diff --git a/README.md b/README.md
index dd3de08..5c970f1 100644
--- a/README.md
+++ b/README.md
@@ -29,4 +29,4 @@ The exact package layout is deferred until the Go architecture and DI decisions
 ## Merchant API contract
 
 - [`docs/API-SPEC.md`](docs/API-SPEC.md) defines the reviewable MVP capability, security boundaries, SSE recovery, detail pagination, and CSV-export policy.
-- [`docs/openapi.yaml`](docs/openapi.yaml) is the draft OpenAPI 3.1 interface source of truth and will generate frontend types after approval.
+- [`docs/openapi.yaml`](docs/openapi.yaml) is the approved OpenAPI 3.1 interface source of truth for generated frontend types.
diff --git a/docs/API-SPEC.md b/docs/API-SPEC.md
index 2ef3475..2d4195d 100644
--- a/docs/API-SPEC.md
+++ b/docs/API-SPEC.md
@@ -1,6 +1,6 @@
 # Merchant Analytics API Capability Spec
 
-- Status: Draft for review — implementation not yet authorized
+- Status: Approved specification — implementation not yet authorized
 - Capability: Merchant API
 - Depends on: Approved Identity, Data Foundation, and Analytics Engine specifications
 - Interface source of truth: `docs/openapi.yaml`
@@ -282,7 +282,7 @@ Correlate `requestId`, authenticated user/merchant internal ids, run id, section
 
 ## Remaining product questions
 
-None. Final approval of this complete capability spec and its OpenAPI contract remains the SDD gate before implementation planning.
+None.
 
 ## Standards references
 
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 7a394a9..cbd7771 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1,11 +1,11 @@
 openapi: 3.1.0
 info:
   title: ZarinPal Merchant Analytics API
-  version: 0.1.0-draft
+  version: 1.0.0
   summary: Contract-first API for authenticated merchant analytics.
   description: |
-    Draft MVP interface. This document is the API source of truth; generated
-    frontend types must come from this contract after approval.
+    Approved MVP interface. This document is the API source of truth; generated
+    frontend types must come from this contract.
 
     Merchant scope is always derived from the authenticated server-side session.
     No operation accepts a merchant identifier as authorization. All timestamps