diff --git a/java/com.sap.sailing.server.gateway/webservices/api/v1/leaderboardCheckinPostDoc.html b/java/com.sap.sailing.server.gateway/webservices/api/v1/leaderboardCheckinPostDoc.html
index 672651492c4..a11d647e14a 100644
--- a/java/com.sap.sailing.server.gateway/webservices/api/v1/leaderboardCheckinPostDoc.html
+++ b/java/com.sap.sailing.server.gateway/webservices/api/v1/leaderboardCheckinPostDoc.html
@@ -51,7 +51,7 @@ deviceType: Either android or ios. Needed for selecting correct push notificatio
 deviceUuid: UUID generated by the app on first run. Not an identifier that globally identifies the piece of hardware such UDID under iOS, IMEI, or other.
 pushDeviceId: On Android the GCM regId, on iOS the APNS push token. This is needed for sending push notifications to the device.
 fromMillis: Milliseconds timestamp from which to map the device to the competitor.
-secret: The regatta registration link secret can be included, in this case it is not necessary, that the request contains a valid Bearer-Token and will be permitted anyway
+secret: The regatta registration link secret can be included as an alternative to a bearertoken,if it is correct, the caller will be permitted ignoring all normal permission checks
         </code></pre>
     </td>
     </tr>
@@ -71,7 +71,7 @@ secret: The regatta registration link secret can be included, in this case it is
         </code></pre>
         </td>
     <tr>
-    <td>Example boat tracking:</td>
+    <td>Example boat tracking (without secret, this means that a valid bearertoken is required with a user that has the correct permissions):</td>
         <td>POST <a href=http://sapsailing.com/api/v1/leaderboards/{name}/device_mappings/start>http://sapsailing.com/api/v1/leaderboards/{name}/device_mappings/start</a>
         <pre><code>
 {
@@ -86,7 +86,7 @@ secret: The regatta registration link secret can be included, in this case it is
     </tr>
 	</tr>
         <tr>
-        <td>Example mark tracking:</td>
+        <td>Example mark tracking (without a secret as well, see note above):</td>
         <td>POST <a href=http://sapsailing.com/api/v1/leaderboards/{name}/device_mappings/start>http://sapsailing.com/api/v1/leaderboards/{name}/device_mappings/start</a>
             <pre><code>
 {
diff --git a/wiki/info/api/api-v1.md b/wiki/info/api/api-v1.md
index 02b12dc454d..d7221397dda 100644
--- a/wiki/info/api/api-v1.md
+++ b/wiki/info/api/api-v1.md
@@ -51,6 +51,7 @@ The app has to receive the following information:
     * ``competitor-id`` (so the app can register the device for the correct competitor)
     * ``boat-id`` (so the app can register the device for the correct boat)
     * ``mark-id`` (so the app can register the device for the correct mark)
+* ``secret`` (optional regattasecret, so the app can register in managed scenarios without every user owning an account)
 
 This information is represented in a URL with one of the following structures:
 
@@ -76,6 +77,7 @@ http://<host>/tracking/checkin
 ```
 
 **Additional Notes:**
+* If the call is not made with a bearertoken linked to a user with correct permissions, it is necessary to use the additional parameter "secret", that should contain the regattasecret. If it is correct,further permission checks will be skipped for this call.
 * The URL is **only symbolic**. Requesting it will for now result in a 404. In the future, it might be used to redirect to the .apk, play store or app store in case the app is not installed.
 * The variable-length leaderboard name is problematic when thinking about length restrictions in QRCodes anyway. We will have to think about URL-shortening anyhow, so legible parameter names were chosen instead of short ones (e.g. ``event_id=`` instead of ``e=``)
 * The app has to get event and competitor data by performing additional REST API calls