Edit APIs and keycloak (#4757)

docs/reference/announcements/870.md

@@ -30,8 +30,8 @@ The 8.7 release includes API updates to support the move to a [Camunda 8 REST AP
 
 The deprecation process for the [Operate](/apis-tools/operate-api/overview.md) and [Tasklist](/apis-tools/tasklist-api-rest/tasklist-api-rest-overview.md) REST APIs starts with the 8.7 release. You can begin migrating to the [Camunda 8 REST API](/apis-tools/camunda-api-rest/camunda-api-rest-overview.md) for querying to prepare for this change.
 
-- Version 8.7, 8.8: These APIs are available, but not recommended for new implementations.
-- Version 8.9: These APIs will be deprecated and removed.
+- Version 8.7, 8.8: These APIs are still available but deprecated, and so not recommended for new implementations.
+- Version 8.9: These APIs will be removed.
 
 ### Deprecated: Job-based User Tasks querying
 
@@ -48,7 +48,7 @@ With the 8.7 release, Camunda announces the deprecation of several [Zeebe gRPC](
 - The final list of retained gRPC endpoints will be confirmed with the 8.7 release.
 - Selected endpoints will remain active, with others scheduled for removal in the 8.9 release.
 
-### Deprecated: Tasklist GraphQL API
+### Removed: Tasklist GraphQL API
 
 With the 8.7 release, the deprecated [Tasklist GraphQL API](/apis-tools/tasklist-api/tasklist-api-overview.md) will be removed from the product.
 
@@ -70,7 +70,7 @@ For SaaS customers, identity management in Camunda 8.7 remains consistent with C
 
 Built-in Keycloak integration in Self-Managed is removed, allowing customers to use any compatible IdP.
 
-- Keycloak remains fully supported as an external option.
+- Keycloak remains fully supported as an external option. For cluster-level identity management it must be connected as an external OIDC provider moving forward.
 - OpenID Connect (OIDC) remains the standard for seamless integration with chosen IdPs.
 
 ### Resource-based permissions