diff --git a/services/core/java/com/android/server/pm/verify/domain/DomainVerificationShell.java b/services/core/java/com/android/server/pm/verify/domain/DomainVerificationShell.java
index 7e755fa384dbb..b6554d7d807c3 100644
--- a/services/core/java/com/android/server/pm/verify/domain/DomainVerificationShell.java
+++ b/services/core/java/com/android/server/pm/verify/domain/DomainVerificationShell.java
@@ -53,7 +53,16 @@ public class DomainVerificationShell {
     public void printHelp(@NonNull PrintWriter pw) {
         pw.println("  get-app-links [--user <USER_ID>] [<PACKAGE>]");
         pw.println("    Prints the domain verification state for the given package, or for all");
-        pw.println("    packages if none is specified.");
+        pw.println("    packages if none is specified. State codes are defined as follows:");
+        pw.println("        - none: nothing has been recorded for this domain");
+        pw.println("        - verified: the domain has been successfully verified");
+        pw.println("        - approved: force approved, usually through shell");
+        pw.println("        - denied: force denied, usually through shell");
+        pw.println("        - migrated: preserved verification from a legacy response");
+        pw.println("        - restored: preserved verification from a user data restore");
+        pw.println("        - legacy_failure: rejected by a legacy verifier, unknown reason");
+        pw.println("        - system_configured: automatically approved by the device config");
+        pw.println("        - >= 1024: Custom error code which is specific to the device verifier");
         pw.println("      --user <USER_ID>: include user selections (includes all domains, not");
         pw.println("        just autoVerify ones)");
         pw.println("  reset-app-links [--user <USER_ID>] [<PACKAGE>]");