Move to legacy

Add missing endpoints to api
Update tags
2026-07-11 16:29:52 +00:00 · 2026-07-10 17:46:03 -04:00 · 2026-07-10 17:13:47 -04:00 · 2026-07-10 17:09:56 -04:00 · 2026-07-10 16:54:00 -04:00 · 2026-07-10 16:46:16 -04:00
93 changed files with 2020 additions and 140 deletions
--- a/messages/bg-BG.json
+++ b/messages/bg-BG.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Създаване на Организационна Потребител",
    "actionUpdateOrg": "Актуализиране на организацията",
    "actionRemoveInvitation": "Премахване на поканата.",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Актуализиране на потребител",
    "actionGetUser": "Получаване на потребител",
    "actionGetOrgUser": "Вземете потребител на организация",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Въведете кода от приложението за удостоверяване или един от вашите резервни кодове за еднократна употреба.",
    "otpAuthSubmit": "Изпрати код",
    "idpContinue": "Или продължете със",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Назад към парола",
    "navbar": "Навигационно меню",
    "navbarDescription": "Главно навигационно меню за приложението",
--- a/messages/cs-CZ.json
+++ b/messages/cs-CZ.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Vytvořit Org uživatele",
    "actionUpdateOrg": "Aktualizovat organizaci",
    "actionRemoveInvitation": "Odstranit pozvání",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Aktualizovat uživatele",
    "actionGetUser": "Získat uživatele",
    "actionGetOrgUser": "Získat uživatele organizace",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Zadejte kód z vaší autentizační aplikace nebo jeden z vlastních záložních kódů.",
    "otpAuthSubmit": "Odeslat kód",
    "idpContinue": "Nebo pokračovat s",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Zpět na heslo",
    "navbar": "Navigation Menu",
    "navbarDescription": "Hlavní navigační menu aplikace",
--- a/messages/da-DK.json
+++ b/messages/da-DK.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Opret organisationsbruger",
    "actionUpdateOrg": "Opdater organisation",
    "actionRemoveInvitation": "Fjern invitation",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Opdater bruger",
    "actionGetUser": "Hent bruger",
    "actionGetOrgUser": "Hent organisationsbruger",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Indtast koden fra autentiseringsappen din eller en af dine engangs reservekoder.",
    "otpAuthSubmit": "Send kode",
    "idpContinue": "Eller fortsæt med",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Tilbage til adgangskode",
    "navbar": "Navigationsmenu",
    "navbarDescription": "Hovednavigasjonsmeny for applikationen",
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Org Benutzer erstellen",
    "actionUpdateOrg": "Organisation aktualisieren",
    "actionRemoveInvitation": "Einladung entfernen",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Benutzer aktualisieren",
    "actionGetUser": "Benutzer abrufen",
    "actionGetOrgUser": "Organisationsbenutzer abrufen",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Geben Sie den Code aus Ihrer Authenticator-App oder einen Ihrer einmaligen Backup-Codes ein.",
    "otpAuthSubmit": "Code absenden",
    "idpContinue": "Oder weiter mit",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Zurück zum Passwort",
    "navbar": "Navigationsmenü",
    "navbarDescription": "Hauptnavigationsmenü für die Anwendung",
--- a/messages/es-ES.json
+++ b/messages/es-ES.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Crear usuario Org",
    "actionUpdateOrg": "Actualizar organización",
    "actionRemoveInvitation": "Eliminar invitación",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Actualizar usuario",
    "actionGetUser": "Obtener usuario",
    "actionGetOrgUser": "Obtener usuario de la organización",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Introduzca el código de su aplicación de autenticación o uno de sus códigos de copia de seguridad de un solo uso.",
    "otpAuthSubmit": "Enviar código",
    "idpContinue": "O continuar con",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Volver a la contraseña",
    "navbar": "Menú de navegación",
    "navbarDescription": "Menú de navegación principal para la aplicación",
--- a/messages/fr-FR.json
+++ b/messages/fr-FR.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Créer un utilisateur Org",
    "actionUpdateOrg": "Mettre à jour l'organisation",
    "actionRemoveInvitation": "Supprimer l'invitation",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Mettre à jour l'utilisateur",
    "actionGetUser": "Obtenir l'utilisateur",
    "actionGetOrgUser": "Obtenir l'utilisateur de l'organisation",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Entrez le code de votre application d'authentification ou l'un de vos codes de secours à usage unique.",
    "otpAuthSubmit": "Soumettre le code",
    "idpContinue": "Ou continuer avec",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Retour au mot de passe",
    "navbar": "Menu de navigation",
    "navbarDescription": "Menu de navigation principal de l'application",
--- a/messages/it-IT.json
+++ b/messages/it-IT.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Crea Utente Org",
    "actionUpdateOrg": "Aggiorna Organizzazione",
    "actionRemoveInvitation": "Rimuovi Invito",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Aggiorna Utente",
    "actionGetUser": "Ottieni Utente",
    "actionGetOrgUser": "Ottieni Utente Organizzazione",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Inserisci il codice dalla tua app di autenticazione o uno dei tuoi codici di backup monouso.",
    "otpAuthSubmit": "Invia Codice",
    "idpContinue": "O continua con",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Torna alla Password",
    "navbar": "Menu di Navigazione",
    "navbarDescription": "Menu di navigazione principale dell'applicazione",
--- a/messages/ko-KR.json
+++ b/messages/ko-KR.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "조직 사용자 생성",
    "actionUpdateOrg": "조직 업데이트",
    "actionRemoveInvitation": "초대 제거",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "사용자 업데이트",
    "actionGetUser": "사용자 조회",
    "actionGetOrgUser": "조직 사용자 가져오기",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "인증 앱에서 코드를 입력하거나 단일 사용 백업 코드 중 하나를 입력하세요.",
    "otpAuthSubmit": "코드 제출",
    "idpContinue": "또는 계속 진행하십시오.",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "비밀번호로 돌아가기",
    "navbar": "탐색 메뉴",
    "navbarDescription": "애플리케이션의 주요 탐색 메뉴",
--- a/messages/nb-NO.json
+++ b/messages/nb-NO.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Opprett Org bruker",
    "actionUpdateOrg": "Oppdater organisasjon",
    "actionRemoveInvitation": "Fjern invitasjon",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Oppdater bruker",
    "actionGetUser": "Hent bruker",
    "actionGetOrgUser": "Hent organisasjonsbruker",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Skriv inn koden fra autentiseringsappen din eller en av dine engangs reservekoder.",
    "otpAuthSubmit": "Send inn kode",
    "idpContinue": "Eller fortsett med",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Tilbake til passord",
    "navbar": "Navigasjonsmeny",
    "navbarDescription": "Hovednavigasjonsmeny for applikasjonen",
--- a/messages/nl-NL.json
+++ b/messages/nl-NL.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Org gebruiker aanmaken",
    "actionUpdateOrg": "Organisatie bijwerken",
    "actionRemoveInvitation": "Verwijder uitnodiging",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Gebruiker bijwerken",
    "actionGetUser": "Gebruiker ophalen",
    "actionGetOrgUser": "Krijg organisatie-gebruiker",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Voer de code van je authenticator-app of een van je reservekopiecodes voor het eenmalig gebruik in.",
    "otpAuthSubmit": "Code indienen",
    "idpContinue": "Of ga verder met",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Terug naar wachtwoord",
    "navbar": "Navigatiemenu",
    "navbarDescription": "Hoofd navigatie menu voor de applicatie",
--- a/messages/pl-PL.json
+++ b/messages/pl-PL.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Utwórz użytkownika Org",
    "actionUpdateOrg": "Aktualizuj organizację",
    "actionRemoveInvitation": "Usuń zaproszenie",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Zaktualizuj użytkownika",
    "actionGetUser": "Pobierz użytkownika",
    "actionGetOrgUser": "Pobierz użytkownika organizacji",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Wprowadź kod z aplikacji uwierzytelniającej lub jeden z jednorazowych kodów zapasowych.",
    "otpAuthSubmit": "Wyślij kod",
    "idpContinue": "Lub kontynuuj z",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Powrót do hasła",
    "navbar": "Menu nawigacyjne",
    "navbarDescription": "Główne menu nawigacyjne aplikacji",
--- a/messages/pt-PT.json
+++ b/messages/pt-PT.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Criar utilizador Org",
    "actionUpdateOrg": "Atualizar Organização",
    "actionRemoveInvitation": "Remover Convite",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Atualizar Usuário",
    "actionGetUser": "Obter Usuário",
    "actionGetOrgUser": "Obter Utilizador da Organização",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Insira o código da sua aplicação de autenticação ou um dos seus códigos de backup de uso único.",
    "otpAuthSubmit": "Submeter Código",
    "idpContinue": "Ou continuar com",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Voltar à Palavra-passe",
    "navbar": "Menu de Navegação",
    "navbarDescription": "Menu de navegação principal da aplicação",
--- a/messages/ru-RU.json
+++ b/messages/ru-RU.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Создать пользователя Org",
    "actionUpdateOrg": "Обновить организацию",
    "actionRemoveInvitation": "Удалить приглашение",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Обновить пользователя",
    "actionGetUser": "Получить пользователя",
    "actionGetOrgUser": "Получить пользователя организации",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Введите код из вашего приложения-аутентификатора или один из ваших одноразовых резервных кодов.",
    "otpAuthSubmit": "Отправить код",
    "idpContinue": "Или продолжить с",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Назад к паролю",
    "navbar": "Навигационное меню",
    "navbarDescription": "Главное навигационное меню приложения",
--- a/messages/tr-TR.json
+++ b/messages/tr-TR.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "Organizasyon Kullanıcısı Oluştur",
    "actionUpdateOrg": "Kuruluşu Güncelle",
    "actionRemoveInvitation": "Daveti Kaldır",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Kullanıcıyı Güncelle",
    "actionGetUser": "Kullanıcıyı Getir",
    "actionGetOrgUser": "Kuruluş Kullanıcısını Al",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "Authenticator uygulamanızdan veya tek kullanımlık yedek kodlarınızdan birini girin.",
    "otpAuthSubmit": "Kodu Gönder",
    "idpContinue": "Veya devam et:",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "Şifreye Geri Dön",
    "navbar": "Navigasyon Menüsü",
    "navbarDescription": "Uygulamanın ana navigasyon menüsü",
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -1397,7 +1397,6 @@
    "createOrgUser": "创建组织用户",
    "actionUpdateOrg": "更新组织",
    "actionRemoveInvitation": "移除邀请",
-    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "更新用户",
    "actionGetUser": "获取用户",
    "actionGetOrgUser": "获取组织用户",
@@ -1517,7 +1516,6 @@
    "otpAuthDescription": "从您的身份验证程序中输入代码或您的单次备份代码。",
    "otpAuthSubmit": "提交代码",
    "idpContinue": "或者继续",
-    "idpLastUsed": "Last Used",
    "otpAuthBack": "回到密码",
    "navbar": "导航菜单",
    "navbarDescription": "应用程序的主导航菜单",
--- a/server/integrationApiServer.ts
+++ b/server/integrationApiServer.ts
@@ -12,7 +12,7 @@ import { logIncomingMiddleware } from "./middlewares/logIncoming";
 import helmet from "helmet";
 import swaggerUi from "swagger-ui-express";
 import { OpenApiGeneratorV3 } from "@asteasolutions/zod-to-openapi";
-import { registry } from "./openApi";
+import { registry, openApiTags } from "./openApi";
 import fs from "fs";
 import path from "path";
 import { APP_PATH } from "./lib/consts";
@@ -181,7 +181,8 @@ function getOpenApiDocumentation() {
            version: "v1",
            title: "Pangolin Integration API"
        },
-        servers: [{ url: "/v1" }]
+        servers: [{ url: "/v1" }],
+        tags: openApiTags
    });

    if (!process.env.DISABLE_GEN_OPENAPI) {
--- a/server/openApi.ts
+++ b/server/openApi.ts
@@ -4,22 +4,33 @@ export const registry = new OpenAPIRegistry();

 export enum OpenAPITags {
    Site = "Site",
-    Org = "Organization",
    PublicResource = "Public Resource",
+    Target = "Resource Target",
    PrivateResource = "Private Resource",
-    Policy = "Policy",
+    Client = "Client",
+    Org = "Organization",
+    Domain = "Domain",
+    PublicResourcePolicy = "Public Resource Policy",
    Role = "Role",
    User = "User",
-    Invitation = "User Invitation",
-    Target = "Resource Target",
    Rule = "Rule",
+    Invitation = "User Invitation",
    AccessToken = "Access Token",
    GlobalIdp = "Identity Provider (Global)",
    OrgIdp = "Identity Provider (Organization Only)",
-    Client = "Client",
    ApiKey = "API Key",
-    Domain = "Domain",
    Blueprint = "Blueprint",
    Ssh = "SSH",
-    Logs = "Logs"
+    Logs = "Logs",
+    EventStreamingDestination = "Event Streaming Destination",
+    AlertRule = "Alert Rule",
+    HealthCheck = "Health Check",
+    PublicResourcePolicyLegacy = "Public Resource Policy (Legacy)",
+    PublicResourceLegacy = "Public Resource (Legacy)",
+    PrivateResourceLegacy = "Private Resource (Legacy)"
 }
+
+// Order here controls the order tags are displayed in Swagger UI
+export const openApiTags = Object.values(OpenAPITags).map((name) => ({
+    name
+}));
--- a/server/private/routers/alertRule/createAlertRule.ts
+++ b/server/private/routers/alertRule/createAlertRule.ts
@@ -191,7 +191,7 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/alert-rule",
    description: "Create an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        params: paramsSchema,
        body: {
--- a/server/private/routers/alertRule/deleteAlertRule.ts
+++ b/server/private/routers/alertRule/deleteAlertRule.ts
@@ -34,7 +34,7 @@ registry.registerPath({
    method: "delete",
    path: "/org/{orgId}/alert-rule/{alertRuleId}",
    description: "Delete an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        params: paramsSchema
    },
--- a/server/private/routers/alertRule/getAlertRule.ts
+++ b/server/private/routers/alertRule/getAlertRule.ts
@@ -48,7 +48,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/alert-rule/{alertRuleId}",
    description: "Get a specific alert rule for an organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        params: paramsSchema
    },
--- a/server/private/routers/alertRule/listAlertRules.ts
+++ b/server/private/routers/alertRule/listAlertRules.ts
@@ -90,7 +90,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/alert-rules",
    description: "List all alert rules for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        query: querySchema,
        params: paramsSchema
--- a/server/private/routers/alertRule/updateAlertRule.ts
+++ b/server/private/routers/alertRule/updateAlertRule.ts
@@ -158,7 +158,7 @@ registry.registerPath({
    method: "post",
    path: "/org/{orgId}/alert-rule/{alertRuleId}",
    description: "Update an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        params: paramsSchema,
        body: {
--- a/server/private/routers/eventStreamingDestination/createEventStreamingDestination.ts
+++ b/server/private/routers/eventStreamingDestination/createEventStreamingDestination.ts
@@ -52,7 +52,7 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/event-streaming-destination",
    description: "Create an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
    request: {
        params: paramsSchema,
        body: {
--- a/server/private/routers/eventStreamingDestination/deleteEventStreamingDestination.ts
+++ b/server/private/routers/eventStreamingDestination/deleteEventStreamingDestination.ts
@@ -35,7 +35,7 @@ registry.registerPath({
    path: "/org/{orgId}/event-streaming-destination/{destinationId}",
    description:
        "Delete an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
    request: {
        params: paramsSchema
    },
--- a/server/private/routers/eventStreamingDestination/listEventStreamingDestinations.ts
+++ b/server/private/routers/eventStreamingDestination/listEventStreamingDestinations.ts
@@ -109,7 +109,7 @@ registry.registerPath({
    path: "/org/{orgId}/event-streaming-destination",
    description:
        "List all event streaming destinations for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
    request: {
        query: querySchema,
        params: paramsSchema
--- a/server/private/routers/eventStreamingDestination/updateEventStreamingDestination.ts
+++ b/server/private/routers/eventStreamingDestination/updateEventStreamingDestination.ts
@@ -55,7 +55,7 @@ registry.registerPath({
    method: "post",
    path: "/org/{orgId}/event-streaming-destination/{destinationId}",
    description: "Update an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
    request: {
        params: paramsSchema,
        body: {
--- a/server/private/routers/healthChecks/createHealthCheck.ts
+++ b/server/private/routers/healthChecks/createHealthCheck.ts
@@ -75,7 +75,7 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/health-check",
    description: "Create a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
    request: {
        params: paramsSchema,
        body: {
--- a/server/private/routers/healthChecks/deleteHealthCheck.ts
+++ b/server/private/routers/healthChecks/deleteHealthCheck.ts
@@ -37,7 +37,7 @@ registry.registerPath({
    method: "delete",
    path: "/org/{orgId}/health-check/{healthCheckId}",
    description: "Delete a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
    request: {
        params: paramsSchema
    },
--- a/server/private/routers/healthChecks/listHealthChecks.ts
+++ b/server/private/routers/healthChecks/listHealthChecks.ts
@@ -63,7 +63,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/health-checks",
    description: "List health checks for an organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
    request: {
        params: paramsSchema,
        query: querySchema
--- a/server/private/routers/healthChecks/updateHealthCheck.ts
+++ b/server/private/routers/healthChecks/updateHealthCheck.ts
@@ -109,7 +109,7 @@ registry.registerPath({
    method: "post",
    path: "/org/{orgId}/health-check/{healthCheckId}",
    description: "Update a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
    request: {
        params: paramsSchema,
        body: {
--- a/server/private/routers/integration.ts
+++ b/server/private/routers/integration.ts
@@ -16,6 +16,10 @@ import * as org from "#private/routers/org";
 import * as logs from "#private/routers/auditLogs";
 import * as alertEvents from "#private/routers/alertEvents";
 import * as certificates from "#private/routers/certificates";
+import * as policy from "#private/routers/policy";
+import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
+import * as alertRule from "#private/routers/alertRule";
+import * as healthChecks from "#private/routers/healthChecks";

 import {
    verifyApiKeyHasAction,
@@ -24,6 +28,7 @@ import {
    verifyApiKeyIdpAccess,
    verifyApiKeyRoleAccess,
    verifyApiKeyUserAccess,
+    verifyApiKeyResourcePolicyAccess,
    verifyLimits
 } from "@server/middlewares";
 import * as user from "#private/routers/user";
@@ -215,3 +220,147 @@ authenticated.delete(
    logActionAudit(ActionsEnum.removeUserRole),
    user.removeUserRole
 );
+
+authenticated.get(
+    ["/org/:orgId/resource-policies", "/org/:orgId/public-resource-policies"],
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.listResourcePolicies),
+    logActionAudit(ActionsEnum.listResourcePolicies),
+    policy.listResourcePolicies
+);
+
+authenticated.post(
+    ["/org/:orgId/resource-policy", "/org/:orgId/public-resource-policy"],
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourcePolicy),
+    logActionAudit(ActionsEnum.createResourcePolicy),
+    policy.createResourcePolicy
+);
+
+authenticated.delete(
+    ["/resource-policy/:resourcePolicyId", "/public-resource-policy/:resourcePolicyId"],
+    verifyApiKeyResourcePolicyAccess,
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.deleteResourcePolicy),
+    logActionAudit(ActionsEnum.deleteResourcePolicy),
+    policy.deleteResourcePolicy
+);
+
+authenticated.put(
+    "/org/:orgId/event-streaming-destination",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createEventStreamingDestination),
+    logActionAudit(ActionsEnum.createEventStreamingDestination),
+    eventStreamingDestination.createEventStreamingDestination
+);
+
+authenticated.post(
+    "/org/:orgId/event-streaming-destination/:destinationId",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.updateEventStreamingDestination),
+    logActionAudit(ActionsEnum.updateEventStreamingDestination),
+    eventStreamingDestination.updateEventStreamingDestination
+);
+
+authenticated.delete(
+    "/org/:orgId/event-streaming-destination/:destinationId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteEventStreamingDestination),
+    logActionAudit(ActionsEnum.deleteEventStreamingDestination),
+    eventStreamingDestination.deleteEventStreamingDestination
+);
+
+authenticated.get(
+    "/org/:orgId/event-streaming-destinations",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listEventStreamingDestinations),
+    eventStreamingDestination.listEventStreamingDestinations
+);
+
+authenticated.put(
+    "/org/:orgId/alert-rule",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createAlertRule),
+    logActionAudit(ActionsEnum.createAlertRule),
+    alertRule.createAlertRule
+);
+
+authenticated.post(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateAlertRule),
+    logActionAudit(ActionsEnum.updateAlertRule),
+    alertRule.updateAlertRule
+);
+
+authenticated.delete(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteAlertRule),
+    logActionAudit(ActionsEnum.deleteAlertRule),
+    alertRule.deleteAlertRule
+);
+
+authenticated.get(
+    "/org/:orgId/alert-rules",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listAlertRules),
+    alertRule.listAlertRules
+);
+
+authenticated.get(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getAlertRule),
+    alertRule.getAlertRule
+);
+
+authenticated.get(
+    "/org/:orgId/health-checks",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listHealthChecks),
+    healthChecks.listHealthChecks
+);
+
+authenticated.put(
+    "/org/:orgId/health-check",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createHealthCheck),
+    logActionAudit(ActionsEnum.createHealthCheck),
+    healthChecks.createHealthCheck
+);
+
+authenticated.post(
+    "/org/:orgId/health-check/:healthCheckId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateHealthCheck),
+    logActionAudit(ActionsEnum.updateHealthCheck),
+    healthChecks.updateHealthCheck
+);
+
+authenticated.delete(
+    "/org/:orgId/health-check/:healthCheckId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteHealthCheck),
+    logActionAudit(ActionsEnum.deleteHealthCheck),
+    healthChecks.deleteHealthCheck
+);
+
+authenticated.get(
+    "/org/:orgId/health-check/:healthCheckId/status-history",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getTarget),
+    healthChecks.getHealthCheckStatusHistory
+);
--- a/server/private/routers/policy/createResourcePolicy.ts
+++ b/server/private/routers/policy/createResourcePolicy.ts
@@ -121,7 +121,7 @@ registry.registerPath({
    method: "post",
    path: "/org/{orgId}/resource-policy",
    description: "Create a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: createResourcePolicyParamsSchema,
        body: {
--- a/server/private/routers/policy/deleteResourcePolicy.ts
+++ b/server/private/routers/policy/deleteResourcePolicy.ts
@@ -31,7 +31,7 @@ registry.registerPath({
    method: "delete",
    path: "/resource-policy/{resourcePolicyId}",
    description: "Delete a resource policy.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: deleteResourcePolicySchema
    },
--- a/server/private/routers/policy/listResourcePolicies.ts
+++ b/server/private/routers/policy/listResourcePolicies.ts
@@ -79,7 +79,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/resource-policies",
    description: "List resource policies for an organization.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: z.object({
            orgId: z.string()
--- a/server/routers/accessToken/generateAccessToken.ts
+++ b/server/routers/accessToken/generateAccessToken.ts
@@ -44,6 +44,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/access-token",
    description: "Generate a new access token for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: generateAccssTokenParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: generateAccessTokenBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/access-token",
+    description: "Generate a new access token for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.AccessToken],
    request: {
        params: generateAccssTokenParamsSchema,
--- a/server/routers/accessToken/listAccessTokens.ts
+++ b/server/routers/accessToken/listAccessTokens.ts
@@ -151,6 +151,35 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/access-tokens",
    description: "List all access tokens for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: z.object({
+            resourceId: z.number()
+        }),
+        query: listAccessTokensSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/access-tokens",
+    description: "List all access tokens for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.AccessToken],
    request: {
        params: z.object({
--- a/server/routers/integration.ts
+++ b/server/routers/integration.ts
@@ -162,7 +162,7 @@ authenticated.get(

 // Site Resource endpoints
 authenticated.put(
-    "/org/:orgId/site-resource",
+    ["/org/:orgId/site-resource", "/org/:orgId/private-resource"],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createSiteResource),
@@ -171,7 +171,10 @@ authenticated.put(
 );

 authenticated.get(
-    "/org/:orgId/site/:siteId/resources",
+    [
+        "/org/:orgId/site/:siteId/resources",
+        "/org/:orgId/site/:siteId/private-resources"
+    ],
    verifyApiKeyOrgAccess,
    verifyApiKeySiteAccess,
    verifyApiKeyHasAction(ActionsEnum.listSiteResources),
@@ -179,21 +182,21 @@ authenticated.get(
 );

 authenticated.get(
-    "/org/:orgId/site-resources",
+    ["/org/:orgId/site-resources", "/org/:orgId/private-resources"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listSiteResources),
    siteResource.listAllSiteResourcesByOrg
 );

 authenticated.get(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getSiteResource),
    siteResource.getSiteResource
 );

 authenticated.post(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateSiteResource),
@@ -202,7 +205,7 @@ authenticated.post(
 );

 authenticated.delete(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteSiteResource),
    logActionAudit(ActionsEnum.deleteSiteResource),
@@ -210,28 +213,40 @@ authenticated.delete(
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/roles",
+    [
+        "/site-resource/:siteResourceId/roles",
+        "/private-resource/:siteResourceId/roles"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
    siteResource.listSiteResourceRoles
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/users",
+    [
+        "/site-resource/:siteResourceId/users",
+        "/private-resource/:siteResourceId/users"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    siteResource.listSiteResourceUsers
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/clients",
+    [
+        "/site-resource/:siteResourceId/clients",
+        "/private-resource/:siteResourceId/clients"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    siteResource.listSiteResourceClients
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles",
+    [
+        "/site-resource/:siteResourceId/roles",
+        "/private-resource/:siteResourceId/roles"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -241,7 +256,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users",
+    [
+        "/site-resource/:siteResourceId/users",
+        "/private-resource/:siteResourceId/users"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -251,7 +269,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles/add",
+    [
+        "/site-resource/:siteResourceId/roles/add",
+        "/private-resource/:siteResourceId/roles/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -261,7 +282,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles/remove",
+    [
+        "/site-resource/:siteResourceId/roles/remove",
+        "/private-resource/:siteResourceId/roles/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -271,7 +295,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users/add",
+    [
+        "/site-resource/:siteResourceId/users/add",
+        "/private-resource/:siteResourceId/users/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -281,7 +308,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users/remove",
+    [
+        "/site-resource/:siteResourceId/users/remove",
+        "/private-resource/:siteResourceId/users/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -291,7 +321,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients",
+    [
+        "/site-resource/:siteResourceId/clients",
+        "/private-resource/:siteResourceId/clients"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -301,7 +334,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients/add",
+    [
+        "/site-resource/:siteResourceId/clients/add",
+        "/private-resource/:siteResourceId/clients/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -311,7 +347,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients/remove",
+    [
+        "/site-resource/:siteResourceId/clients/remove",
+        "/private-resource/:siteResourceId/clients/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -321,7 +360,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/client/:clientId/site-resources",
+    ["/client/:clientId/site-resources", "/client/:clientId/private-resources"],
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceUsers),
    logActionAudit(ActionsEnum.setResourceUsers),
@@ -329,7 +368,7 @@ authenticated.post(
 );

 authenticated.put(
-    "/org/:orgId/resource",
+    ["/org/:orgId/resource", "/org/:orgId/public-resource"],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResource),
@@ -338,7 +377,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/org/:orgId/site/:siteId/resource",
+    [
+        "/org/:orgId/site/:siteId/resource",
+        "/org/:orgId/site/:siteId/public-resource"
+    ],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResource),
@@ -347,14 +389,14 @@ authenticated.put(
 );

 authenticated.get(
-    "/site/:siteId/resources",
+    ["/site/:siteId/resources", "/site/:siteId/public-resources"],
    verifyApiKeySiteAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listResources
 );

 authenticated.get(
-    "/org/:orgId/resources",
+    ["/org/:orgId/resources", "/org/:orgId/public-resources"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listResources
@@ -442,42 +484,45 @@ authenticated.delete(
 );

 authenticated.get(
-    "/resource/:resourceId/roles",
+    ["/resource/:resourceId/roles", "/public-resource/:resourceId/roles"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
    resource.listResourceRoles
 );

 authenticated.get(
-    "/resource/:resourceId/users",
+    ["/resource/:resourceId/users", "/public-resource/:resourceId/users"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    resource.listResourceUsers
 );

 authenticated.get(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResource),
    resource.getResource
 );

 authenticated.get(
-    "/resource-policy/:resourcePolicyId",
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
    policy.getResourcePolicy
 );

 authenticated.get(
-    "/resource/:resourceId/policies",
+    ["/resource/:resourceId/policies", "/public-resource/:resourceId/policies"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
    resource.getResourcePolicies
 );

 authenticated.post(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateResource),
@@ -486,14 +531,17 @@ authenticated.post(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId",
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyHasAction(ActionsEnum.updateResourcePolicy),
    policy.updateResourcePolicy
 );

 authenticated.delete(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteResource),
    logActionAudit(ActionsEnum.deleteResource),
@@ -501,7 +549,7 @@ authenticated.delete(
 );

 authenticated.put(
-    "/resource/:resourceId/target",
+    ["/resource/:resourceId/target", "/public-resource/:resourceId/target"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createTarget),
@@ -510,14 +558,14 @@ authenticated.put(
 );

 authenticated.get(
-    "/resource/:resourceId/targets",
+    ["/resource/:resourceId/targets", "/public-resource/:resourceId/targets"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listTargets),
    target.listTargets
 );

 authenticated.put(
-    "/resource/:resourceId/rule",
+    ["/resource/:resourceId/rule", "/public-resource/:resourceId/rule"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResourceRule),
@@ -526,14 +574,17 @@ authenticated.put(
 );

 authenticated.get(
-    "/resource/:resourceId/rules",
+    ["/resource/:resourceId/rules", "/public-resource/:resourceId/rules"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRules),
    resource.listResourceRules
 );

 authenticated.post(
-    "/resource/:resourceId/rule/:ruleId",
+    [
+        "/resource/:resourceId/rule/:ruleId",
+        "/public-resource/:resourceId/rule/:ruleId"
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateResourceRule),
@@ -542,7 +593,10 @@ authenticated.post(
 );

 authenticated.delete(
-    "/resource/:resourceId/rule/:ruleId",
+    [
+        "/resource/:resourceId/rule/:ruleId",
+        "/public-resource/:resourceId/rule/:ruleId"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteResourceRule),
    logActionAudit(ActionsEnum.deleteResourceRule),
@@ -624,7 +678,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/roles",
+    ["/resource/:resourceId/roles", "/public-resource/:resourceId/roles"],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -634,7 +688,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users",
+    ["/resource/:resourceId/users", "/public-resource/:resourceId/users"],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -644,7 +698,10 @@ authenticated.post(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/access-control",
+    [
+        "/resource-policy/:resourcePolicyId/access-control",
+        "/public-resource-policy/:resourcePolicyId/access-control"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -656,7 +713,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/password",
+    [
+        "/resource-policy/:resourcePolicyId/password",
+        "/public-resource-policy/:resourcePolicyId/password"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPassword),
@@ -665,7 +725,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/pincode",
+    [
+        "/resource-policy/:resourcePolicyId/pincode",
+        "/public-resource-policy/:resourcePolicyId/pincode"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPincode),
@@ -674,7 +737,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/header-auth",
+    [
+        "/resource-policy/:resourcePolicyId/header-auth",
+        "/public-resource-policy/:resourcePolicyId/header-auth"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
@@ -683,7 +749,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/whitelist",
+    [
+        "/resource-policy/:resourcePolicyId/whitelist",
+        "/public-resource-policy/:resourcePolicyId/whitelist"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyWhitelist),
@@ -692,7 +761,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/rules",
+    [
+        "/resource-policy/:resourcePolicyId/rules",
+        "/public-resource-policy/:resourcePolicyId/rules"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRules),
@@ -701,7 +773,10 @@ authenticated.put(
 );

 authenticated.post(
-    "/resource/:resourceId/roles/add",
+    [
+        "/resource/:resourceId/roles/add",
+        "/public-resource/:resourceId/roles/add"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -711,7 +786,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/roles/remove",
+    [
+        "/resource/:resourceId/roles/remove",
+        "/public-resource/:resourceId/roles/remove"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -721,7 +799,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users/add",
+    [
+        "/resource/:resourceId/users/add",
+        "/public-resource/:resourceId/users/add"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -731,7 +812,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users/remove",
+    [
+        "/resource/:resourceId/users/remove",
+        "/public-resource/:resourceId/users/remove"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -741,7 +825,7 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/password`,
+    [`/resource/:resourceId/password`, `/public-resource/:resourceId/password`],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePassword),
@@ -750,7 +834,7 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/pincode`,
+    [`/resource/:resourceId/pincode`, `/public-resource/:resourceId/pincode`],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePincode),
@@ -759,7 +843,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/header-auth`,
+    [
+        `/resource/:resourceId/header-auth`,
+        `/public-resource/:resourceId/header-auth`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceHeaderAuth),
@@ -768,7 +855,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist`,
+    [
+        `/resource/:resourceId/whitelist`,
+        `/public-resource/:resourceId/whitelist`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -777,7 +867,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist/add`,
+    [
+        `/resource/:resourceId/whitelist/add`,
+        `/public-resource/:resourceId/whitelist/add`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -785,7 +878,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist/remove`,
+    [
+        `/resource/:resourceId/whitelist/remove`,
+        `/public-resource/:resourceId/whitelist/remove`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -793,14 +889,20 @@ authenticated.post(
 );

 authenticated.get(
-    `/resource/:resourceId/whitelist`,
+    [
+        `/resource/:resourceId/whitelist`,
+        `/public-resource/:resourceId/whitelist`
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourceWhitelist),
    resource.getResourceWhitelist
 );

 authenticated.post(
-    `/resource/:resourceId/access-token`,
+    [
+        `/resource/:resourceId/access-token`,
+        `/public-resource/:resourceId/access-token`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.generateAccessToken),
@@ -809,7 +911,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/session-token`,
+    [
+        `/resource/:resourceId/session-token`,
+        `/public-resource/:resourceId/session-token`
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyUserAccess,
    verifyLimits,
@@ -834,7 +939,10 @@ authenticated.get(
 );

 authenticated.get(
-    `/resource/:resourceId/access-tokens`,
+    [
+        `/resource/:resourceId/access-tokens`,
+        `/public-resource/:resourceId/access-tokens`
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listAccessTokens),
    accessToken.listAccessTokens
@@ -1164,7 +1272,7 @@ authenticated.get(
 );

 authenticated.get(
-    "/org/:orgId/resource-names",
+    ["/org/:orgId/resource-names", "/org/:orgId/public-resource-names"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listAllResourceNames
--- a/server/routers/policy/getResourcePolicy.ts
+++ b/server/routers/policy/getResourcePolicy.ts
@@ -168,7 +168,7 @@ registry.registerPath({
    path: "/org/{orgId}/resource-policy/{niceId}",
    description:
        "Get a resource policy by orgId and niceId. NiceId is a readable ID for the resource and unique on a per org basis.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: z.object({
            orgId: z.string(),
@@ -182,7 +182,20 @@ registry.registerPath({
    method: "get",
    path: "/resource-policy/{resourcePolicyId}",
    description: "Get a resource policy by its resourcePolicyId.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: z.object({
+            resourcePolicyId: z.number()
+        })
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource-policy/{resourcePolicyId}",
+    description: "Get a resource policy by its resourcePolicyId.",
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: z.object({
            resourcePolicyId: z.number()
--- a/server/routers/policy/setResourcePolicyAccessControl.ts
+++ b/server/routers/policy/setResourcePolicyAccessControl.ts
@@ -40,7 +40,26 @@ registry.registerPath({
    path: "/resource-policy/{resourceId}/access-control",
    description:
        "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
-    tags: [OpenAPITags.Policy, OpenAPITags.User],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyAccessControlParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyAcccessControlBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourceId}/access-control",
+    description:
+        "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
+    tags: [OpenAPITags.PublicResourcePolicy, OpenAPITags.User],
    request: {
        params: setResourcePolicyAccessControlParamsSchema,
        body: {
--- a/server/routers/policy/setResourcePolicyHeaderAuth.ts
+++ b/server/routers/policy/setResourcePolicyHeaderAuth.ts
@@ -29,7 +29,26 @@ registry.registerPath({
    path: "/resource-policy/{resourcePolicyId}/header-auth",
    description:
        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyHeaderAuthParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyHeaderAuthBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/header-auth",
+    description:
+        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyHeaderAuthParamsSchema,
        body: {
--- a/server/routers/policy/setResourcePolicyPassword.ts
+++ b/server/routers/policy/setResourcePolicyPassword.ts
@@ -24,7 +24,26 @@ registry.registerPath({
    path: "/resource-policy/{resourcePolicyId}/password",
    description:
        "Set the password for a resource policy. Setting the password to null will remove it.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyPasswordParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPasswordBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/password",
+    description:
+        "Set the password for a resource policy. Setting the password to null will remove it.",
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyPasswordParamsSchema,
        body: {
--- a/server/routers/policy/setResourcePolicyPincode.ts
+++ b/server/routers/policy/setResourcePolicyPincode.ts
@@ -27,7 +27,26 @@ registry.registerPath({
    path: "/resource-policy/{resourcePolicyId}/pincode",
    description:
        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyPincodeParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPincodeBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/pincode",
+    description:
+        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyPincodeParamsSchema,
        body: {
--- a/server/routers/policy/setResourcePolicyRules.ts
+++ b/server/routers/policy/setResourcePolicyRules.ts
@@ -47,7 +47,26 @@ registry.registerPath({
    path: "/resource-policy/{resourcePolicyId}/rules",
    description:
        "Set all rules for a resource policy at once. This will replace all existing rules.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyRulesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyRulesBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/rules",
+    description:
+        "Set all rules for a resource policy at once. This will replace all existing rules.",
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyRulesParamsSchema,
        body: {
--- a/server/routers/policy/setResourcePolicyWhitelist.ts
+++ b/server/routers/policy/setResourcePolicyWhitelist.ts
@@ -32,7 +32,26 @@ registry.registerPath({
    path: "/resource-policy/{resourcePolicyId}/whitelist",
    description:
        "Set email whitelist for a resource policy. This will replace all existing emails.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/whitelist",
+    description:
+        "Set email whitelist for a resource policy. This will replace all existing emails.",
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyWhitelistParamsSchema,
        body: {
--- a/server/routers/policy/updateResourcePolicy.ts
+++ b/server/routers/policy/updateResourcePolicy.ts
@@ -22,7 +22,25 @@ registry.registerPath({
    method: "put",
    path: "/resource-policy/{resourcePolicyId}",
    description: "Update a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: updateResourcePolicyParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateResourcePolicyBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}",
+    description: "Update a resource policy.",
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: updateResourcePolicyParamsSchema,
        body: {
--- a/server/routers/resource/addEmailToResourceWhitelist.ts
+++ b/server/routers/resource/addEmailToResourceWhitelist.ts
@@ -34,6 +34,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/whitelist/add",
    description: "Add a single email to the resource whitelist.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: addEmailToResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addEmailToResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist/add",
+    description: "Add a single email to the resource whitelist.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: addEmailToResourceWhitelistParamsSchema,
@@ -144,10 +177,7 @@ export async function addEmailToResourceWhitelist(
                .from(resourcePolicyWhiteList)
                .where(
                    and(
-                        eq(
-                            resourcePolicyWhiteList.resourcePolicyId,
-                            policyId
-                        ),
+                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
                        eq(resourcePolicyWhiteList.email, email)
                    )
                );
--- a/server/routers/resource/addRoleToResource.ts
+++ b/server/routers/resource/addRoleToResource.ts
@@ -28,6 +28,40 @@ const addRoleToResourceParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/roles/add",
+    description:
+        "Add a single role to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the role is added to the inline policy instead of directly to the resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: addRoleToResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addRoleToResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles/add",
    description:
        "Add a single role to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the role is added to the inline policy instead of directly to the resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
--- a/server/routers/resource/addUserToResource.ts
+++ b/server/routers/resource/addUserToResource.ts
@@ -28,6 +28,40 @@ const addUserToResourceParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/users/add",
+    description:
+        "Add a single user to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the user is added to the inline policy instead of directly to the resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: addUserToResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addUserToResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users/add",
    description:
        "Add a single user to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the user is added to the inline policy instead of directly to the resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
--- a/server/routers/resource/createResource.ts
+++ b/server/routers/resource/createResource.ts
@@ -153,6 +153,39 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/resource",
    description: "Create a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: createResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createHttpResourceSchema.or(createRawResourceSchema)
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/public-resource",
+    description: "Create a resource.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: createResourceParamsSchema,
--- a/server/routers/resource/createResourceRule.ts
+++ b/server/routers/resource/createResourceRule.ts
@@ -32,6 +32,39 @@ registry.registerPath({
    method: "put",
    path: "/resource/{resourceId}/rule",
    description: "Create a resource rule.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: createResourceRuleParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createResourceRuleSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource/{resourceId}/rule",
+    description: "Create a resource rule.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
    request: {
        params: createResourceRuleParamsSchema,
--- a/server/routers/resource/deleteResource.ts
+++ b/server/routers/resource/deleteResource.ts
@@ -22,6 +22,32 @@ registry.registerPath({
    method: "delete",
    path: "/resource/{resourceId}",
    description: "Delete a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: deleteResourceSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/public-resource/{resourceId}",
+    description: "Delete a resource.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: deleteResourceSchema
--- a/server/routers/resource/deleteResourceRule.ts
+++ b/server/routers/resource/deleteResourceRule.ts
@@ -19,6 +19,32 @@ registry.registerPath({
    method: "delete",
    path: "/resource/{resourceId}/rule/{ruleId}",
    description: "Delete a resource rule.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: deleteResourceRuleSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/public-resource/{resourceId}/rule/{ruleId}",
+    description: "Delete a resource rule.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
    request: {
        params: deleteResourceRuleSchema
--- a/server/routers/resource/getResource.ts
+++ b/server/routers/resource/getResource.ts
@@ -63,7 +63,7 @@ registry.registerPath({
    path: "/org/{orgId}/resource/{niceId}",
    description:
        "Get a resource by orgId and niceId. NiceId is a readable ID for the resource and unique on a per org basis.",
-    tags: [OpenAPITags.PublicResource],
+    tags: [OpenAPITags.PublicResourceLegacy],
    request: {
        params: z.object({
            orgId: z.string(),
@@ -92,6 +92,34 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}",
    description: "Get a resource by resourceId.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: z.object({
+            resourceId: z.number()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}",
+    description: "Get a resource by resourceId.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: z.object({
--- a/server/routers/resource/getResourcePolicies.ts
+++ b/server/routers/resource/getResourcePolicies.ts
@@ -25,8 +25,21 @@ export type GetResourcePoliciesResponse = {
 registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/policies",
-    description: "Get the inline and shared policies associated with a resource.",
-    tags: [OpenAPITags.PublicResource, OpenAPITags.Policy],
+    description:
+        "Get the inline and shared policies associated with a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: getResourcePoliciesParamsSchema
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/policies",
+    description:
+        "Get the inline and shared policies associated with a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.PublicResourcePolicy],
    request: {
        params: getResourcePoliciesParamsSchema
    },
--- a/server/routers/resource/getResourceWhitelist.ts
+++ b/server/routers/resource/getResourceWhitelist.ts
@@ -44,6 +44,32 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/whitelist",
    description: "Get the whitelist of emails for a specific resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: getResourceWhitelistSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/whitelist",
+    description: "Get the whitelist of emails for a specific resource.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: getResourceWhitelistSchema
--- a/server/routers/resource/listAllResourceNames.ts
+++ b/server/routers/resource/listAllResourceNames.ts
@@ -33,6 +33,34 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/resources-names",
    description: "List all resource names for an organization.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: z.object({
+            orgId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/public-resource-names",
+    description: "List all resource names for an organization.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: z.object({
--- a/server/routers/resource/listResourceRoles.ts
+++ b/server/routers/resource/listResourceRoles.ts
@@ -48,6 +48,32 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/roles",
    description: "List all roles for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listResourceRolesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/roles",
+    description: "List all roles for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
    request: {
        params: listResourceRolesSchema
--- a/server/routers/resource/listResourceRules.ts
+++ b/server/routers/resource/listResourceRules.ts
@@ -71,6 +71,33 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/rules",
    description: "List rules for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listResourceRulesParamsSchema,
+        query: listResourceRulesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/rules",
+    description: "List rules for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
    request: {
        params: listResourceRulesParamsSchema,
--- a/server/routers/resource/listResourceUsers.ts
+++ b/server/routers/resource/listResourceUsers.ts
@@ -38,6 +38,32 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/users",
    description: "List all users for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listResourceUsersSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/users",
+    description: "List all users for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
    request: {
        params: listResourceUsersSchema
--- a/server/routers/resource/listResources.ts
+++ b/server/routers/resource/listResources.ts
@@ -400,6 +400,35 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/resources",
    description: "List resources for an organization.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: z.object({
+            orgId: z.string()
+        }),
+        query: listResourcesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/public-resources",
+    description: "List resources for an organization.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: z.object({
--- a/server/routers/resource/removeEmailFromResourceWhitelist.ts
+++ b/server/routers/resource/removeEmailFromResourceWhitelist.ts
@@ -34,6 +34,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/whitelist/remove",
    description: "Remove a single email from the resource whitelist.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: removeEmailFromResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeEmailFromResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist/remove",
+    description: "Remove a single email from the resource whitelist.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: removeEmailFromResourceWhitelistParamsSchema,
@@ -143,10 +176,7 @@ export async function removeEmailFromResourceWhitelist(
                .from(resourcePolicyWhiteList)
                .where(
                    and(
-                        eq(
-                            resourcePolicyWhiteList.resourcePolicyId,
-                            policyId
-                        ),
+                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
                        eq(resourcePolicyWhiteList.email, email)
                    )
                );
@@ -164,10 +194,7 @@ export async function removeEmailFromResourceWhitelist(
                .delete(resourcePolicyWhiteList)
                .where(
                    and(
-                        eq(
-                            resourcePolicyWhiteList.resourcePolicyId,
-                            policyId
-                        ),
+                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
                        eq(resourcePolicyWhiteList.email, email)
                    )
                );
--- a/server/routers/resource/removeRoleFromResource.ts
+++ b/server/routers/resource/removeRoleFromResource.ts
@@ -29,6 +29,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/roles/remove",
    description: "Remove a single role from a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: removeRoleFromResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeRoleFromResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles/remove",
+    description: "Remove a single role from a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
    request: {
        params: removeRoleFromResourceParamsSchema,
--- a/server/routers/resource/removeUserFromResource.ts
+++ b/server/routers/resource/removeUserFromResource.ts
@@ -29,6 +29,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/users/remove",
    description: "Remove a single user from a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: removeUserFromResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeUserFromResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users/remove",
+    description: "Remove a single user from a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
    request: {
        params: removeUserFromResourceParamsSchema,
--- a/server/routers/resource/setResourceHeaderAuth.ts
+++ b/server/routers/resource/setResourceHeaderAuth.ts
@@ -29,6 +29,40 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/header-auth",
+    description:
+        "Set or update the header authentication for a resource. If user and password is not provided, it will remove the header authentication.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/header-auth",
    description:
        "Set or update the header authentication for a resource. If user and password is not provided, it will remove the header authentication.",
    tags: [OpenAPITags.PublicResource],
--- a/server/routers/resource/setResourcePassword.ts
+++ b/server/routers/resource/setResourcePassword.ts
@@ -27,6 +27,40 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/password",
+    description:
+        "Set the password for a resource. Setting the password to null will remove it.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/password",
    description:
        "Set the password for a resource. Setting the password to null will remove it.",
    tags: [OpenAPITags.PublicResource],
--- a/server/routers/resource/setResourcePincode.ts
+++ b/server/routers/resource/setResourcePincode.ts
@@ -27,6 +27,40 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/pincode",
+    description:
+        "Set the PIN code for a resource. Setting the PIN code to null will remove it.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/pincode",
    description:
        "Set the PIN code for a resource. Setting the PIN code to null will remove it.",
    tags: [OpenAPITags.PublicResource],
--- a/server/routers/resource/setResourceRoles.ts
+++ b/server/routers/resource/setResourceRoles.ts
@@ -21,6 +21,40 @@ const setResourceRolesParamsSchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/roles",
+    description:
+        "Set roles for a resource. This will replace all existing roles. When the resource has an inline policy defined (no shared resource policy assigned), roles are set on the inline policy instead of directly on the resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceRolesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceRolesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles",
    description:
        "Set roles for a resource. This will replace all existing roles. When the resource has an inline policy defined (no shared resource policy assigned), roles are set on the inline policy instead of directly on the resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
--- a/server/routers/resource/setResourceUsers.ts
+++ b/server/routers/resource/setResourceUsers.ts
@@ -21,6 +21,40 @@ const setUserResourcesParamsSchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/users",
+    description:
+        "Set users for a resource. This will replace all existing users. When the resource has an inline policy defined (no shared resource policy assigned), users are set on the inline policy instead of directly on the resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setUserResourcesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setUserResourcesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users",
    description:
        "Set users for a resource. This will replace all existing users. When the resource has an inline policy defined (no shared resource policy assigned), users are set on the inline policy instead of directly on the resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
--- a/server/routers/resource/setResourceWhitelist.ts
+++ b/server/routers/resource/setResourceWhitelist.ts
@@ -35,6 +35,40 @@ const setResourceWhitelistParamsSchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/whitelist",
+    description:
+        "Set email whitelist for a resource. This will replace all existing emails.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist",
    description:
        "Set email whitelist for a resource. This will replace all existing emails.",
    tags: [OpenAPITags.PublicResource],
--- a/server/routers/resource/updateResource.ts
+++ b/server/routers/resource/updateResource.ts
@@ -240,6 +240,42 @@ const updateRawResourceBodySchema = z
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}",
+    description:
+        "Update a resource. Policy fields (sso, mfa, pincode, password, whitelist) update the inline policy when no shared resource policy is assigned; when a shared policy is assigned those fields override the shared policy for this resource only.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: updateResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateHttpResourceBodySchema.and(
+                        updateRawResourceBodySchema
+                    )
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}",
    description:
        "Update a resource. Policy fields (sso, mfa, pincode, password, whitelist) update the inline policy when no shared resource policy is assigned; when a shared policy is assigned those fields override the shared policy for this resource only.",
    tags: [OpenAPITags.PublicResource],
--- a/server/routers/resource/updateResourceRule.ts
+++ b/server/routers/resource/updateResourceRule.ts
@@ -49,6 +49,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/rule/{ruleId}",
    description: "Update a resource rule.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: updateResourceRuleParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateResourceRuleSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/rule/{ruleId}",
+    description: "Update a resource rule.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
    request: {
        params: updateResourceRuleParamsSchema,
--- a/server/routers/site/listSites.ts
+++ b/server/routers/site/listSites.ts
@@ -177,7 +177,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/sites",
    description: "List all sites in an organization",
-    tags: [OpenAPITags.Org, OpenAPITags.Site],
+    tags: [OpenAPITags.Site],
    request: {
        params: listSitesParamsSchema,
        query: listSitesSchema
--- a/server/routers/siteResource/addClientToSiteResource.ts
+++ b/server/routers/siteResource/addClientToSiteResource.ts
@@ -31,6 +31,40 @@ const addClientToSiteResourceParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/clients/add",
+    description:
+        "Add a single client to a site resource. Clients with a userId cannot be added.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: addClientToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addClientToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients/add",
    description:
        "Add a single client to a site resource. Clients with a userId cannot be added.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
--- a/server/routers/siteResource/addRoleToSiteResource.ts
+++ b/server/routers/siteResource/addRoleToSiteResource.ts
@@ -33,6 +33,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/roles/add",
    description: "Add a single role to a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: addRoleToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addRoleToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles/add",
+    description: "Add a single role to a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
    request: {
        params: addRoleToSiteResourceParamsSchema,
--- a/server/routers/siteResource/addUserToSiteResource.ts
+++ b/server/routers/siteResource/addUserToSiteResource.ts
@@ -33,6 +33,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/users/add",
    description: "Add a single user to a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: addUserToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addUserToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users/add",
+    description: "Add a single user to a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
    request: {
        params: addUserToSiteResourceParamsSchema,
--- a/server/routers/siteResource/batchAddClientToSiteResources.ts
+++ b/server/routers/siteResource/batchAddClientToSiteResources.ts
@@ -38,6 +38,39 @@ registry.registerPath({
    method: "post",
    path: "/client/{clientId}/site-resources",
    description: "Add a machine client to multiple site resources at once.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: batchAddClientToSiteResourcesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: batchAddClientToSiteResourcesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/client/{clientId}/private-resources",
+    description: "Add a machine client to multiple site resources at once.",
    tags: [OpenAPITags.Client],
    request: {
        params: batchAddClientToSiteResourcesParamsSchema,
--- a/server/routers/siteResource/createSiteResource.ts
+++ b/server/routers/siteResource/createSiteResource.ts
@@ -208,6 +208,39 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/site-resource",
    description: "Create a new site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: createSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createSiteResourceSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/private-resource",
+    description: "Create a new site resource.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: createSiteResourceParamsSchema,
--- a/server/routers/siteResource/deleteSiteResource.ts
+++ b/server/routers/siteResource/deleteSiteResource.ts
@@ -27,6 +27,32 @@ registry.registerPath({
    method: "delete",
    path: "/site-resource/{siteResourceId}",
    description: "Delete a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: deleteSiteResourceParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/private-resource/{siteResourceId}",
+    description: "Delete a site resource.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: deleteSiteResourceParamsSchema
--- a/server/routers/siteResource/getSiteResource.ts
+++ b/server/routers/siteResource/getSiteResource.ts
@@ -57,6 +57,36 @@ registry.registerPath({
    method: "get",
    path: "/site-resource/{siteResourceId}",
    description: "Get a specific site resource by siteResourceId.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: z.object({
+            siteResourceId: z.number(),
+            siteId: z.number(),
+            orgId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}",
+    description: "Get a specific site resource by siteResourceId.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: z.object({
--- a/server/routers/siteResource/listAllSiteResourcesByOrg.ts
+++ b/server/routers/siteResource/listAllSiteResourcesByOrg.ts
@@ -221,6 +221,33 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/site-resources",
    description: "List all site resources for an organization.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listAllSiteResourcesByOrgParamsSchema,
+        query: listAllSiteResourcesByOrgQuerySchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/private-resources",
+    description: "List all site resources for an organization.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: listAllSiteResourcesByOrgParamsSchema,
--- a/server/routers/siteResource/listSiteResourceClients.ts
+++ b/server/routers/siteResource/listSiteResourceClients.ts
@@ -39,6 +39,32 @@ registry.registerPath({
    method: "get",
    path: "/site-resource/{siteResourceId}/clients",
    description: "List all clients for a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listSiteResourceClientsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/clients",
+    description: "List all clients for a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
    request: {
        params: listSiteResourceClientsSchema
--- a/server/routers/siteResource/listSiteResourceRoles.ts
+++ b/server/routers/siteResource/listSiteResourceRoles.ts
@@ -40,6 +40,32 @@ registry.registerPath({
    method: "get",
    path: "/site-resource/{siteResourceId}/roles",
    description: "List all roles for a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listSiteResourceRolesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/roles",
+    description: "List all roles for a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
    request: {
        params: listSiteResourceRolesSchema
--- a/server/routers/siteResource/listSiteResourceUsers.ts
+++ b/server/routers/siteResource/listSiteResourceUsers.ts
@@ -43,6 +43,32 @@ registry.registerPath({
    method: "get",
    path: "/site-resource/{siteResourceId}/users",
    description: "List all users for a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listSiteResourceUsersSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/users",
+    description: "List all users for a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
    request: {
        params: listSiteResourceUsersSchema
--- a/server/routers/siteResource/listSiteResources.ts
+++ b/server/routers/siteResource/listSiteResources.ts
@@ -58,6 +58,33 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/site/{siteId}/resources",
    description: "List site resources for a site.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listSiteResourcesParamsSchema,
+        query: listSiteResourcesQuerySchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/site/{siteId}/private-resources",
+    description: "List site resources for a site.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: listSiteResourcesParamsSchema,
--- a/server/routers/siteResource/removeClientFromSiteResource.ts
+++ b/server/routers/siteResource/removeClientFromSiteResource.ts
@@ -31,6 +31,40 @@ const removeClientFromSiteResourceParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/clients/remove",
+    description:
+        "Remove a single client from a site resource. Clients with a userId cannot be removed.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: removeClientFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeClientFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients/remove",
    description:
        "Remove a single client from a site resource. Clients with a userId cannot be removed.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
--- a/server/routers/siteResource/removeRoleFromSiteResource.ts
+++ b/server/routers/siteResource/removeRoleFromSiteResource.ts
@@ -33,6 +33,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/roles/remove",
    description: "Remove a single role from a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: removeRoleFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeRoleFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles/remove",
+    description: "Remove a single role from a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
    request: {
        params: removeRoleFromSiteResourceParamsSchema,
--- a/server/routers/siteResource/removeUserFromSiteResource.ts
+++ b/server/routers/siteResource/removeUserFromSiteResource.ts
@@ -33,6 +33,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/users/remove",
    description: "Remove a single user from a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: removeUserFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeUserFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users/remove",
+    description: "Remove a single user from a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
    request: {
        params: removeUserFromSiteResourceParamsSchema,
--- a/server/routers/siteResource/setSiteResourceClients.ts
+++ b/server/routers/siteResource/setSiteResourceClients.ts
@@ -31,6 +31,40 @@ const setSiteResourceClientsParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/clients",
+    description:
+        "Set clients for a site resource. This will replace all existing clients. Clients with a userId cannot be added.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: setSiteResourceClientsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceClientsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients",
    description:
        "Set clients for a site resource. This will replace all existing clients. Clients with a userId cannot be added.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
--- a/server/routers/siteResource/setSiteResourceRoles.ts
+++ b/server/routers/siteResource/setSiteResourceRoles.ts
@@ -32,6 +32,40 @@ const setSiteResourceRolesParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/roles",
+    description:
+        "Set roles for a site resource. This will replace all existing roles.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: setSiteResourceRolesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceRolesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles",
    description:
        "Set roles for a site resource. This will replace all existing roles.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
--- a/server/routers/siteResource/setSiteResourceUsers.ts
+++ b/server/routers/siteResource/setSiteResourceUsers.ts
@@ -33,6 +33,40 @@ const setSiteResourceUsersParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/users",
+    description:
+        "Set users for a site resource. This will replace all existing users.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: setSiteResourceUsersParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceUsersBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users",
    description:
        "Set users for a site resource. This will replace all existing users.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
--- a/server/routers/siteResource/updateSiteResource.ts
+++ b/server/routers/siteResource/updateSiteResource.ts
@@ -208,6 +208,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}",
    description: "Update a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: updateSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateSiteResourceSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}",
+    description: "Update a site resource.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: updateSiteResourceParamsSchema,
--- a/server/routers/target/createTarget.ts
+++ b/server/routers/target/createTarget.ts
@@ -93,6 +93,39 @@ registry.registerPath({
    method: "put",
    path: "/resource/{resourceId}/target",
    description: "Create a target for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: createTargetParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createTargetSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource/{resourceId}/target",
+    description: "Create a target for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
    request: {
        params: createTargetParamsSchema,
--- a/server/routers/target/listTargets.ts
+++ b/server/routers/target/listTargets.ts
@@ -92,6 +92,33 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/targets",
    description: "List targets for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listTargetsParamsSchema,
+        query: listTargetsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/targets",
+    description: "List targets for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
    request: {
        params: listTargetsParamsSchema,
Author	SHA1	Message	Date
Owen	b726f3be3c	Move to legacy	2026-07-10 17:46:03 -04:00
Owen	78a3d84f69	Add missing endpoints to api	2026-07-10 17:13:47 -04:00
Owen	35960f94fc	Update tags	2026-07-10 17:09:56 -04:00
Owen	f03d1d3793	More route cleanup	2026-07-10 16:54:00 -04:00
Owen	5b47c21347	Order more api routes	2026-07-10 16:46:16 -04:00
Owen	1af486ac48	Just add ordering	2026-07-10 16:01:22 -04:00
Owen	0149984e85	Recategorize	2026-07-10 15:52:37 -04:00
Owen	a2c96ea2f7	Add aliaes for public/private resources	2026-07-09 20:23:19 -04:00