diff --git a/README.md b/README.md
index 3f7ba44..c56a441 100644
--- a/README.md
+++ b/README.md
@@ -208,11 +208,13 @@ Application-defined HTTP status codes are generated in `AuthController` for succ
 
 | HTTP code | Status | Generated in | Trigger | Response body |
 |---:|---|---|---|---|
-| `201` | Created | `AuthController.register` | `POST /auth/register` creates a new user. | `UserResponse` with `id`, `username`, and `createdAt`. |
+| `200` | OK | `AuthController.login`; `NoteController.listNotes`; `NoteController.getNote`; `NoteController.updateNote` | Login succeeds, visible notes are listed, an authorized note is retrieved, or an owned note is updated. | `AuthResponse`, `NoteResponse`, or list of `NoteResponse` values depending on the endpoint. |
+| `201` | Created | `AuthController.register`; `NoteController.createNote`; `NoteController.shareNote` | A user is registered, a note is created, or a note is shared. | `UserResponse`, `NoteResponse`, or `ShareResponse` depending on the endpoint. |
+| `204` | No Content | `NoteController.deleteNote` | Owner successfully deletes a note. | Empty body. |
 | `400` | Bad Request | `GlobalExceptionHandler.handleMalformedJson` | Request body cannot be parsed or converted from JSON. | `ErrorResponse` with `Malformed request body`. |
 | `400` | Bad Request | `GlobalExceptionHandler.handleTypeMismatch` | Path variable or query parameter cannot be converted to the expected type. | `ErrorResponse` with `Invalid request parameter`. |
-| `401` | Unauthorized | `GlobalExceptionHandler.handleAuthentication`; Spring Security filter chain | Authentication fails or an unauthenticated request targets a protected route. | `ErrorResponse` with `Invalid username or password` when handled by `GlobalExceptionHandler`; framework-generated body when rejected before controller handling. |
-| `403` | Forbidden | `GlobalExceptionHandler.handleForbidden` | Authenticated caller is not allowed to perform the requested operation. | `ErrorResponse` with the exception message. |
+| `401` | Unauthorized | `GlobalExceptionHandler.handleAuthentication`; `SecurityConfig` authentication entry point via `ApiErrorWriter` | Login authentication fails or an unauthenticated request targets a protected route. | `ErrorResponse` with `Invalid username or password` for failed login; `ErrorResponse` with `Unauthorized` for protected routes without valid authentication. |
+| `403` | Forbidden | `GlobalExceptionHandler.handleForbidden`; `SecurityConfig` access denied handler via `ApiErrorWriter` | Authenticated caller is not allowed to perform the requested operation. | `ErrorResponse` with the exception message or `Forbidden`. |
 | `404` | Not Found | `GlobalExceptionHandler.handleNotFound` | Requested domain resource does not exist or should be hidden from the caller. | `ErrorResponse` with the exception message. |
 | `404` | Not Found | `GlobalExceptionHandler.handleNoResourceFound` | No controller route or static resource matches the request. | `ErrorResponse` with `Not found`. |
 | `409` | Conflict | `GlobalExceptionHandler.handleConflict`; `AuthController.register` throws `ConflictException` | Duplicate username or other persistence/domain uniqueness conflict. | `ErrorResponse` with the exception message. |