diff --git a/oas_docs/output/kibana.serverless.yaml b/oas_docs/output/kibana.serverless.yaml
index 9b1c24c344f4b..c0deb062cd3fc 100644
--- a/oas_docs/output/kibana.serverless.yaml
+++ b/oas_docs/output/kibana.serverless.yaml
@@ -59772,26 +59772,12 @@ paths:
               - copySavedObjectsIntoSpace
               - shareSavedObjectsIntoSpace
             type: string
-        - description: When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.
+        - description: When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter.
           in: query
           name: include_authorized_purposes
-          required: true
+          required: false
           schema:
-            anyOf:
-              - items: {}
-                type: array
-              - type: boolean
-              - type: number
-              - type: object
-              - type: string
-            nullable: true
-            oneOf:
-              - enum:
-                  - false
-                type: boolean
-                x-oas-optional: true
-              - type: boolean
-                x-oas-optional: true
+            type: boolean
       responses:
         '200':
           description: Indicates a successful call.
diff --git a/oas_docs/output/kibana.yaml b/oas_docs/output/kibana.yaml
index 109b8f7d4c902..060586278ad7e 100644
--- a/oas_docs/output/kibana.yaml
+++ b/oas_docs/output/kibana.yaml
@@ -64140,26 +64140,12 @@ paths:
               - copySavedObjectsIntoSpace
               - shareSavedObjectsIntoSpace
             type: string
-        - description: When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.
+        - description: When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter.
           in: query
           name: include_authorized_purposes
-          required: true
+          required: false
           schema:
-            anyOf:
-              - items: {}
-                type: array
-              - type: boolean
-              - type: number
-              - type: object
-              - type: string
-            nullable: true
-            oneOf:
-              - enum:
-                  - false
-                type: boolean
-                x-oas-optional: true
-              - type: boolean
-                x-oas-optional: true
+            type: boolean
       responses:
         '200':
           description: Indicates a successful call.
diff --git a/packages/kbn-api-contracts/allowlist.json b/packages/kbn-api-contracts/allowlist.json
index 916f53a8c1aab..1d40337449314 100644
--- a/packages/kbn-api-contracts/allowlist.json
+++ b/packages/kbn-api-contracts/allowlist.json
@@ -63,6 +63,13 @@
       "method": "put",
       "reason": "Optional package policy stream data_stream.type in 200 responses for OTel inputs with dynamic_signal_types (composable integrations).",
       "approvedBy": "elastic/fleet"
+    },
+    {
+      "path": "/api/spaces/space",
+      "method": "get",
+      "reason": "Replace schema.conditional with schema.maybe(schema.boolean()) for include_authorized_purposes query param. Runtime behavior is identical — the custom validate function still rejects include_authorized_purposes=true when purpose is set. The OAS type widens from conditional literal(false)/boolean to always boolean. TF provider codegen simplifies from union type to plain *bool, but the endpoint is unused in provider code.",
+      "approvedBy": "@elastic/kibana-security",
+      "prUrl": "https://github.com/elastic/kibana/pull/260831"
     }
   ]
 }
diff --git a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts
index f5fc5349b7eb7..3bad5984cf5a4 100644
--- a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts
+++ b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts
@@ -125,7 +125,7 @@ describe('GET /spaces/space', () => {
             expect(response.payload).toEqual(spaces);
           } else {
             expect(() => queryParamsValidation.validate(request.query)).toThrowError(
-              '[include_authorized_purposes]: expected value to equal [false]'
+              'include_authorized_purposes can only be false when purpose is specified'
             );
           }
         });
diff --git a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts
index 7803698ef9032..47b8c18d9acd8 100644
--- a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts
+++ b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts
@@ -36,35 +36,44 @@ export function initGetAllSpacesApi(deps: ExternalRouteDeps) {
         version: API_VERSIONS.public.v1,
         validate: {
           request: {
-            query: schema.object({
-              purpose: schema.maybe(
-                schema.oneOf(
-                  [
-                    schema.literal('any'),
-                    schema.literal('copySavedObjectsIntoSpace'),
-                    schema.literal('shareSavedObjectsIntoSpace'),
-                  ],
-                  {
+            query: schema.object(
+              {
+                purpose: schema.maybe(
+                  schema.oneOf(
+                    [
+                      schema.literal('any'),
+                      schema.literal('copySavedObjectsIntoSpace'),
+                      schema.literal('shareSavedObjectsIntoSpace'),
+                    ],
+                    {
+                      meta: {
+                        description:
+                          'Specifies which authorization checks are applied to the API call. The default value is `any`.',
+                      },
+                    }
+                  )
+                ),
+                include_authorized_purposes: schema.maybe(
+                  schema.boolean({
                     meta: {
                       description:
-                        'Specifies which authorization checks are applied to the API call. The default value is `any`.',
+                        'When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter.',
                     },
+                  })
+                ),
+              },
+              {
+                validate: (value) => {
+                  if (
+                    value.purpose &&
+                    value.include_authorized_purposes !== undefined &&
+                    value.include_authorized_purposes !== false
+                  ) {
+                    return 'include_authorized_purposes can only be false when purpose is specified';
                   }
-                )
-              ),
-              include_authorized_purposes: schema.conditional(
-                schema.siblingRef('purpose'),
-                schema.string(),
-                schema.maybe(schema.literal(false)),
-                schema.maybe(schema.boolean()),
-                {
-                  meta: {
-                    description:
-                      'When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.',
-                  },
-                }
-              ),
-            }),
+                },
+              }
+            ),
           },
           response: {
             200: {