diff --git a/__tests__/lars-flow-checklist.md b/__tests__/lars-flow-checklist.md
index 9b83e78..7960762 100644
--- a/__tests__/lars-flow-checklist.md
+++ b/__tests__/lars-flow-checklist.md
@@ -67,9 +67,22 @@ Navigeer naar [http://localhost:3000](http://localhost:3000).
 
 ---
 
-## Stap 6: API-endpoints testen via curl
+## Stap 6: API-endpoints testen
 
-Vervang `<token>`, `<product-id>` en `<story-id>` met echte waarden.
+### Geautomatiseerd (aanbevolen)
+
+Vul `TOKEN`, `PRODUCT_ID`, `SPRINT_ID`, `STORY_ID` en `TASK_ID` in `scripts/test-api.sh` in en voer uit:
+
+```bash
+bash scripts/test-api.sh
+```
+
+Zie `scripts/README.md` voor een stap-voor-stap beschrijving van hoe je de IDs vindt.
+Verwacht: alle 30 curl-testcases slagen (`Results: 30 passed, 0 failed`).
+
+### Handmatig (referentie)
+
+Vervang `<token>`, `<product-id>`, `<sprint-id>`, `<story-id>` en `<task-id>` met echte waarden.
 
 ```bash
 # 1. Producten ophalen
@@ -80,28 +93,54 @@ curl -H "Authorization: Bearer <token>" \
 # 2. Volgende story ophalen
 curl -H "Authorization: Bearer <token>" \
   http://localhost:3000/api/products/<product-id>/next-story
-# Verwacht: story-object met taken
+# Verwacht: story-object met taken, of 404 als er geen actieve sprint is
 
-# 3. Implementatieplan loggen
+# 3. Eerste 10 taken van sprint ophalen
+curl -H "Authorization: Bearer <token>" \
+  "http://localhost:3000/api/sprints/<sprint-id>/tasks?limit=10"
+# Verwacht: JSON-array met taken
+
+# 4. Taakvolgorde aanpassen
+curl -X PATCH -H "Authorization: Bearer <token>" \
+  -H "Content-Type: application/json" \
+  -d '{"task_ids":["<task-id>"]}' \
+  http://localhost:3000/api/stories/<story-id>/tasks/reorder
+# Verwacht: {"success":true}
+
+# 5. Taakstatus bijwerken
+curl -X PATCH -H "Authorization: Bearer <token>" \
+  -H "Content-Type: application/json" \
+  -d '{"status":"IN_PROGRESS"}' \
+  http://localhost:3000/api/tasks/<task-id>
+# Verwacht: {"id":"...","status":"IN_PROGRESS","implementation_plan":null}
+
+# 6. Implementatieplan loggen
 curl -X POST -H "Authorization: Bearer <token>" \
   -H "Content-Type: application/json" \
   -d '{"type":"IMPLEMENTATION_PLAN","content":"Aanpak: component-first, dan server action"}' \
   http://localhost:3000/api/stories/<story-id>/log
-# Verwacht: {"id":"...","type":"IMPLEMENTATION_PLAN"}
+# Verwacht: {"id":"...","created_at":"..."}
 
-# 4. Testresultaat loggen
+# 7. Testresultaat loggen
 curl -X POST -H "Authorization: Bearer <token>" \
   -H "Content-Type: application/json" \
   -d '{"type":"TEST_RESULT","content":"Alle unit tests geslaagd","status":"PASSED"}' \
   http://localhost:3000/api/stories/<story-id>/log
-# Verwacht: {"id":"...","type":"TEST_RESULT"}
+# Verwacht: {"id":"...","created_at":"..."}
 
-# 5. Commit loggen
+# 8. Commit loggen
 curl -X POST -H "Authorization: Bearer <token>" \
   -H "Content-Type: application/json" \
   -d '{"type":"COMMIT","content":"feat: story afgerond","commit_hash":"abc1234","commit_message":"feat: ST-XXX story afgerond"}' \
   http://localhost:3000/api/stories/<story-id>/log
-# Verwacht: {"id":"...","type":"COMMIT"}
+# Verwacht: {"id":"...","created_at":"..."}
+
+# 9. Demo-gebruiker geblokkeerd op schrijfoperaties
+curl -X POST -H "Authorization: Bearer <demo-token>" \
+  -H "Content-Type: application/json" \
+  -d '{"type":"IMPLEMENTATION_PLAN","content":"test"}' \
+  http://localhost:3000/api/stories/<story-id>/log
+# Verwacht: HTTP 403 {"error":"Niet beschikbaar in demo-modus"}
 ```
 
 ---