diff --git a/SKILL.md b/SKILL.md
index 53093b3..ba51e92 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -124,8 +124,10 @@ bms lookup priorities      # List all priorities with IDs
 bms lookup queues          # List all queues with IDs
 bms lookup issue-types     # List all issue types
 bms lookup assignees       # List all assignees/technicians
-bms lookup ticket-types    # List ticket types
-bms lookup sources         # List ticket sources
+bms accounts               # List CRM accounts (Id, Name, Code)
+bms locations --account 123  # List CRM locations for account 123
+bms lookup ticket-types    # Not exposed in public BMS v2 Swagger for all tenants
+bms lookup sources         # Not exposed in public BMS v2 Swagger for all tenants
 ```
 
 ### Templates
@@ -155,13 +157,13 @@ Use `bms templates tickets list` to see available template IDs before creating.
 
 ## Notes / Quirks
 
-- **Auth**: BMS uses JWT Bearer tokens obtained via `POST /v2/security/authenticate` with `GrantType=password`. Tokens expire; the skill auto-refreshes using the refresh token endpoint.
+- **Auth**: BMS uses JWT Bearer tokens obtained via `POST /v2/security/authenticate` with `GrantType=password`. Tokens expire; the skill auto-refreshes using `POST /v2/security/refreshtoken`.
 - **Required fields for ticket creation**: Title, Details, AccountId, LocationId, StatusId, PriorityId, TypeId, SourceId, OpenDate — all are required by the API schema.
-- **IDs not names**: The API uses integer IDs for status, priority, type, etc. Use `bms lookup` commands to find the right IDs for your tenant.
+- **IDs not names**: The API uses integer IDs for status, priority, type, etc. Use `bms lookup`, `bms accounts`, and `bms locations` to find the right IDs for your tenant.
 - **Search vs GET list**: For filtered searches, `POST /v2/servicedesk/tickets/search` (with body) is more flexible than `GET /v2/servicedesk/tickets` (with query params); this skill uses the POST search by default.
 - **Pagination**: Default page size is 25. Use `--page-size` (max appears to be 100) and `--page` for large result sets.
 - **Date format**: Dates should be ISO 8601 strings, e.g. `2024-01-15T00:00:00`.
-- **Note TypeId**: Required when posting notes. Use `bms lookup note-types` to find valid IDs (typically: 1=Comment, 2=Resolution, etc. — varies by tenant).
+- **Note TypeId**: Required when posting notes. The public BMS v2 Swagger does not clearly expose a generic note-type lookup endpoint for all tenants, so you may need tenant-specific documentation or known values.
 - **Rate limits**: Not documented in the Swagger spec. Treat as standard REST API — avoid tight loops; add a small sleep between bulk operations.
 
 ## References
diff --git a/scripts/bms-accounts.sh b/scripts/bms-accounts.sh
old mode 100755
new mode 100644
index e80c6ec..60e395f
--- a/scripts/bms-accounts.sh
+++ b/scripts/bms-accounts.sh
@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Get token from bms-auth.sh
 if ! token=$(bash "${SCRIPT_DIR}/bms-auth.sh" get-token 2>/dev/null); then
diff --git a/scripts/bms-auth.sh b/scripts/bms-auth.sh
old mode 100755
new mode 100644
index 2c252a1..88f7cf6
--- a/scripts/bms-auth.sh
+++ b/scripts/bms-auth.sh
@@ -88,8 +88,8 @@ cmd_auth_refresh() {
 
   local response
   response=$(curl -sf -X POST "${BMS_API_BASE}/v2/security/refreshtoken" \
-    -H "Content-Type: application/json" \
-    -d "{\"AccessToken\":\"${access_token}\",\"RefreshToken\":\"${refresh_token}\"}") \
+    -F "AccessToken=${access_token}" \
+    -F "RefreshToken=${refresh_token}") \
     || { echo "Refresh failed, re-authenticating..." >&2; cmd_auth_login; return; }
 
   save_token "$response"
diff --git a/scripts/bms-locations.sh b/scripts/bms-locations.sh
old mode 100755
new mode 100644
index ff8e6d2..33ad840
--- a/scripts/bms-locations.sh
+++ b/scripts/bms-locations.sh
@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Get token from bms-auth.sh
 if ! token=$(bash "${SCRIPT_DIR}/bms-auth.sh" get-token 2>/dev/null); then
diff --git a/scripts/bms-lookup.sh b/scripts/bms-lookup.sh
old mode 100755
new mode 100644
index 52d4cce..9890fad
--- a/scripts/bms-lookup.sh
+++ b/scripts/bms-lookup.sh
@@ -53,12 +53,10 @@ cmd_lookup() {
       bms_curl "/v2/system/issuetypes/lookup" | format_lookup
       ;;
     sources|source)
-      echo "=== Ticket Sources ===" >&2
-      bms_curl "/v2/system/lookup/TicketSource" | format_lookup
+      die "Ticket source lookup endpoint is not exposed in the public BMS v2 Swagger. Use tenant-specific documentation or known SourceId values."
       ;;
     ticket-types|tickettypes)
-      echo "=== Ticket Types ===" >&2
-      bms_curl "/v2/system/lookup/TicketType" | format_lookup
+      die "Ticket type lookup endpoint is not exposed in the public BMS v2 Swagger. Use tenant-specific documentation or known TypeId values."
       ;;
     assignees|assignee|technicians)
       echo "=== Assignees / Technicians ===" >&2
@@ -73,8 +71,7 @@ cmd_lookup() {
       bms_curl "/v2/system/worktypes/lookup" | format_lookup
       ;;
     note-types|notetypes)
-      echo "=== Note Types (via tenantlookup) ===" >&2
-      bms_curl "/v2/system/tenantlookup/NoteType" | format_lookup
+      die "Note type lookup endpoint is not exposed in the public BMS v2 Swagger. Use tenant-specific documentation or known note TypeId values."
       ;;
     all)
       cmd_lookup statuses