diff --git a/config/packages/security.yaml b/config/packages/security.yaml
index 26f233d5..ffe985a9 100644
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -33,7 +33,7 @@ security:
             provider: api_doc_provider
 
         public_endpoints:
-            pattern: ^/(api/v1/altcha/(challenge|config)$|api/v1/user/(send-code|verify-code|register|otp-login|reset-password)|oauth/token$|session/token|api/v1/categorys/|api/v1/doctors$|api/v1/clinics$|api/v1/clinic/doctor-list/|api/v1/clinic/[^/]+/addresses$|api/v1/clinic-pro/doctor-addresses/|api/v1/appointment-slots|api/v1/appointment-service-slots|api/v1/appointment-booking-services/|api/v1/appointment-settings/month-availability/|api/v1/comments/|api/v1/rate/[^/]+$|api/v1/specialties|api/v1/blogs$|api/v1/tags$|api/v1/clinic-invitation/|api/v1/pre-registration$|api/v1/doctor/[^/]+/claim-info$)
+            pattern: ^/(api/v1/altcha/(challenge|config)$|api/v1/user/(send-code|verify-code|register|otp-login|reset-password)|oauth/token$|session/token|api/v1/categorys/|api/v1/doctors$|api/v1/clinics$|api/v1/clinic/doctor-list/|api/v1/clinic/[^/]+/addresses$|api/v1/clinic-pro/doctor-addresses/|api/v1/appointment-slots|api/v1/appointment-service-slots|api/v1/appointment-booking-services/|api/v1/appointment-booking-locations/|api/v1/appointment-settings/month-availability/|api/v1/comments/|api/v1/rate/[^/]+$|api/v1/specialties|api/v1/blogs$|api/v1/tags$|api/v1/clinic-invitation/|api/v1/pre-registration$|api/v1/doctor/[^/]+/claim-info$)
             stateless: true
             security: false
 
@@ -62,6 +62,7 @@ security:
         - { path: ^/api/v1/appointment-slots,              roles: PUBLIC_ACCESS }
         - { path: ^/api/v1/appointment-service-slots,      roles: PUBLIC_ACCESS }
         - { path: ^/api/v1/appointment-booking-services/,  roles: PUBLIC_ACCESS }
+        - { path: ^/api/v1/appointment-booking-locations/, roles: PUBLIC_ACCESS }
         - { path: ^/api/v1/appointment-settings/month-availability/, roles: PUBLIC_ACCESS }
         - { path: ^/api/v1/comments/,                      roles: PUBLIC_ACCESS }
         - { path: ^/api/v1/site-context$,                  methods: [GET], roles: PUBLIC_ACCESS }
diff --git a/docs/api/appointment.md b/docs/api/appointment.md
index 7565d4fc..c4a4d78e 100644
--- a/docs/api/appointment.md
+++ b/docs/api/appointment.md
@@ -717,7 +717,8 @@ On `POST /api/v1/appointment`, any `service_item_uuids` must belong to the same
 
 ### GET `/api/v1/appointment-booking-locations/{doctorUuid}`
 
-**Permission:** public.
+**Permission:** public — whitelisted in `config/packages/security.yaml` (both the
+`public_endpoints` firewall pattern and an `access_control` entry).
 
 Lists every place the doctor can be booked at. The site should show **all** of them, grouped by
 location — picking one and hiding the rest removes real capacity from the doctor.