diff --git a/app/Http/Controllers/InvoiceController.php b/app/Http/Controllers/InvoiceController.php
index 3165d798fd3b..f6dce2777f1a 100644
--- a/app/Http/Controllers/InvoiceController.php
+++ b/app/Http/Controllers/InvoiceController.php
@@ -653,49 +653,49 @@ class InvoiceController extends BaseController {
 	}
 
 	/**
-		 *
-		 * @OA\Get(
-		 *      path="/api/v1/invoice/{invitation_key}/download",
-		 *      operationId="downloadInvoice",
-		 *      tags={"invoices"},
-		 *      summary="Download a specific invoice by invitation key",
-		 *      description="Downloads a specific invoice",
-		 *      @OA\Parameter(ref="#/components/parameters/X-Api-Secret"),
-		 *      @OA\Parameter(ref="#/components/parameters/X-Api-Token"),
-		 *      @OA\Parameter(ref="#/components/parameters/X-Requested-With"),
-		 *      @OA\Parameter(ref="#/components/parameters/include"),
-		 *      @OA\Parameter(
-		 *          name="invitation_key",
-		 *          in="path",
-		 *          description="The Invoice Invitation Key",
-		 *          example="D2J234DFA",
-		 *          required=true,
-		 *          @OA\Schema(
-		 *              type="string",
-		 *              format="string",
-		 *          ),
-		 *      ),
-		 *      @OA\Response(
-		 *          response=200,
-		 *          description="Returns the invoice pdf",
-		 *          @OA\Header(header="X-API-Version", ref="#/components/headers/X-API-Version"),
-		 *          @OA\Header(header="X-RateLimit-Remaining", ref="#/components/headers/X-RateLimit-Remaining"),
-		 *          @OA\Header(header="X-RateLimit-Limit", ref="#/components/headers/X-RateLimit-Limit"),
-		 *       ),
-		 *       @OA\Response(
-		 *          response=422,
-		 *          description="Validation error",
-		 *          @OA\JsonContent(ref="#/components/schemas/ValidationError"),
-		 *
-		 *       ),
-		 *       @OA\Response(
-		 *           response="default",
-		 *           description="Unexpected Error",
-		 *           @OA\JsonContent(ref="#/components/schemas/Error"),
-		 *       ),
-		 *     )
-		 *
-		 */
+	 *
+	 * @OA\Get(
+	 *      path="/api/v1/invoice/{invitation_key}/download",
+	 *      operationId="downloadInvoice",
+	 *      tags={"invoices"},
+	 *      summary="Download a specific invoice by invitation key",
+	 *      description="Downloads a specific invoice",
+	 *      @OA\Parameter(ref="#/components/parameters/X-Api-Secret"),
+	 *      @OA\Parameter(ref="#/components/parameters/X-Api-Token"),
+	 *      @OA\Parameter(ref="#/components/parameters/X-Requested-With"),
+	 *      @OA\Parameter(ref="#/components/parameters/include"),
+	 *      @OA\Parameter(
+	 *          name="invitation_key",
+	 *          in="path",
+	 *          description="The Invoice Invitation Key",
+	 *          example="D2J234DFA",
+	 *          required=true,
+	 *          @OA\Schema(
+	 *              type="string",
+	 *              format="string",
+	 *          ),
+	 *      ),
+	 *      @OA\Response(
+	 *          response=200,
+	 *          description="Returns the invoice pdf",
+	 *          @OA\Header(header="X-API-Version", ref="#/components/headers/X-API-Version"),
+	 *          @OA\Header(header="X-RateLimit-Remaining", ref="#/components/headers/X-RateLimit-Remaining"),
+	 *          @OA\Header(header="X-RateLimit-Limit", ref="#/components/headers/X-RateLimit-Limit"),
+	 *       ),
+	 *       @OA\Response(
+	 *          response=422,
+	 *          description="Validation error",
+	 *          @OA\JsonContent(ref="#/components/schemas/ValidationError"),
+	 *
+	 *       ),
+	 *       @OA\Response(
+	 *           response="default",
+	 *           description="Unexpected Error",
+	 *           @OA\JsonContent(ref="#/components/schemas/Error"),
+	 *       ),
+	 *     )
+	 *
+	 */
 	public function downloadPdf($invitation_key) {
 
 		$invitation = $this->invoice_repo->getInvitationByKey($invitation_key);
diff --git a/app/Http/Controllers/SelfUpdateController.php b/app/Http/Controllers/SelfUpdateController.php
index 969f6434f34e..9a6446aac48b 100644
--- a/app/Http/Controllers/SelfUpdateController.php
+++ b/app/Http/Controllers/SelfUpdateController.php
@@ -23,6 +23,38 @@ class SelfUpdateController extends BaseController
 
     }
 
+    /**
+     *
+     *
+     * @OA\Post(
+     *      path="/api/v1/self-update",
+     *      operationId="selfUpdate",
+     *      tags={"update"},
+     *      summary="Performs a system update",
+     *      description="Performs a system update",
+     *      @OA\Parameter(ref="#/components/parameters/X-Api-Secret"),
+     *      @OA\Parameter(ref="#/components/parameters/X-Api-Token"),
+     *      @OA\Parameter(ref="#/components/parameters/X-Api-Password"),
+     *      @OA\Parameter(ref="#/components/parameters/X-Requested-With"),
+     *      @OA\Parameter(ref="#/components/parameters/include"),
+     *      @OA\Response(
+     *          response=200,
+     *          description="Success/failure response"
+     *       ),
+     *       @OA\Response(
+     *          response=422,
+     *          description="Validation error",
+     *          @OA\JsonContent(ref="#/components/schemas/ValidationError"),
+     *
+     *       ),
+     *       @OA\Response(
+     *           response="default",
+     *           description="Unexpected Error",
+     *           @OA\JsonContent(ref="#/components/schemas/Error"),
+     *       ),
+     *     )
+     *
+     */
     public function update(UpdaterManager $updater)
     {
     	
diff --git a/routes/api.php b/routes/api.php
index f2e9cd74481c..5557d9a286d1 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -112,7 +112,7 @@ Route::group(['middleware' => ['api_db', 'token_auth', 'locale'], 'prefix' => 'a
 
 		Route::post('templates', 'TemplateController@show')->name('templates.show');
 
-		Route::post('self-update', 'SelfUpdateController@update');
+		Route::post('self-update', 'SelfUpdateController@update')->middleware('password_protected');
 
 		/*
 		Route::resource('tasks', 'TaskController'); // name = (tasks. index / create / show / update / destroy / edit