Add aliaes for public/private resources

Add missing action
Merge pull request #3420 from fosrl/crowdin_dev
2026-07-10 16:02:08 +02:00 · 2026-07-09 20:23:19 -04:00 · 2026-07-09 11:16:15 -04:00 · 2026-07-09 10:35:21 -04:00 · 2026-07-09 10:34:31 -04:00 · 2026-07-09 10:34:29 -04:00
87 changed files with 2050 additions and 95 deletions
@@ -41,7 +41,7 @@ services:
      - 80:80 # Port for traefik because of the network_mode

  traefik:
-    image: traefik:v3.7
+    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
@@ -50,7 +50,7 @@ services:
      - 80:80{{end}}

  traefik:
-    image: docker.io/traefik:v3.7
+    image: docker.io/traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Генериране на токен за достъп",
    "actionDeleteAccessToken": "Изтриване на токен за достъп",
    "actionListAccessTokens": "Изброяване на токени за достъп",
+    "actionCreateResourceSessionToken": "Създаване на токен за сесия на ресурс",
    "actionCreateResourceRule": "Създаване на правило за ресурс",
    "actionDeleteResourceRule": "Изтрийте правило за ресурс",
    "actionListResourceRules": "Изброяване на правила за ресурс",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Затвори",
    "createInternalResourceDialogCreateClientResource": "Създаване на частен ресурс",
    "createInternalResourceDialogCreateClientResourceDescription": "Създайте нов ресурс, който ще бъде достъпен само за клиенти, свързани към организацията",
+    "privateResourceGeneralDescription": "Конфигурирайте името, идентификатора и другите общи настройки на ресурса.",
    "privateResourceCreatePageSeeAll": "Вижте всички частни ресурси",
    "privateResourceAllowIcmpPing": "Разрешете ICMP Ping",
    "privateResourceNetworkAccess": "Достъп до мрежата",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Добавяне на потребители.",
    "editInternalResourceDialogAddClients": "Добавяне на клиенти.",
    "editInternalResourceDialogDestinationLabel": "Дестинация.",
-    "editInternalResourceDialogDestinationDescription": "Изберете къде работи този ресурс и как клиентите го достигат",
+    "editInternalResourceDialogDestinationDescription": "Конфигурирайте как клиентите да достигнат до този ресурс.",
    "internalResourceFormMultiSiteRoutingHelp": "Избирайки няколко сайта, се осигурява сигурен път и пренасочване при висока достъпност.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Научете повече",
    "editInternalResourceDialogPortRestrictionsDescription": "Ограничете достъпа до конкретни TCP/UDP портове или позволете/блокирайте всички портове.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generovat přístupový token",
    "actionDeleteAccessToken": "Odstranit přístupový token",
    "actionListAccessTokens": "Seznam přístupových tokenů",
+    "actionCreateResourceSessionToken": "Vytvořit token relace prostředku",
    "actionCreateResourceRule": "Vytvořit pravidlo pro zdroj",
    "actionDeleteResourceRule": "Odstranit pravidlo pro dokument",
    "actionListResourceRules": "Seznam pravidel zdrojů",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Zavřít",
    "createInternalResourceDialogCreateClientResource": "Vytvořit soukromý zdroj",
    "createInternalResourceDialogCreateClientResourceDescription": "Vytvořte nový zdroj, který bude přístupný pouze klientům připojeným k organizaci",
+    "privateResourceGeneralDescription": "Nastavte název, identifikátor a další obecná nastavení zdroje.",
    "privateResourceCreatePageSeeAll": "Zobrazit všechny privátní zdroje",
    "privateResourceAllowIcmpPing": "Povolit ICMP ping",
    "privateResourceNetworkAccess": "Přístup k síti",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Přidat uživatele",
    "editInternalResourceDialogAddClients": "Přidat klienty",
    "editInternalResourceDialogDestinationLabel": "Cíl",
-    "editInternalResourceDialogDestinationDescription": "Vyberte, kde bude tento zdroj spuštěn a jak ho klienti dosáhnou",
+    "editInternalResourceDialogDestinationDescription": "Nakonfigurujte, jak klienti dosáhnou tohoto zdroje.",
    "internalResourceFormMultiSiteRoutingHelp": "Výběrem více webů se povolí odolné směrování a přepojení pro vysokou dostupnost.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Zjistit více",
    "editInternalResourceDialogPortRestrictionsDescription": "Omezte přístup na specifické TCP/UDP porty nebo povolte/blokujte všechny porty.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generer adgangstoken",
    "actionDeleteAccessToken": "Slet adgangstoken",
    "actionListAccessTokens": "Vis adgangstokens",
+    "actionCreateResourceSessionToken": "Opret ressourcessession token",
    "actionCreateResourceRule": "Opret ressourceregel",
    "actionDeleteResourceRule": "Slet ressourceregel",
    "actionListResourceRules": "Vis ressourceregler",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Luk",
    "createInternalResourceDialogCreateClientResource": "Opret privat ressource",
    "createInternalResourceDialogCreateClientResourceDescription": "Opret en ny ressource som kun vil være tilgængelig for kunder som er forbundet til organisationen",
+    "privateResourceGeneralDescription": "Konfigurer navnet, identifikatoren, og andre generelle indstillinger for ressourcen.",
    "privateResourceCreatePageSeeAll": "Se alle private ressourcer",
    "privateResourceAllowIcmpPing": "Tillad ICMP-ping",
    "privateResourceNetworkAccess": "Netværksadgang",
@@ -2546,7 +2548,7 @@
    "noRemoteExitNodesAvailableDescription": "Ingen noder er tilgængelige for denne organisation. Opret en node først for at bruge lokale sites.",
    "exitNode": "Exitnode",
    "country": "Land",
-    "countryIsNot": "Country Is Not",
+    "countryIsNot": "Land er ikke",
    "rulesMatchCountry": "I øjeblikket baseret på kilde-IP",
    "region": "Fylke",
    "selectRegion": "Vælg region",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Tilføj brugere",
    "editInternalResourceDialogAddClients": "Tilføj klienter",
    "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it",
+    "editInternalResourceDialogDestinationDescription": "Konfigurer hvordan klienter får adgang til denne ressource.",
    "internalResourceFormMultiSiteRoutingHelp": "Valg af flere sites muliggør robust routing og failover for høj tilgængelighed.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Læs mere",
    "editInternalResourceDialogPortRestrictionsDescription": "Begrens adgang til specifikke TCP/UDP-porte eller tillade/blokere alle porte.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Zugriffstoken generieren",
    "actionDeleteAccessToken": "Zugriffstoken löschen",
    "actionListAccessTokens": "Zugriffstoken auflisten",
+    "actionCreateResourceSessionToken": "Ressourcensitzungstoken erstellen",
    "actionCreateResourceRule": "Ressourcenregel erstellen",
    "actionDeleteResourceRule": "Ressourcenregel löschen",
    "actionListResourceRules": "Ressourcenregeln auflisten",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Schließen",
    "createInternalResourceDialogCreateClientResource": "Private Ressource erstellen",
    "createInternalResourceDialogCreateClientResourceDescription": "Erstelle eine neue Ressource, die nur für Clients zugänglich ist, die mit der Organisation verbunden sind",
+    "privateResourceGeneralDescription": "Konfigurieren Sie den Namen, die Kennung und andere allgemeine Ressourceneinstellungen.",
    "privateResourceCreatePageSeeAll": "Alle privaten Ressourcen anzeigen",
    "privateResourceAllowIcmpPing": "ICMP-Ping zulassen",
    "privateResourceNetworkAccess": "Netzwerkzugriff",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Nutzer hinzufügen",
    "editInternalResourceDialogAddClients": "Clients hinzufügen",
    "editInternalResourceDialogDestinationLabel": "Ziel",
-    "editInternalResourceDialogDestinationDescription": "Wählen Sie aus, wo diese Ressource läuft und wie Clients darauf zugreifen können",
+    "editInternalResourceDialogDestinationDescription": "Konfigurieren Sie, wie Clients diese Ressource erreichen.",
    "internalResourceFormMultiSiteRoutingHelp": "Durch die Auswahl mehrerer Seiten wird ein ausfallsicheres Routing und Failover für hohe Verfügbarkeit ermöglicht.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Mehr erfahren",
    "editInternalResourceDialogPortRestrictionsDescription": "Den Zugriff auf bestimmte TCP/UDP-Ports beschränken oder alle Ports erlauben/blockieren.",
@@ -3679,7 +3681,7 @@
    "resourceLauncherSaveForEveryoneDescription": "Teilen Sie diese Ansicht mit allen Organisationsmitgliedern. Wenn nicht aktiviert, ist die Ansicht nur für Sie sichtbar.",
    "resourceLauncherMakePersonal": "Persönlich machen",
    "resourceLauncherFilter": "Filter",
-    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherFilterWithCount": "Filter, {count} angewendet",
    "resourceLauncherSort": "Sortieren",
    "resourceLauncherSortAscending": "Aufsteigend sortieren",
    "resourceLauncherSortDescending": "Absteigend sortieren",
@@ -1397,6 +1397,7 @@
    "createOrgUser": "Create Org User",
    "actionUpdateOrg": "Update Organization",
    "actionRemoveInvitation": "Remove Invitation",
+    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Update User",
    "actionGetUser": "Get User",
    "actionGetOrgUser": "Get Organization User",
@@ -1462,6 +1463,7 @@
    "actionGenerateAccessToken": "Generate Access Token",
    "actionDeleteAccessToken": "Delete Access Token",
    "actionListAccessTokens": "List Access Tokens",
+    "actionCreateResourceSessionToken": "Create Resource Session Token",
    "actionCreateResourceRule": "Create Resource Rule",
    "actionDeleteResourceRule": "Delete Resource Rule",
    "actionListResourceRules": "List Resource Rules",
@@ -2392,6 +2394,7 @@
    "createInternalResourceDialogClose": "Close",
    "createInternalResourceDialogCreateClientResource": "Create Private Resource",
    "createInternalResourceDialogCreateClientResourceDescription": "Create a new resource that will only be accessible to clients connected to the organization",
+    "privateResourceGeneralDescription": "Configure the name, identifier, and other general resource settings.",
    "privateResourceCreatePageSeeAll": "See All Private Resources",
    "privateResourceAllowIcmpPing": "Allow ICMP Ping",
    "privateResourceNetworkAccess": "Network Access",
@@ -3268,7 +3271,7 @@
    "editInternalResourceDialogAddUsers": "Add Users",
    "editInternalResourceDialogAddClients": "Add Clients",
    "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it",
+    "editInternalResourceDialogDestinationDescription": "Configure how clients reach this resource.",
    "internalResourceFormMultiSiteRoutingHelp": "Selecting multiple sites enables resilient routing and failover for high availability.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Learn more",
    "editInternalResourceDialogPortRestrictionsDescription": "Restrict access to specific TCP/UDP ports or allow/block all ports.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generar token de acceso",
    "actionDeleteAccessToken": "Eliminar token de acceso",
    "actionListAccessTokens": "Lista de Tokens de Acceso",
+    "actionCreateResourceSessionToken": "Crear Token de Sesión de Recurso",
    "actionCreateResourceRule": "Crear Regla de Recursos",
    "actionDeleteResourceRule": "Eliminar Regla de Recurso",
    "actionListResourceRules": "Lista de Reglas de Recursos",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Cerrar",
    "createInternalResourceDialogCreateClientResource": "Crear recurso privado",
    "createInternalResourceDialogCreateClientResourceDescription": "Crear un nuevo recurso que sólo será accesible a los clientes conectados a la organización",
+    "privateResourceGeneralDescription": "Configura el nombre, identificador y otros ajustes generales del recurso.",
    "privateResourceCreatePageSeeAll": "Ver todos los recursos privados",
    "privateResourceAllowIcmpPing": "Permitir ping ICMP",
    "privateResourceNetworkAccess": "Acceso de red",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Agregar usuarios",
    "editInternalResourceDialogAddClients": "Agregar clientes",
    "editInternalResourceDialogDestinationLabel": "Destino",
-    "editInternalResourceDialogDestinationDescription": "Elija dónde se ejecuta este recurso y cómo lo alcanzan los clientes",
+    "editInternalResourceDialogDestinationDescription": "Configura cómo los clientes acceden a este recurso.",
    "internalResourceFormMultiSiteRoutingHelp": "Seleccionar múltiples sitios habilita el enrutamiento resistente y la conmutación por error para alta disponibilidad.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Más información",
    "editInternalResourceDialogPortRestrictionsDescription": "Restringir el acceso a puertos TCP/UDP específicos o permitir/bloquear todos los puertos.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Générer un jeton d'accès",
    "actionDeleteAccessToken": "Supprimer un jeton d'accès",
    "actionListAccessTokens": "Lister les jetons d'accès",
+    "actionCreateResourceSessionToken": "Créer un jeton de session de ressource",
    "actionCreateResourceRule": "Créer une règle de ressource",
    "actionDeleteResourceRule": "Supprimer une règle de ressource",
    "actionListResourceRules": "Lister les règles de ressource",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Fermer",
    "createInternalResourceDialogCreateClientResource": "Créer une ressource privée",
    "createInternalResourceDialogCreateClientResourceDescription": "Créer une nouvelle ressource qui ne sera accessible qu'aux clients connectés à l'organisation",
+    "privateResourceGeneralDescription": "Configurez le nom, l'identifiant et d'autres paramètres généraux de la ressource.",
    "privateResourceCreatePageSeeAll": "Voir toutes les ressources privées",
    "privateResourceAllowIcmpPing": "Autoriser le ping ICMP",
    "privateResourceNetworkAccess": "Accès au réseau",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Ajouter des utilisateurs",
    "editInternalResourceDialogAddClients": "Ajouter des clients",
    "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choisissez où cette ressource fonctionne et comment les clients l'atteignent",
+    "editInternalResourceDialogDestinationDescription": "Configurez comment les clients accèdent à cette ressource.",
    "internalResourceFormMultiSiteRoutingHelp": "La sélection de plusieurs sites permet un routage résilient et un basculement pour une haute disponibilité.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "En savoir plus",
    "editInternalResourceDialogPortRestrictionsDescription": "Restreindre l'accès à des ports TCP/UDP spécifiques ou autoriser/bloquer tous les ports.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Genera Token di Accesso",
    "actionDeleteAccessToken": "Elimina Token di Accesso",
    "actionListAccessTokens": "Elenca Token di Accesso",
+    "actionCreateResourceSessionToken": "Crea Token di Sessione della Risorsa",
    "actionCreateResourceRule": "Crea Regola Risorsa",
    "actionDeleteResourceRule": "Elimina Regola Risorsa",
    "actionListResourceRules": "Elenca Regole Risorsa",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Chiudi",
    "createInternalResourceDialogCreateClientResource": "Crea Risorsa Privata",
    "createInternalResourceDialogCreateClientResourceDescription": "Crea una nuova risorsa che sarà accessibile solo ai client connessi all'organizzazione",
+    "privateResourceGeneralDescription": "Configura il nome, l'identificativo e altre impostazioni generali delle risorse.",
    "privateResourceCreatePageSeeAll": "Vedi Tutte le Risorse Private",
    "privateResourceAllowIcmpPing": "Consenti ICMP Ping",
    "privateResourceNetworkAccess": "Accesso alla Rete",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Aggiungi Utenti",
    "editInternalResourceDialogAddClients": "Aggiungi Clienti",
    "editInternalResourceDialogDestinationLabel": "Destinazione",
-    "editInternalResourceDialogDestinationDescription": "Scegli dove eseguire questa risorsa e come i client lo raggiungono",
+    "editInternalResourceDialogDestinationDescription": "Configura come i client raggiungono questa risorsa.",
    "internalResourceFormMultiSiteRoutingHelp": "Selezionare più siti consente un routing resiliente e Failover per alta disponibilità.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Scopri di più",
    "editInternalResourceDialogPortRestrictionsDescription": "Limita l'accesso a porte TCP/UDP specifiche o consenti/blocca tutte le porte.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "액세스 토큰 생성",
    "actionDeleteAccessToken": "액세스 토큰 삭제",
    "actionListAccessTokens": "액세스 토큰 목록",
+    "actionCreateResourceSessionToken": "리소스 세션 토큰 생성",
    "actionCreateResourceRule": "리소스 규칙 생성",
    "actionDeleteResourceRule": "리소스 규칙 삭제",
    "actionListResourceRules": "리소스 규칙 목록",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "닫기",
    "createInternalResourceDialogCreateClientResource": "사이트 리소스 생성",
    "createInternalResourceDialogCreateClientResourceDescription": "선택한 사이트에 연결된 클라이언트에 접근할 새 리소스를 생성합니다",
+    "privateResourceGeneralDescription": "이름, 식별자, 기타 일반 리소스 설정을 구성합니다.",
    "privateResourceCreatePageSeeAll": "모든 개인 리소스 보기",
    "privateResourceAllowIcmpPing": "ICMP 핑 허용",
    "privateResourceNetworkAccess": "네트워크 접근",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "사용자 추가",
    "editInternalResourceDialogAddClients": "클라이언트 추가",
    "editInternalResourceDialogDestinationLabel": "대상지",
-    "editInternalResourceDialogDestinationDescription": "이 리소스가 실행되는 위치와 고객이 도달하는 방법 선택",
+    "editInternalResourceDialogDestinationDescription": "클라이언트가 이 리소스에 어떻게 도달하는지 구성합니다.",
    "internalResourceFormMultiSiteRoutingHelp": "다중 사이트를 선택하면 높은 가용성을 위해 회복력 있는 라우팅 및 페일오버가 가능해집니다.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "자세히 알아보기",
    "editInternalResourceDialogPortRestrictionsDescription": "특정 TCP/UDP 포트에 대한 접근을 제한하거나 모든 포트를 허용/차단하십시오.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generer tilgangstoken",
    "actionDeleteAccessToken": "Slett tilgangstoken",
    "actionListAccessTokens": "List opp tilgangstokener",
+    "actionCreateResourceSessionToken": "Opprett ressurs økt-token",
    "actionCreateResourceRule": "Opprett ressursregel",
    "actionDeleteResourceRule": "Slett ressursregel",
    "actionListResourceRules": "List opp ressursregler",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Lukk",
    "createInternalResourceDialogCreateClientResource": "Opprett privat ressurs",
    "createInternalResourceDialogCreateClientResourceDescription": "Opprett en ny ressurs som bare vil være tilgjengelig for kunder som er koblet til organisasjonen",
+    "privateResourceGeneralDescription": "Konfigurer navnet, identifikatoren og andre generelle ressursinnstillinger.",
    "privateResourceCreatePageSeeAll": "Se alle private ressurser",
    "privateResourceAllowIcmpPing": "Tillat ICMP Ping",
    "privateResourceNetworkAccess": "Nettverkstilgang",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Legg til brukere",
    "editInternalResourceDialogAddClients": "Legg til klienter",
    "editInternalResourceDialogDestinationLabel": "Destinasjon",
-    "editInternalResourceDialogDestinationDescription": "Velg hvor denne ressursen kjører og hvordan klienter når den",
+    "editInternalResourceDialogDestinationDescription": "Konfigurer hvordan klienter får tilgang til denne ressursen.",
    "internalResourceFormMultiSiteRoutingHelp": "Valg av flere nettsteder muliggjør motstandskraftig ruting og failover for høy tilgjengelighet.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Lær mer",
    "editInternalResourceDialogPortRestrictionsDescription": "Begrens tilgang til spesifikke TCP/UDP-porter eller tillate/blokkere alle porter.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Genereer Toegangstoken",
    "actionDeleteAccessToken": "Verwijder toegangstoken",
    "actionListAccessTokens": "Lijst toegangstokens",
+    "actionCreateResourceSessionToken": "Maak Resource Sessie Token",
    "actionCreateResourceRule": "Bronregel aanmaken",
    "actionDeleteResourceRule": "Verwijder Resource Regel",
    "actionListResourceRules": "Bron regels weergeven",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Sluiten",
    "createInternalResourceDialogCreateClientResource": "Privé bron maken",
    "createInternalResourceDialogCreateClientResourceDescription": "Maak een nieuwe bron aan die alleen toegankelijk is voor klanten die verbonden zijn met de organisatie",
+    "privateResourceGeneralDescription": "Configureer de naam, identificatie en andere algemene resource-instellingen.",
    "privateResourceCreatePageSeeAll": "Bekijk Alle Privébronnen",
    "privateResourceAllowIcmpPing": "Sta ICMP Ping toe",
    "privateResourceNetworkAccess": "Netwerktoegang",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Gebruikers toevoegen",
    "editInternalResourceDialogAddClients": "Clienten toevoegen",
    "editInternalResourceDialogDestinationLabel": "Bestemming",
-    "editInternalResourceDialogDestinationDescription": "Kies waar deze bron draait en hoe clients deze bereiken",
+    "editInternalResourceDialogDestinationDescription": "Configureer hoe klanten toegang krijgen tot deze resource.",
    "internalResourceFormMultiSiteRoutingHelp": "Selecteren van meerdere sites maakt veerkrachtige routing en failover mogelijk voor hoge beschikbaarheid.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Meer informatie",
    "editInternalResourceDialogPortRestrictionsDescription": "Beperk toegang tot specifieke TCP/UDP-poorten of sta alle poorten toe/blokkeer.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Wygeneruj token dostępu",
    "actionDeleteAccessToken": "Usuń token dostępu",
    "actionListAccessTokens": "Lista tokenów dostępu",
+    "actionCreateResourceSessionToken": "Utwórz token sesji zasobu",
    "actionCreateResourceRule": "Utwórz regułę zasobu",
    "actionDeleteResourceRule": "Usuń regułę zasobu",
    "actionListResourceRules": "Lista reguł zasobu",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Zamknij",
    "createInternalResourceDialogCreateClientResource": "Utwórz zasób prywatny",
    "createInternalResourceDialogCreateClientResourceDescription": "Utwórz nowy zasób, który będzie dostępny tylko dla klientów podłączonych do organizacji",
+    "privateResourceGeneralDescription": "Skonfiguruj nazwę, identyfikator i inne ogólne ustawienia zasobów.",
    "privateResourceCreatePageSeeAll": "Zobacz wszystkie zasoby prywatne",
    "privateResourceAllowIcmpPing": "Zezwalaj na ping ICMP",
    "privateResourceNetworkAccess": "Dostęp do sieci",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Dodaj użytkowników",
    "editInternalResourceDialogAddClients": "Dodaj klientów",
    "editInternalResourceDialogDestinationLabel": "Miejsce docelowe",
-    "editInternalResourceDialogDestinationDescription": "Wybierz, gdzie ten zasób działa i jak klienci go osiągają",
+    "editInternalResourceDialogDestinationDescription": "Skonfiguruj sposób, w jaki klienci docierają do tego zasobu.",
    "internalResourceFormMultiSiteRoutingHelp": "Wybór wielu stron umożliwia odporne trasowanie i awarię dla wysokiej dostępności.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Dowiedz się więcej",
    "editInternalResourceDialogPortRestrictionsDescription": "Ogranicz dostęp do konkretnych portów TCP/UDP lub zezwól/zablokuj wszystkie porty.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Gerar Token de Acesso",
    "actionDeleteAccessToken": "Eliminar Token de Acesso",
    "actionListAccessTokens": "Listar Tokens de Acesso",
+    "actionCreateResourceSessionToken": "Criar Token de Sessão de Recurso",
    "actionCreateResourceRule": "Criar Regra de Recurso",
    "actionDeleteResourceRule": "Eliminar Regra de Recurso",
    "actionListResourceRules": "Listar Regras de Recurso",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Fechar",
    "createInternalResourceDialogCreateClientResource": "Criar Recurso Privado",
    "createInternalResourceDialogCreateClientResourceDescription": "Criar um novo recurso que só será acessível para clientes conectados à organização",
+    "privateResourceGeneralDescription": "Configure o nome, identificador e outras configurações gerais de recursos.",
    "privateResourceCreatePageSeeAll": "Ver Todos os Recursos Privados",
    "privateResourceAllowIcmpPing": "Permitir ICMP Ping",
    "privateResourceNetworkAccess": "Acesso à Rede",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Adicionar Usuários",
    "editInternalResourceDialogAddClients": "Adicionar Clientes",
    "editInternalResourceDialogDestinationLabel": "Destino",
-    "editInternalResourceDialogDestinationDescription": "Escolha onde este recurso é executado e como os clientes o acessam",
+    "editInternalResourceDialogDestinationDescription": "Configure como os clientes acessam este recurso.",
    "internalResourceFormMultiSiteRoutingHelp": "Selecionar múltiplos sites permite roteamento resiliente e failover para alta disponibilidade.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Saiba mais",
    "editInternalResourceDialogPortRestrictionsDescription": "Restrinja o acesso a portas TCP/UDP específicas ou permita/bloqueie todas as portas.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Сгенерировать токен доступа",
    "actionDeleteAccessToken": "Удалить токен доступа",
    "actionListAccessTokens": "Список токенов доступа",
+    "actionCreateResourceSessionToken": "Создать токен сеанса ресурса",
    "actionCreateResourceRule": "Создать правило ресурса",
    "actionDeleteResourceRule": "Удалить правило ресурса",
    "actionListResourceRules": "Список правил ресурса",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Закрыть",
    "createInternalResourceDialogCreateClientResource": "Создать приватный ресурс",
    "createInternalResourceDialogCreateClientResourceDescription": "Создать новый ресурс, который будет доступен только клиентам, подключенным к организации",
+    "privateResourceGeneralDescription": "Настройте имя, идентификатор и другие общие параметры ресурса.",
    "privateResourceCreatePageSeeAll": "Посмотреть все частные ресурсы",
    "privateResourceAllowIcmpPing": "Разрешить ICMP Ping",
    "privateResourceNetworkAccess": "Сетевой доступ",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Добавить пользователей",
    "editInternalResourceDialogAddClients": "Добавить клиентов",
    "editInternalResourceDialogDestinationLabel": "Пункт назначения",
-    "editInternalResourceDialogDestinationDescription": "Выберите, где этот ресурс работает и как к нему получают доступ клиенты",
+    "editInternalResourceDialogDestinationDescription": "Настройте, как клиенты получают доступ к этому ресурсу.",
    "internalResourceFormMultiSiteRoutingHelp": "Выбор нескольких сайтов позволяет обеспечить отказоустойчивую маршрутизацию и фейловер для высокой доступности.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Узнать больше",
    "editInternalResourceDialogPortRestrictionsDescription": "Ограничьте доступ к определенным TCP/UDP-портам или разрешите/заблокируйте все порты.",
@@ -3679,7 +3681,7 @@
    "resourceLauncherSaveForEveryoneDescription": "Поделитесь этим видом со всеми членами организации. Если не отмечено, видимость только для вас.",
    "resourceLauncherMakePersonal": "Сделать личным",
    "resourceLauncherFilter": "Фильтр",
-    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherFilterWithCount": "Фильтр, применено {count}",
    "resourceLauncherSort": "Сортировать",
    "resourceLauncherSortAscending": "Сортировать по возрастанию",
    "resourceLauncherSortDescending": "Сортировать по убыванию",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Erişim Jetonu Oluştur",
    "actionDeleteAccessToken": "Erişim Jetonunu Sil",
    "actionListAccessTokens": "Erişim Jetonlarını Listele",
+    "actionCreateResourceSessionToken": "Kaynak Oturum Otomasyonu Oluştur",
    "actionCreateResourceRule": "Kaynak Kuralı Oluştur",
    "actionDeleteResourceRule": "Kaynak Kuralını Sil",
    "actionListResourceRules": "Kaynak Kurallarını Listele",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "Kapat",
    "createInternalResourceDialogCreateClientResource": "Özel Kaynak Oluştur",
    "createInternalResourceDialogCreateClientResourceDescription": "Seçilen siteye bağlı istemcilere erişilebilir olacak yeni bir kaynak oluşturun",
+    "privateResourceGeneralDescription": "Kaynağın adı, tanımlayıcı ve diğer genel ayarlarını yapılandırın.",
    "privateResourceCreatePageSeeAll": "Tüm Özel Kaynakları Gör",
    "privateResourceAllowIcmpPing": "ICMP Ping İzne Ver",
    "privateResourceNetworkAccess": "Ağ Erişimi",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "Kullanıcılar Ekle",
    "editInternalResourceDialogAddClients": "Müşteriler Ekle",
    "editInternalResourceDialogDestinationLabel": "Hedef",
-    "editInternalResourceDialogDestinationDescription": "Bu kaynağın nerede çalıştığını ve istemcilerin ona nasıl eriştiğini seçin",
+    "editInternalResourceDialogDestinationDescription": "Bu kaynağa müşterilerin nasıl erişeceğini yapılandırın.",
    "internalResourceFormMultiSiteRoutingHelp": "Birden fazla site seçmek, yüksek kullanılabilirlik için dirençli yönlendirme ve yedeklik sağlar.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Daha fazla bilgi",
    "editInternalResourceDialogPortRestrictionsDescription": "Belirtilen TCP/UDP portlarına erişimi kısıtlayın veya tüm portlara izin/engelleme verin.",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "生成访问令牌",
    "actionDeleteAccessToken": "删除访问令牌",
    "actionListAccessTokens": "访问令牌",
+    "actionCreateResourceSessionToken": "创建资源会话令牌",
    "actionCreateResourceRule": "创建资源规则",
    "actionDeleteResourceRule": "删除资源规则",
    "actionListResourceRules": "列出资源规则",
@@ -2392,6 +2393,7 @@
    "createInternalResourceDialogClose": "关闭",
    "createInternalResourceDialogCreateClientResource": "创建私有资源",
    "createInternalResourceDialogCreateClientResourceDescription": "创建一个新资源只能为连接到组织的客户端访问",
+    "privateResourceGeneralDescription": "配置名称、标识符和其他一般资源设置。",
    "privateResourceCreatePageSeeAll": "查看所有私人资源",
    "privateResourceAllowIcmpPing": "允许 ICMP Ping",
    "privateResourceNetworkAccess": "网络访问",
@@ -3268,7 +3270,7 @@
    "editInternalResourceDialogAddUsers": "添加用户",
    "editInternalResourceDialogAddClients": "添加客户端",
    "editInternalResourceDialogDestinationLabel": "目标",
-    "editInternalResourceDialogDestinationDescription": "选择该资源运行位置及客户端访问方式",
+    "editInternalResourceDialogDestinationDescription": "配置客户端如何访问此资源。",
    "internalResourceFormMultiSiteRoutingHelp": "选择多个站点可以实现高可用性的弹性路由和故障转移。",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "了解更多",
    "editInternalResourceDialogPortRestrictionsDescription": "限制访问特定的TCP/UDP端口或允许/阻止所有端口。",
@@ -1099,6 +1099,7 @@
    "actionGenerateAccessToken": "生成訪問令牌",
    "actionDeleteAccessToken": "刪除訪問令牌",
    "actionListAccessTokens": "訪問令牌",
+    "actionCreateResourceSessionToken": "建立資源工作階段權杖",
    "actionCreateResourceRule": "創建資源規則",
    "actionDeleteResourceRule": "刪除資源規則",
    "actionListResourceRules": "列出資源規則",
@@ -12,7 +12,7 @@
                "@asteasolutions/zod-to-openapi": "8.5.0",
                "@aws-sdk/client-s3": "3.1056.0",
                "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
                "@headlessui/react": "2.2.10",
                "@hookform/resolvers": "5.4.0",
                "@monaco-editor/react": "4.7.0",
@@ -1124,9 +1124,9 @@
            "integrity": "sha512-9o7PkCw9fdvGTPs0hgsUJG10QleGgcdsSCw1ekLpUOlVXtWCuiuPH+0bPDFhLWxqbVA+8pyVhwqdOI+t1T3TNA=="
        },
        "node_modules/@devolutions/iron-remote-desktop-rdp": {
-            "version": "0.0.0",
-            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
-            "integrity": "sha512-O0YVpOJDwUzekH3N2QKj+48WP+56wI0sj4VmaJkGoW5XgyAj2ONn2k3i+vk17Eavx+Vg6vAg3lwYRAOK4kKIDQ=="
+            "version": "0.0.1",
+            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
+            "integrity": "sha512-sIHllJ6rJfAgClsUFjJfVGFjIxm6ZQRyGfinwCzHYgwnHAMFE+Kvm0YzR9tg811Fhjm5F6gNUSLAll+7Eh0Deg=="
        },
        "node_modules/@dotenvx/dotenvx": {
            "version": "1.69.1",
@@ -34,7 +34,7 @@
    "dependencies": {
        "@asteasolutions/zod-to-openapi": "8.5.0",
        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
        "@aws-sdk/client-s3": "3.1056.0",
        "@headlessui/react": "2.2.10",
        "@hookform/resolvers": "5.4.0",
@@ -71,6 +71,7 @@ export enum ActionsEnum {
    setResourceWhitelist = "setResourceWhitelist",
    getResourceWhitelist = "getResourceWhitelist",
    generateAccessToken = "generateAccessToken",
+    createResourceSessionToken = "createResourceSessionToken",
    deleteAcessToken = "deleteAcessToken",
    listAccessTokens = "listAccessTokens",
    createResourceRule = "createResourceRule",
@@ -73,6 +73,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/access-token",
+    description: "Generate a new access token for a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.AccessToken],
+    request: {
+        params: generateAccssTokenParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: generateAccessTokenBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function generateAccessToken(
    req: Request,
    res: Response,
@@ -176,6 +176,35 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/access-tokens",
+    description: "List all access tokens for a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.AccessToken],
+    request: {
+        params: z.object({
+            resourceId: z.number()
+        }),
+        query: listAccessTokensSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listAccessTokens(
    req: Request,
    res: Response,
@@ -736,11 +736,14 @@ export async function verifyResourceSession(
            }
        }

-        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge
+        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge.
+        // Skip the challenge when SSO is also enabled so browsers get the SSO redirect instead of a native Basic
+        // Auth dialog; clients that proactively send Authorization: Basic are still accepted above.
        if (
            headerAuthExtendedCompatibility &&
            headerAuthExtendedCompatibility.extendedCompatibilityIsActivated &&
-            !clientHeaderAuth
+            !clientHeaderAuth &&
+            !sso
        ) {
            return headerAuthChallenged(res, redirectPath, resource.orgId);
        }
@@ -162,7 +162,7 @@ authenticated.get(

 // Site Resource endpoints
 authenticated.put(
-    "/org/:orgId/site-resource",
+    ["/org/:orgId/site-resource", "/org/:orgId/private-resource"],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createSiteResource),
@@ -171,7 +171,10 @@ authenticated.put(
 );

 authenticated.get(
-    "/org/:orgId/site/:siteId/resources",
+    [
+        "/org/:orgId/site/:siteId/resources",
+        "/org/:orgId/site/:siteId/private-resources"
+    ],
    verifyApiKeyOrgAccess,
    verifyApiKeySiteAccess,
    verifyApiKeyHasAction(ActionsEnum.listSiteResources),
@@ -179,21 +182,21 @@ authenticated.get(
 );

 authenticated.get(
-    "/org/:orgId/site-resources",
+    ["/org/:orgId/site-resources", "/org/:orgId/private-resources"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listSiteResources),
    siteResource.listAllSiteResourcesByOrg
 );

 authenticated.get(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getSiteResource),
    siteResource.getSiteResource
 );

 authenticated.post(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateSiteResource),
@@ -202,7 +205,7 @@ authenticated.post(
 );

 authenticated.delete(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteSiteResource),
    logActionAudit(ActionsEnum.deleteSiteResource),
@@ -210,28 +213,40 @@ authenticated.delete(
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/roles",
+    [
+        "/site-resource/:siteResourceId/roles",
+        "/private-resource/:siteResourceId/roles"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
    siteResource.listSiteResourceRoles
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/users",
+    [
+        "/site-resource/:siteResourceId/users",
+        "/private-resource/:siteResourceId/users"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    siteResource.listSiteResourceUsers
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/clients",
+    [
+        "/site-resource/:siteResourceId/clients",
+        "/private-resource/:siteResourceId/clients"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    siteResource.listSiteResourceClients
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles",
+    [
+        "/site-resource/:siteResourceId/roles",
+        "/private-resource/:siteResourceId/roles"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -241,7 +256,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users",
+    [
+        "/site-resource/:siteResourceId/users",
+        "/private-resource/:siteResourceId/users"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -251,7 +269,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles/add",
+    [
+        "/site-resource/:siteResourceId/roles/add",
+        "/private-resource/:siteResourceId/roles/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -261,7 +282,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles/remove",
+    [
+        "/site-resource/:siteResourceId/roles/remove",
+        "/private-resource/:siteResourceId/roles/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -271,7 +295,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users/add",
+    [
+        "/site-resource/:siteResourceId/users/add",
+        "/private-resource/:siteResourceId/users/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -281,7 +308,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users/remove",
+    [
+        "/site-resource/:siteResourceId/users/remove",
+        "/private-resource/:siteResourceId/users/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -291,7 +321,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients",
+    [
+        "/site-resource/:siteResourceId/clients",
+        "/private-resource/:siteResourceId/clients"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -301,7 +334,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients/add",
+    [
+        "/site-resource/:siteResourceId/clients/add",
+        "/private-resource/:siteResourceId/clients/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -311,7 +347,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients/remove",
+    [
+        "/site-resource/:siteResourceId/clients/remove",
+        "/private-resource/:siteResourceId/clients/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -321,7 +360,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/client/:clientId/site-resources",
+    ["/client/:clientId/site-resources", "/client/:clientId/private-resources"],
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceUsers),
    logActionAudit(ActionsEnum.setResourceUsers),
@@ -329,7 +368,7 @@ authenticated.post(
 );

 authenticated.put(
-    "/org/:orgId/resource",
+    ["/org/:orgId/resource", "/org/:orgId/public-resource"],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResource),
@@ -338,7 +377,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/org/:orgId/site/:siteId/resource",
+    [
+        "/org/:orgId/site/:siteId/resource",
+        "/org/:orgId/site/:siteId/public-resource"
+    ],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResource),
@@ -347,14 +389,14 @@ authenticated.put(
 );

 authenticated.get(
-    "/site/:siteId/resources",
+    ["/site/:siteId/resources", "/site/:siteId/public-resources"],
    verifyApiKeySiteAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listResources
 );

 authenticated.get(
-    "/org/:orgId/resources",
+    ["/org/:orgId/resources", "/org/:orgId/public-resources"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listResources
@@ -442,42 +484,45 @@ authenticated.delete(
 );

 authenticated.get(
-    "/resource/:resourceId/roles",
+    ["/resource/:resourceId/roles", "/public-resource/:resourceId/roles"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
    resource.listResourceRoles
 );

 authenticated.get(
-    "/resource/:resourceId/users",
+    ["/resource/:resourceId/users", "/public-resource/:resourceId/users"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    resource.listResourceUsers
 );

 authenticated.get(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResource),
    resource.getResource
 );

 authenticated.get(
-    "/resource-policy/:resourcePolicyId",
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
    policy.getResourcePolicy
 );

 authenticated.get(
-    "/resource/:resourceId/policies",
+    ["/resource/:resourceId/policies", "/public-resource/:resourceId/policies"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
    resource.getResourcePolicies
 );

 authenticated.post(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateResource),
@@ -486,14 +531,17 @@ authenticated.post(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId",
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyHasAction(ActionsEnum.updateResourcePolicy),
    policy.updateResourcePolicy
 );

 authenticated.delete(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteResource),
    logActionAudit(ActionsEnum.deleteResource),
@@ -501,7 +549,7 @@ authenticated.delete(
 );

 authenticated.put(
-    "/resource/:resourceId/target",
+    ["/resource/:resourceId/target", "/public-resource/:resourceId/target"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createTarget),
@@ -510,14 +558,14 @@ authenticated.put(
 );

 authenticated.get(
-    "/resource/:resourceId/targets",
+    ["/resource/:resourceId/targets", "/public-resource/:resourceId/targets"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listTargets),
    target.listTargets
 );

 authenticated.put(
-    "/resource/:resourceId/rule",
+    ["/resource/:resourceId/rule", "/public-resource/:resourceId/rule"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResourceRule),
@@ -526,14 +574,17 @@ authenticated.put(
 );

 authenticated.get(
-    "/resource/:resourceId/rules",
+    ["/resource/:resourceId/rules", "/public-resource/:resourceId/rules"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRules),
    resource.listResourceRules
 );

 authenticated.post(
-    "/resource/:resourceId/rule/:ruleId",
+    [
+        "/resource/:resourceId/rule/:ruleId",
+        "/public-resource/:resourceId/rule/:ruleId"
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateResourceRule),
@@ -542,7 +593,10 @@ authenticated.post(
 );

 authenticated.delete(
-    "/resource/:resourceId/rule/:ruleId",
+    [
+        "/resource/:resourceId/rule/:ruleId",
+        "/public-resource/:resourceId/rule/:ruleId"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteResourceRule),
    logActionAudit(ActionsEnum.deleteResourceRule),
@@ -624,7 +678,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/roles",
+    ["/resource/:resourceId/roles", "/public-resource/:resourceId/roles"],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -634,7 +688,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users",
+    ["/resource/:resourceId/users", "/public-resource/:resourceId/users"],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -644,7 +698,10 @@ authenticated.post(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/access-control",
+    [
+        "/resource-policy/:resourcePolicyId/access-control",
+        "/public-resource-policy/:resourcePolicyId/access-control"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -656,7 +713,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/password",
+    [
+        "/resource-policy/:resourcePolicyId/password",
+        "/public-resource-policy/:resourcePolicyId/password"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPassword),
@@ -665,7 +725,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/pincode",
+    [
+        "/resource-policy/:resourcePolicyId/pincode",
+        "/public-resource-policy/:resourcePolicyId/pincode"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPincode),
@@ -674,7 +737,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/header-auth",
+    [
+        "/resource-policy/:resourcePolicyId/header-auth",
+        "/public-resource-policy/:resourcePolicyId/header-auth"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
@@ -683,7 +749,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/whitelist",
+    [
+        "/resource-policy/:resourcePolicyId/whitelist",
+        "/public-resource-policy/:resourcePolicyId/whitelist"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyWhitelist),
@@ -692,7 +761,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/resource-policy/:resourcePolicyId/rules",
+    [
+        "/resource-policy/:resourcePolicyId/rules",
+        "/public-resource-policy/:resourcePolicyId/rules"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRules),
@@ -701,7 +773,10 @@ authenticated.put(
 );

 authenticated.post(
-    "/resource/:resourceId/roles/add",
+    [
+        "/resource/:resourceId/roles/add",
+        "/public-resource/:resourceId/roles/add"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -711,7 +786,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/roles/remove",
+    [
+        "/resource/:resourceId/roles/remove",
+        "/public-resource/:resourceId/roles/remove"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -721,7 +799,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users/add",
+    [
+        "/resource/:resourceId/users/add",
+        "/public-resource/:resourceId/users/add"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -731,7 +812,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users/remove",
+    [
+        "/resource/:resourceId/users/remove",
+        "/public-resource/:resourceId/users/remove"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -741,7 +825,7 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/password`,
+    [`/resource/:resourceId/password`, `/public-resource/:resourceId/password`],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePassword),
@@ -750,7 +834,7 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/pincode`,
+    [`/resource/:resourceId/pincode`, `/public-resource/:resourceId/pincode`],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePincode),
@@ -759,7 +843,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/header-auth`,
+    [
+        `/resource/:resourceId/header-auth`,
+        `/public-resource/:resourceId/header-auth`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceHeaderAuth),
@@ -768,7 +855,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist`,
+    [
+        `/resource/:resourceId/whitelist`,
+        `/public-resource/:resourceId/whitelist`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -777,7 +867,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist/add`,
+    [
+        `/resource/:resourceId/whitelist/add`,
+        `/public-resource/:resourceId/whitelist/add`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -785,7 +878,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist/remove`,
+    [
+        `/resource/:resourceId/whitelist/remove`,
+        `/public-resource/:resourceId/whitelist/remove`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -793,14 +889,20 @@ authenticated.post(
 );

 authenticated.get(
-    `/resource/:resourceId/whitelist`,
+    [
+        `/resource/:resourceId/whitelist`,
+        `/public-resource/:resourceId/whitelist`
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourceWhitelist),
    resource.getResourceWhitelist
 );

 authenticated.post(
-    `/resource/:resourceId/access-token`,
+    [
+        `/resource/:resourceId/access-token`,
+        `/public-resource/:resourceId/access-token`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.generateAccessToken),
@@ -808,6 +910,19 @@ authenticated.post(
    accessToken.generateAccessToken
 );

+authenticated.post(
+    [
+        `/resource/:resourceId/session-token`,
+        `/public-resource/:resourceId/session-token`
+    ],
+    verifyApiKeyResourceAccess,
+    verifyApiKeyUserAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourceSessionToken),
+    logActionAudit(ActionsEnum.createResourceSessionToken),
+    resource.createResourceSessionToken
+);
+
 authenticated.delete(
    `/access-token/:accessTokenId`,
    verifyApiKeyAccessTokenAccess,
@@ -824,7 +939,10 @@ authenticated.get(
 );

 authenticated.get(
-    `/resource/:resourceId/access-tokens`,
+    [
+        `/resource/:resourceId/access-tokens`,
+        `/public-resource/:resourceId/access-tokens`
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listAccessTokens),
    accessToken.listAccessTokens
@@ -1154,7 +1272,7 @@ authenticated.get(
 );

 authenticated.get(
-    "/org/:orgId/resource-names",
+    ["/org/:orgId/resource-names", "/org/:orgId/public-resource-names"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listAllResourceNames
@@ -94,7 +94,13 @@ async function flushSitePingsToDb(): Promise<void> {
    const pingsToFlush = new Map(pendingSitePings);
    pendingSitePings.clear();

-    const entries = Array.from(pingsToFlush.entries());
+    // Sort by id ascending so concurrent writers (other app replicas, or
+    // unrelated single-row updates elsewhere in the app) always acquire row
+    // locks in the same order. Without this, overlapping batches/updates
+    // that touch the same rows in different orders can deadlock each other.
+    const entries = Array.from(pingsToFlush.entries()).sort(
+        ([a], [b]) => a - b
+    );

    const BATCH_SIZE = 50;
    for (let i = 0; i < entries.length; i += BATCH_SIZE) {
@@ -193,7 +199,11 @@ async function flushClientPingsToDb(): Promise<void> {

    // ── Flush client pings ─────────────────────────────────────────────
    if (pingsToFlush.size > 0) {
-        const entries = Array.from(pingsToFlush.entries());
+        // Sort ascending for consistent lock ordering (see note in
+        // flushSitePingsToDb).
+        const entries = Array.from(pingsToFlush.entries()).sort(
+            ([a], [b]) => a - b
+        );

        const BATCH_SIZE = 50;
        for (let i = 0; i < entries.length; i += BATCH_SIZE) {
@@ -191,6 +191,19 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource-policy/{resourcePolicyId}",
+    description: "Get a resource policy by its resourcePolicyId.",
+    tags: [OpenAPITags.Policy],
+    request: {
+        params: z.object({
+            resourcePolicyId: z.number()
+        })
+    },
+    responses: {}
+});
+
 export async function getResourcePolicy(
    req: Request,
    res: Response,
@@ -54,6 +54,25 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourceId}/access-control",
+    description:
+        "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
+    tags: [OpenAPITags.Policy, OpenAPITags.User],
+    request: {
+        params: setResourcePolicyAccessControlParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyAcccessControlBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
 export async function setResourcePolicyAccessControl(
    req: Request,
    res: Response,
@@ -43,6 +43,25 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/header-auth",
+    description:
+        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
+    tags: [OpenAPITags.Policy],
+    request: {
+        params: setResourcePolicyHeaderAuthParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyHeaderAuthBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
 export async function setResourcePolicyHeaderAuth(
    req: Request,
    res: Response,
@@ -38,6 +38,25 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/password",
+    description:
+        "Set the password for a resource policy. Setting the password to null will remove it.",
+    tags: [OpenAPITags.Policy],
+    request: {
+        params: setResourcePolicyPasswordParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPasswordBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
 export async function setResourcePolicyPassword(
    req: Request,
    res: Response,
@@ -41,6 +41,25 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/pincode",
+    description:
+        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
+    tags: [OpenAPITags.Policy],
+    request: {
+        params: setResourcePolicyPincodeParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPincodeBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
 export async function setResourcePolicyPincode(
    req: Request,
    res: Response,
@@ -61,6 +61,25 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/rules",
+    description:
+        "Set all rules for a resource policy at once. This will replace all existing rules.",
+    tags: [OpenAPITags.Policy],
+    request: {
+        params: setResourcePolicyRulesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyRulesBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
 export async function setResourcePolicyRules(
    req: Request,
    res: Response,
@@ -46,6 +46,25 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/whitelist",
+    description:
+        "Set email whitelist for a resource policy. This will replace all existing emails.",
+    tags: [OpenAPITags.Policy],
+    request: {
+        params: setResourcePolicyWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
 export async function setResourcePolicyWhitelist(
    req: Request,
    res: Response,
@@ -36,6 +36,24 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}",
+    description: "Update a resource policy.",
+    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    request: {
+        params: updateResourcePolicyParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateResourcePolicyBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
 export async function updateResourcePolicy(
    req: Request,
    res: Response,
@@ -63,6 +63,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist/add",
+    description: "Add a single email to the resource whitelist.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: addEmailToResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addEmailToResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function addEmailToResourceWhitelist(
    req: Request,
    res: Response,
@@ -59,6 +59,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles/add",
+    description:
+        "Add a single role to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the role is added to the inline policy instead of directly to the resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
+    request: {
+        params: addRoleToResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addRoleToResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function addRoleToResource(
    req: Request,
    res: Response,
@@ -59,6 +59,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users/add",
+    description:
+        "Add a single user to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the user is added to the inline policy instead of directly to the resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
+    request: {
+        params: addUserToResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addUserToResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function addUserToResource(
    req: Request,
    res: Response,
@@ -182,6 +182,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/public-resource",
+    description: "Create a resource.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: createResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createHttpResourceSchema.or(createRawResourceSchema)
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function createResource(
    req: Request,
    res: Response,
@@ -61,6 +61,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "put",
+    path: "/public-resource/{resourceId}/rule",
+    description: "Create a resource rule.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
+    request: {
+        params: createResourceRuleParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createResourceRuleSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function createResourceRule(
    req: Request,
    res: Response,
@@ -0,0 +1,133 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resources, users, userOrgs } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import { createResourceSession } from "@server/auth/sessions/resource";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+import { createSession, generateSessionToken } from "@server/auth/sessions/app";
+import { response } from "@server/lib/response";
+
+const createResourceSessionTokenParams = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+const createResourceSessionTokenBody = z.strictObject({
+    userId: z.string().nonempty(),
+    idpId: z.coerce.number().int().positive().optional()
+});
+
+export type CreateResourceSessionTokenResponse = {
+    requestToken: string;
+};
+
+export async function createResourceSessionToken(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = createResourceSessionTokenParams.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = createResourceSessionTokenBody.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+        const { userId, idpId } = parsedBody.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        const candidates = await db
+            .select({ userId: users.userId })
+            .from(userOrgs)
+            .innerJoin(users, eq(userOrgs.userId, users.userId))
+            .where(
+                and(
+                    eq(users.userId, userId),
+                    eq(userOrgs.orgId, resource.orgId)
+                )
+            );
+
+        if (candidates.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `User not found in the organization that owns this resource`
+                )
+            );
+        }
+
+        if (candidates.length > 1) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Multiple users match this username (external users from different identity providers). Specify idpId to disambiguate."
+                )
+            );
+        }
+
+        const targetUserId = candidates[0].userId;
+
+        const appSessionToken = generateSessionToken();
+        const appSession = await createSession(appSessionToken, targetUserId);
+
+        const requestToken = generateSessionToken();
+        await createResourceSession({
+            resourceId,
+            token: requestToken,
+            userSessionId: appSession.sessionId,
+            isRequestToken: true,
+            expiresAt: Date.now() + 1000 * 30, // 30 seconds
+            sessionLength: 1000 * 30,
+            doNotExtend: true
+        });
+
+        logger.debug("Resource session token created successfully");
+
+        return response<CreateResourceSessionTokenResponse>(res, {
+            data: { requestToken },
+            success: true,
+            error: false,
+            message: "Resource session token created successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
@@ -44,6 +44,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "delete",
+    path: "/public-resource/{resourceId}",
+    description: "Delete a resource.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: deleteResourceSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function deleteResource(
    req: Request,
    res: Response,
@@ -41,6 +41,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "delete",
+    path: "/public-resource/{resourceId}/rule/{ruleId}",
+    description: "Delete a resource rule.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
+    request: {
+        params: deleteResourceRuleSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function deleteResourceRule(
    req: Request,
    res: Response,
@@ -116,6 +116,34 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}",
+    description: "Get a resource by resourceId.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: z.object({
+            resourceId: z.number()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function getResource(
    req: Request,
    res: Response,
@@ -33,6 +33,17 @@ registry.registerPath({
    responses: {}
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/policies",
+    description: "Get the inline and shared policies associated with a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Policy],
+    request: {
+        params: getResourcePoliciesParamsSchema
+    },
+    responses: {}
+});
+
 export async function getResourcePolicies(
    req: Request,
    res: Response,
@@ -66,6 +66,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/whitelist",
+    description: "Get the whitelist of emails for a specific resource.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: getResourceWhitelistSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function getResourceWhitelist(
    req: Request,
    res: Response,
@@ -17,6 +17,7 @@ export * from "./getResourceWhitelist";
 export * from "./authWithWhitelist";
 export * from "./authWithAccessToken";
 export * from "./getExchangeToken";
+export * from "./createResourceSessionToken";
 export * from "./createResourceRule";
 export * from "./deleteResourceRule";
 export * from "./listResourceRules";
@@ -57,6 +57,34 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/public-resource-names",
+    description: "List all resource names for an organization.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: z.object({
+            orgId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listAllResourceNames(
    req: Request,
    res: Response,
@@ -70,6 +70,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/roles",
+    description: "List all roles for a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
+    request: {
+        params: listResourceRolesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listResourceRoles(
    req: Request,
    res: Response,
@@ -94,6 +94,33 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/rules",
+    description: "List rules for a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
+    request: {
+        params: listResourceRulesParamsSchema,
+        query: listResourceRulesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listResourceRules(
    req: Request,
    res: Response,
@@ -60,6 +60,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/users",
+    description: "List all users for a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
+    request: {
+        params: listResourceUsersSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listResourceUsers(
    req: Request,
    res: Response,
@@ -425,6 +425,35 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/public-resources",
+    description: "List resources for an organization.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: z.object({
+            orgId: z.string()
+        }),
+        query: listResourcesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listResources(
    req: Request,
    res: Response,
@@ -63,6 +63,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist/remove",
+    description: "Remove a single email from the resource whitelist.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: removeEmailFromResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeEmailFromResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function removeEmailFromResourceWhitelist(
    req: Request,
    res: Response,
@@ -58,6 +58,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles/remove",
+    description: "Remove a single role from a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
+    request: {
+        params: removeRoleFromResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeRoleFromResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function removeRoleFromResource(
    req: Request,
    res: Response,
@@ -58,6 +58,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users/remove",
+    description: "Remove a single user from a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
+    request: {
+        params: removeUserFromResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeUserFromResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function removeUserFromResource(
    req: Request,
    res: Response,
@@ -60,6 +60,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/header-auth",
+    description:
+        "Set or update the header authentication for a resource. If user and password is not provided, it will remove the header authentication.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setResourceHeaderAuth(
    req: Request,
    res: Response,
@@ -58,6 +58,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/password",
+    description:
+        "Set the password for a resource. Setting the password to null will remove it.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setResourcePassword(
    req: Request,
    res: Response,
@@ -58,6 +58,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/pincode",
+    description:
+        "Set the PIN code for a resource. Setting the PIN code to null will remove it.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setResourcePincode(
    req: Request,
    res: Response,
@@ -52,6 +52,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles",
+    description:
+        "Set roles for a resource. This will replace all existing roles. When the resource has an inline policy defined (no shared resource policy assigned), roles are set on the inline policy instead of directly on the resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
+    request: {
+        params: setResourceRolesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceRolesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setResourceRoles(
    req: Request,
    res: Response,
@@ -52,6 +52,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users",
+    description:
+        "Set users for a resource. This will replace all existing users. When the resource has an inline policy defined (no shared resource policy assigned), users are set on the inline policy instead of directly on the resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
+    request: {
+        params: setUserResourcesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setUserResourcesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setResourceUsers(
    req: Request,
    res: Response,
@@ -66,6 +66,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist",
+    description:
+        "Set email whitelist for a resource. This will replace all existing emails.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: setResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setResourceWhitelist(
    req: Request,
    res: Response,
@@ -273,6 +273,42 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}",
+    description:
+        "Update a resource. Policy fields (sso, mfa, pincode, password, whitelist) update the inline policy when no shared resource policy is assigned; when a shared policy is assigned those fields override the shared policy for this resource only.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: updateResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateHttpResourceBodySchema.and(
+                        updateRawResourceBodySchema
+                    )
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function updateResource(
    req: Request,
    res: Response,
@@ -78,6 +78,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/rule/{ruleId}",
+    description: "Update a resource rule.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
+    request: {
+        params: updateResourceRuleParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateResourceRuleSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function updateResourceRule(
    req: Request,
    res: Response,
@@ -62,6 +62,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients/add",
+    description:
+        "Add a single client to a site resource. Clients with a userId cannot be added.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
+    request: {
+        params: addClientToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addClientToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function addClientToSiteResource(
    req: Request,
    res: Response,
@@ -62,6 +62,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles/add",
+    description: "Add a single role to a site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
+    request: {
+        params: addRoleToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addRoleToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function addRoleToSiteResource(
    req: Request,
    res: Response,
@@ -62,6 +62,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users/add",
+    description: "Add a single user to a site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
+    request: {
+        params: addUserToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addUserToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function addUserToSiteResource(
    req: Request,
    res: Response,
@@ -67,6 +67,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/client/{clientId}/private-resources",
+    description: "Add a machine client to multiple site resources at once.",
+    tags: [OpenAPITags.Client],
+    request: {
+        params: batchAddClientToSiteResourcesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: batchAddClientToSiteResourcesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function batchAddClientToSiteResources(
    req: Request,
    res: Response,
@@ -237,6 +237,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/private-resource",
+    description: "Create a new site resource.",
+    tags: [OpenAPITags.PrivateResource],
+    request: {
+        params: createSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createSiteResourceSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function createSiteResource(
    req: Request,
    res: Response,
@@ -49,6 +49,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "delete",
+    path: "/private-resource/{siteResourceId}",
+    description: "Delete a site resource.",
+    tags: [OpenAPITags.PrivateResource],
+    request: {
+        params: deleteSiteResourceParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function deleteSiteResource(
    req: Request,
    res: Response,
@@ -83,6 +83,36 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}",
+    description: "Get a specific site resource by siteResourceId.",
+    tags: [OpenAPITags.PrivateResource],
+    request: {
+        params: z.object({
+            siteResourceId: z.number(),
+            siteId: z.number(),
+            orgId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 registry.registerPath({
    method: "get",
    path: "/org/{orgId}/site/{siteId}/resource/nice/{niceId}",
@@ -244,6 +244,33 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/private-resources",
+    description: "List all site resources for an organization.",
+    tags: [OpenAPITags.PrivateResource],
+    request: {
+        params: listAllSiteResourcesByOrgParamsSchema,
+        query: listAllSiteResourcesByOrgQuerySchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listAllSiteResourcesByOrg(
    req: Request,
    res: Response,
@@ -61,6 +61,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/clients",
+    description: "List all clients for a site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
+    request: {
+        params: listSiteResourceClientsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listSiteResourceClients(
    req: Request,
    res: Response,
@@ -62,6 +62,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/roles",
+    description: "List all roles for a site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
+    request: {
+        params: listSiteResourceRolesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listSiteResourceRoles(
    req: Request,
    res: Response,
@@ -65,6 +65,32 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/users",
+    description: "List all users for a site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
+    request: {
+        params: listSiteResourceUsersSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listSiteResourceUsers(
    req: Request,
    res: Response,
@@ -81,6 +81,33 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/site/{siteId}/private-resources",
+    description: "List site resources for a site.",
+    tags: [OpenAPITags.PrivateResource],
+    request: {
+        params: listSiteResourcesParamsSchema,
+        query: listSiteResourcesQuerySchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listSiteResources(
    req: Request,
    res: Response,
@@ -62,6 +62,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients/remove",
+    description:
+        "Remove a single client from a site resource. Clients with a userId cannot be removed.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
+    request: {
+        params: removeClientFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeClientFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function removeClientFromSiteResource(
    req: Request,
    res: Response,
@@ -62,6 +62,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles/remove",
+    description: "Remove a single role from a site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
+    request: {
+        params: removeRoleFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeRoleFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function removeRoleFromSiteResource(
    req: Request,
    res: Response,
@@ -62,6 +62,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users/remove",
+    description: "Remove a single user from a site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
+    request: {
+        params: removeUserFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeUserFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function removeUserFromSiteResource(
    req: Request,
    res: Response,
@@ -62,6 +62,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients",
+    description:
+        "Set clients for a site resource. This will replace all existing clients. Clients with a userId cannot be added.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
+    request: {
+        params: setSiteResourceClientsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceClientsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setSiteResourceClients(
    req: Request,
    res: Response,
@@ -63,6 +63,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles",
+    description:
+        "Set roles for a site resource. This will replace all existing roles.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
+    request: {
+        params: setSiteResourceRolesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceRolesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setSiteResourceRoles(
    req: Request,
    res: Response,
@@ -64,6 +64,40 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users",
+    description:
+        "Set users for a site resource. This will replace all existing users.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
+    request: {
+        params: setSiteResourceUsersParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceUsersBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function setSiteResourceUsers(
    req: Request,
    res: Response,
@@ -237,6 +237,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}",
+    description: "Update a site resource.",
+    tags: [OpenAPITags.PrivateResource],
+    request: {
+        params: updateSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateSiteResourceSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function updateSiteResource(
    req: Request,
    res: Response,
@@ -122,6 +122,39 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "put",
+    path: "/public-resource/{resourceId}/target",
+    description: "Create a target for a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
+    request: {
+        params: createTargetParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createTargetSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function createTarget(
    req: Request,
    res: Response,
@@ -115,6 +115,33 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/targets",
+    description: "List targets for a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
+    request: {
+        params: listTargetsParamsSchema,
+        query: listTargetsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listTargets(
    req: Request,
    res: Response,
@@ -106,17 +106,23 @@ export function PrivateResourceNetworkAccessFields({
    embedInParentGrid = false
 }: PrivateResourceNetworkAccessFieldsProps) {
    const t = useTranslations();
+    const resolvedInitialTcp = initialTcp !== undefined ? initialTcp : "*";
+    const resolvedInitialUdp = initialUdp !== undefined ? initialUdp : "*";
    const [tcpPortMode, setTcpPortMode] = useState<PortMode>(() =>
-        getPortModeFromString(initialTcp)
+        getPortModeFromString(resolvedInitialTcp)
    );
    const [udpPortMode, setUdpPortMode] = useState<PortMode>(() =>
-        getPortModeFromString(initialUdp)
+        getPortModeFromString(resolvedInitialUdp)
    );
    const [tcpCustomPorts, setTcpCustomPorts] = useState(() =>
-        initialTcp && initialTcp !== "*" ? initialTcp : ""
+        resolvedInitialTcp && resolvedInitialTcp !== "*"
+            ? resolvedInitialTcp
+            : ""
    );
    const [udpCustomPorts, setUdpCustomPorts] = useState(() =>
-        initialUdp && initialUdp !== "*" ? initialUdp : ""
+        resolvedInitialUdp && resolvedInitialUdp !== "*"
+            ? resolvedInitialUdp
+            : ""
    );

    useEffect(() => {
@@ -64,7 +64,7 @@ export default function PrivateResourceGeneralPage() {
                        {t("resourceGeneral")}
                    </SettingsSectionTitle>
                    <SettingsSectionDescription>
-                        {t("resourceGeneralDescription")}
+                        {t("privateResourceGeneralDescription")}
                    </SettingsSectionDescription>
                </SettingsSectionHeader>

@@ -77,7 +77,8 @@ function getActionsCategories(root: boolean) {
            [t("actionDeleteSiteResource")]: "deleteSiteResource",
            [t("actionGetSiteResource")]: "getSiteResource",
            [t("actionListSiteResources")]: "listSiteResources",
-            [t("actionUpdateSiteResource")]: "updateSiteResource"
+            [t("actionUpdateSiteResource")]: "updateSiteResource",
+            [t("actionCreateResourceSessionToken")]: "createResourceSessionToken"
        },

        Target: {
Author	SHA1	Message	Date
Owen	a2c96ea2f7	Add aliaes for public/private resources	2026-07-09 20:23:19 -04:00
Owen	dc7eb630c3	Add missing action	2026-07-09 11:16:15 -04:00
Owen Schwartz	bbcd352817	Merge pull request #3420 from fosrl/crowdin_dev New Crowdin updates	2026-07-09 10:35:21 -04:00
Owen Schwartz	21d9199978	New translations en-us.json (French) [ci skip]	2026-07-09 10:34:31 -04:00
Owen Schwartz	3e7b9d7bff	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-07-09 10:34:29 -04:00
Owen Schwartz	54acdbe282	New translations en-us.json (Chinese Simplified) [ci skip]	2026-07-09 10:34:27 -04:00
Owen Schwartz	11bbd028fc	New translations en-us.json (Turkish) [ci skip]	2026-07-09 10:34:24 -04:00
Owen Schwartz	7ae99731f4	New translations en-us.json (Russian) [ci skip]	2026-07-09 10:34:22 -04:00
Owen Schwartz	17b4fd9a44	New translations en-us.json (Portuguese) [ci skip]	2026-07-09 10:34:20 -04:00
Owen Schwartz	caa398ae54	New translations en-us.json (Polish) [ci skip]	2026-07-09 10:34:18 -04:00
Owen Schwartz	035e324e5a	New translations en-us.json (Dutch) [ci skip]	2026-07-09 10:34:16 -04:00
Owen Schwartz	272a5737b0	New translations en-us.json (Korean) [ci skip]	2026-07-09 10:34:14 -04:00
Owen Schwartz	be50fd4586	New translations en-us.json (Italian) [ci skip]	2026-07-09 10:34:12 -04:00
Owen Schwartz	8301511efe	New translations en-us.json (German) [ci skip]	2026-07-09 10:34:10 -04:00
Owen Schwartz	c527ce6562	New translations en-us.json (Danish) [ci skip]	2026-07-09 10:34:08 -04:00
Owen Schwartz	80bee900aa	New translations en-us.json (Czech) [ci skip]	2026-07-09 10:34:06 -04:00
Owen Schwartz	54209c2390	New translations en-us.json (Bulgarian) [ci skip]	2026-07-09 10:34:04 -04:00
Owen Schwartz	3b0ee8d9d4	New translations en-us.json (Spanish) [ci skip]	2026-07-09 10:34:02 -04:00
miloschwartz	7a0a877dc0	fix create private resource ports default to blocked	2026-07-09 10:28:06 -04:00
Owen	b6ed762724	Sort before inserting	2026-07-09 10:18:41 -04:00
Owen Schwartz	d1d58cf455	Merge pull request #3418 from fosrl/crowdin_dev New Crowdin updates	2026-07-09 10:00:30 -04:00
Owen Schwartz	e22f30c694	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-07-09 09:59:33 -04:00
Owen Schwartz	d71c112959	New translations en-us.json (Turkish) [ci skip]	2026-07-09 09:59:30 -04:00
Owen Schwartz	199e960f6d	New translations en-us.json (Portuguese) [ci skip]	2026-07-09 09:59:26 -04:00
Owen Schwartz	843b9a0b16	New translations en-us.json (Dutch) [ci skip]	2026-07-09 09:59:23 -04:00
Owen Schwartz	b9aedc65fe	New translations en-us.json (Italian) [ci skip]	2026-07-09 09:59:20 -04:00
Owen Schwartz	11f5cfd4f8	New translations en-us.json (German) [ci skip]	2026-07-09 09:59:18 -04:00
Owen Schwartz	2ff2e32e9c	New translations en-us.json (Danish) [ci skip]	2026-07-09 09:59:16 -04:00
Owen Schwartz	facb1e4cdf	New translations en-us.json (Spanish) [ci skip]	2026-07-09 09:59:11 -04:00
Owen	6d129c0738	Fix #3099	2026-07-08 21:44:20 -04:00
Owen	67a3d226f5	Add session creation	2026-07-08 21:17:40 -04:00
Owen	19a3773880	Update ironrdp Ref #3272	2026-07-08 16:23:53 -04:00