diff --git a/nextcloud_mcp_server/api/vector_sync.py b/nextcloud_mcp_server/api/vector_sync.py
index 3944de33..4d49ed77 100644
--- a/nextcloud_mcp_server/api/vector_sync.py
+++ b/nextcloud_mcp_server/api/vector_sync.py
@@ -80,6 +80,9 @@ async def purge_doc_types_route(request: Request) -> JSONResponse:
     if not isinstance(raw, list) or not all(isinstance(d, str) for d in raw):
         return _bad_request("doc_types must be a list of strings")
     doc_types = [d for d in raw if d]
+    # No whitelist against INDEXED_DOC_TYPES on purpose: an unknown type yields a
+    # zero-match Qdrant filter (harmless no-op), and the canonical set lives with
+    # the indexer — the route shouldn't need a server update to purge a new type.
     # Bound the batch: there are only a handful of real indexed types, so a huge
     # list is abuse — cap it rather than fan out unbounded count+delete calls.
     if len(doc_types) > _MAX_PURGE_DOC_TYPES:
diff --git a/nextcloud_mcp_server/app.py b/nextcloud_mcp_server/app.py
index 3d419a28..39c383b8 100644
--- a/nextcloud_mcp_server/app.py
+++ b/nextcloud_mcp_server/app.py
@@ -2435,6 +2435,7 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                     methods=["POST"],
                 )
             )
+            logger.info("Vector-sync admin endpoint enabled: /api/v1/vector-sync/purge")
         # Access and scope management endpoints (ADR-022)
         routes.append(
             Route(
@@ -2457,7 +2458,7 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
             "/api/v1/users/{user_id}/app-password, /api/v1/users/{user_id}/access, "
             "/api/v1/users/{user_id}/scopes, /api/v1/scopes, "
             "/api/v1/vector-viz/search, /api/v1/search, /api/v1/apps, "
-            "/api/v1/webhooks, /api/v1/vector-sync/purge, /api/v1/pdf-preview"
+            "/api/v1/webhooks, /api/v1/pdf-preview"
         )
 
     # Note: Metrics endpoint is NOT exposed on main HTTP port for security reasons.