diff --git a/library/psa_crypto_mac.h b/library/psa_crypto_mac.h
index d923511..6a56296 100644
--- a/library/psa_crypto_mac.h
+++ b/library/psa_crypto_mac.h
@@ -23,15 +23,93 @@
 
 #include <psa/crypto.h>
 
+/** Internal API for starting an HMAC operation, using PSA hash primitives.
+ *
+ * \note This API is not meant for application use. Applications should always
+ *       use the top-level psa_mac_xxx APIs for doing HMAC operations.
+ *
+ * \param[in] hmac      Context structure for this HMAC operation. Needs to have
+ *                      been zero-initialized prior to calling this function.
+ * \param[in] key       Key to initialize the HMAC operation with.
+ * \param key_length    Length (in bytes) of key \p key.
+ * \param hash_alg      Hash algorithm to use for calculating the HMAC.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \return Any error code reported by psa_hash_compute(), psa_hash_setup() or
+ *         psa_hash_update().
+ */
 psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
                                       const uint8_t *key,
                                       size_t key_length,
                                       psa_algorithm_t hash_alg );
 
+/** Internal API for adding data to an HMAC operation, using PSA hash primitives.
+ *
+ * \note This API is not meant for application use. Applications should always
+ *       use the top-level psa_mac_xxx APIs for doing HMAC operations.
+ *
+ * \param[in] hmac      Context structure for this HMAC operation. Needs to have
+ *                      been initialized with psa_hmac_setup_internal().
+ * \param[in] data      Buffer containing the data to add to the current HMAC
+ *                      calculation.
+ * \param data_length   Length (in bytes) of the input buffer \p data.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \return Any error code reported by psa_hash_update().
+ */
+psa_status_t psa_hmac_update_internal( psa_hmac_internal_data *hmac,
+                                       const uint8_t *data,
+                                       size_t data_length );
+
+/** Internal API for finalizing an HMAC operation, using PSA hash primitives.
+ *
+ * \note This API is not meant for application use. Applications should always
+ *       use the top-level psa_mac_xxx APIs for doing HMAC operations.
+ *
+ * \param[in] hmac      Context structure for this HMAC operation. Needs to have
+ *                      been initialized with psa_hmac_setup_internal().
+ * \param[out] mac      Buffer to output the calculated HMAC into.
+ * \param mac_size      Size (in bytes) of the output buffer \p mac.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \return Any error code reported by psa_hash_setup(), psa_hash_update() or
+ *         psa_hash_finish().
+ */
 psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
                                        uint8_t *mac,
                                        size_t mac_size );
 
+/** Internal API for cloning an HMAC operation, using PSA hash primitives.
+ *
+ * \note This API is not meant for application use. Applications should always
+ *       use the top-level psa_mac_xxx APIs for doing HMAC operations.
+ *
+ * \param[in] source        Context structure to clone from. Needs to have been
+ *                          initialized with psa_hmac_setup_internal().
+ * \param[out] destination  Context structure to clone to. Needs to have been
+ *                          zero-initialized.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \return Any error code reported by psa_hash_clone().
+ */
+psa_status_t psa_hmac_clone_internal( const psa_hmac_internal_data *source,
+                                      psa_hmac_internal_data *destination );
+
+/** Internal API for aborting an HMAC operation, using PSA hash primitives.
+ *
+ * \note This API is not meant for application use. Applications should always
+ *       use the top-level psa_mac_xxx APIs for doing HMAC operations.
+ *
+ * \param[in] hmac      Context structure for the HMAC operation to abort.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \return Any error code reported by psa_hash_abort().
+ */
 psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac );
 
 /** Calculate the MAC (message authentication code) of a message using Mbed TLS.