diff --git a/docs/proxy/token_auth.md b/docs/proxy/token_auth.md
index 4d90baa60..44a920b61 100644
--- a/docs/proxy/token_auth.md
+++ b/docs/proxy/token_auth.md
@@ -788,7 +788,7 @@ Defaults (what the proxy uses if you don't override them in `litellm_jwtauth`):
 
 - `admin_jwt_scope`: `litellm_proxy_admin`
 - `admin_allowed_routes` (default): `management_routes`, `spend_tracking_routes`, `global_spend_tracking_routes`, `info_routes` 
-- `team_allowed_routes` (default): `openai_routes`, `info_routes`, `mcp_routes`, `/v1/messages`, `/v1/messages/count_tokens`. Setting `team_allowed_routes` replaces this list, so add `mcp_routes` and the `/v1/messages` routes back if teams still need them
+- `team_allowed_routes` (default): `openai_routes`, `info_routes`, `mcp_routes`, `/v1/messages`, `/v1/messages/count_tokens`, `/rag/ingest`, `/v1/rag/ingest`, `/rag/query`, `/v1/rag/query`. Setting `team_allowed_routes` replaces this list, so add `mcp_routes`, the `/v1/messages` routes and the `/rag` routes back if teams still need them
 - `public_allowed_routes` (default): `public_routes`
 
 
diff --git a/docs/rag_ingest.md b/docs/rag_ingest.md
index 18605834c..02876de0d 100644
--- a/docs/rag_ingest.md
+++ b/docs/rag_ingest.md
@@ -254,6 +254,10 @@ When `vector_store.vector_store_id` names a store in the [vector store registry]
 | `custom_llm_provider` | string | - | `"openai"` |
 | `vector_store_id` | string | auto-create | Existing vector store ID |
 
+:::info[Team deployments]
+When the caller's team has its own OpenAI deployment (a model list entry with `model_info.team_id`, such as a team-only `openai/*`), `/v1/rag/ingest` and `/v1/rag/query` send the vector store, file and search calls with that deployment's `api_key` and `api_base`. A key restricted to a model that deployment covers uses it too. A store registered with its own `api_key` or `litellm_credential_name` keeps those. Callers without a team OpenAI deployment keep the proxy's `OPENAI_API_KEY`. Unlike `/v1/files` and `/v1/batches`, the RAG routes never pick another OpenAI deployment the caller can reach.
+:::
+
 ### vector_store (Bedrock)
 
 | Parameter | Type | Default | Description |