     @PermitAll
+    @Operation(
+            summary = "Check the overall status of the application",
+            description =
+                    """
+                    Returns a map indicating whether various external components (ex.
+                        jfr-datasource, grafana-dashboard) are configured and whether those
+                        components can be reached by the Cryostat application. Also includes
+                        application semantic version and build information.
+                    """)
     public ApplicationHealth health() {
         CompletableFuture<Boolean> datasourceAvailable = new CompletableFuture<>();
         CompletableFuture<Boolean> dashboardAvailable = new CompletableFuture<>();
@@ -113,12 +124,31 @@ public ApplicationHealth health() {
     @Blocking
     @Path("/health/liveness")
     @PermitAll
+    @Operation(
+            summary = "Check if the application is able to accept and respond to requests.",
+            description =
+                    """
+                    Performs a no-op on a worker thread. This is a simply check to determine if
+                    the application has available threads to service requests. HTTP 204 No Content
+                    is the only expected response. If the application is not live and no worker
+                    threads are available, then the client will never receive a response.
+                    """)
     public void liveness() {}
 
     @GET
     @Path("/api/v4/grafana_dashboard_url")
     @PermitAll
     @Produces({MediaType.APPLICATION_JSON})
+    @Operation(
+            summary =
+                    "Return the URL which users can visit to access the associated Grafana"
+                            + " dashboard instance.",
+            description =
+                    """
+                    Returns the URL for the associated Grafana dashboard instance. If there is an internally-accessible
+                    (for Cryostat) URL and an externally-accessible URL (for users) URL, the externally-accessible URL
+                    is preferred. If neither are configured then the response is an HTTP 400 Bad Request.
+                    """)
     public DashboardUrl grafanaDashboardUrl() {
         String url =
                 dashboardExternalURL.orElseGet(
@@ -130,6 +160,14 @@ public DashboardUrl grafanaDashboardUrl() {
     @Path("/api/v4/grafana_datasource_url")
     @PermitAll
     @Produces({MediaType.APPLICATION_JSON})
+    @Operation(
+            summary = "Return the URL to the associated jfr-datasource instance.",
+            description =
+                    """
+                    Returns the URL for the jfr-datasource instance which Cryostat is configured to use. This datasource
+                    accepts JFR file uploads from Cryostat and allows the Grafana dashboard to perform queries on the
+                    data within the recording file.
+                    """)
     public DatasourceUrl grafanaDatasourceUrl() {
         String url = datasourceURL.orElseThrow(() -> new BadRequestException());
         return new DatasourceUrl(url);
diff --git a/src/main/java/io/cryostat/JsonRequestFilter.java b/src/main/java/io/cryostat/JsonRequestFilter.java
index affac89d9..86eb74663 100644
--- a/src/main/java/io/cryostat/JsonRequestFilter.java
+++ b/src/main/java/io/cryostat/JsonRequestFilter.java
@@ -34,6 +34,7 @@
 import jakarta.ws.rs.ext.Provider;
 
 @Provider
+/** Filter incoming request bodies or outgoing response bodies to scrub particular content. */
 public class JsonRequestFilter implements ContainerRequestFilter {
 
     static final Set<String> disallowedFields = Set.of("id");
diff --git a/src/main/java/io/cryostat/ProgressInputStream.java b/src/main/java/io/cryostat/ProgressInputStream.java
index 075cdbec1..f11f6b3e0 100644
--- a/src/main/java/io/cryostat/ProgressInputStream.java
+++ b/src/main/java/io/cryostat/ProgressInputStream.java
@@ -20,6 +20,10 @@
 
 import org.apache.commons.io.input.ProxyInputStream;
 
+/**
+ * An InputStream which informs a provided {@link java.util.function.Consumer} about the number of
+ * bytes read each time a chunk is read from this stream.
+ */
 public class ProgressInputStream extends ProxyInputStream {
 
     private final Consumer<Integer> onUpdate;
diff --git a/src/main/java/io/cryostat/StorageBuckets.java b/src/main/java/io/cryostat/StorageBuckets.java
index 87b9fa9bd..dc8c8e7fc 100644
--- a/src/main/java/io/cryostat/StorageBuckets.java
+++ b/src/main/java/io/cryostat/StorageBuckets.java
@@ -35,6 +35,10 @@
 import software.amazon.awssdk.services.s3.model.CreateBucketRequest;
 import software.amazon.awssdk.services.s3.model.HeadBucketRequest;
 
+/**
+ * Utility for interacting with S3 object storage buckets. Use to ensure that the S3 object storage
+ * meets the application requirements, ex. that the expected buckets exist.
+ */
 @ApplicationScoped
 public class StorageBuckets {
 
diff --git a/src/main/java/io/cryostat/credentials/Credential.java b/src/main/java/io/cryostat/credentials/Credential.java
index 324efaa9d..f5c3b834a 100644
--- a/src/main/java/io/cryostat/credentials/Credential.java
+++ b/src/main/java/io/cryostat/credentials/Credential.java
@@ -42,6 +42,21 @@
 import org.hibernate.annotations.ColumnTransformer;
 import org.projectnessie.cel.tools.ScriptException;
 
+/**
+ * Stored Credentials are used for communicating with secured remote targets. Target JMX servers may
+ * (should) be configured to require authentication from clients like Cryostat. Cryostat needs to be
+ * able to establish connections to these targets and pass their authentication checks, and needs to
+ * be able to do so without prompting a user for credentials every time, therefore the credentials
+ * for remote targets are stored in this encrypted keyring. Each Credential instance has a single
+ * username and password, as well as a {@link io.cryostat.expressions.MatchExpression} which should
+ * evaluate to match one or more target applications which Cryostat has discovered or will discover.
+ * The entire database table containing these credentials is encrypted using the Postgres 'pgcrypto'
+ * module and pgp symmetric encryption/decryption. The encryption key is set by configuration on the
+ * database deployment. Whenever Cryostat attempts to open a network connection to a target (see
+ * {@link io.cryostat.targets.TargetConnectionManager}) it will first check for any Credentials that
+ * match the target, then use the first matching Credential (see
+ * https://github.com/cryostatio/cryostat/issues/376)
+ */
 @Entity
 @EntityListeners(Credential.Listener.class)
 public class Credential extends PanacheEntity {
diff --git a/src/main/java/io/cryostat/credentials/Credentials.java b/src/main/java/io/cryostat/credentials/Credentials.java
index 984408015..26d95026f 100644
--- a/src/main/java/io/cryostat/credentials/Credentials.java
+++ b/src/main/java/io/cryostat/credentials/Credentials.java
@@ -49,6 +49,7 @@
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.UriInfo;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestForm;
 import org.jboss.resteasy.reactive.RestPath;
@@ -117,6 +118,10 @@ private void createFromFile(java.nio.file.Path path) {
     @Blocking
     @RolesAllowed("read")
     @Path("/test/{targetId}")
+    @Operation(
+            summary =
+                    "Test if the supplied username/password are valid credentials for the specified"
+                            + " target.")
     public Uni<CredentialTestResult> checkCredentialForTarget(
             @RestPath long targetId, @RestForm String username, @RestForm String password)
             throws URISyntaxException {
@@ -155,6 +160,14 @@ public Uni<CredentialTestResult> checkCredentialForTarget(
     @Blocking
     @GET
     @RolesAllowed("read")
+    @Operation(
+            summary = "List information about all of the available Stored Credentials.",
+            description =
+                    """
+                    Returns a list of match results. A match result includes the Stored Credential's ID,
+                    its Match Expression, and a list of currently discovered Targets which match that expression
+                    and are therefore candidates for Cryostat to select this Credential.
+                    """)
     public List<CredentialMatchResult> list() {
         return Credential.<Credential>listAll().stream()
                 .map(
@@ -174,6 +187,14 @@ public List<CredentialMatchResult> list() {
     @GET
     @RolesAllowed("read")
     @Path("/{id}")
+    @Operation(
+            summary = "Get information about a Stored Credential",
+            description =
+                    """
+                    Get match result information about a specific Stored Credential. A match result includes the Stored
+                    Credential's ID, its Match Expression, and a list of currently discovered Targets which match that
+                    expression and are therefore candidates for Cryostat to select this Credential.
+                    """)
     public CredentialMatchResult get(@RestPath long id) {
         try {
             Credential credential = Credential.find("id", id).singleResult();
@@ -187,6 +208,15 @@ public CredentialMatchResult get(@RestPath long id) {
     @Transactional
     @POST
     @RolesAllowed("write")
+    @Operation(
+            summary = "Define a new Stored Credential",
+            description =
+                    """
+                    Define a new Stored Credential. Requires a match expression which defines which targets require
+                    this credential, and the username and password to use to pass authentication checks on those
+                    targets. Stored Credentials are stored in an encrypted keyring using symmetric encryption and an
+                    encryption key configured on the Cryostat database.
+                    """)
     public RestResponse<Credential> create(
             @Context UriInfo uriInfo,
             @RestForm String matchExpression,
@@ -209,6 +239,7 @@ public RestResponse<Credential> create(
     @DELETE
     @RolesAllowed("write")
     @Path("/{id}")
+    @Operation(summary = "Delete a Stored Credential")
     public void delete(@RestPath long id) {
         Credential.find("id", id).singleResult().delete();
     }
diff --git a/src/main/java/io/cryostat/credentials/CredentialsFinder.java b/src/main/java/io/cryostat/credentials/CredentialsFinder.java
index 52239c820..3148a4de5 100644
--- a/src/main/java/io/cryostat/credentials/CredentialsFinder.java
+++ b/src/main/java/io/cryostat/credentials/CredentialsFinder.java
@@ -31,6 +31,10 @@
 import org.jboss.logging.Logger;
 import org.projectnessie.cel.tools.ScriptException;
 
+/**
+ * Utility for mapping and caching {@link io.cryostat.targets.Target} to associated {@link
+ * io.cryostat.credentials.Credential}.
+ */
 @ApplicationScoped
 public class CredentialsFinder {
 
diff --git a/src/main/java/io/cryostat/diagnostic/Diagnostics.java b/src/main/java/io/cryostat/diagnostic/Diagnostics.java
index 1ae118f41..b729922f3 100644
--- a/src/main/java/io/cryostat/diagnostic/Diagnostics.java
+++ b/src/main/java/io/cryostat/diagnostic/Diagnostics.java
@@ -23,6 +23,7 @@
 import jakarta.inject.Inject;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.resteasy.reactive.RestPath;
 
 @Path("/api/beta/diagnostics/targets/{targetId}")
@@ -34,6 +35,13 @@ public class Diagnostics {
     @RolesAllowed("write")
     @Blocking
     @POST
+    @Operation(
+            summary = "Initiate a garbage collection on the specified target",
+            description =
+                    """
+                    Request the remote target to perform a garbage collection. The target JVM is free to ignore this
+                    request. This is generally equivalent to a System.gc() call made within the target JVM.
+                    """)
     public void gc(@RestPath long targetId) {
         targetConnectionManager.executeConnectedTask(
                 Target.getTargetById(targetId),
diff --git a/src/main/java/io/cryostat/discovery/ContainerDiscovery.java b/src/main/java/io/cryostat/discovery/ContainerDiscovery.java
index a959749e6..60e399039 100644
--- a/src/main/java/io/cryostat/discovery/ContainerDiscovery.java
+++ b/src/main/java/io/cryostat/discovery/ContainerDiscovery.java
@@ -70,6 +70,7 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
+/** Discovery mechanism for Docker and Podman container engines. */
 @ApplicationScoped
 class PodmanDiscovery extends ContainerDiscovery {
     @ConfigProperty(name = "cryostat.discovery.podman.enabled")
diff --git a/src/main/java/io/cryostat/discovery/CustomDiscovery.java b/src/main/java/io/cryostat/discovery/CustomDiscovery.java
index 0367a65c3..669c97170 100644
--- a/src/main/java/io/cryostat/discovery/CustomDiscovery.java
+++ b/src/main/java/io/cryostat/discovery/CustomDiscovery.java
@@ -52,6 +52,7 @@
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.exception.ExceptionUtils;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.hibernate.exception.ConstraintViolationException;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestForm;
@@ -60,6 +61,13 @@
 import org.jboss.resteasy.reactive.RestResponse;
 import org.jboss.resteasy.reactive.RestResponse.ResponseBuilder;
 
+/**
+ * Discovery implementation that allows user-defined {@link io.cryostat.target.Target} definitions.
+ * These can be created or deleted at will by any authenticated and authorized user. This is mainly
+ * intended for ad-hoc connections to short-lived target instances, or cases where Cryostat is only
+ * deployed for a short term. For long-lived Cryostat installations monitoring regular target
+ * applications other discovery mechanisms should be preferred.
+ */
 @ApplicationScoped
 @Path("")
 public class CustomDiscovery {
@@ -81,6 +89,15 @@ public class CustomDiscovery {
     @Path("/api/v4/targets")
     @Consumes(MediaType.APPLICATION_JSON)
     @RolesAllowed("write")
+    @Operation(
+            summary = "Create a target definition",
+            description =
+                    """
+                    Create a target definition given a JSON request body target stub. The target stub must contain the
+                    connectUrl and alias, and optionally contain a username and password to create a Stored Credential
+                    associated with this target. The dryrun parameter can be used to perform this operation as a check,
+                    to verify if such a target could be created (no connectUrl conflict and acceptable credentials).
+                    """)
     public RestResponse<Target> create(
             @Context UriInfo uriInfo,
             TargetStub target,
@@ -94,6 +111,15 @@ public RestResponse<Target> create(
     @Path("/api/v4/targets")
     @Consumes({MediaType.MULTIPART_FORM_DATA, MediaType.APPLICATION_FORM_URLENCODED})
     @RolesAllowed("write")
+    @Operation(
+            summary = "Create a target definition",
+            description =
+                    """
+                    Create a target definition given a form (url-encoded or multipart) containing a target connectUrl
+                    and alias, and optional username and password. The dryrun parameter can be used to perform this
+                    operation as a check, to verify if such a target could be created (no connectUrl conflict and
+                    acceptable credentials).
+                    """)
     public RestResponse<Target> createForm(
             @Context UriInfo uriInfo,
             @RestForm URI connectUrl,
@@ -194,6 +220,14 @@ RestResponse<Target> doCreate(
     @DELETE
     @Path("/api/v4/targets/{id}")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Delete the specified target",
+            description =
+                    """
+                    Delete the specified target by ID. Only allows deletion of targets that were defined by the same
+                    Custom Target discovery API. Other targets must be removed by the discovery mechanisms which
+                    discovered them.
+                    """)
     public void delete(@RestPath long id) throws URISyntaxException {
         Target target = Target.find("id", id).singleResult();
         DiscoveryNode realm = DiscoveryNode.getRealm(REALM).orElseThrow();
diff --git a/src/main/java/io/cryostat/discovery/Discovery.java b/src/main/java/io/cryostat/discovery/Discovery.java
index d0afeaa84..60156c379 100644
--- a/src/main/java/io/cryostat/discovery/Discovery.java
+++ b/src/main/java/io/cryostat/discovery/Discovery.java
@@ -67,6 +67,8 @@
 import jakarta.ws.rs.core.UriBuilder;
 import org.apache.commons.lang3.StringUtils;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 import org.jboss.resteasy.reactive.RestQuery;
@@ -154,6 +156,7 @@ void onStop(@Observes ShutdownEvent evt) throws SchedulerException {
     @GET
     @Path("/api/v4/discovery")
     @RolesAllowed("read")
+    @Operation(summary = "Retrieve the entire discovery tree.")
     public DiscoveryNode get() {
         return DiscoveryNode.getUniverse();
     }
@@ -161,6 +164,14 @@ public DiscoveryNode get() {
     @GET
     @Path("/api/v4/discovery/{id}")
     @RolesAllowed("read")
+    @Tag(ref = "Discovery")
+    @Operation(
+            summary = "Endpoint for discovery plugins to check their own registration status",
+            description =
+                    """
+                    Endpoint for discovery plugins to check their own current registration status, ie. whether their
+                    registration ID is still known and their current token is still valid.
+                    """)
     public void checkRegistration(
             @Context RoutingContext ctx, @RestPath UUID id, @RestQuery String token) {
         DiscoveryPlugin plugin = DiscoveryPlugin.find("id", id).singleResult();
@@ -183,6 +194,24 @@ public void checkRegistration(
     @Consumes(MediaType.APPLICATION_JSON)
     @RolesAllowed("write")
     @SuppressFBWarnings("DLS_DEAD_LOCAL_STORE")
+    @Tag(
+            name = "Discovery",
+            description =
+                    """
+                    Endpoints for Discovery Plugins to register with a Cryostat instance, refresh their registration
+                    token, publish information about known targets, and unregister themselves.
+
+                    The reference implementation of a Discovery Plugin is the Cryostat Agent.
+                    """)
+    @Operation(
+            summary = "Register as a new discovery plugin or refresh existing registration",
+            description =
+                    """
+                    Register a new discovery plugin, or refresh an existing plugin's registration and generate a new
+                    token. New registrations require the realm and callback fields. Registration refreshers
+                    additionally require the id and token fields, which are supplied in the response to the original
+                    registration.
+                    """)
     public PluginRegistration register(@Context RoutingContext ctx, JsonObject body)
             throws SchedulerException {
         String pluginId = body.getString("id");
@@ -350,6 +379,16 @@ public PluginRegistration register(@Context RoutingContext ctx, JsonObject body)
     @Path("/api/v4/discovery/{id}")
     @Consumes(MediaType.APPLICATION_JSON)
     @PermitAll
+    @Tag(ref = "Discovery")
+    @Operation(
+            summary = "Publish updated target discovery information",
+            description =
+                    """
+                    Using its plugin ID and current token, a discovery plugin uses this endpoint to publish a JSON
+                    request body containing a list of discovery nodes. The discovery plugin itself is a Realm node in
+                    the overall discovery tree, so the published list of nodes here will replace the plugin Realm
+                    node's list of children.
+                    """)
     public void publish(
             @Context RoutingContext ctx,
             @RestPath UUID id,
@@ -411,6 +450,14 @@ public void publish(
     @DELETE
     @Path("/api/v4/discovery/{id}")
     @PermitAll
+    @Tag(ref = "Discovery")
+    @Operation(
+            summary = "Delete the given plugin's registration",
+            description =
+                    """
+                    Delete the plugin's registration along with its discovery Realm node and all of its children. This
+                    is used when a discovery plugin is shutting down.
+                    """)
     public void deregister(@Context RoutingContext ctx, @RestPath UUID id, @RestQuery String token)
             throws SchedulerException {
         DiscoveryPlugin plugin = DiscoveryPlugin.find("id", id).singleResult();
@@ -441,6 +488,13 @@ public void deregister(@Context RoutingContext ctx, @RestPath UUID id, @RestQuer
     @JsonView(DiscoveryNode.Views.Flat.class)
     @Path("/api/v4/discovery_plugins")
     @RolesAllowed("read")
+    @Tag(ref = "Discovery")
+    @Operation(
+            summary = "List currently registered discovery plugins",
+            description =
+                    """
+                    Retrieve a list of currently registered discovery plugins only, not including their subtrees.
+                    """)
     public List<DiscoveryPlugin> getPlugins(@RestQuery String realm) {
         // TODO filter for the matching realm name within the DB query
         return DiscoveryPlugin.findAll().<DiscoveryPlugin>list().stream()
@@ -451,10 +505,24 @@ public List<DiscoveryPlugin> getPlugins(@RestQuery String realm) {
     @GET
     @Path("/api/v4/discovery_plugins/{id}")
     @RolesAllowed("read")
+    @Tag(ref = "Discovery")
+    @Operation(
+            summary = "Retrieve a specific discovery plugin",
+            description =
+                    """
+                    Retrieve information about a specific discovery plugin, including its discovery Realm node and
+                    subtree.
+                    """)
     public DiscoveryPlugin getPlugin(@RestPath UUID id) {
         return DiscoveryPlugin.find("id", id).singleResult();
     }
 
+    /**
+     * Check that discovery plugins are still alive/reachable and prompt them to regenerate expiring
+     * tokens. Plugins are issued short-lived tokens at registration time. Cryostat periodically
+     * pings plugins to ensure they are still alive/reachable and to prompt them to request a fresh
+     * token if their token will be expiring soon.
+     */
     @SuppressFBWarnings("RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE")
     static class RefreshPluginJob implements Job {
         @Inject Logger logger;
diff --git a/src/main/java/io/cryostat/discovery/DiscoveryNode.java b/src/main/java/io/cryostat/discovery/DiscoveryNode.java
index a8967f868..ebead587a 100644
--- a/src/main/java/io/cryostat/discovery/DiscoveryNode.java
+++ b/src/main/java/io/cryostat/discovery/DiscoveryNode.java
@@ -61,6 +61,15 @@
 import org.hibernate.type.SqlTypes;
 import org.jboss.logging.Logger;
 
+/**
+ * Represents a node in the overall discovery tree. Nodes either have a {@link
+ * io.cryostat.targets.Target} reference or a list of children (which are also DiscoveryNodes),
+ * never both. A node with a target, known as a TargetNode, represents a discovered JVM process. A
+ * node with a list of children, known as an EnvironmentMode, represents some intermediate object
+ * such as a {@link io.cryostat.discovery.DiscoveryPlugin}, a Podman Pod, a Kubernetes Deployment,
+ * etc. All {@link io.cryostat.targets.Target} instances are associated with a DiscoveryNode which
+ * places them in the tree.
+ */
 @Entity
 @EntityListeners(DiscoveryNode.Listener.class)
 @NamedQueries({
diff --git a/src/main/java/io/cryostat/discovery/DiscoveryPlugin.java b/src/main/java/io/cryostat/discovery/DiscoveryPlugin.java
index cd6c2a630..f62cae5a5 100644
--- a/src/main/java/io/cryostat/discovery/DiscoveryPlugin.java
+++ b/src/main/java/io/cryostat/discovery/DiscoveryPlugin.java
@@ -55,6 +55,12 @@
 import org.hibernate.annotations.GenericGenerator;
 import org.jboss.logging.Logger;
 
+/**
+ * DiscoveryPlugin instances track registrations of discovery plugins. The reference implementation
+ * for a discovery plugin is the Cryostat Agent. Plugins communicate with Cryostat via the {@link
+ * io.cryostat.discovery.Discovery} API endpoints. Registration through that API generates a
+ * DiscoveryPlugin record to place that plugin into the discovery tree.
+ */
 @Entity
 @EntityListeners(DiscoveryPlugin.Listener.class)
 public class DiscoveryPlugin extends PanacheEntityBase {
diff --git a/src/main/java/io/cryostat/discovery/JDPDiscovery.java b/src/main/java/io/cryostat/discovery/JDPDiscovery.java
index 9cbfe1106..7295c0710 100644
--- a/src/main/java/io/cryostat/discovery/JDPDiscovery.java
+++ b/src/main/java/io/cryostat/discovery/JDPDiscovery.java
@@ -45,6 +45,7 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
+/** Discovery mechanism for the Java Discovery Protocol (multicast). */
 @ApplicationScoped
 public class JDPDiscovery implements Consumer<JvmDiscoveryEvent> {
 
diff --git a/src/main/java/io/cryostat/discovery/KubeApiDiscovery.java b/src/main/java/io/cryostat/discovery/KubeApiDiscovery.java
index 938289cb3..150ad85d7 100644
--- a/src/main/java/io/cryostat/discovery/KubeApiDiscovery.java
+++ b/src/main/java/io/cryostat/discovery/KubeApiDiscovery.java
@@ -67,6 +67,14 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
+/**
+ * Discovery mechanism for Kubernetes and derivatives. Uses a Kubernetes client to communicate with
+ * the k8s API server. This works by querying for Endpoint objects, which represent <ip, port>
+ * tuples on k8s Services and therefore map to Pods (and therefore containers running JVMs), then
+ * constructing a subtree by chasing owner references from the Endpoint object until the ownership
+ * chain either ends or hits a Namespace object. Intermediate nodes across these chains are reused
+ * so that common ancestors are shared and a tree is formed, rather than a list of lists.
+ */
 @ApplicationScoped
 public class KubeApiDiscovery implements ResourceEventHandler<Endpoints> {
 
diff --git a/src/main/java/io/cryostat/events/EventTemplates.java b/src/main/java/io/cryostat/events/EventTemplates.java
index 7a7a95a7b..647f82aad 100644
--- a/src/main/java/io/cryostat/events/EventTemplates.java
+++ b/src/main/java/io/cryostat/events/EventTemplates.java
@@ -41,6 +41,7 @@
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.UriInfo;
 import org.apache.commons.lang3.StringUtils;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestForm;
 import org.jboss.resteasy.reactive.RestPath;
@@ -69,6 +70,14 @@ public class EventTemplates {
     @GET
     @Blocking
     @RolesAllowed("read")
+    @Operation(
+            summary = "List server event templates",
+            description =
+                    """
+                    Retrieve a list of templates available on this Cryostat server. These templates can be applied to
+                    recordings started on any discovered target, but any event configurations within the template which
+                    reference events that do not exist on the target will be ignored.
+                    """)
     public List<Template> listTemplates() throws Exception {
         var list = new ArrayList<Template>();
         list.add(ALL_EVENTS_TEMPLATE);
@@ -81,6 +90,7 @@ public List<Template> listTemplates() throws Exception {
     @Path("/{templateType}")
     @Blocking
     @RolesAllowed("read")
+    @Operation(summary = "List server event templates of the given type")
     public List<Template> getTemplates(@RestPath String templateType)
             throws IOException, FlightRecorderException {
         TemplateType tt = TemplateType.valueOf(templateType);
@@ -99,6 +109,13 @@ public List<Template> getTemplates(@RestPath String templateType)
     @Blocking
     @RolesAllowed("read")
     @Produces(MediaType.APPLICATION_XML)
+    @Operation(
+            summary = "Get a specific event template",
+            description =
+                    """
+                    Get the .jfc (XML) file definition for the given server event template. This is the same type of
+                    event configuration file that ships with OpenJDK distributions.
+                    """)
     public String getTemplate(@RestPath String templateType, @RestPath String templateName)
             throws IOException, FlightRecorderException {
         TemplateType tt = TemplateType.valueOf(templateType);
@@ -118,6 +135,12 @@ public String getTemplate(@RestPath String templateType, @RestPath String templa
 
     @POST
     @RolesAllowed("write")
+    @Operation(
+            summary = "Upload a custom event template",
+            description =
+                    """
+                    Upload a new custom event template to the server. This must be in OpenJDK .jfc (XML) format.
+                    """)
     public RestResponse<Template> postTemplates(
             @Context UriInfo uriInfo, @RestForm("template") FileUpload body) throws IOException {
         if (body == null || body.filePath() == null || !"template".equals(body.name())) {
@@ -138,6 +161,13 @@ public RestResponse<Template> postTemplates(
     @Blocking
     @Path("/{templateName}")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Delete a custom event template",
+            description =
+                    """
+                    Delete a custom event template from the server. Only previously uploaded custom event templates can
+                    be deleted.
+                    """)
     public void deleteTemplate(@RestPath String templateName) throws FlightRecorderException {
         if (StringUtils.isBlank(templateName)) {
             throw new BadRequestException();
diff --git a/src/main/java/io/cryostat/events/Events.java b/src/main/java/io/cryostat/events/Events.java
index ed2c11593..acf48b8ac 100644
--- a/src/main/java/io/cryostat/events/Events.java
+++ b/src/main/java/io/cryostat/events/Events.java
@@ -30,6 +30,7 @@
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
 import org.apache.commons.lang3.StringUtils;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 import org.jboss.resteasy.reactive.RestQuery;
@@ -43,6 +44,15 @@ public class Events {
     @GET
     @Path("/api/v4/targets/{id}/events")
     @RolesAllowed("read")
+    @Operation(
+            summary = "List JFR event types registered within the given target",
+            description =
+                    """
+                    Retrieve a list of JFR event types registered within the given target. This will include all
+                    built-in JFR types emitted by the target JVM, as well as custom event types specific to that
+                    target JVM if they are correctly registered. Custom event types, or event types emitted by plugins
+                    and extensions, may not always appear in this list.
+                    """)
     public List<SerializableEventTypeInfo> listEvents(@RestPath long id, @RestQuery String q)
             throws Exception {
         return searchEvents(Target.find("id", id).singleResult(), q);
diff --git a/src/main/java/io/cryostat/events/PresetTemplateService.java b/src/main/java/io/cryostat/events/PresetTemplateService.java
index 8c2c0a1cf..e34b84908 100644
--- a/src/main/java/io/cryostat/events/PresetTemplateService.java
+++ b/src/main/java/io/cryostat/events/PresetTemplateService.java
@@ -57,6 +57,13 @@
 import org.jsoup.Jsoup;
 import org.jsoup.parser.Parser;
 
+/**
+ * Event Template service implementation for Preset templates. Preset templates are ones located in
+ * src/main/docker/include/template_presets and are available to be applied to any discovered
+ * target. These behave similarly to {@link io.cryostat.events.S3TemplateService} Custom Event
+ * Templates, except Presets are shipped with the Cryostat distribution and cannot be deleted by end
+ * users at runtime.
+ */
 @ApplicationScoped
 public class PresetTemplateService implements TemplateService {
 
diff --git a/src/main/java/io/cryostat/events/S3TemplateService.java b/src/main/java/io/cryostat/events/S3TemplateService.java
index 35d8f575b..a66f04ad3 100644
--- a/src/main/java/io/cryostat/events/S3TemplateService.java
+++ b/src/main/java/io/cryostat/events/S3TemplateService.java
@@ -73,6 +73,11 @@
 import software.amazon.awssdk.services.s3.model.Tag;
 import software.amazon.awssdk.services.s3.model.Tagging;
 
+/**
+ * Event Template service implementation for Custom Event Templates. Custom Event Templates are ones
+ * that users can create and delete at runtime. These must be in conventional .jfc XML format. This
+ * implementation uses an S3 object storage service to house the XML files.
+ */
 @ApplicationScoped
 public class S3TemplateService implements MutableTemplateService {
 
diff --git a/src/main/java/io/cryostat/events/TargetEventTemplates.java b/src/main/java/io/cryostat/events/TargetEventTemplates.java
index 65f97eb2b..0cd6f824e 100644
--- a/src/main/java/io/cryostat/events/TargetEventTemplates.java
+++ b/src/main/java/io/cryostat/events/TargetEventTemplates.java
@@ -35,6 +35,7 @@
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 
@@ -59,6 +60,14 @@ public class TargetEventTemplates {
     @GET
     @Blocking
     @RolesAllowed("read")
+    @Operation(
+            summary = "Retrieve a list of event templates available on the given target",
+            description =
+                    """
+                    Retrieve a list of event templates available on the given target when starting recordings on the
+                    same target. This includes all of the server's available templates, plus the templates available
+                    specifically from the target (ex. within /usr/lib/jvm/java/lib/jfr).
+                    """)
     public List<Template> listTargetTemplates(@RestPath long id) throws Exception {
         Target target = Target.find("id", id).singleResult();
         var list = new ArrayList<Template>();
@@ -79,6 +88,12 @@ public List<Template> listTargetTemplates(@RestPath long id) throws Exception {
     @Path("/{templateType}/{templateName}")
     @RolesAllowed("read")
     @Produces(MediaType.APPLICATION_XML)
+    @Operation(
+            summary = "Get a specific event template",
+            description =
+                    """
+                    Get the .jfc (XML) file definition for the given target event template.
+                    """)
     public String getTargetTemplate(
             @RestPath long id, @RestPath TemplateType templateType, @RestPath String templateName)
             throws Exception {
diff --git a/src/main/java/io/cryostat/expressions/MatchExpression.java b/src/main/java/io/cryostat/expressions/MatchExpression.java
index b576d9b94..cf2aadf2c 100644
--- a/src/main/java/io/cryostat/expressions/MatchExpression.java
+++ b/src/main/java/io/cryostat/expressions/MatchExpression.java
@@ -45,6 +45,14 @@
 import org.jboss.logging.Logger;
 import org.projectnessie.cel.tools.ScriptException;
 
+/**
+ * Match Expressions contain small snippets of Common Expression Language and are used to evaluate
+ * other resources' applicability to {@link io.cryostat.target.Target}s. {@link
+ * io.cryostat.rules.Rule}s and {@link io.cryostat.credentials.Credential}s use Match Expressions to
+ * determine the set of Targets they should apply to. When evaluating a Match Expression, Cryostat
+ * passes a slightly slimmed down and read-only representation of the Target instance into the
+ * expression context so that the expression can make assertions about the Target's properties.
+ */
 @Entity
 @EntityListeners(MatchExpression.Listener.class)
 public class MatchExpression extends PanacheEntity {
diff --git a/src/main/java/io/cryostat/expressions/MatchExpressionEvaluator.java b/src/main/java/io/cryostat/expressions/MatchExpressionEvaluator.java
index 4eabe2a04..d90650adc 100644
--- a/src/main/java/io/cryostat/expressions/MatchExpressionEvaluator.java
+++ b/src/main/java/io/cryostat/expressions/MatchExpressionEvaluator.java
@@ -233,7 +233,7 @@ public static class MatchExpressionApplies extends Event {
     public static class ScriptCreation extends Event {}
 
     /**
-     * Restricted view of a {@link io.cryostat.targets.Target} with only particular
+     * Restricted read-only view of a {@link io.cryostat.targets.Target} with only particular
      * expression-relevant fields exposed, connection URI exposed as a String, etc.
      */
     private static record SimplifiedTarget(
diff --git a/src/main/java/io/cryostat/expressions/MatchExpressions.java b/src/main/java/io/cryostat/expressions/MatchExpressions.java
index 1d9532f6e..8ca8bdbb3 100644
--- a/src/main/java/io/cryostat/expressions/MatchExpressions.java
+++ b/src/main/java/io/cryostat/expressions/MatchExpressions.java
@@ -30,6 +30,7 @@
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 import org.projectnessie.cel.tools.ScriptException;
@@ -43,6 +44,15 @@ public class MatchExpressions {
     @POST
     @RolesAllowed("read")
     @Blocking
+    @Operation(
+            summary = "Test a MatchExpression against a list of Targets",
+            description =
+                    """
+                    Given a list of Target IDs, retrieve each Target instance from the database, then return the list
+                    filtered by the Targets which satisfy the Match Expression. If a given ID does not exist in the
+                    database then the whole request will fail. The expression must evaluate to a boolean value for each
+                    target. The match expression will not be stored.
+                    """)
     public MatchedExpression test(RequestData requestData) throws ScriptException {
         var targets = new HashSet<Target>();
         if (requestData.targetIds == null) {
@@ -56,11 +66,20 @@ public MatchedExpression test(RequestData requestData) throws ScriptException {
     @GET
     @RolesAllowed("read")
     @Blocking
+    @Operation(
+            summary = "Retrieve a list of all currently defined Match Expressions",
+            description =
+                    """
+                    Retrieve a list of all currently defined Match Expressions. These objects cannot be created
+                    independently in the current API definition, so each of these expressions will be associated with
+                    an Automated Rule or Stored Credential.
+                    """)
     public Multi<Map<String, Object>> list() {
         List<MatchExpression> exprs = MatchExpression.listAll();
         // FIXME hack so that this endpoint renders the response as the entity object with id and
         // script fields, rather than allowing Jackson serialization to handle it normally where it
-        // will be encoded as only the script as a raw string
+        // will be encoded as only the script as a raw string. This should be done using a JsonView
+        // or similar technique instead
         return Multi.createFrom()
                 .items(exprs.stream().map(expr -> Map.of("id", expr.id, "script", expr.script)));
     }
@@ -69,6 +88,7 @@ public Multi<Map<String, Object>> list() {
     @Path("/{id}")
     @RolesAllowed("read")
     @Blocking
+    @Operation(summary = "Retrieve a single Match Expression")
     public MatchedExpression get(@RestPath long id) throws ScriptException {
         return targetMatcher.match(MatchExpression.find("id", id).singleResult());
     }
diff --git a/src/main/java/io/cryostat/graphql/ActiveRecordings.java b/src/main/java/io/cryostat/graphql/ActiveRecordings.java
index afbe66b4b..5522283e8 100644
--- a/src/main/java/io/cryostat/graphql/ActiveRecordings.java
+++ b/src/main/java/io/cryostat/graphql/ActiveRecordings.java
@@ -265,6 +265,7 @@ public ArchivedRecording doArchive(@Source ActiveRecording recording) throws Exc
         return recordingHelper.archiveRecording(ar, null);
     }
 
+    @Description("List and optionally filter active recordings belonging to a Target")
     public TargetNodes.ActiveRecordings active(
             @Source Recordings recordings, ActiveRecordingsFilter filter) {
         var out = new TargetNodes.ActiveRecordings();
diff --git a/src/main/java/io/cryostat/graphql/ArchivedRecordings.java b/src/main/java/io/cryostat/graphql/ArchivedRecordings.java
index 150b2a8a1..72f85b186 100644
--- a/src/main/java/io/cryostat/graphql/ArchivedRecordings.java
+++ b/src/main/java/io/cryostat/graphql/ArchivedRecordings.java
@@ -31,6 +31,7 @@
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import io.smallrye.graphql.api.Nullable;
 import jakarta.inject.Inject;
+import org.eclipse.microprofile.graphql.Description;
 import org.eclipse.microprofile.graphql.GraphQLApi;
 import org.eclipse.microprofile.graphql.NonNull;
 import org.eclipse.microprofile.graphql.Query;
@@ -42,6 +43,7 @@ public class ArchivedRecordings {
     @Inject RecordingHelper recordingHelper;
 
     @Query("archivedRecordings")
+    @Description("List archived recordings")
     public TargetNodes.ArchivedRecordings listArchivedRecordings(ArchivedRecordingsFilter filter) {
         var r = new TargetNodes.ArchivedRecordings();
         r.data =
@@ -54,6 +56,7 @@ public TargetNodes.ArchivedRecordings listArchivedRecordings(ArchivedRecordingsF
         return r;
     }
 
+    @Description("List and optionally filter archived recordings belonging to a Target")
     public TargetNodes.ArchivedRecordings archived(
             @Source Recordings recordings, ArchivedRecordingsFilter filter) {
         var out = new TargetNodes.ArchivedRecordings();
@@ -71,12 +74,14 @@ public TargetNodes.ArchivedRecordings archived(
     }
 
     @NonNull
+    @Description("Delete an archived recording")
     public ArchivedRecording doDelete(@Source ArchivedRecording recording) {
         recordingHelper.deleteArchivedRecording(recording.jvmId(), recording.name());
         return recording;
     }
 
     @NonNull
+    @Description("Update the metadata associated with an archived recording")
     public ArchivedRecording doPutMetadata(
             @Source ArchivedRecording recording, MetadataLabels metadataInput) {
         recordingHelper.updateArchivedRecordingMetadata(
diff --git a/src/main/java/io/cryostat/graphql/TargetNodes.java b/src/main/java/io/cryostat/graphql/TargetNodes.java
index f13c2c7d1..7ef686cf5 100644
--- a/src/main/java/io/cryostat/graphql/TargetNodes.java
+++ b/src/main/java/io/cryostat/graphql/TargetNodes.java
@@ -79,6 +79,7 @@ public List<DiscoveryNode> getTargetNodes(DiscoveryNodeFilter filter) {
     }
 
     @Transactional
+    @Description("Retrieve a list of active recordings currently available on the target")
     public ActiveRecordings activeRecordings(
             @Source Target target, @Nullable ActiveRecordingsFilter filter) {
         var fTarget = Target.getTargetById(target.id);
@@ -93,6 +94,7 @@ public ActiveRecordings activeRecordings(
         return recordings;
     }
 
+    @Description("Retrieve a list of archived recordings belonging to the target")
     public ArchivedRecordings archivedRecordings(
             @Source Target target, @Nullable ArchivedRecordingsFilter filter) {
         var fTarget = Target.getTargetById(target.id);
@@ -107,6 +109,13 @@ public ArchivedRecordings archivedRecordings(
         return recordings;
     }
 
+    @Description(
+            """
+            Retrieve an automated analysis report from the selected target(s). If there is no report currently
+            available then this request will not cause a report to be generated, and instead it will return an empty
+            result. Report generation may be an expensive operation, especially if many reports are to be generated at
+            once, and should not be triggered by broad GraphQL selections.
+            """)
     public Uni<Report> report(@Source Target target) {
         var fTarget = Target.getTargetById(target.id);
         return reportAggregator
diff --git a/src/main/java/io/cryostat/jmcagent/JMCAgentProbes.java b/src/main/java/io/cryostat/jmcagent/JMCAgentProbes.java
index 2ba9c66ca..e288bcc06 100644
--- a/src/main/java/io/cryostat/jmcagent/JMCAgentProbes.java
+++ b/src/main/java/io/cryostat/jmcagent/JMCAgentProbes.java
@@ -40,6 +40,7 @@
 import jakarta.ws.rs.InternalServerErrorException;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 
@@ -59,6 +60,12 @@ public class JMCAgentProbes {
     @Blocking
     @POST
     @Path("/api/v4/targets/{id}/probes/{probeTemplateName}")
+    @Operation(
+            summary = "Activate a probe template on the specified target",
+            description =
+                    """
+                    Activate a probe template (specified by template name) on the specified target (specified by ID).
+                    """)
     public void postProbe(@RestPath long id, @RestPath String probeTemplateName) {
         try {
             Target target = Target.getTargetById(id);
@@ -102,6 +109,7 @@ public void postProbe(@RestPath long id, @RestPath String probeTemplateName) {
     @Blocking
     @DELETE
     @Path("/api/v4/targets/{id}/probes")
+    @Operation(summary = "Remove all loaded probes from the specified target")
     public void deleteProbe(@RestPath long id) {
         try {
             Target target = Target.getTargetById(id);
@@ -133,6 +141,7 @@ public void deleteProbe(@RestPath long id) {
     @Blocking
     @GET
     @Path("/api/v4/targets/{id}/probes")
+    @Operation(summary = "List loaded probes on the specified target")
     public List<ProbeResponse> getProbes(@RestPath long id) {
         try {
             Target target = Target.getTargetById(id);
diff --git a/src/main/java/io/cryostat/jmcagent/JMCAgentTemplates.java b/src/main/java/io/cryostat/jmcagent/JMCAgentTemplates.java
index f9429262a..e2c9de40b 100644
--- a/src/main/java/io/cryostat/jmcagent/JMCAgentTemplates.java
+++ b/src/main/java/io/cryostat/jmcagent/JMCAgentTemplates.java
@@ -31,6 +31,7 @@
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.UriInfo;
 import org.apache.commons.lang3.StringUtils;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestForm;
 import org.jboss.resteasy.reactive.RestPath;
@@ -48,6 +49,7 @@ public class JMCAgentTemplates {
 
     @Blocking
     @GET
+    @Operation(summary = "List defined probe templates")
     public List<ProbeTemplateResponse> getProbeTemplates() {
         return service.getTemplates().stream()
                 .map(SerializableProbeTemplateInfo::fromProbeTemplate)
@@ -58,12 +60,22 @@ public List<ProbeTemplateResponse> getProbeTemplates() {
     @Blocking
     @DELETE
     @Path("/{probeTemplateName}")
+    @Operation(summary = "Delete the specified probe template")
     public void deleteProbeTemplate(@RestPath String probeTemplateName) {
         service.deleteTemplate(probeTemplateName);
     }
 
     @Blocking
     @POST
+    @Operation(
+            summary = "Create a probe template",
+            description =
+                    """
+                        Create a probe template. This requires a probe template file upload in XML format. See
+                        https://github.com/openjdk/jmc/blob/master/agent/README.md and
+                        https://github.com/openjdk/jmc/blob/master/agent/src/main/resources/org/openjdk/jmc/agent/impl/jfrprobes_schema.xsd
+                        for more information about this file format.
+                    """)
     public RestResponse<ProbeTemplate> uploadProbeTemplate(
             @Context UriInfo uriInfo,
             @RestForm("probeTemplate") FileUpload body,
diff --git a/src/main/java/io/cryostat/jmcagent/S3ProbeTemplateService.java b/src/main/java/io/cryostat/jmcagent/S3ProbeTemplateService.java
index 132ccedf2..5a44ff0dc 100644
--- a/src/main/java/io/cryostat/jmcagent/S3ProbeTemplateService.java
+++ b/src/main/java/io/cryostat/jmcagent/S3ProbeTemplateService.java
@@ -55,6 +55,11 @@
 import software.amazon.awssdk.services.s3.model.Tag;
 import software.amazon.awssdk.services.s3.model.Tagging;
 
+/**
+ * Implementation for JMC Agent event probe templates stored in S3 object storage.
+ *
+ * @see io.cryostat.events.S3TemplateService
+ */
 public class S3ProbeTemplateService implements ProbeTemplateService {
 
     @ConfigProperty(name = ConfigProperties.AWS_BUCKET_NAME_PROBE_TEMPLATES)
diff --git a/src/main/java/io/cryostat/recordings/ActiveRecording.java b/src/main/java/io/cryostat/recordings/ActiveRecording.java
index 9e000d7a6..8d0879d6c 100644
--- a/src/main/java/io/cryostat/recordings/ActiveRecording.java
+++ b/src/main/java/io/cryostat/recordings/ActiveRecording.java
@@ -52,6 +52,11 @@
 import org.hibernate.type.SqlTypes;
 import org.jboss.logging.Logger;
 
+/**
+ * Represents a Flight Recording currently present on a remote @{link io.cryostat.target.Target}
+ * JVM. This Recording may be in any state, but should actually be present on the remote Target. It
+ * may have been created by Cryostat, by another external tool, or by the target JVM itself.
+ */
 @Entity
 @EntityListeners(ActiveRecording.Listener.class)
 @Table(
diff --git a/src/main/java/io/cryostat/recordings/ActiveRecordings.java b/src/main/java/io/cryostat/recordings/ActiveRecordings.java
index afa20e310..50d681018 100644
--- a/src/main/java/io/cryostat/recordings/ActiveRecordings.java
+++ b/src/main/java/io/cryostat/recordings/ActiveRecordings.java
@@ -55,6 +55,8 @@
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestForm;
 import org.jboss.resteasy.reactive.RestPath;
@@ -77,6 +79,13 @@ public class ActiveRecordings {
     @Blocking
     @Transactional
     @RolesAllowed("read")
+    @Operation(
+            summary = "List active recordings on the specified target",
+            description =
+                    """
+                    Retrieve a list of active recordings currently present on the specified target. This may initiate
+                    a new remote connection to the target to update Cryostat's model of available recordings.
+                    """)
     public List<LinkedRecordingDescriptor> list(@RestPath long targetId) throws Exception {
         Target target = Target.find("id", targetId).singleResult();
         return recordingHelper.listActiveRecordings(target).stream()
@@ -88,6 +97,15 @@ public List<LinkedRecordingDescriptor> list(@RestPath long targetId) throws Exce
     @Blocking
     @Path("/{remoteId}")
     @RolesAllowed("read")
+    @Operation(
+            summary = "Download a Flight Recording binary file",
+            description =
+                    """
+                    Given a recording ID and a remote recording ID within that target, Cryostat will open a remote
+                    connection to the target and pipe back a data stream containing the Flight Recording binary file
+                    format for that recording. The client can feed this data to other tooling which ingests the JFR
+                    binary file format.
+                    """)
     public RestResponse<InputStream> download(@RestPath long targetId, @RestPath long remoteId)
             throws Exception {
         Target target = Target.find("id", targetId).singleResult();
@@ -106,6 +124,13 @@ public RestResponse<InputStream> download(@RestPath long targetId, @RestPath lon
     @Blocking
     @Path("/{remoteId}")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Update a remote recording on the specified target",
+            description =
+                    """
+                    Remote recordings can be stopped by sending the request body "stop", or copied to archives by
+                    sending the request body "save". The body is case-insensitive.
+                    """)
     public String patch(
             HttpServerResponse response,
             @RestPath long targetId,
@@ -121,7 +146,7 @@ public String patch(
             throw new NotFoundException();
         }
         ActiveRecording activeRecording = recording.get();
-        switch (body.toLowerCase()) {
+        switch (body.strip().toLowerCase()) {
             case "stop":
                 recordingHelper
                         .stopRecording(activeRecording)
@@ -148,15 +173,29 @@ public String patch(
     @Transactional
     @Blocking
     @RolesAllowed("write")
+    @Operation(
+            summary = "Start a new recording on the specified target",
+            description =
+                    """
+                    Create a new Flight Recording on the specified target. The recording will be immediately started
+                    and begin capturing Flight Recording data.
+                    The recording must be given a name (unique within the
+                    target). An event specifier string must be included, which follows the format
+                    "template={name},(type={type})". The type parameter is optional and the template name is required.
+                    See the Event Templates API for more information about the values that can be used here.
+                    """)
     public RestResponse<LinkedRecordingDescriptor> create(
             @Context UriInfo uriInfo,
             @RestPath long targetId,
-            @RestForm String recordingName,
-            @RestForm String events,
+            @Parameter(required = true, description = "must be unique within the target") @RestForm
+                    String recordingName,
+            @Parameter(required = true, description = "ex. template=Profiling,type=TARGET")
+                    @RestForm
+                    String events,
             @RestForm Optional<String> replace,
             // restart param is deprecated, only 'replace' should be used and takes priority if both
             // are provided
-            @Deprecated @RestForm Optional<Boolean> restart,
+            @Parameter(deprecated = true) @Deprecated @RestForm Optional<Boolean> restart,
             @RestForm Optional<Long> duration,
             @RestForm Optional<Boolean> toDisk,
             @RestForm Optional<Long> maxAge,
@@ -215,6 +254,13 @@ public RestResponse<LinkedRecordingDescriptor> create(
     @Blocking
     @Path("/{remoteId}")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Delete a recording from the specified target",
+            description =
+                    """
+                    Delete a recording from the specified target. This will remove it both from Cryostat's database
+                    as well as remove the recording and release all resources in the remote target JVM.
+                    """)
     public void delete(@RestPath long targetId, @RestPath long remoteId) throws Exception {
         Target target = Target.find("id", targetId).singleResult();
         var recording = target.getRecordingById(remoteId);
@@ -228,6 +274,13 @@ public void delete(@RestPath long targetId, @RestPath long remoteId) throws Exce
     @Blocking
     @Path("/{remoteId}/upload")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Upload a recording for analysis in Grafana dashboard",
+            description =
+                    """
+                    Upload the current data stream of the specified recording to the jfr-datasource for online analysis
+                    in the associated Grafana dashboard.
+                    """)
     public String uploadToGrafana(
             HttpServerResponse response, @RestPath long targetId, @RestPath long remoteId)
             throws Exception {
diff --git a/src/main/java/io/cryostat/recordings/ActiveRecordingsDownload.java b/src/main/java/io/cryostat/recordings/ActiveRecordingsDownload.java
index 540e25ace..175392e0d 100644
--- a/src/main/java/io/cryostat/recordings/ActiveRecordingsDownload.java
+++ b/src/main/java/io/cryostat/recordings/ActiveRecordingsDownload.java
@@ -31,6 +31,7 @@
 import jakarta.ws.rs.core.HttpHeaders;
 import org.apache.commons.codec.binary.Base64;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 import org.jboss.resteasy.reactive.RestResponse;
@@ -52,6 +53,15 @@ public class ActiveRecordingsDownload {
     @GET
     @Blocking
     @RolesAllowed("read")
+    @Operation(
+            summary = "Download a Flight Recording binary file",
+            description =
+                    """
+                    Given a recording ID and a remote recording ID within that target, Cryostat will open a remote
+                    connection to the target and pipe back a data stream containing the Flight Recording binary file
+                    format for that recording. The client can feed this data to other tooling which ingests the JFR
+                    binary file format.
+                    """)
     public RestResponse<InputStream> handleActiveDownload(@RestPath long id) throws Exception {
         ActiveRecording recording = ActiveRecording.find("id", id).singleResult();
         return ResponseBuilder.<InputStream>ok()
diff --git a/src/main/java/io/cryostat/recordings/ArchivedRecordings.java b/src/main/java/io/cryostat/recordings/ArchivedRecordings.java
index f71d8c7f4..6f6a8fd47 100644
--- a/src/main/java/io/cryostat/recordings/ArchivedRecordings.java
+++ b/src/main/java/io/cryostat/recordings/ArchivedRecordings.java
@@ -63,6 +63,8 @@
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestForm;
 import org.jboss.resteasy.reactive.RestPath;
@@ -117,6 +119,12 @@ void onStart(@Observes StartupEvent evt) {
     @Blocking
     @Path("/api/v4/recordings")
     @RolesAllowed("read")
+    @Operation(
+            summary = "List all archived recordings",
+            description =
+                    """
+                    List all archived recordings from all targets, including (re-)uploaded files.
+                    """)
     public List<ArchivedRecording> listArchivesV4() {
         return recordingHelper.listArchivedRecordings();
     }
@@ -125,8 +133,18 @@ public List<ArchivedRecording> listArchivesV4() {
     @Blocking
     @Path("/api/v4/recordings")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Upload a JFR binary file to archives",
+            description =
+                    """
+                    (Re-)upload a JFR binary file into the archives. This allows for the restoration of archived files
+                    after they have been otherwise removed, or for portability across Cryostat instances or between
+                    Cryostat version upgrades. This can also be used to upload JFR files which were not collected by
+                    Cryostat, so that Cryostat can be used to perform online analysis of the file.
+                    """)
     public Map<String, Object> upload(
-            @RestForm("recording") FileUpload recording, @RestForm("labels") JsonObject rawLabels)
+            @Parameter(required = true) @RestForm("recording") FileUpload recording,
+            @Parameter(required = false) @RestForm("labels") JsonObject rawLabels)
             throws Exception {
         Map<String, String> labels = new HashMap<>();
         if (rawLabels != null) {
@@ -142,11 +160,27 @@ public Map<String, Object> upload(
     @Blocking
     @Path("/api/beta/recordings/{jvmId}")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Upload a JFR binary file to archives, associated with a particular target",
+            description =
+                    """
+                    Upload a JFR binary file into the archives, associating the archived recording with a particular
+                    target JVM. This is primarily used by the Cryostat Agent for pushing harvested recording files.
+                    """)
     public void agentPush(
-            @RestPath String jvmId,
-            @RestForm("recording") FileUpload recording,
-            @RestForm("labels") JsonObject rawLabels,
-            @RestForm("maxFiles") int maxFiles)
+            @Parameter(required = true) @RestPath String jvmId,
+            @Parameter(required = true) @RestForm("recording") FileUpload recording,
+            @Parameter(required = false) @RestForm("labels") JsonObject rawLabels,
+            @Parameter(
+                            required = false,
+                            description =
+                                    """
+                                    if supplied and greater than zero, Cryostat will only keep this many archived
+                                    recordings associated with this target. Recordings will be sorted by
+                                    'last modified' date and only the most recent 'maxFiles' will be retained.
+                                    """)
+                    @RestForm("maxFiles")
+                    int maxFiles)
             throws Exception {
         jvmId = jvmId.strip();
         int max = Integer.MAX_VALUE;
@@ -223,7 +257,8 @@ public void agentPush(
     @Blocking
     @Path("/api/beta/recordings/{jvmId}")
     @RolesAllowed("read")
-    public List<ArchivedRecording> agentGet(@RestPath String jvmId) {
+    @Operation(summary = "List archived recordings belonging to the specified target")
+    public List<ArchivedRecording> agentGet(@Parameter(required = true) @RestPath String jvmId) {
         var result = new ArrayList<ArchivedRecording>();
         recordingHelper
                 .listArchivedRecordingObjects(jvmId)
@@ -252,7 +287,14 @@ public List<ArchivedRecording> agentGet(@RestPath String jvmId) {
     @Blocking
     @Path("/api/beta/recordings/{connectUrl}/{filename}")
     @RolesAllowed("write")
-    public void agentDelete(@RestPath String connectUrl, @RestPath String filename)
+    @Operation(summary = "Delete an archived recording belonging to the specified target")
+    public void agentDelete(
+            @Parameter(
+                            required = true,
+                            description = "the connection URL associated with the target")
+                    @RestPath
+                    String connectUrl,
+            @Parameter(required = true) @RestPath String filename)
             throws Exception {
         String jvmId;
         if ("uploads".equals(connectUrl)) {
@@ -319,6 +361,7 @@ Map<String, Object> doUpload(FileUpload recording, Metadata metadata, String jvm
     @Blocking
     @Path("/api/v4/recordings/{filename}")
     @RolesAllowed("write")
+    @Operation(deprecated = true, summary = "Delete an archived recording by filename")
     public void delete(@RestPath String filename) throws Exception {
         var key = String.format("%s/%s", "uploads", filename);
         try {
@@ -334,6 +377,7 @@ public void delete(@RestPath String filename) throws Exception {
     @Blocking
     @Path("/api/beta/fs/recordings")
     @RolesAllowed("read")
+    @Operation(summary = "List all archived recordings grouped by target")
     public Collection<ArchivedRecordingDirectory> listFsArchives() {
         var map = new HashMap<String, ArchivedRecordingDirectory>();
         recordingHelper
@@ -375,6 +419,7 @@ public Collection<ArchivedRecordingDirectory> listFsArchives() {
     @Blocking
     @Path("/api/beta/fs/recordings/{jvmId}")
     @RolesAllowed("read")
+    @Operation(summary = "List all archived recordings belonging to the specified target")
     public Collection<ArchivedRecordingDirectory> listFsArchives(@RestPath String jvmId) {
         var map = new HashMap<String, ArchivedRecordingDirectory>();
         recordingHelper
@@ -413,6 +458,7 @@ public Collection<ArchivedRecordingDirectory> listFsArchives(@RestPath String jv
     @Blocking
     @Path("/api/beta/fs/recordings/{jvmId}/{filename}")
     @RolesAllowed("write")
+    @Operation(summary = "Delete an archived recording by name belonging to the specified target")
     public void deleteArchivedRecording(@RestPath String jvmId, @RestPath String filename)
             throws Exception {
         logger.tracev("Handling archived recording deletion: {0} / {1}", jvmId, filename);
@@ -475,6 +521,13 @@ public void deleteArchivedRecording(@RestPath String jvmId, @RestPath String fil
     @Blocking
     @Path("/api/v4/grafana/{encodedKey}")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Upload an archived recording to Grafana for online analysis",
+            description =
+                    """
+                    Upload an archived recording to the jfr-datasource for later online analysis in the associated
+                    Grafana dashboard.
+                    """)
     public String uploadArchivedToGrafana(HttpServerResponse response, @RestPath String encodedKey)
             throws Exception {
         var pair = recordingHelper.decodedKey(encodedKey);
@@ -508,6 +561,13 @@ public String uploadArchivedToGrafana(HttpServerResponse response, @RestPath Str
     @Blocking
     @Path("/api/v4/download/{encodedKey}")
     @RolesAllowed("read")
+    @Operation(
+            summary = "Get a download URL for an archived recording",
+            description =
+                    """
+                    Get a download URL for an archived recording. The response will be an HTTP redirect with a Location
+                    header pointing to the location where the client can download the recording JFR binary file.
+                    """)
     public RestResponse<Object> handleStorageDownload(
             @RestPath String encodedKey, @RestQuery String f) throws URISyntaxException {
         Pair<String, String> pair = recordingHelper.decodedKey(encodedKey);
diff --git a/src/main/java/io/cryostat/recordings/LongRunningRequestGenerator.java b/src/main/java/io/cryostat/recordings/LongRunningRequestGenerator.java
index 04d65cfdb..4ac46d88e 100644
--- a/src/main/java/io/cryostat/recordings/LongRunningRequestGenerator.java
+++ b/src/main/java/io/cryostat/recordings/LongRunningRequestGenerator.java
@@ -40,6 +40,13 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
+/**
+ * Message consumer and emitter for long-running batch processing tasks. Jobs such as copying active
+ * recording data into archives, or generating automated analysis reports, can take some time to
+ * complete due to computational complexity, network bandwidth constraints or latency, etc. This
+ * class is responsible for marshalling messages relating to these sorts of activities and
+ * delegating task execution to various implementing services.
+ */
 @ApplicationScoped
 public class LongRunningRequestGenerator {
 
diff --git a/src/main/java/io/cryostat/recordings/RecordingHelper.java b/src/main/java/io/cryostat/recordings/RecordingHelper.java
index 3e669a0d0..1b00be9e8 100644
--- a/src/main/java/io/cryostat/recordings/RecordingHelper.java
+++ b/src/main/java/io/cryostat/recordings/RecordingHelper.java
@@ -133,6 +133,19 @@
 import software.amazon.awssdk.services.s3.model.Tagging;
 import software.amazon.awssdk.services.s3.model.UploadPartRequest;
 
+/**
+ * Utility class for all things relating to Flight Recording operations. This class is used to
+ * interact with remote target JVMs when performing any kind of JFR operations such as starting,
+ * stopping, or deleting recordings, as well as retrieving recording data streams or piping these
+ * data streams to other destinations. This also implements complementary operations on archived
+ * recordings, which are active recordings that have already been copied from data streams into S3
+ * object storage.
+ *
+ * @see io.cryostat.target.Target
+ * @see io.cryostat.recordings.Recording
+ * @see io.cryostat.recordings.ActiveRecordings
+ * @see io.cryostat.recordings.ArchivedRecordings
+ */
 @ApplicationScoped
 public class RecordingHelper {
 
diff --git a/src/main/java/io/cryostat/recordings/RecordingOptions.java b/src/main/java/io/cryostat/recordings/RecordingOptions.java
index 5f8d0af21..55ac87841 100644
--- a/src/main/java/io/cryostat/recordings/RecordingOptions.java
+++ b/src/main/java/io/cryostat/recordings/RecordingOptions.java
@@ -37,6 +37,8 @@
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.PATCH;
 import jakarta.ws.rs.Path;
+import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestForm;
 import org.jboss.resteasy.reactive.RestPath;
@@ -52,6 +54,12 @@ public class RecordingOptions {
     @GET
     @Blocking
     @RolesAllowed("read")
+    @Operation(
+            summary = "Get the current set of options for the specified target",
+            description =
+                    """
+                    Retrieve a map of the current options for the specified target.
+                    """)
     public Map<String, Object> getRecordingOptions(@RestPath long targetId) throws Exception {
         Target target = Target.find("id", targetId).singleResult();
         return connectionManager.executeConnectedTask(
@@ -65,14 +73,40 @@ public Map<String, Object> getRecordingOptions(@RestPath long targetId) throws E
     @PATCH
     @Blocking
     @RolesAllowed("read")
+    @Operation(
+            summary = "Update the recording options for the specified target",
+            description =
+                    """
+                    Set default recording options for the specified target. These options will be applied to any
+                    recordings started on this target if no override values are specified when the recording is
+                    created.
+                    """)
     @SuppressFBWarnings(
             value = "UC_USELESS_OBJECT",
             justification = "SpotBugs thinks the options map is unused, but it is used")
     public Map<String, Object> patchRecordingOptions(
-            @RestPath long targetId,
-            @RestForm String toDisk,
-            @RestForm String maxAge,
-            @RestForm String maxSize)
+            @Parameter(required = true) @RestPath long targetId,
+            @Parameter(
+                            required = false,
+                            description =
+                                    "whether the JFR disk repository (using disk space local to the"
+                                            + " target JVM) is enabled")
+                    @RestForm
+                    String toDisk,
+            @Parameter(
+                            required = false,
+                            description =
+                                    "the maximum age of JFR events that should be retained in the"
+                                            + " disk repository")
+                    @RestForm
+                    String maxAge,
+            @Parameter(
+                            required = false,
+                            description =
+                                    "the maximum size of data that should be retained in the disk"
+                                            + " repository")
+                    @RestForm
+                    String maxSize)
             throws Exception {
         final String unsetKeyword = "unset";
 
diff --git a/src/main/java/io/cryostat/recordings/RemoteRecordingInputStreamFactory.java b/src/main/java/io/cryostat/recordings/RemoteRecordingInputStreamFactory.java
index f094dc582..a1a30a4cd 100644
--- a/src/main/java/io/cryostat/recordings/RemoteRecordingInputStreamFactory.java
+++ b/src/main/java/io/cryostat/recordings/RemoteRecordingInputStreamFactory.java
@@ -28,6 +28,12 @@
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 
+/**
+ * Creates {@link java.io.InputStream}s that pipe Flight Recording data from a remote target JVM.
+ * This class ensures that the cached target connection is continuously marked as in use, so that
+ * the {@link io.cryostat.target.TargetConnectionManager} does not prematurely evict and close the
+ * connection while streaming is still underway.
+ */
 @ApplicationScoped
 public class RemoteRecordingInputStreamFactory {
 
diff --git a/src/main/java/io/cryostat/recordings/Snapshots.java b/src/main/java/io/cryostat/recordings/Snapshots.java
index 4749a8a14..55d49e8f5 100644
--- a/src/main/java/io/cryostat/recordings/Snapshots.java
+++ b/src/main/java/io/cryostat/recordings/Snapshots.java
@@ -25,6 +25,7 @@
 import jakarta.transaction.Transactional;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 import org.jboss.resteasy.reactive.RestResponse;
@@ -39,6 +40,7 @@ public class Snapshots {
     @POST
     @Transactional
     @RolesAllowed("write")
+    @Operation(summary = "Create a JFR Snapshot on the specified target")
     public Uni<RestResponse<LinkedRecordingDescriptor>> createSnapshotUsingTargetId(
             @RestPath long targetId) throws Exception {
         return recordingHelper
diff --git a/src/main/java/io/cryostat/reports/AnalysisReportAggregator.java b/src/main/java/io/cryostat/reports/AnalysisReportAggregator.java
index c7f9a406d..d3d033f56 100644
--- a/src/main/java/io/cryostat/reports/AnalysisReportAggregator.java
+++ b/src/main/java/io/cryostat/reports/AnalysisReportAggregator.java
@@ -59,6 +59,7 @@
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
 import org.apache.commons.lang3.tuple.Pair;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 import org.jboss.resteasy.reactive.RestResponse;
@@ -198,6 +199,13 @@ public void reset() {
     @Produces(MediaType.TEXT_PLAIN)
     @RolesAllowed("read")
     @Transactional
+    @Operation(
+            summary = "Retrieve the latest aggregate report data",
+            description =
+                    """
+                    Retrieve the latest aggregate report data across all targets with recent automated analysis reports
+                    scores. These are multi-dimensional metrics in Prometheus format.
+                    """)
     // TODO should this include results from lost targets?
     public Multi<String> scrape() {
         var multis =
@@ -217,6 +225,13 @@ public Multi<String> scrape() {
     @Produces(MediaType.TEXT_PLAIN)
     @RolesAllowed("read")
     @Transactional
+    @Operation(
+            summary = "Retrieve the latest aggregate report data for the specified target",
+            description =
+                    """
+                    Retrieve the latest aggregate report data for a given target's recent automated analysis reports
+                    scores. These are multi-dimensional metrics in Prometheus format.
+                    """)
     // TODO should this include results from lost targets?
     public Uni<RestResponse<String>> scrape(@RestPath String jvmId) {
         return getEntry(jvmId)
diff --git a/src/main/java/io/cryostat/reports/MemoryCachingReportsListener.java b/src/main/java/io/cryostat/reports/MemoryCachingReportsListener.java
index dc5bd907f..0f29c8541 100644
--- a/src/main/java/io/cryostat/reports/MemoryCachingReportsListener.java
+++ b/src/main/java/io/cryostat/reports/MemoryCachingReportsListener.java
@@ -34,6 +34,7 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
+/** Event listener for pruning cached automated analysis reports when sources disappear. */
 @ApplicationScoped
 class MemoryCachingReportsListener {
 
diff --git a/src/main/java/io/cryostat/reports/MemoryCachingReportsService.java b/src/main/java/io/cryostat/reports/MemoryCachingReportsService.java
index 0b2e1a8a2..427059e68 100644
--- a/src/main/java/io/cryostat/reports/MemoryCachingReportsService.java
+++ b/src/main/java/io/cryostat/reports/MemoryCachingReportsService.java
@@ -38,6 +38,11 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
+/**
+ * Tiered caching layer for automated analysis reports. Holds report results in an in-memory cache
+ * for a short duration to improve report retrieval performance, since report generation can be
+ * quite expensive while the resulting reports themselves are not particularly large.
+ */
 @Priority(10)
 @Decorator
 @Dependent
diff --git a/src/main/java/io/cryostat/reports/ReportSidecarService.java b/src/main/java/io/cryostat/reports/ReportSidecarService.java
index ee763a0e2..92baf9470 100644
--- a/src/main/java/io/cryostat/reports/ReportSidecarService.java
+++ b/src/main/java/io/cryostat/reports/ReportSidecarService.java
@@ -30,6 +30,10 @@
 import org.jboss.resteasy.reactive.PartType;
 import org.jboss.resteasy.reactive.RestForm;
 
+/**
+ * Interface for HTTP client to communicate with reports sidecar generators instances. See
+ * https://github.com/cryostatio/cryostat-reports
+ */
 @RegisterRestClient(configKey = "reports")
 @ApplicationScoped
 public interface ReportSidecarService {
diff --git a/src/main/java/io/cryostat/reports/Reports.java b/src/main/java/io/cryostat/reports/Reports.java
index 77276996f..786ad76d1 100644
--- a/src/main/java/io/cryostat/reports/Reports.java
+++ b/src/main/java/io/cryostat/reports/Reports.java
@@ -51,6 +51,7 @@
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.UriBuilder;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 import org.jboss.resteasy.reactive.RestResponse;
@@ -90,6 +91,18 @@ void onStart(@Observes StartupEvent evt) {
     @Blocking
     @Path("/api/v4/reports/{encodedKey}")
     @RolesAllowed("read")
+    @Operation(
+            summary = "Get an automated analysis report",
+            description =
+                    """
+                    Given an encoded key from another endpoint, request an actual automated analysis report. If the
+                    requested report already exists in one of the tiered caching layers then the report will be
+                    directly returned as a JSON response body. If the report does not yet exist then the response will
+                    contain a Job UUID as a plain text response body. Cryostat will emit a WebSocket notification later
+                    using the same Job UUID to indicate that the report generation has been completed and the document
+                    is now available. The client may then re-issue a request to this endpoint with the same encoded key
+                    to retrieve the report document.
+                    """)
     // Response isn't strongly typed which allows us to return either the Analysis result
     // or a job ID String along with setting different Status codes.
     // TODO: Is there a cleaner way to accomplish this?
@@ -131,6 +144,15 @@ public Response get(HttpServerResponse response, @RestPath String encodedKey) {
     @Transactional
     @Path("/api/v4.1/targets/{targetId}/reports")
     @RolesAllowed("write")
+    @Operation(
+            summary = "Perform \"target analysis\" on the specified target",
+            description =
+                    """
+                    Composite action that 1) creates a Snapshot active recording on the specified target, 2) archives
+                    that Snapshot immediately, 3) performs automated analysis report generation on the archived file.
+                    The response will include a Location header pointing the client to an endpoint where the report can
+                    be retrieved, which may require the client to wait for a Job UUID notification.
+                    """)
     public Response analyze(
             HttpServerResponse resp,
             @RestPath long targetId,
@@ -168,6 +190,14 @@ public Response analyze(
     @Path("/api/v4.1/targets/{targetId}/reports")
     @Produces(MediaType.APPLICATION_JSON)
     @RolesAllowed("read")
+    @Operation(
+            summary = "Retrieve current automated analysis report for a target",
+            description =
+                    """
+                    Get the current cached automated analysis report for the specified target, if any. If no such
+                    report currently exists for the specified target then the response will be an HTTP 404 Not Found,
+                    and automated analysis report generation will not be triggered.
+                    """)
     public Uni<RestResponse<Map<String, AnalysisResult>>> getCached(@RestPath long targetId) {
         var target = Target.getTargetById(targetId);
         return reportAggregator
@@ -191,6 +221,17 @@ public Uni<RestResponse<Map<String, AnalysisResult>>> getCached(@RestPath long t
     @Blocking
     @Path("/api/v4/targets/{targetId}/reports/{recordingId}")
     @RolesAllowed("read")
+    @Operation(
+            summary =
+                    "Get an automated analysis report for a particular recording on the specified"
+                            + " target",
+            description =
+                    """
+                    Request an automated analysis report for a particular active recording on the specified target. If
+                    such a report already exists it will be returned directly as a JSON response body. If the report
+                    does not yet exist then an asynchronous task for it will be started, and a Job UUID will be
+                    sent as the plaintext response body.
+                    """)
     // Response isn't strongly typed which allows us to return either the Analysis result
     // or a job ID String along with setting different Status codes.
     // TODO: Is there a cleaner way to accomplish this?
diff --git a/src/main/java/io/cryostat/reports/ReportsServiceImpl.java b/src/main/java/io/cryostat/reports/ReportsServiceImpl.java
index b2acb4d23..2568f92fc 100644
--- a/src/main/java/io/cryostat/reports/ReportsServiceImpl.java
+++ b/src/main/java/io/cryostat/reports/ReportsServiceImpl.java
@@ -45,6 +45,16 @@
 import software.amazon.awssdk.services.s3.presigner.S3Presigner;
 import software.amazon.awssdk.services.s3.presigner.model.GetObjectPresignRequest;
 
+/**
+ * Implementation for automated analysis report generation. Handles direct report generation or
+ * delegation to sidecar reports generators (see https://github.com/cryostatio/cryostat-reports),
+ * for active or archived recordings. Results, whether directly generated or retrieved from
+ * delegated sidecars, may be entered into tiered cache layers.
+ *
+ * @see io.cryostat.recordings.LongRunningRequestGenerator
+ * @see io.cryostat.reports.MemoryCachingReportsService
+ * @see io.cryostat.reports.StorageCachingReportsService
+ */
 @ApplicationScoped
 class ReportsServiceImpl implements ReportsService {
 
diff --git a/src/main/java/io/cryostat/reports/StorageCachingReportsListener.java b/src/main/java/io/cryostat/reports/StorageCachingReportsListener.java
index b6a951248..2577431dc 100644
--- a/src/main/java/io/cryostat/reports/StorageCachingReportsListener.java
+++ b/src/main/java/io/cryostat/reports/StorageCachingReportsListener.java
@@ -31,6 +31,7 @@
 import software.amazon.awssdk.services.s3.model.DeleteObjectRequest;
 import software.amazon.awssdk.services.s3.model.S3Exception;
 
+/** Event listener for pruning cached automated analysis reports when sources disappear. */
 @ApplicationScoped
 class StorageCachingReportsListener {
 
diff --git a/src/main/java/io/cryostat/reports/StorageCachingReportsService.java b/src/main/java/io/cryostat/reports/StorageCachingReportsService.java
index d68d82853..c5c24b45c 100644
--- a/src/main/java/io/cryostat/reports/StorageCachingReportsService.java
+++ b/src/main/java/io/cryostat/reports/StorageCachingReportsService.java
@@ -50,6 +50,16 @@
 import software.amazon.awssdk.services.s3.model.NoSuchKeyException;
 import software.amazon.awssdk.services.s3.model.PutObjectRequest;
 
+/**
+ * Tiered caching layer for automated analysis reports. Uses S3 object storage to cache automated
+ * analysis reports as JSON files. This is only done for archived recordings, not active recordings.
+ * Since archived recordings contain fixed, static data, once a single report is generated for that
+ * recording file then the automated analysis report file is always valid. The report documents
+ * themselves are not particularly large files and storing them should be cheap (much cheaper than
+ * storing the input recording file). If in-memory report caching is disabled, or a report has
+ * dropped out of that cache due to TTL, then retrieving the report file from S3 object storage is
+ * still much cheaper than, and preferable to, regenerating the report again.
+ */
 @Priority(20)
 @Decorator
 @Dependent
diff --git a/src/main/java/io/cryostat/rules/Rule.java b/src/main/java/io/cryostat/rules/Rule.java
index cc719d9b6..8dbd6f7c7 100644
--- a/src/main/java/io/cryostat/rules/Rule.java
+++ b/src/main/java/io/cryostat/rules/Rule.java
@@ -49,6 +49,13 @@
 import org.hibernate.annotations.JdbcTypeCode;
 import org.hibernate.type.SqlTypes;
 
+/**
+ * Represents an Automated Rule which triggers Flight Recording creation on matching {@link
+ * io.cryostat.target.Target} instances. Automated Rules may also be configured to periodically pull
+ * the latest recording data stream out from the target into Cryostat's S3 object storage.
+ *
+ * @see io.cryostat.expressions.MatchExpression
+ */
 @Entity
 @EntityListeners(Rule.Listener.class)
 @Table(indexes = {@Index(columnList = "name")})
diff --git a/src/main/java/io/cryostat/rules/RuleExecutor.java b/src/main/java/io/cryostat/rules/RuleExecutor.java
index 035006ea8..7b45e5082 100644
--- a/src/main/java/io/cryostat/rules/RuleExecutor.java
+++ b/src/main/java/io/cryostat/rules/RuleExecutor.java
@@ -59,6 +59,17 @@
 import org.quartz.Trigger;
 import org.quartz.TriggerBuilder;
 
+/**
+ * Handle executing on Automated Rule activations against Targets. Start new Flight Recordings on
+ * targets as needed, and schedule periodically copying data streams from the remote targets into
+ * Cryostat S3 object storage.
+ *
+ * @see io.cryostat.rules.RuleService
+ * @see io.cryostat.target.Target
+ * @see io.cryostat.rules.Rule
+ * @see io.cryostat.expressions.MatchExpression
+ * @see io.cryostat.expressions.MatchExpressionEvaluator
+ */
 @ApplicationScoped
 public class RuleExecutor {
 
diff --git a/src/main/java/io/cryostat/rules/RuleService.java b/src/main/java/io/cryostat/rules/RuleService.java
index 2504c55e9..28367dc8f 100644
--- a/src/main/java/io/cryostat/rules/RuleService.java
+++ b/src/main/java/io/cryostat/rules/RuleService.java
@@ -52,6 +52,16 @@
 import org.projectnessie.cel.tools.ScriptException;
 import org.quartz.SchedulerException;
 
+/**
+ * Handle {@link io.cryostat.target.Target} instances appearing and disappearing, and {@link
+ * io.cryostat.rules.Rule} instances being created or deleted. Delegates to the RuleExecutor to kick
+ * off new Flight Recordings in applicable targets and to handle periodically copying recording
+ * data, if configured to do so.
+ *
+ * @see io.cryostat.rules.RuleExecutor
+ * @see io.cryostat.expressions.MatchExpression
+ * @see io.cryostat.expressions.MatchExpressionEvaluator
+ */
 @ApplicationScoped
 public class RuleService {
 
diff --git a/src/main/java/io/cryostat/rules/Rules.java b/src/main/java/io/cryostat/rules/Rules.java
index bac767987..b8d89b8cd 100644
--- a/src/main/java/io/cryostat/rules/Rules.java
+++ b/src/main/java/io/cryostat/rules/Rules.java
@@ -48,6 +48,7 @@
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.UriInfo;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestForm;
 import org.jboss.resteasy.reactive.RestPath;
@@ -113,6 +114,7 @@ private boolean checkDir() {
 
     @GET
     @RolesAllowed("read")
+    @Operation(summary = "List all Automated Rules")
     public List<Rule> list() {
         return Rule.listAll();
     }
@@ -120,6 +122,7 @@ public List<Rule> list() {
     @GET
     @RolesAllowed("read")
     @Path("/{name}")
+    @Operation(summary = "Get an Automated Rule by name")
     public Rule get(@RestPath String name) {
         return Rule.getByName(name);
     }
@@ -128,6 +131,7 @@ public Rule get(@RestPath String name) {
     @POST
     @RolesAllowed("write")
     @Consumes(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Create a new Automated Rule")
     public RestResponse<Rule> create(@Context UriInfo uriInfo, Rule rule) {
         // TODO validate the incoming rule
         if (rule == null) {
@@ -153,6 +157,12 @@ public RestResponse<Rule> create(@Context UriInfo uriInfo, Rule rule) {
     @RolesAllowed("write")
     @Path("/{name}")
     @Consumes(MediaType.APPLICATION_JSON)
+    @Operation(
+            summary = "Update an Automated Rule",
+            description =
+                    """
+                    Update Automated Rule parameters, such as whether the rule is currently active or not.
+                    """)
     public Rule update(@RestPath String name, @RestQuery boolean clean, JsonObject body) {
         Rule rule = Rule.getByName(name);
         if (rule == null) {
@@ -222,6 +232,7 @@ public RestResponse<Rule> create(
     @DELETE
     @RolesAllowed("write")
     @Path("/{name}")
+    @Operation(summary = "Delete an Automated Rule by name")
     public void delete(@RestPath String name, @RestQuery boolean clean) {
         Rule rule = Rule.getByName(name);
         if (rule == null) {
diff --git a/src/main/java/io/cryostat/rules/ScheduledArchiveJob.java b/src/main/java/io/cryostat/rules/ScheduledArchiveJob.java
index f23c75595..1595dd2cf 100644
--- a/src/main/java/io/cryostat/rules/ScheduledArchiveJob.java
+++ b/src/main/java/io/cryostat/rules/ScheduledArchiveJob.java
@@ -34,6 +34,15 @@
 import org.quartz.JobExecutionContext;
 import org.quartz.JobExecutionException;
 
+/**
+ * Perform recording archival by pulling data stream from a target and copying it into a file in S3
+ * object storage.
+ *
+ * @see io.cryostat.target.Target
+ * @see io.cryostat.recordings.ActiveRecording
+ * @see io.cryostat.rules.Rule
+ * @see io.cryostat.rules.RuleExecutor
+ */
 class ScheduledArchiveJob implements Job {
 
     private static final Pattern RECORDING_FILENAME_PATTERN =
diff --git a/src/main/java/io/cryostat/security/Auth.java b/src/main/java/io/cryostat/security/Auth.java
index 9f5765821..7a486cfbf 100644
--- a/src/main/java/io/cryostat/security/Auth.java
+++ b/src/main/java/io/cryostat/security/Auth.java
@@ -25,6 +25,7 @@
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.SecurityContext;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.resteasy.reactive.RestResponse;
 import org.jboss.resteasy.reactive.RestResponse.ResponseBuilder;
 
@@ -35,6 +36,7 @@ public class Auth {
     @Path("/api/v4/logout")
     @PermitAll
     @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "OAuth2 sign out. Invalidate the current user session")
     public RestResponse<Object> logout(@Context RoutingContext context) {
         return ResponseBuilder.create(RestResponse.Status.PERMANENT_REDIRECT)
                 .location(URI.create("/oauth2/sign_out"))
@@ -45,6 +47,17 @@ public RestResponse<Object> logout(@Context RoutingContext context) {
     @Path("/api/v4/auth")
     @PermitAll
     @Produces(MediaType.APPLICATION_JSON)
+    @Operation(
+            summary = "Authenticate to the Cryostat server",
+            description =
+                    """
+                    In modern Cryostat deployments it is customary to deploy Cryostat behind an authenticating reverse
+                    proxy, so authentication is not actually handled by Cryostat itself. This endpoint is used by the
+                    Cryostat Web UI client to send an authenticated client request, including some authentication
+                    headers, to the Cryostat server so that it can extract information about the logged-in user. The
+                    response contains the current user's username if it can be determined, or else an empty string.
+                    This is only used for display in the Web UI. API clients do not need to use this endpoint.
+                    """)
     public AuthResponse login(@Context RoutingContext context, SecurityContext securityContext) {
         String user =
                 securityContext.getUserPrincipal() != null
diff --git a/src/main/java/io/cryostat/security/TrustStore.java b/src/main/java/io/cryostat/security/TrustStore.java
index 430c330d6..cf305254d 100644
--- a/src/main/java/io/cryostat/security/TrustStore.java
+++ b/src/main/java/io/cryostat/security/TrustStore.java
@@ -29,6 +29,7 @@
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 
 @Path("/api/v4/tls/certs")
@@ -42,6 +43,15 @@ public class TrustStore {
     @Blocking
     @GET
     @Produces(MediaType.APPLICATION_JSON)
+    @Operation(
+            summary = "List additional trusted SSL/TLS certificates",
+            description =
+                    """
+                    In addition to the standard system/OpenJDK certificate trust store, Cryostat can be configured to
+                    trust additional certificates which may be presented by target JVM JMX servers or by Cryostat Agent
+                    HTTPS servers. This endpoint returns a list of local file paths to additional certificate files,
+                    which Cryostat will have loaded into an additional trust store at startup.
+                    """)
     public List<String> listCerts() throws IOException {
         var accessible =
                 Files.exists(trustStoreDir)
diff --git a/src/main/java/io/cryostat/targets/AgentApiException.java b/src/main/java/io/cryostat/targets/AgentApiException.java
index b67bfdb02..dc6e7dad7 100644
--- a/src/main/java/io/cryostat/targets/AgentApiException.java
+++ b/src/main/java/io/cryostat/targets/AgentApiException.java
@@ -17,6 +17,11 @@
 
 import jakarta.ws.rs.WebApplicationException;
 
+/**
+ * Indicates an HTTP exception during regular communications with a Cryostat Agent instance.
+ *
+ * @see io.cryostat.target.AgentClient
+ */
 public class AgentApiException extends WebApplicationException {
     public AgentApiException(int statusCode) {
         super(String.format("Unexpected HTTP response code %d", statusCode));
diff --git a/src/main/java/io/cryostat/targets/AgentClient.java b/src/main/java/io/cryostat/targets/AgentClient.java
index dd5b0e22d..f6cfc8d40 100644
--- a/src/main/java/io/cryostat/targets/AgentClient.java
+++ b/src/main/java/io/cryostat/targets/AgentClient.java
@@ -67,6 +67,14 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
+/**
+ * Client layer for HTTP(S) communications with Cryostat Agent instances. See
+ * https://github.com/cryostatio/cryostat-agent . This is an HTTP-based client for communicating
+ * with Cryostat Agent instances.
+ *
+ * @see io.cryostat.target.AgentJFRService
+ * @see io.cryostat.target.AgentConnection
+ */
 public class AgentClient {
 
     public static final String NULL_CREDENTIALS = "No credentials found for agent";
diff --git a/src/main/java/io/cryostat/targets/AgentConnection.java b/src/main/java/io/cryostat/targets/AgentConnection.java
index 09e1805f0..243a4cdbd 100644
--- a/src/main/java/io/cryostat/targets/AgentConnection.java
+++ b/src/main/java/io/cryostat/targets/AgentConnection.java
@@ -45,6 +45,14 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
+/**
+ * {@link io.cryostat.core.net.JFRConnection} implementation representing a Cryostat Agent instance.
+ * The original JFRConnection implementation is {@link io.cryostat.core.net.JFRJMXConnection}, which
+ * represents a view of a target JVM using JMX to perform remote operations. This class implements
+ * the same set of operations, but based on HTTP communications with Cryostat Agent instances.
+ *
+ * @see io.cryostat.targets.AgentClient
+ */
 class AgentConnection implements JFRConnection {
 
     private final AgentClient client;
diff --git a/src/main/java/io/cryostat/targets/AgentJFRService.java b/src/main/java/io/cryostat/targets/AgentJFRService.java
index 37d9db91c..316dbaad5 100644
--- a/src/main/java/io/cryostat/targets/AgentJFRService.java
+++ b/src/main/java/io/cryostat/targets/AgentJFRService.java
@@ -55,6 +55,19 @@
 import io.vertx.mutiny.core.buffer.Buffer;
 import org.jboss.logging.Logger;
 
+/**
+ * {@link io.cryostat.core.net.CryostatFlightRecorderService} implementation representing a Cryostat
+ * Agent instance. The CryostatFlightRecorderService is based on {@link
+ * org.openjdk.jmc.flightrecorder.configuration.IFlightRecorderService}.
+ * CryostatFlightRecorderService extends this with some Cryostat-specific operations. The original
+ * CryostatFlightRecorderService implementation is {@link
+ * io.cryostat.core.net.JmxFlightRecorderService}, which uses a JMX connection to the target JVM to
+ * implement its various operations. This implementation uses HTTP rather than JMX and communicates
+ * with Cryostat Agent instances.
+ *
+ * @see io.cryostat.targets.AgentClient
+ * @see io.cryostat.targets.AgentConnection
+ */
 class AgentJFRService implements CryostatFlightRecorderService {
 
     private final AgentClient client;
diff --git a/src/main/java/io/cryostat/targets/Target.java b/src/main/java/io/cryostat/targets/Target.java
index c5fc098c4..361e1b780 100644
--- a/src/main/java/io/cryostat/targets/Target.java
+++ b/src/main/java/io/cryostat/targets/Target.java
@@ -66,6 +66,13 @@
 import org.hibernate.type.SqlTypes;
 import org.jboss.logging.Logger;
 
+/**
+ * Represents a remote target JVM which Cryostat has discovered. These may be discovered by built-in
+ * discovery plugins, external discovery plugins (ex. Cryostat Agent instances), or directly by API
+ * clients via the Custom Targets API.
+ *
+ * @see io.cryostat.discovery.Discovery
+ */
 @Entity
 @EntityListeners(Target.Listener.class)
 @NamedQueries({@NamedQuery(name = "Target.unconnected", query = "from Target where jvmId is null")})
@@ -84,6 +91,20 @@ public class Target extends PanacheEntity {
 
     @NotBlank public String alias;
 
+    /**
+     * Hash ID identifying this JVM instance. This is a (mostly) unique hash computed from various
+     * factors in the remote target's {@link java.lang.management.RuntimeMXBean}. Two different
+     * remote JVM processes running as replicas of the same container will have all of the same hash
+     * inputs, except for hopefully different start timestamps. This hash ID is used to identify
+     * JVMs because multiple connectUrls may resolve to the same host:port and therefore the same
+     * actual JVM process.
+     *
+     * <p>Cryostat attempts to connect to a target immediately to retrieve the RuntimeMXBean data
+     * and compute the hash ID. If the connection attempt fails then Cryostat will retry for some
+     * time before eventually giving up. Therefore, a null JVM ID indicates that Cryostat has not
+     * yet been successful in connecting to the target JVM. The connection URL may be incorrect or
+     * there may be external network factors preventing Cryostat from establishing a connection.
+     */
     public String jvmId;
 
     @JdbcTypeCode(SqlTypes.JSON)
diff --git a/src/main/java/io/cryostat/targets/TargetConnectionManager.java b/src/main/java/io/cryostat/targets/TargetConnectionManager.java
index 6ec77b5df..c5a91c274 100644
--- a/src/main/java/io/cryostat/targets/TargetConnectionManager.java
+++ b/src/main/java/io/cryostat/targets/TargetConnectionManager.java
@@ -70,6 +70,22 @@
 import org.jboss.logging.Logger;
 import org.projectnessie.cel.tools.ScriptException;
 
+/**
+ * Handles creating, caching, and cleaning up remote target connections (JMX or HTTP). Since
+ * Cryostat may perform many remote operations on target JVMs in rapid succession, it is better for
+ * performance and resource utilization to cache and reuse network connections rather than opening a
+ * new connection for each operation. This class handles the creation and maintenance of these
+ * connections and cleaning them up when they have been inactive for some time. This class also
+ * handles finding relevant Stored Credentials that may be required for establishing these
+ * connections, and attaching these Credentials to the requests as needed.
+ *
+ * @see io.cryostat.target.Target
+ * @see io.cryostat.credentials.Credential
+ * @see io.cryostat.core.net.JFRConnection
+ * @see io.cryostat.core.net.JFRJMXConnection
+ * @see io.cryostat.target.AgentConnection
+ * @see io.cryostat.recordings.RemoteRecordingInputStreamFactory
+ */
 @ApplicationScoped
 public class TargetConnectionManager {
 
diff --git a/src/main/java/io/cryostat/targets/TargetUpdateJob.java b/src/main/java/io/cryostat/targets/TargetUpdateJob.java
index c56bf1027..f1f2a1f02 100644
--- a/src/main/java/io/cryostat/targets/TargetUpdateJob.java
+++ b/src/main/java/io/cryostat/targets/TargetUpdateJob.java
@@ -35,6 +35,12 @@
 import org.quartz.JobExecutionContext;
 import org.quartz.JobExecutionException;
 
+/**
+ * Attempt to connect to a remote target JVM to retrieve {@link java.lang.management.RuntimeMXBean}
+ * data and calculate the JVM hash ID.
+ *
+ * @see io.cryostat.target.Target
+ */
 public class TargetUpdateJob implements Job {
 
     @Inject Logger logger;
diff --git a/src/main/java/io/cryostat/targets/TargetUpdateService.java b/src/main/java/io/cryostat/targets/TargetUpdateService.java
index 68e55e552..953ff4e77 100644
--- a/src/main/java/io/cryostat/targets/TargetUpdateService.java
+++ b/src/main/java/io/cryostat/targets/TargetUpdateService.java
@@ -42,6 +42,11 @@
 import org.quartz.Trigger;
 import org.quartz.TriggerBuilder;
 
+/**
+ * Watch for {@link io.cryostat.target.Target} instances to be discovered, or matching {@link
+ * io.cryostat.credentials.Credential} to be added, and schedule {@link
+ * io.cryostat.targets.TargetUpdateJob} jobs to compute the target JVM hash IDs.
+ */
 @ApplicationScoped
 public class TargetUpdateService {
 
diff --git a/src/main/java/io/cryostat/targets/Targets.java b/src/main/java/io/cryostat/targets/Targets.java
index 4e29ddddb..4121c925b 100644
--- a/src/main/java/io/cryostat/targets/Targets.java
+++ b/src/main/java/io/cryostat/targets/Targets.java
@@ -26,6 +26,7 @@
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.RestPath;
 
@@ -42,6 +43,13 @@ public class Targets {
     @GET
     @Path("/api/v4/targets")
     @RolesAllowed("read")
+    @Operation(
+            summary = "List currently discovered targets",
+            description =
+                    """
+                    Get a list of the currently discovered targets. These are essentialy the same as the leaf nodes of
+                    the discovery tree. See 'GET /api/v4/discovery'.
+                    """)
     public List<Target> list() {
         return Target.listAll();
     }
@@ -49,6 +57,12 @@ public List<Target> list() {
     @GET
     @Path("/api/v4/targets/{id}")
     @RolesAllowed("read")
+    @Operation(
+            summary = "Get a target by ID",
+            description =
+                    """
+                    Get details about a particular target given its ID.
+                    """)
     public Target getById(@RestPath Long id) {
         return Target.find("id", id).singleResult();
     }
diff --git a/src/main/java/io/cryostat/util/URIRange.java b/src/main/java/io/cryostat/util/URIRange.java
index 993fa66c4..7fb59eafd 100644
--- a/src/main/java/io/cryostat/util/URIRange.java
+++ b/src/main/java/io/cryostat/util/URIRange.java
@@ -24,6 +24,19 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+/**
+ * Implement URI range validation. The configuration property 'cryostat.target.uri-range' can be
+ * used to control this feature. The value of this property should be one of the enum member names
+ * (case insensitive). The enum members are ordered in descending order of strictness: LOOPBACK is
+ * the strictest and only accepts hostnames that map back to the current host (ex. 'localhost',
+ * '127.0.0.1'), PUBLIC is the least strict and accepts any hostname. This is used by administrators
+ * to lock down the Cryostat instance and ensure that it will only initiate network connections to
+ * hosts within an expected "distance" from Cryostat on the network. PUBLIC is the default for
+ * historical and convenience reasons. In many practical deployment situtations, DNS_LOCAL is a good
+ * default to take and stricter settings should be considered.
+ *
+ * @see io.cryostat.ConfigProperties
+ */
 public enum URIRange {
     LOOPBACK(hostname -> check(hostname, InetAddress::isLoopbackAddress)),
     LINK_LOCAL(hostname -> check(hostname, InetAddress::isLinkLocalAddress)),
diff --git a/src/main/java/io/cryostat/ws/MessagingServer.java b/src/main/java/io/cryostat/ws/MessagingServer.java
index 0a5229798..ddb36fbc9 100644
--- a/src/main/java/io/cryostat/ws/MessagingServer.java
+++ b/src/main/java/io/cryostat/ws/MessagingServer.java
@@ -36,6 +36,18 @@
 import jakarta.websocket.server.ServerEndpoint;
 import org.jboss.logging.Logger;
 
+/**
+ * Implements a WebSocket-based notifications channel. Cryostat uses this notifications channel to
+ * emit updates about work being done. Many of these notifications will correspond 1:1 with HTTP API
+ * responses, but not all. The Cryostat Web graphical UI client uses these notifications to update
+ * its graphical state responsively. Other clients can mostly ignore WebSocket notifications and use
+ * HTTP API responses alone, except in the case of long-running async jobs where the HTTP API
+ * response may initially be a Job UUID which will later be included in a WebSocket notification
+ * indicating job completion.
+ *
+ * @see io.cryostat.recordings.LongRunningRequestGenerator
+ * @see io.cryostat.reports.Reports
+ */
 @ApplicationScoped
 @ServerEndpoint("/api/notifications")
 public class MessagingServer {