diff --git a/developer/roc-api.rst b/developer/roc-api.rst
index ee65e26..2ba3605 100644
--- a/developer/roc-api.rst
+++ b/developer/roc-api.rst
@@ -48,6 +48,10 @@
 the scope of a particular type of object. For example, a site may be named `foo` and a device-group
 may also be named `foo`, and the two names do not conflict because they are different object types.
 
+In addition to the `id`, most identifiable objects also include a `display-name`. The `display-name`
+may be changed at any time by the user without affecting behavior. In contrast, the `id` is immutable,
+and the only way to change an `id` is to delete the object and make a new one.
+
 Some objects contain references to other objects. For example, many objects contain references to
 the `Enterprise` object, which allows them to be associated with a particular enterprise. References
 are constructed using the `id` field of the referenced object. It is an error to attempt to create
@@ -99,8 +103,9 @@
      `CCCNNNEEESSSSSS` will construct IMSIs using a 3-digit MCC, 3-digit MNC, 3-digit ENT, and a
      6-digit subscriber.
 
-* `small-cell` A list of 5G gNodeB or Access Point or Radios. Each access point has the following:
+* `small-cell` A list of 5G gNodeB or Access Point or Radios. Each small cell has the following:
 
+    * `small-cell-id`. Identifier for the small cell. Serves the same purpose as other `id` fields.
     * `address`. Hostname of the small cell.
     * `tac`. Type Allocation Code.
     * `enable`. If set to `true`, the small cell is enabled. Otherwise, it is disabled.
@@ -111,9 +116,9 @@
     * `edge-monitoring-prometheus-url` the URL of the site's Edge monitoring Prometheus service
     * `edge-device` a list of monitoring devices that verify end-to-end connectivity
 
-        * `name` the name of the monitoring device (usually a Raspberry Pi). This will usually
-          correspond to its short hostname
-        * `display-name` a user friendly name
+        * `edge-device-id` the identifier of the edge monitoring device. Serves the same purpose as other `id` fields.
+        * `display-name` the user-friendly name for the edge device. It is recommended that the short hostname
+          be used for the `display-name` as a convention.
         * `description` an optional description
 
 Device-Group
@@ -125,22 +130,25 @@
 * `imsis`. A list of IMSI ranges. Each range has the following
   fields:
 
-   * `name`. Name of the range. Used as a key.
+   * `imsi-id`. Identifier of the IMSI. Serves the same purpose as other `id` fields.
    * `imsi-range-from`. First subscriber in the range.
    * `imsi-range-to`. Last subscriber in the range. Can be omitted if the range only contains one
-     IMSI.
+     IMSI. It is recommended to not use this feature, and to represent all IMSIs as singletons. This
+     field will be deprecated in the future.
 * `ip-domain`. Reference to an `IP-Domain` object that describes the IP and DNS settings for UEs
   within this group.
 * `site`. Reference to the site where this `Device-Group` may be used. Indirectly identifies the
   `Enterprise` as `Site` contains a reference to `Enterprise`.
 
-* `device` related configuration:
+* `device`. Per-device related QoS settings:
 
    * `mbr`. The maximum bitrate in bits per second that the application will be limited to:
 
       * `uplink` the `mbr` from device to slice
       * `downlink` the `mbr` from slice to device
 
+   * `traffic-class`. The traffic class to be used for devices in this group.
+
 Virtual Cellular Service
 ~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -150,19 +158,23 @@
 * `device-group`. A list of `Device-Group` objects that can participate in this `VCS`. Each
   entry in the list contains both the reference to the `Device-Group` as well as an `enable`
   field which may be used to temporarily remove access to the group.
+* `default-behavior`. May be set to either `ALLOW-ALL`, `DENY-ALL`, or `ALLOW-PUBLIC`. This is
+  the rule to use if no other rule in the filter matches. `ALLOW-PUBLIC` is a special alias
+  that denies all private networks and then allows everything else.
 * `filter`. A list of `Application` objects that are either allowed or denied for this
   `VCS`. Each entry in the list contains both a reference to the `Application` as well as an
   `allow` field which can be set to `true` to allow the application or `false` to deny it. It
   also has a `priority` field which can be used to order the applications when considering the
-  enforcing of their `allow` condition.
-* `template`. Reference to the `Template` that was used to initialize this `VCS`.
+  enforcing of their `allow` or `deny` conditions.
 * `upf`. Reference to the User Plane Function (`UPF`) that should be used to process packets
   for this `VCS`. It's permitted for multiple `VCS` to share a single `UPF`.
-* `ap`. Reference to an Access Point List (`AP-List`) that lists the access points for this
-  `VCS`.
 * `enterprise`. Reference to the `Enterprise` that owns this `VCS`.
-* `SST`, `SD`, `uplink`, `downlink`, `traffic-class`. Parameters that were initialized using the
-  `template`. They are described in the section for the `Template` model.
+* `site`. Reference to the `Site` where this `VCS` is deployed. Aether maintains the restriction
+  that the `Site` of the `UPF` and `Device-Group` must match the `Site` of the `VCS`.
+* `SST`, `SD`. Slice identifiers. These are assigned by Aether Operations.
+* `slice.mbr.uplink`, `slice.mbr.downlink`. Slice-total Uplink and downlink maximum bit rates in bps.
+* `slice.mbr.uplink-burst-size`, `slice.mbr.downlink-burst-size`. Maximum burst sizes in bytes for
+   the maximum bit rates.
 
 Application
 ~~~~~~~~~~~
@@ -177,11 +189,14 @@
     * `port-start`. Starting port number.
     * `port-end`. Ending port number.
     * `protocol`. `TCP|UDP`, specifies the protocol for the endpoint.
-    * `mbr`. The maximum bitrate in bits per second that the application will be limited to:
+    * `mbr`. The maximum bitrate in bits per second that UEs sending traffic to the application endpoint
+      will be limited to:
 
         * `uplink` the `mbr` from device to application
         * `downlink` the `mbr` from application to device
 
+    * `traffic-class`. Traffic class to be used when UEs send traffic to this Application endpoint.
+
 * `enterprise`. Link to an `Enterprise` object that owns this application. May be left empty
   to indicate a global application that may be used by multiple enterprises.
 
@@ -194,6 +209,7 @@
 `Connectivity-Service` specifies the URL of an SD-Core control plane.
 
 * `core-5g-endpoint`. Endpoint of a `config4g` or `config5g` core.
+* `acc-prometheus-url`. Prometheus endpoint where metrics may be queried regarding this connectivity service.
 
 IP-Domain
 ~~~~~~~~~
@@ -214,15 +230,15 @@
 `Template` contains connectivity settings that are pre-configured by Aether Operations.
 Templates are used to initialize `VCS` objects. `Template` has the following fields:
 
+* `default-behavior`. May be set to either `ALLOW-ALL`, `DENY-ALL`, or `ALLOW-PUBLIC`. This is
+  the rule to use if no other rule in the VCS's application filter matches. `ALLOW-PUBLIC` is
+  a special alias that denies all private networks and then allows everything else.
 * `sst`, `sd`. Slice identifiers.
 * `uplink`, `downlink`. Guaranteed uplink and downlink bandwidth.
 * `traffic-class`. Link to a `Traffic-Class` object that describes the type of traffic.
-* `slice` configuration for slice
-
-    * `mbr` configuration of maximum bit rate in slice
-
-        * `uplink` the `mbr` from device to slice
-        * `downlink` the `mbr` from slice to device
+* `slice.mbr.uplink`, `slice.mbr.downlink`. Slice-total Uplink and downlink maximum bit rates in bps.
+* `slice.mbr.uplink-burst-size`, `slice.mbr.downlink-burst-size`. Maximum burst sizes in bytes for
+  the maximum bit rates.
 
 Traffic-Class
 ~~~~~~~~~~~~~