diff --git a/website/content/api-docs/secret/ssh.mdx b/website/content/api-docs/secret/ssh.mdx
index 5b60ef5cd293..ff1bf37655ba 100644
--- a/website/content/api-docs/secret/ssh.mdx
+++ b/website/content/api-docs/secret/ssh.mdx
@@ -752,8 +752,9 @@ parameters of the issued certificate can be further customized in this API call.
   set.
 
 - `valid_principals` `(string: "")` – Specifies valid principals, either
-  usernames or hostnames, that the certificate should be signed for.  Required
-  unless the role has specified allow_empty_principals.
+  usernames or hostnames, that the certificate should be signed for. Required
+  unless the role has specified allow_empty_principals or a value has been set for
+  either the default_user or default_user_template role parameters.
 
 - `cert_type` `(string: "user")` – Specifies the type of certificate to be
   created; either "user" or "host".
@@ -936,4 +937,4 @@ $ curl \
   "warnings": null,
   "auth": null
 }
-```
\ No newline at end of file
+```