diff --git a/docs/api-reference/v4/endpoints/explain-identifier-event.mdx b/docs/api-reference/v4/endpoints/explain-identifier-event.mdx
index 86fd7ed..05afab6 100644
--- a/docs/api-reference/v4/endpoints/explain-identifier-event.mdx
+++ b/docs/api-reference/v4/endpoints/explain-identifier-event.mdx
@@ -1,5 +1,5 @@
 ---
-openapi: get /firework/v4/events/identifiers/{identifier_id}/_explain
+openapi: firework-v4-openapi get /firework/v4/events/identifiers/{identifier_id}/_explain
 ---
 
-Provides evidence as to how an event matches to an identifier, clarifying why an event is or is not found within a feed.
+Provides evidence as to how an event matches to an identifier, clarifying why an event is or is not found within a feed.
\ No newline at end of file
diff --git a/docs/guides/threat-flow-report.mdx b/docs/guides/threat-flow-report.mdx
index bc0e7f5..ae831e2 100644
--- a/docs/guides/threat-flow-report.mdx
+++ b/docs/guides/threat-flow-report.mdx
@@ -13,6 +13,9 @@ import GatedAccessFeature from '/snippets/gated-access-feature.mdx';
     [threat_flow/intel/requests <Icon icon="code" size={16} />](/api-reference/v4/endpoints/create-intel-request)
     endpoint to queue the generation of a report for a given question.
 
+    Send the intelligence question in `question`. Include any time window in the
+    question, such as "in the last week" or "in the last 6 months".
+
     This endpoint returns a `request_id` that can be used to poll the request until it is completed.
   </Step>
 
@@ -49,7 +52,7 @@ api_client = FlareApiClient.from_env()
 intel_request_resp = api_client.post(
     "/firework/v4/threat_flow/intel/requests",
     json={
-        "question": "xss vulnerability in banks",
+        "question": "xss vulnerabilities targeting banks in the last 30 days",
         "tone": "analytical",
     },
 )