Bump axios from 1.16.1 to 1.18.0

Bumps [axios](https://github.com/axios/axios) from 1.16.1 to 1.18.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.16.1...v1.18.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #3467 from fosrl/dev
2026-07-21 21:16:30 +02:00 · 2026-07-20 19:06:46 +00:00 · 2026-07-20 11:46:48 -04:00 · 2026-07-20 11:44:25 -04:00 · 2026-07-20 11:44:07 -04:00 · 2026-07-20 11:44:07 -04:00
94 changed files with 2783 additions and 245 deletions
@@ -41,7 +41,7 @@ services:
      - 80:80 # Port for traefik because of the network_mode

  traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
@@ -50,7 +50,7 @@ services:
      - 80:80{{end}}

  traefik:
-    image: docker.io/traefik:v3.6
+    image: docker.io/traefik:v3.7
    container_name: traefik
    restart: unless-stopped
    {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
@@ -934,7 +934,7 @@
    "newtVersion": "Version",
    "architecture": "Architecture",
    "sites": "Sites",
-    "siteWgAnyClients": "Use any WireGuard client to connect. You will have to address internal resources using the peer IP.",
+    "siteWgAnyClients": "Use any WireGuard client to connect. You will have to address private resources using the peer IP.",
    "siteWgCompatibleAllClients": "Compatible with all WireGuard clients",
    "siteWgManualConfigurationRequired": "Manual configuration required",
    "userErrorNotAdminOrOwner": "User is not an admin or owner",
@@ -1995,6 +1995,9 @@
    "domainPickerSubdomain": "Subdomain: {subdomain}",
    "domainPickerNamespace": "Namespace: {namespace}",
    "domainPickerShowMore": "Show More",
+    "domainPickerNoDomainsAvailableTitle": "No domains available",
+    "domainPickerNoDomainsAvailableDescription": "You don't have any domains set up yet. Create a domain to continue.",
+    "domainPickerNoDomainsAvailableAction": "Go to Domains",
    "regionSelectorTitle": "Select Region",
    "domainPickerRemoteExitNodeWarning": "Provided domains are not supported when sites connect to remote exit nodes. For resources to be available on remote nodes, use a custom domain instead.",
    "regionSelectorInfo": "Selecting a region helps us provide better performance for your location. You do not have to be in the same region as your server.",
@@ -2358,7 +2361,7 @@
    "resourcesTableProxyResources": "Public",
    "resourcesTableClientResources": "Private",
    "resourcesTableNoProxyResourcesFound": "No proxy resources found.",
-    "resourcesTableNoInternalResourcesFound": "No internal resources found.",
+    "resourcesTableNoInternalResourcesFound": "No private resources found.",
    "resourcesTableDestination": "Destination",
    "resourcesTableAlias": "Alias",
    "resourcesTableAliasAddress": "Alias Address",
@@ -2381,9 +2384,9 @@
    "editInternalResourceDialogCancel": "Cancel",
    "editInternalResourceDialogSaveResource": "Save Resource",
    "editInternalResourceDialogSuccess": "Success",
-    "editInternalResourceDialogInternalResourceUpdatedSuccessfully": "Internal resource updated successfully",
+    "editInternalResourceDialogInternalResourceUpdatedSuccessfully": "Private resource updated successfully",
    "editInternalResourceDialogError": "Error",
-    "editInternalResourceDialogFailedToUpdateInternalResource": "Failed to update internal resource",
+    "editInternalResourceDialogFailedToUpdateInternalResource": "Failed to update private resource",
    "editInternalResourceDialogNameRequired": "Name is required",
    "editInternalResourceDialogNameMaxLength": "Name must be less than 255 characters",
    "editInternalResourceDialogProxyPortMin": "Proxy port must be at least 1",
@@ -2409,7 +2412,7 @@
    "editInternalResourceDialogAlias": "Alias",
    "editInternalResourceDialogAliasDescription": "An optional internal DNS alias for this resource.",
    "createInternalResourceDialogNoSitesAvailable": "No Sites Available",
-    "createInternalResourceDialogNoSitesAvailableDescription": "You need to have at least one Newt site with a subnet configured to create internal resources.",
+    "createInternalResourceDialogNoSitesAvailableDescription": "You need to have at least one Newt site with a subnet configured to create private resources.",
    "createInternalResourceDialogClose": "Close",
    "createInternalResourceDialogCreateClientResource": "Create Private Resource",
    "createInternalResourceDialogCreateClientResourceDescription": "Create a new resource that will only be accessible to clients connected to the organization",
@@ -2438,9 +2441,9 @@
    "createInternalResourceDialogCancel": "Cancel",
    "createInternalResourceDialogCreateResource": "Create Resource",
    "createInternalResourceDialogSuccess": "Success",
-    "createInternalResourceDialogInternalResourceCreatedSuccessfully": "Internal resource created successfully",
+    "createInternalResourceDialogInternalResourceCreatedSuccessfully": "Private resource created successfully",
    "createInternalResourceDialogError": "Error",
-    "createInternalResourceDialogFailedToCreateInternalResource": "Failed to create internal resource",
+    "createInternalResourceDialogFailedToCreateInternalResource": "Failed to create private resource",
    "createInternalResourceDialogNameRequired": "Name is required",
    "createInternalResourceDialogNameMaxLength": "Name must be less than 255 characters",
    "createInternalResourceDialogPleaseSelectSite": "Please select a site",
@@ -51,7 +51,7 @@
                "@xterm/addon-web-links": "^0.12.0",
                "@xterm/xterm": "^6.0.0",
                "arctic": "3.7.0",
-                "axios": "1.16.1",
+                "axios": "1.18.0",
                "better-sqlite3": "11.9.1",
                "canvas-confetti": "1.9.4",
                "class-variance-authority": "0.7.1",
@@ -9078,9 +9078,9 @@
            }
        },
        "node_modules/axios": {
-            "version": "1.16.1",
-            "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.1.tgz",
-            "integrity": "sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==",
+            "version": "1.18.0",
+            "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.0.tgz",
+            "integrity": "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==",
            "license": "MIT",
            "dependencies": {
                "follow-redirects": "^1.16.0",
@@ -74,7 +74,7 @@
        "@xterm/addon-web-links": "^0.12.0",
        "@xterm/xterm": "^6.0.0",
        "arctic": "3.7.0",
-        "axios": "1.16.1",
+        "axios": "1.18.0",
        "better-sqlite3": "11.9.1",
        "canvas-confetti": "1.9.4",
        "class-variance-authority": "0.7.1",
@@ -30,14 +30,14 @@ export const NotifyTrialExpiring = ({
    const isLastDay = daysRemaining === 1;

    const previewText = hasEnded
-        ? `Your trial for ${orgName} has ended.`
+        ? `Your cloud trial for ${orgName} has ended.`
        : isLastDay
-          ? `Your trial for ${orgName} ends tomorrow.`
-          : `Your trial for ${orgName} ends in ${daysRemaining} days.`;
+          ? `Your cloud trial for ${orgName} ends tomorrow.`
+          : `Your cloud trial for ${orgName} ends in ${daysRemaining} days.`;

    const heading = hasEnded
-        ? "Your Trial Ended"
-        : "Your Trial is Ending Soon";
+        ? "Your Cloud Trial Ended"
+        : "Your Cloud Trial is Ending Soon";

    return (
        <Html>
@@ -55,7 +55,7 @@ export const NotifyTrialExpiring = ({
                        {hasEnded ? (
                            <>
                                <EmailText>
-                                    Your free trial for{" "}
+                                    Your cloud free trial for{" "}
                                    <strong>{orgName}</strong> ended on{" "}
                                    <strong>{trialEndsAt}</strong>. Your account
                                    has been moved to the free plan, which
@@ -64,10 +64,11 @@ export const NotifyTrialExpiring = ({

                                <EmailText>
                                    Some features and resources may now be
-                                    restricted. To restore full
-                                    access and continue using all the features
-                                    you had during your trial, please upgrade to
-                                    a paid plan.
+                                    restricted. To restore full access and
+                                    continue using all the features you had
+                                    during your trial, please upgrade to a paid
+                                    plan. This does not effect any self hosted
+                                    licenses.
                                </EmailText>

                                <EmailText>
@@ -93,7 +94,8 @@ export const NotifyTrialExpiring = ({
                                <EmailText>
                                    After your trial ends, your account will be
                                    moved to the free plan and some
-                                    functionality may be restricted.
+                                    functionality may be restricted. This does
+                                    not effect any self hosted licenses.
                                </EmailText>

                                <EmailText>
@@ -12,7 +12,7 @@ import { logIncomingMiddleware } from "./middlewares/logIncoming";
 import helmet from "helmet";
 import swaggerUi from "swagger-ui-express";
 import { OpenApiGeneratorV3 } from "@asteasolutions/zod-to-openapi";
-import { registry } from "./openApi";
+import { registry, openApiTags } from "./openApi";
 import fs from "fs";
 import path from "path";
 import { APP_PATH } from "./lib/consts";
@@ -181,7 +181,8 @@ function getOpenApiDocumentation() {
            version: "v1",
            title: "Pangolin Integration API"
        },
-        servers: [{ url: "/v1" }]
+        servers: [{ url: "/v1" }],
+        tags: openApiTags
    });

    if (!process.env.DISABLE_GEN_OPENAPI) {
@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";

 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.20.0";
+export const APP_VERSION = "1.21.0";

 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);
@@ -15,10 +15,41 @@ function getSegmentRegex(patternPart: string): RegExp {
    return regex;
 }

+// Decodes percent-encoding (so an encoded slash like `%2F` is treated as a
+// real path separator, matching what most backends will do) and then
+// resolves `.` / `..` segments, so a request like `/public%2F..%2Fadmin/`
+// or `/public/../admin/` is matched as `/admin/`, not as a literal segment
+// or a wildcard-swallowed sequence under `/public/*`.
+function decodeAndResolvePath(p: string): string[] {
+    const rawParts = p.split("/").filter(Boolean);
+
+    const resolved: string[] = [];
+    for (const rawPart of rawParts) {
+        let part: string;
+        try {
+            part = decodeURIComponent(rawPart);
+        } catch {
+            part = rawPart;
+        }
+
+        // an encoded slash can turn one raw segment into several real ones
+        for (const segment of part.split("/").filter(Boolean)) {
+            if (segment === ".") {
+                continue;
+            } else if (segment === "..") {
+                resolved.pop();
+            } else {
+                resolved.push(segment);
+            }
+        }
+    }
+
+    return resolved;
+}
+
 export function isPathAllowed(pattern: string, path: string): boolean {
-    const normalize = (p: string) => p.split("/").filter(Boolean);
-    const patternParts = normalize(pattern);
-    const pathParts = normalize(path);
+    const patternParts = pattern.split("/").filter(Boolean);
+    const pathParts = decodeAndResolvePath(path);

    function matchSegments(
        patternIndex: number,
@@ -4,23 +4,34 @@ export const registry = new OpenAPIRegistry();

 export enum OpenAPITags {
    Site = "Site",
-    Org = "Organization",
    PublicResource = "Public Resource",
+    Target = "Resource Target",
    PrivateResource = "Private Resource",
-    Policy = "Policy",
+    Client = "Client",
+    Org = "Organization",
+    Domain = "Domain",
+    PublicResourcePolicy = "Public Resource Policy",
    Role = "Role",
    User = "User",
-    Invitation = "User Invitation",
-    Target = "Resource Target",
    Rule = "Rule",
+    Invitation = "User Invitation",
    AccessToken = "Access Token",
    GlobalIdp = "Identity Provider (Global)",
    OrgIdp = "Identity Provider (Organization Only)",
-    Client = "Client",
    ApiKey = "API Key",
    SiteProvisioningKey = "Site Provisioning Key",
-    Domain = "Domain",
    Blueprint = "Blueprint",
    Ssh = "SSH",
-    Logs = "Logs"
+    Logs = "Logs",
+    EventStreamingDestination = "Event Streaming Destination",
+    AlertRule = "Alert Rule",
+    HealthCheck = "Health Check",
+    PublicResourcePolicyLegacy = "Public Resource Policy (Legacy)",
+    PublicResourceLegacy = "Public Resource (Legacy)",
+    PrivateResourceLegacy = "Private Resource (Legacy)"
 }
+
+// Order here controls the order tags are displayed in Swagger UI
+export const openApiTags = Object.values(OpenAPITags).map((name) => ({
+    name
+}));
@@ -191,7 +191,7 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/alert-rule",
    description: "Create an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        params: paramsSchema,
        body: {
@@ -34,7 +34,7 @@ registry.registerPath({
    method: "delete",
    path: "/org/{orgId}/alert-rule/{alertRuleId}",
    description: "Delete an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        params: paramsSchema
    },
@@ -48,7 +48,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/alert-rule/{alertRuleId}",
    description: "Get a specific alert rule for an organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        params: paramsSchema
    },
@@ -90,7 +90,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/alert-rules",
    description: "List all alert rules for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        query: querySchema,
        params: paramsSchema
@@ -158,7 +158,7 @@ registry.registerPath({
    method: "post",
    path: "/org/{orgId}/alert-rule/{alertRuleId}",
    description: "Update an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
    request: {
        params: paramsSchema,
        body: {
@@ -52,7 +52,7 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/event-streaming-destination",
    description: "Create an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
    request: {
        params: paramsSchema,
        body: {
@@ -35,7 +35,7 @@ registry.registerPath({
    path: "/org/{orgId}/event-streaming-destination/{destinationId}",
    description:
        "Delete an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
    request: {
        params: paramsSchema
    },
@@ -109,7 +109,7 @@ registry.registerPath({
    path: "/org/{orgId}/event-streaming-destination",
    description:
        "List all event streaming destinations for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
    request: {
        query: querySchema,
        params: paramsSchema
@@ -55,7 +55,7 @@ registry.registerPath({
    method: "post",
    path: "/org/{orgId}/event-streaming-destination/{destinationId}",
    description: "Update an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
    request: {
        params: paramsSchema,
        body: {
@@ -75,7 +75,7 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/health-check",
    description: "Create a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
    request: {
        params: paramsSchema,
        body: {
@@ -37,7 +37,7 @@ registry.registerPath({
    method: "delete",
    path: "/org/{orgId}/health-check/{healthCheckId}",
    description: "Delete a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
    request: {
        params: paramsSchema
    },
@@ -63,7 +63,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/health-checks",
    description: "List health checks for an organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
    request: {
        params: paramsSchema,
        query: querySchema
@@ -109,7 +109,7 @@ registry.registerPath({
    method: "post",
    path: "/org/{orgId}/health-check/{healthCheckId}",
    description: "Update a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
    request: {
        params: paramsSchema,
        body: {
@@ -17,6 +17,10 @@ import * as logs from "#private/routers/auditLogs";
 import * as alertEvents from "#private/routers/alertEvents";
 import * as certificates from "#private/routers/certificates";
 import * as siteProvisioning from "#private/routers/siteProvisioning";
+import * as policy from "#private/routers/policy";
+import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
+import * as alertRule from "#private/routers/alertRule";
+import * as healthChecks from "#private/routers/healthChecks";

 import {
    verifyApiKeyHasAction,
@@ -26,6 +30,7 @@ import {
    verifyApiKeyRoleAccess,
    verifyApiKeyUserAccess,
    verifyApiKeySiteProvisioningKeyAccess,
+    verifyApiKeyResourcePolicyAccess,
    verifyLimits
 } from "@server/middlewares";
 import * as user from "#private/routers/user";
@@ -259,3 +264,150 @@ authenticated.patch(
    logActionAudit(ActionsEnum.updateSiteProvisioningKey),
    siteProvisioning.updateSiteProvisioningKey
 );
+
+authenticated.get(
+    ["/org/:orgId/resource-policies", "/org/:orgId/public-resource-policies"],
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.listResourcePolicies),
+    logActionAudit(ActionsEnum.listResourcePolicies),
+    policy.listResourcePolicies
+);
+
+authenticated.post(
+    ["/org/:orgId/resource-policy", "/org/:orgId/public-resource-policy"],
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourcePolicy),
+    logActionAudit(ActionsEnum.createResourcePolicy),
+    policy.createResourcePolicy
+);
+
+authenticated.delete(
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.deleteResourcePolicy),
+    logActionAudit(ActionsEnum.deleteResourcePolicy),
+    policy.deleteResourcePolicy
+);
+
+authenticated.put(
+    "/org/:orgId/event-streaming-destination",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createEventStreamingDestination),
+    logActionAudit(ActionsEnum.createEventStreamingDestination),
+    eventStreamingDestination.createEventStreamingDestination
+);
+
+authenticated.post(
+    "/org/:orgId/event-streaming-destination/:destinationId",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.updateEventStreamingDestination),
+    logActionAudit(ActionsEnum.updateEventStreamingDestination),
+    eventStreamingDestination.updateEventStreamingDestination
+);
+
+authenticated.delete(
+    "/org/:orgId/event-streaming-destination/:destinationId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteEventStreamingDestination),
+    logActionAudit(ActionsEnum.deleteEventStreamingDestination),
+    eventStreamingDestination.deleteEventStreamingDestination
+);
+
+authenticated.get(
+    "/org/:orgId/event-streaming-destinations",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listEventStreamingDestinations),
+    eventStreamingDestination.listEventStreamingDestinations
+);
+
+authenticated.put(
+    "/org/:orgId/alert-rule",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createAlertRule),
+    logActionAudit(ActionsEnum.createAlertRule),
+    alertRule.createAlertRule
+);
+
+authenticated.post(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateAlertRule),
+    logActionAudit(ActionsEnum.updateAlertRule),
+    alertRule.updateAlertRule
+);
+
+authenticated.delete(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteAlertRule),
+    logActionAudit(ActionsEnum.deleteAlertRule),
+    alertRule.deleteAlertRule
+);
+
+authenticated.get(
+    "/org/:orgId/alert-rules",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listAlertRules),
+    alertRule.listAlertRules
+);
+
+authenticated.get(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getAlertRule),
+    alertRule.getAlertRule
+);
+
+authenticated.get(
+    "/org/:orgId/health-checks",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listHealthChecks),
+    healthChecks.listHealthChecks
+);
+
+authenticated.put(
+    "/org/:orgId/health-check",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createHealthCheck),
+    logActionAudit(ActionsEnum.createHealthCheck),
+    healthChecks.createHealthCheck
+);
+
+authenticated.post(
+    "/org/:orgId/health-check/:healthCheckId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateHealthCheck),
+    logActionAudit(ActionsEnum.updateHealthCheck),
+    healthChecks.updateHealthCheck
+);
+
+authenticated.delete(
+    "/org/:orgId/health-check/:healthCheckId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteHealthCheck),
+    logActionAudit(ActionsEnum.deleteHealthCheck),
+    healthChecks.deleteHealthCheck
+);
+
+authenticated.get(
+    "/org/:orgId/health-check/:healthCheckId/status-history",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getTarget),
+    healthChecks.getHealthCheckStatusHistory
+);
@@ -121,7 +121,7 @@ registry.registerPath({
    method: "post",
    path: "/org/{orgId}/resource-policy",
    description: "Create a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: createResourcePolicyParamsSchema,
        body: {
@@ -31,7 +31,7 @@ registry.registerPath({
    method: "delete",
    path: "/resource-policy/{resourcePolicyId}",
    description: "Delete a resource policy.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: deleteResourcePolicySchema
    },
@@ -79,7 +79,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/resource-policies",
    description: "List resource policies for an organization.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: z.object({
            orgId: z.string()
@@ -45,6 +45,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/access-token",
    description: "Generate a new access token for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: generateAccssTokenParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: generateAccessTokenBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/access-token",
+    description: "Generate a new access token for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.AccessToken],
    request: {
        params: generateAccssTokenParamsSchema,
@@ -159,6 +159,35 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/access-tokens",
    description: "List all access tokens for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: z.object({
+            resourceId: z.number()
+        }),
+        query: listAccessTokensSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/access-tokens",
+    description: "List all access tokens for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.AccessToken],
    request: {
        params: z.object({
@@ -236,6 +236,38 @@ function runTests() {
        "Root path should not match non-root path"
    );

+    // Path traversal / encoded-slash bypass regression tests
+    assertEquals(
+        isPathAllowed("public/*", "public/../admin"),
+        false,
+        "Literal .. traversal out of an allowed prefix must not match"
+    );
+    assertEquals(
+        isPathAllowed("public/*", "public%2F..%2Fadmin"),
+        false,
+        "Encoded-slash traversal out of an allowed prefix must not match"
+    );
+    assertEquals(
+        isPathAllowed("public/*", "public%2f..%2fadmin%2ffile"),
+        false,
+        "Encoded-slash traversal is case-insensitively decoded before matching"
+    );
+    assertEquals(
+        isPathAllowed("admin/*", "public/../admin/secret"),
+        true,
+        ".. traversal INTO a restricted path should still be caught by its own rule"
+    );
+    assertEquals(
+        isPathAllowed("public/*", "public%2Ffoo"),
+        true,
+        "Encoded slash without traversal should still resolve and match normally"
+    );
+    assertEquals(
+        isPathAllowed("public/*", "public/./foo"),
+        true,
+        "Single-dot segments are a no-op and should not affect matching"
+    );
+
    console.log("All path matching tests passed!");
 }

@@ -418,7 +418,7 @@ export async function verifyResourceSession(
        }

        // check for HTTP Basic Auth header
-        const clientHeaderAuthKey = `headerAuth:${clientHeaderAuth}`;
+        const clientHeaderAuthKey = `headerAuth:${resource.resourceId}:${clientHeaderAuth}`;
        if (headerAuth && clientHeaderAuth) {
            if (localCache.get(clientHeaderAuthKey)) {
                logger.debug(
@@ -33,7 +33,7 @@ const UpdateDomainResponseDataSchema = z.object({


 registry.registerPath({
-    method: "patch",
+    method: "post",
    path: "/org/{orgId}/domain/{domainId}",
    description: "Update a domain by domainId.",
    tags: [OpenAPITags.Domain],
@@ -55,6 +55,31 @@ registry.registerPath({
    }
 });

+registry.registerPath({
+    method: "patch",
+    path: "/org/{orgId}/domain/{domainId}",
+    description:
+        "Update a domain by domainId. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.Domain],
+    request: {
+        params: z.object({
+            domainId: z.string(),
+            orgId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateDomainResponseDataSchema)
+                }
+            }
+        }
+    }
+});
+
 export async function updateOrgDomain(
    req: Request,
    res: Response,
@@ -163,7 +163,7 @@ authenticated.get(

 // Site Resource endpoints
 authenticated.put(
-    "/org/:orgId/site-resource",
+    ["/org/:orgId/site-resource", "/org/:orgId/private-resource"],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createSiteResource),
@@ -172,7 +172,10 @@ authenticated.put(
 );

 authenticated.get(
-    "/org/:orgId/site/:siteId/resources",
+    [
+        "/org/:orgId/site/:siteId/resources",
+        "/org/:orgId/site/:siteId/private-resources"
+    ],
    verifyApiKeyOrgAccess,
    verifyApiKeySiteAccess,
    verifyApiKeyHasAction(ActionsEnum.listSiteResources),
@@ -180,21 +183,21 @@ authenticated.get(
 );

 authenticated.get(
-    "/org/:orgId/site-resources",
+    ["/org/:orgId/site-resources", "/org/:orgId/private-resources"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listSiteResources),
    siteResource.listAllSiteResourcesByOrg
 );

 authenticated.get(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getSiteResource),
    siteResource.getSiteResource
 );

 authenticated.post(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateSiteResource),
@@ -203,7 +206,7 @@ authenticated.post(
 );

 authenticated.delete(
-    "/site-resource/:siteResourceId",
+    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteSiteResource),
    logActionAudit(ActionsEnum.deleteSiteResource),
@@ -211,28 +214,40 @@ authenticated.delete(
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/roles",
+    [
+        "/site-resource/:siteResourceId/roles",
+        "/private-resource/:siteResourceId/roles"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
    siteResource.listSiteResourceRoles
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/users",
+    [
+        "/site-resource/:siteResourceId/users",
+        "/private-resource/:siteResourceId/users"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    siteResource.listSiteResourceUsers
 );

 authenticated.get(
-    "/site-resource/:siteResourceId/clients",
+    [
+        "/site-resource/:siteResourceId/clients",
+        "/private-resource/:siteResourceId/clients"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    siteResource.listSiteResourceClients
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles",
+    [
+        "/site-resource/:siteResourceId/roles",
+        "/private-resource/:siteResourceId/roles"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -242,7 +257,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users",
+    [
+        "/site-resource/:siteResourceId/users",
+        "/private-resource/:siteResourceId/users"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -252,7 +270,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles/add",
+    [
+        "/site-resource/:siteResourceId/roles/add",
+        "/private-resource/:siteResourceId/roles/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -262,7 +283,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/roles/remove",
+    [
+        "/site-resource/:siteResourceId/roles/remove",
+        "/private-resource/:siteResourceId/roles/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -272,7 +296,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users/add",
+    [
+        "/site-resource/:siteResourceId/users/add",
+        "/private-resource/:siteResourceId/users/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -282,7 +309,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/users/remove",
+    [
+        "/site-resource/:siteResourceId/users/remove",
+        "/private-resource/:siteResourceId/users/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -292,7 +322,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients",
+    [
+        "/site-resource/:siteResourceId/clients",
+        "/private-resource/:siteResourceId/clients"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -302,7 +335,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients/add",
+    [
+        "/site-resource/:siteResourceId/clients/add",
+        "/private-resource/:siteResourceId/clients/add"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -312,7 +348,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/site-resource/:siteResourceId/clients/remove",
+    [
+        "/site-resource/:siteResourceId/clients/remove",
+        "/private-resource/:siteResourceId/clients/remove"
+    ],
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
@@ -322,7 +361,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/client/:clientId/site-resources",
+    ["/client/:clientId/site-resources", "/client/:clientId/private-resources"],
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceUsers),
    logActionAudit(ActionsEnum.setResourceUsers),
@@ -330,7 +369,7 @@ authenticated.post(
 );

 authenticated.put(
-    "/org/:orgId/resource",
+    ["/org/:orgId/resource", "/org/:orgId/public-resource"],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResource),
@@ -339,7 +378,10 @@ authenticated.put(
 );

 authenticated.put(
-    "/org/:orgId/site/:siteId/resource",
+    [
+        "/org/:orgId/site/:siteId/resource",
+        "/org/:orgId/site/:siteId/public-resource"
+    ],
    verifyApiKeyOrgAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResource),
@@ -348,14 +390,14 @@ authenticated.put(
 );

 authenticated.get(
-    "/site/:siteId/resources",
+    ["/site/:siteId/resources", "/site/:siteId/public-resources"],
    verifyApiKeySiteAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listResources
 );

 authenticated.get(
-    "/org/:orgId/resources",
+    ["/org/:orgId/resources", "/org/:orgId/public-resources"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listResources
@@ -384,6 +426,15 @@ authenticated.put(
    domain.createOrgDomain
 );

+authenticated.post(
+    "/org/:orgId/domain/:domainId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyDomainAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateOrgDomain),
+    domain.updateOrgDomain
+);
+
+// Deprecated: use POST instead. Kept for backward compatibility.
 authenticated.patch(
    "/org/:orgId/domain/:domainId",
    verifyApiKeyOrgAccess,
@@ -443,42 +494,45 @@ authenticated.delete(
 );

 authenticated.get(
-    "/resource/:resourceId/roles",
+    ["/resource/:resourceId/roles", "/public-resource/:resourceId/roles"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
    resource.listResourceRoles
 );

 authenticated.get(
-    "/resource/:resourceId/users",
+    ["/resource/:resourceId/users", "/public-resource/:resourceId/users"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
    resource.listResourceUsers
 );

 authenticated.get(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResource),
    resource.getResource
 );

 authenticated.get(
-    "/resource-policy/:resourcePolicyId",
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
    policy.getResourcePolicy
 );

 authenticated.get(
-    "/resource/:resourceId/policies",
+    ["/resource/:resourceId/policies", "/public-resource/:resourceId/policies"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
    resource.getResourcePolicies
 );

 authenticated.post(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateResource),
@@ -486,15 +540,29 @@ authenticated.post(
    resource.updateResource
 );

+authenticated.post(
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateResourcePolicy),
+    policy.updateResourcePolicy
+);
+
+// Deprecated: use POST instead. Kept for backward compatibility.
 authenticated.put(
-    "/resource-policy/:resourcePolicyId",
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyHasAction(ActionsEnum.updateResourcePolicy),
    policy.updateResourcePolicy
 );

 authenticated.delete(
-    "/resource/:resourceId",
+    ["/resource/:resourceId", "/public-resource/:resourceId"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteResource),
    logActionAudit(ActionsEnum.deleteResource),
@@ -502,7 +570,7 @@ authenticated.delete(
 );

 authenticated.put(
-    "/resource/:resourceId/target",
+    ["/resource/:resourceId/target", "/public-resource/:resourceId/target"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createTarget),
@@ -511,14 +579,14 @@ authenticated.put(
 );

 authenticated.get(
-    "/resource/:resourceId/targets",
+    ["/resource/:resourceId/targets", "/public-resource/:resourceId/targets"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listTargets),
    target.listTargets
 );

 authenticated.put(
-    "/resource/:resourceId/rule",
+    ["/resource/:resourceId/rule", "/public-resource/:resourceId/rule"],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.createResourceRule),
@@ -527,14 +595,17 @@ authenticated.put(
 );

 authenticated.get(
-    "/resource/:resourceId/rules",
+    ["/resource/:resourceId/rules", "/public-resource/:resourceId/rules"],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listResourceRules),
    resource.listResourceRules
 );

 authenticated.post(
-    "/resource/:resourceId/rule/:ruleId",
+    [
+        "/resource/:resourceId/rule/:ruleId",
+        "/public-resource/:resourceId/rule/:ruleId"
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.updateResourceRule),
@@ -543,7 +614,10 @@ authenticated.post(
 );

 authenticated.delete(
-    "/resource/:resourceId/rule/:ruleId",
+    [
+        "/resource/:resourceId/rule/:ruleId",
+        "/public-resource/:resourceId/rule/:ruleId"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.deleteResourceRule),
    logActionAudit(ActionsEnum.deleteResourceRule),
@@ -625,7 +699,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/roles",
+    ["/resource/:resourceId/roles", "/public-resource/:resourceId/roles"],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -635,7 +709,7 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users",
+    ["/resource/:resourceId/users", "/public-resource/:resourceId/users"],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -644,8 +718,11 @@ authenticated.post(
    resource.setResourceUsers
 );

-authenticated.put(
-    "/resource-policy/:resourcePolicyId/access-control",
+authenticated.post(
+    [
+        "/resource-policy/:resourcePolicyId/access-control",
+        "/public-resource-policy/:resourcePolicyId/access-control"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -656,8 +733,27 @@ authenticated.put(
    policy.setResourcePolicyAccessControl
 );

+// Deprecated: use POST instead. Kept for backward compatibility.
 authenticated.put(
-    "/resource-policy/:resourcePolicyId/password",
+    [
+        "/resource-policy/:resourcePolicyId/access-control",
+        "/public-resource-policy/:resourcePolicyId/access-control"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyApiKeyRoleAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
+    logActionAudit(ActionsEnum.setResourcePolicyUsers),
+    logActionAudit(ActionsEnum.setResourcePolicyRoles),
+    policy.setResourcePolicyAccessControl
+);
+
+authenticated.post(
+    [
+        "/resource-policy/:resourcePolicyId/password",
+        "/public-resource-policy/:resourcePolicyId/password"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPassword),
@@ -665,8 +761,24 @@ authenticated.put(
    policy.setResourcePolicyPassword
 );

+// Deprecated: use POST instead. Kept for backward compatibility.
 authenticated.put(
-    "/resource-policy/:resourcePolicyId/pincode",
+    [
+        "/resource-policy/:resourcePolicyId/password",
+        "/public-resource-policy/:resourcePolicyId/password"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPassword),
+    logActionAudit(ActionsEnum.setResourcePolicyPassword),
+    policy.setResourcePolicyPassword
+);
+
+authenticated.post(
+    [
+        "/resource-policy/:resourcePolicyId/pincode",
+        "/public-resource-policy/:resourcePolicyId/pincode"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPincode),
@@ -674,8 +786,24 @@ authenticated.put(
    policy.setResourcePolicyPincode
 );

+// Deprecated: use POST instead. Kept for backward compatibility.
 authenticated.put(
-    "/resource-policy/:resourcePolicyId/header-auth",
+    [
+        "/resource-policy/:resourcePolicyId/pincode",
+        "/public-resource-policy/:resourcePolicyId/pincode"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPincode),
+    logActionAudit(ActionsEnum.setResourcePolicyPincode),
+    policy.setResourcePolicyPincode
+);
+
+authenticated.post(
+    [
+        "/resource-policy/:resourcePolicyId/header-auth",
+        "/public-resource-policy/:resourcePolicyId/header-auth"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
@@ -683,8 +811,24 @@ authenticated.put(
    policy.setResourcePolicyHeaderAuth
 );

+// Deprecated: use POST instead. Kept for backward compatibility.
 authenticated.put(
-    "/resource-policy/:resourcePolicyId/whitelist",
+    [
+        "/resource-policy/:resourcePolicyId/header-auth",
+        "/public-resource-policy/:resourcePolicyId/header-auth"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
+    logActionAudit(ActionsEnum.setResourcePolicyHeaderAuth),
+    policy.setResourcePolicyHeaderAuth
+);
+
+authenticated.post(
+    [
+        "/resource-policy/:resourcePolicyId/whitelist",
+        "/public-resource-policy/:resourcePolicyId/whitelist"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyWhitelist),
@@ -692,8 +836,37 @@ authenticated.put(
    policy.setResourcePolicyWhitelist
 );

+// Deprecated: use POST instead. Kept for backward compatibility.
 authenticated.put(
-    "/resource-policy/:resourcePolicyId/rules",
+    [
+        "/resource-policy/:resourcePolicyId/whitelist",
+        "/public-resource-policy/:resourcePolicyId/whitelist"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyWhitelist),
+    logActionAudit(ActionsEnum.setResourcePolicyWhitelist),
+    policy.setResourcePolicyWhitelist
+);
+
+authenticated.post(
+    [
+        "/resource-policy/:resourcePolicyId/rules",
+        "/public-resource-policy/:resourcePolicyId/rules"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRules),
+    logActionAudit(ActionsEnum.setResourcePolicyRules),
+    policy.setResourcePolicyRules
+);
+
+// Deprecated: use POST instead. Kept for backward compatibility.
+authenticated.put(
+    [
+        "/resource-policy/:resourcePolicyId/rules",
+        "/public-resource-policy/:resourcePolicyId/rules"
+    ],
    verifyApiKeyResourcePolicyAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRules),
@@ -702,7 +875,10 @@ authenticated.put(
 );

 authenticated.post(
-    "/resource/:resourceId/roles/add",
+    [
+        "/resource/:resourceId/roles/add",
+        "/public-resource/:resourceId/roles/add"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -712,7 +888,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/roles/remove",
+    [
+        "/resource/:resourceId/roles/remove",
+        "/public-resource/:resourceId/roles/remove"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
@@ -722,7 +901,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users/add",
+    [
+        "/resource/:resourceId/users/add",
+        "/public-resource/:resourceId/users/add"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -732,7 +914,10 @@ authenticated.post(
 );

 authenticated.post(
-    "/resource/:resourceId/users/remove",
+    [
+        "/resource/:resourceId/users/remove",
+        "/public-resource/:resourceId/users/remove"
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeySetResourceUsers,
    verifyLimits,
@@ -742,7 +927,7 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/password`,
+    [`/resource/:resourceId/password`, `/public-resource/:resourceId/password`],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePassword),
@@ -751,7 +936,7 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/pincode`,
+    [`/resource/:resourceId/pincode`, `/public-resource/:resourceId/pincode`],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourcePincode),
@@ -760,7 +945,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/header-auth`,
+    [
+        `/resource/:resourceId/header-auth`,
+        `/public-resource/:resourceId/header-auth`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceHeaderAuth),
@@ -769,7 +957,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist`,
+    [
+        `/resource/:resourceId/whitelist`,
+        `/public-resource/:resourceId/whitelist`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -778,7 +969,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist/add`,
+    [
+        `/resource/:resourceId/whitelist/add`,
+        `/public-resource/:resourceId/whitelist/add`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -786,7 +980,10 @@ authenticated.post(
 );

 authenticated.post(
-    `/resource/:resourceId/whitelist/remove`,
+    [
+        `/resource/:resourceId/whitelist/remove`,
+        `/public-resource/:resourceId/whitelist/remove`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -794,14 +991,20 @@ authenticated.post(
 );

 authenticated.get(
-    `/resource/:resourceId/whitelist`,
+    [
+        `/resource/:resourceId/whitelist`,
+        `/public-resource/:resourceId/whitelist`
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.getResourceWhitelist),
    resource.getResourceWhitelist
 );

 authenticated.post(
-    `/resource/:resourceId/access-token`,
+    [
+        `/resource/:resourceId/access-token`,
+        `/public-resource/:resourceId/access-token`
+    ],
    verifyApiKeyResourceAccess,
    verifyLimits,
    verifyApiKeyHasAction(ActionsEnum.generateAccessToken),
@@ -825,7 +1028,10 @@ authenticated.get(
 );

 authenticated.get(
-    `/resource/:resourceId/access-tokens`,
+    [
+        `/resource/:resourceId/access-tokens`,
+        `/public-resource/:resourceId/access-tokens`
+    ],
    verifyApiKeyResourceAccess,
    verifyApiKeyHasAction(ActionsEnum.listAccessTokens),
    accessToken.listAccessTokens
@@ -1155,7 +1361,7 @@ authenticated.get(
 );

 authenticated.get(
-    "/org/:orgId/resource-names",
+    ["/org/:orgId/resource-names", "/org/:orgId/public-resource-names"],
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction(ActionsEnum.listResources),
    resource.listAllResourceNames
@@ -168,7 +168,7 @@ registry.registerPath({
    path: "/org/{orgId}/resource-policy/{niceId}",
    description:
        "Get a resource policy by orgId and niceId. NiceId is a readable ID for the resource and unique on a per org basis.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: z.object({
            orgId: z.string(),
@@ -182,7 +182,20 @@ registry.registerPath({
    method: "get",
    path: "/resource-policy/{resourcePolicyId}",
    description: "Get a resource policy by its resourcePolicyId.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: z.object({
+            resourcePolicyId: z.number()
+        })
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource-policy/{resourcePolicyId}",
+    description: "Get a resource policy by its resourcePolicyId.",
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: z.object({
            resourcePolicyId: z.number()
@@ -40,7 +40,66 @@ registry.registerPath({
    path: "/resource-policy/{resourceId}/access-control",
    description:
        "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
-    tags: [OpenAPITags.Policy, OpenAPITags.User],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyAccessControlParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyAcccessControlBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourceId}/access-control",
+    description:
+        "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
+    tags: [OpenAPITags.PublicResourcePolicy, OpenAPITags.User],
+    request: {
+        params: setResourcePolicyAccessControlParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyAcccessControlBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/resource-policy/{resourceId}/access-control",
+    description:
+        "Set access control users for a resource policy, including SSO, users, roles, Identity provider. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyAccessControlParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyAcccessControlBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourceId}/access-control",
+    description:
+        "Set access control users for a resource policy, including SSO, users, roles, Identity provider. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicy, OpenAPITags.User],
    request: {
        params: setResourcePolicyAccessControlParamsSchema,
        body: {
@@ -25,11 +25,70 @@ const setResourcePolicyHeaderAuthBodySchema = z.strictObject({
 });

 registry.registerPath({
-    method: "put",
+    method: "post",
    path: "/resource-policy/{resourcePolicyId}/header-auth",
    description:
        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyHeaderAuthParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyHeaderAuthBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourcePolicyId}/header-auth",
+    description:
+        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: setResourcePolicyHeaderAuthParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyHeaderAuthBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/resource-policy/{resourcePolicyId}/header-auth",
+    description:
+        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyHeaderAuthParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyHeaderAuthBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/header-auth",
+    description:
+        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyHeaderAuthParamsSchema,
        body: {
@@ -20,11 +20,70 @@ const setResourcePolicyPasswordBodySchema = z.strictObject({
 });

 registry.registerPath({
-    method: "put",
+    method: "post",
    path: "/resource-policy/{resourcePolicyId}/password",
    description:
        "Set the password for a resource policy. Setting the password to null will remove it.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyPasswordParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPasswordBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourcePolicyId}/password",
+    description:
+        "Set the password for a resource policy. Setting the password to null will remove it.",
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: setResourcePolicyPasswordParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPasswordBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/resource-policy/{resourcePolicyId}/password",
+    description:
+        "Set the password for a resource policy. Setting the password to null will remove it. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyPasswordParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPasswordBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/password",
+    description:
+        "Set the password for a resource policy. Setting the password to null will remove it. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyPasswordParamsSchema,
        body: {
@@ -23,11 +23,70 @@ const setResourcePolicyPincodeBodySchema = z.strictObject({
 });

 registry.registerPath({
-    method: "put",
+    method: "post",
    path: "/resource-policy/{resourcePolicyId}/pincode",
    description:
        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyPincodeParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPincodeBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourcePolicyId}/pincode",
+    description:
+        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: setResourcePolicyPincodeParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPincodeBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/resource-policy/{resourcePolicyId}/pincode",
+    description:
+        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyPincodeParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyPincodeBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/pincode",
+    description:
+        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyPincodeParamsSchema,
        body: {
@@ -43,11 +43,70 @@ const setResourcePolicyRulesParamsSchema = z.strictObject({
 });

 registry.registerPath({
-    method: "put",
+    method: "post",
    path: "/resource-policy/{resourcePolicyId}/rules",
    description:
        "Set all rules for a resource policy at once. This will replace all existing rules.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyRulesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyRulesBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourcePolicyId}/rules",
+    description:
+        "Set all rules for a resource policy at once. This will replace all existing rules.",
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: setResourcePolicyRulesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyRulesBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/resource-policy/{resourcePolicyId}/rules",
+    description:
+        "Set all rules for a resource policy at once. This will replace all existing rules. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyRulesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyRulesBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/rules",
+    description:
+        "Set all rules for a resource policy at once. This will replace all existing rules. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyRulesParamsSchema,
        body: {
@@ -28,11 +28,70 @@ const setResourcePolicyWhitelistParamsSchema = z.strictObject({
 });

 registry.registerPath({
-    method: "put",
+    method: "post",
    path: "/resource-policy/{resourcePolicyId}/whitelist",
    description:
        "Set email whitelist for a resource policy. This will replace all existing emails.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourcePolicyId}/whitelist",
+    description:
+        "Set email whitelist for a resource policy. This will replace all existing emails.",
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: setResourcePolicyWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/resource-policy/{resourcePolicyId}/whitelist",
+    description:
+        "Set email whitelist for a resource policy. This will replace all existing emails. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    request: {
+        params: setResourcePolicyWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourcePolicyWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}/whitelist",
+    description:
+        "Set email whitelist for a resource policy. This will replace all existing emails. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: setResourcePolicyWhitelistParamsSchema,
        body: {
@@ -19,10 +19,66 @@ const updateResourcePolicyBodySchema = z.strictObject({
 });

 registry.registerPath({
-    method: "put",
+    method: "post",
    path: "/resource-policy/{resourcePolicyId}",
    description: "Update a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: updateResourcePolicyParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateResourcePolicyBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource-policy/{resourcePolicyId}",
+    description: "Update a resource policy.",
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: updateResourcePolicyParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateResourcePolicyBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/resource-policy/{resourcePolicyId}",
+    description: "Update a resource policy. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicy],
+    request: {
+        params: updateResourcePolicyParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateResourcePolicyBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource-policy/{resourcePolicyId}",
+    description: "Update a resource policy. Deprecated: use POST instead.",
+    deprecated: true,
+    tags: [OpenAPITags.PublicResourcePolicy],
    request: {
        params: updateResourcePolicyParamsSchema,
        body: {
@@ -34,6 +34,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/whitelist/add",
    description: "Add a single email to the resource whitelist.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: addEmailToResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addEmailToResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist/add",
+    description: "Add a single email to the resource whitelist.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: addEmailToResourceWhitelistParamsSchema,
@@ -144,10 +177,7 @@ export async function addEmailToResourceWhitelist(
                .from(resourcePolicyWhiteList)
                .where(
                    and(
-                        eq(
-                            resourcePolicyWhiteList.resourcePolicyId,
-                            policyId
-                        ),
+                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
                        eq(resourcePolicyWhiteList.email, email)
                    )
                );
@@ -28,6 +28,40 @@ const addRoleToResourceParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/roles/add",
+    description:
+        "Add a single role to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the role is added to the inline policy instead of directly to the resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: addRoleToResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addRoleToResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles/add",
    description:
        "Add a single role to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the role is added to the inline policy instead of directly to the resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
@@ -28,6 +28,40 @@ const addUserToResourceParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/users/add",
+    description:
+        "Add a single user to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the user is added to the inline policy instead of directly to the resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: addUserToResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addUserToResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users/add",
    description:
        "Add a single user to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the user is added to the inline policy instead of directly to the resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
@@ -153,6 +153,39 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/resource",
    description: "Create a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: createResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createHttpResourceSchema.or(createRawResourceSchema)
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/public-resource",
+    description: "Create a resource.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: createResourceParamsSchema,
@@ -9,16 +9,14 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import {
-    isValidCIDR,
-    isValidIP,
-    isValidUrlGlobPattern
+    RESOURCE_RULE_MATCH_TYPES,
+    getResourceRuleValueValidationError
 } from "@server/lib/validators";
 import { OpenAPITags, registry } from "@server/openApi";
-import { isValidRegionId } from "@server/db/regions";

 const createResourceRuleSchema = z.strictObject({
    action: z.enum(["ACCEPT", "DROP", "PASS"]),
-    match: z.enum(["CIDR", "IP", "PATH", "COUNTRY", "ASN", "REGION"]),
+    match: z.enum(RESOURCE_RULE_MATCH_TYPES),
    value: z.string().min(1),
    priority: z.int(),
    enabled: z.boolean().optional()
@@ -32,6 +30,39 @@ registry.registerPath({
    method: "put",
    path: "/resource/{resourceId}/rule",
    description: "Create a resource rule.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: createResourceRuleParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createResourceRuleSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource/{resourceId}/rule",
+    description: "Create a resource rule.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
    request: {
        params: createResourceRuleParamsSchema,
@@ -118,39 +149,14 @@ export async function createResourceRule(
            );
        }

-        if (match === "CIDR") {
-            if (!isValidCIDR(value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid CIDR provided"
-                    )
-                );
-            }
-        } else if (match === "IP") {
-            if (!isValidIP(value)) {
-                return next(
-                    createHttpError(HttpCode.BAD_REQUEST, "Invalid IP provided")
-                );
-            }
-        } else if (match === "PATH") {
-            if (!isValidUrlGlobPattern(value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid URL glob pattern provided"
-                    )
-                );
-            }
-        } else if (match === "REGION") {
-            if (!isValidRegionId(value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid region ID provided"
-                    )
-                );
-            }
+        const valueValidationError = getResourceRuleValueValidationError(
+            match,
+            value
+        );
+        if (valueValidationError) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, valueValidationError)
+            );
        }

        // Create the new resource rule
@@ -22,6 +22,32 @@ registry.registerPath({
    method: "delete",
    path: "/resource/{resourceId}",
    description: "Delete a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: deleteResourceSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/public-resource/{resourceId}",
+    description: "Delete a resource.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: deleteResourceSchema
@@ -19,6 +19,32 @@ registry.registerPath({
    method: "delete",
    path: "/resource/{resourceId}/rule/{ruleId}",
    description: "Delete a resource rule.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: deleteResourceRuleSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/public-resource/{resourceId}/rule/{ruleId}",
+    description: "Delete a resource rule.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
    request: {
        params: deleteResourceRuleSchema
@@ -63,7 +63,7 @@ registry.registerPath({
    path: "/org/{orgId}/resource/{niceId}",
    description:
        "Get a resource by orgId and niceId. NiceId is a readable ID for the resource and unique on a per org basis.",
-    tags: [OpenAPITags.PublicResource],
+    tags: [OpenAPITags.PublicResourceLegacy],
    request: {
        params: z.object({
            orgId: z.string(),
@@ -92,6 +92,34 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}",
    description: "Get a resource by resourceId.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: z.object({
+            resourceId: z.number()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}",
+    description: "Get a resource by resourceId.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: z.object({
@@ -25,8 +25,21 @@ export type GetResourcePoliciesResponse = {
 registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/policies",
-    description: "Get the inline and shared policies associated with a resource.",
-    tags: [OpenAPITags.PublicResource, OpenAPITags.Policy],
+    description:
+        "Get the inline and shared policies associated with a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: getResourcePoliciesParamsSchema
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/policies",
+    description:
+        "Get the inline and shared policies associated with a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.PublicResourcePolicy],
    request: {
        params: getResourcePoliciesParamsSchema
    },
@@ -44,6 +44,32 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/whitelist",
    description: "Get the whitelist of emails for a specific resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: getResourceWhitelistSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/whitelist",
+    description: "Get the whitelist of emails for a specific resource.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: getResourceWhitelistSchema
@@ -33,6 +33,34 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/resources-names",
    description: "List all resource names for an organization.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: z.object({
+            orgId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/public-resource-names",
+    description: "List all resource names for an organization.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: z.object({
@@ -48,6 +48,32 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/roles",
    description: "List all roles for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listResourceRolesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/roles",
+    description: "List all roles for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
    request: {
        params: listResourceRolesSchema
@@ -71,6 +71,33 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/rules",
    description: "List rules for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listResourceRulesParamsSchema,
+        query: listResourceRulesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/rules",
+    description: "List rules for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
    request: {
        params: listResourceRulesParamsSchema,
@@ -38,6 +38,32 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/users",
    description: "List all users for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listResourceUsersSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/users",
+    description: "List all users for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
    request: {
        params: listResourceUsersSchema
@@ -409,6 +409,35 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/resources",
    description: "List resources for an organization.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: z.object({
+            orgId: z.string()
+        }),
+        query: listResourcesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/public-resources",
+    description: "List resources for an organization.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: z.object({
@@ -34,6 +34,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/whitelist/remove",
    description: "Remove a single email from the resource whitelist.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: removeEmailFromResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeEmailFromResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist/remove",
+    description: "Remove a single email from the resource whitelist.",
    tags: [OpenAPITags.PublicResource],
    request: {
        params: removeEmailFromResourceWhitelistParamsSchema,
@@ -143,10 +176,7 @@ export async function removeEmailFromResourceWhitelist(
                .from(resourcePolicyWhiteList)
                .where(
                    and(
-                        eq(
-                            resourcePolicyWhiteList.resourcePolicyId,
-                            policyId
-                        ),
+                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
                        eq(resourcePolicyWhiteList.email, email)
                    )
                );
@@ -164,10 +194,7 @@ export async function removeEmailFromResourceWhitelist(
                .delete(resourcePolicyWhiteList)
                .where(
                    and(
-                        eq(
-                            resourcePolicyWhiteList.resourcePolicyId,
-                            policyId
-                        ),
+                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
                        eq(resourcePolicyWhiteList.email, email)
                    )
                );
@@ -29,6 +29,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/roles/remove",
    description: "Remove a single role from a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: removeRoleFromResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeRoleFromResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles/remove",
+    description: "Remove a single role from a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
    request: {
        params: removeRoleFromResourceParamsSchema,
@@ -29,6 +29,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/users/remove",
    description: "Remove a single user from a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: removeUserFromResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeUserFromResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users/remove",
+    description: "Remove a single user from a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
    request: {
        params: removeUserFromResourceParamsSchema,
@@ -29,6 +29,40 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/header-auth",
+    description:
+        "Set or update the header authentication for a resource. If user and password is not provided, it will remove the header authentication.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/header-auth",
    description:
        "Set or update the header authentication for a resource. If user and password is not provided, it will remove the header authentication.",
    tags: [OpenAPITags.PublicResource],
@@ -27,6 +27,40 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/password",
+    description:
+        "Set the password for a resource. Setting the password to null will remove it.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/password",
    description:
        "Set the password for a resource. Setting the password to null will remove it.",
    tags: [OpenAPITags.PublicResource],
@@ -27,6 +27,40 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/pincode",
+    description:
+        "Set the PIN code for a resource. Setting the PIN code to null will remove it.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceAuthMethodsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAuthMethodsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/pincode",
    description:
        "Set the PIN code for a resource. Setting the PIN code to null will remove it.",
    tags: [OpenAPITags.PublicResource],
@@ -21,6 +21,40 @@ const setResourceRolesParamsSchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/roles",
+    description:
+        "Set roles for a resource. This will replace all existing roles. When the resource has an inline policy defined (no shared resource policy assigned), roles are set on the inline policy instead of directly on the resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceRolesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceRolesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/roles",
    description:
        "Set roles for a resource. This will replace all existing roles. When the resource has an inline policy defined (no shared resource policy assigned), roles are set on the inline policy instead of directly on the resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
@@ -21,6 +21,40 @@ const setUserResourcesParamsSchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/users",
+    description:
+        "Set users for a resource. This will replace all existing users. When the resource has an inline policy defined (no shared resource policy assigned), users are set on the inline policy instead of directly on the resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setUserResourcesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setUserResourcesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/users",
    description:
        "Set users for a resource. This will replace all existing users. When the resource has an inline policy defined (no shared resource policy assigned), users are set on the inline policy instead of directly on the resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.User],
@@ -35,6 +35,40 @@ const setResourceWhitelistParamsSchema = z.strictObject({
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/whitelist",
+    description:
+        "Set email whitelist for a resource. This will replace all existing emails.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: setResourceWhitelistParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceWhitelistBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/whitelist",
    description:
        "Set email whitelist for a resource. This will replace all existing emails.",
    tags: [OpenAPITags.PublicResource],
@@ -240,6 +240,42 @@ const updateRawResourceBodySchema = z
 registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}",
+    description:
+        "Update a resource. Policy fields (sso, mfa, pincode, password, whitelist) update the inline policy when no shared resource policy is assigned; when a shared policy is assigned those fields override the shared policy for this resource only.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: updateResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateHttpResourceBodySchema.and(
+                        updateRawResourceBodySchema
+                    )
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}",
    description:
        "Update a resource. Policy fields (sso, mfa, pincode, password, whitelist) update the inline policy when no shared resource policy is assigned; when a shared policy is assigned those fields override the shared policy for this resource only.",
    tags: [OpenAPITags.PublicResource],
@@ -9,12 +9,11 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import {
-    isValidCIDR,
-    isValidIP,
-    isValidUrlGlobPattern
+    RESOURCE_RULE_MATCH_TYPES,
+    getResourceRuleValueValidationError,
+    ResourceRuleMatchType
 } from "@server/lib/validators";
 import { OpenAPITags, registry } from "@server/openApi";
-import { isValidRegionId } from "@server/db/regions";

 // Define Zod schema for request parameters validation
 const updateResourceRuleParamsSchema = z.strictObject({
@@ -22,15 +21,7 @@ const updateResourceRuleParamsSchema = z.strictObject({
    resourceId: z.coerce.number().int().positive()
 });

-const resourceRuleMatchSchema = z.enum([
-    "CIDR",
-    "IP",
-    "PATH",
-    "COUNTRY",
-    "COUNTRY_IS_NOT",
-    "ASN",
-    "REGION"
-]);
+const resourceRuleMatchSchema = z.enum(RESOURCE_RULE_MATCH_TYPES);

 // Define Zod schema for request body validation
 const updateResourceRuleSchema = z
@@ -49,6 +40,39 @@ registry.registerPath({
    method: "post",
    path: "/resource/{resourceId}/rule/{ruleId}",
    description: "Update a resource rule.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: updateResourceRuleParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateResourceRuleSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/public-resource/{resourceId}/rule/{ruleId}",
+    description: "Update a resource rule.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
    request: {
        params: updateResourceRuleParamsSchema,
@@ -140,14 +164,7 @@ export async function updateResourceRule(
            resource.resourcePolicyId === null &&
            resource.defaultResourcePolicyId !== null;

-        let existingMatch:
-            | "CIDR"
-            | "IP"
-            | "PATH"
-            | "COUNTRY"
-            | "COUNTRY_IS_NOT"
-            | "ASN"
-            | "REGION";
+        let existingMatch: ResourceRuleMatchType;

        if (isInlinePolicy) {
            const policyId = resource.defaultResourcePolicyId!;
@@ -231,42 +248,14 @@ export async function updateResourceRule(
        const { value } = updateData;

        if (value !== undefined) {
-            if (match === "CIDR") {
-                if (!isValidCIDR(value)) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Invalid CIDR provided"
-                        )
-                    );
-                }
-            } else if (match === "IP") {
-                if (!isValidIP(value)) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Invalid IP provided"
-                        )
-                    );
-                }
-            } else if (match === "PATH") {
-                if (!isValidUrlGlobPattern(value)) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Invalid URL glob pattern provided"
-                        )
-                    );
-                }
-            } else if (match === "REGION") {
-                if (!isValidRegionId(value)) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Invalid region ID provided"
-                        )
-                    );
-                }
+            const valueValidationError = getResourceRuleValueValidationError(
+                match,
+                value
+            );
+            if (valueValidationError) {
+                return next(
+                    createHttpError(HttpCode.BAD_REQUEST, valueValidationError)
+                );
            }
        }

@@ -177,7 +177,7 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/sites",
    description: "List all sites in an organization",
-    tags: [OpenAPITags.Org, OpenAPITags.Site],
+    tags: [OpenAPITags.Site],
    request: {
        params: listSitesParamsSchema,
        query: listSitesSchema
@@ -31,6 +31,40 @@ const addClientToSiteResourceParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/clients/add",
+    description:
+        "Add a single client to a site resource. Clients with a userId cannot be added.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: addClientToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addClientToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients/add",
    description:
        "Add a single client to a site resource. Clients with a userId cannot be added.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
@@ -33,6 +33,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/roles/add",
    description: "Add a single role to a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: addRoleToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addRoleToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles/add",
+    description: "Add a single role to a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
    request: {
        params: addRoleToSiteResourceParamsSchema,
@@ -33,6 +33,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/users/add",
    description: "Add a single user to a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: addUserToSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addUserToSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users/add",
+    description: "Add a single user to a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
    request: {
        params: addUserToSiteResourceParamsSchema,
@@ -38,6 +38,39 @@ registry.registerPath({
    method: "post",
    path: "/client/{clientId}/site-resources",
    description: "Add a machine client to multiple site resources at once.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: batchAddClientToSiteResourcesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: batchAddClientToSiteResourcesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/client/{clientId}/private-resources",
+    description: "Add a machine client to multiple site resources at once.",
    tags: [OpenAPITags.Client],
    request: {
        params: batchAddClientToSiteResourcesParamsSchema,
@@ -207,6 +207,39 @@ registry.registerPath({
    method: "put",
    path: "/org/{orgId}/site-resource",
    description: "Create a new site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: createSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createSiteResourceSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/private-resource",
+    description: "Create a new site resource.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: createSiteResourceParamsSchema,
@@ -27,6 +27,32 @@ registry.registerPath({
    method: "delete",
    path: "/site-resource/{siteResourceId}",
    description: "Delete a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: deleteSiteResourceParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/private-resource/{siteResourceId}",
+    description: "Delete a site resource.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: deleteSiteResourceParamsSchema
@@ -57,6 +57,36 @@ registry.registerPath({
    method: "get",
    path: "/site-resource/{siteResourceId}",
    description: "Get a specific site resource by siteResourceId.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: z.object({
+            siteResourceId: z.number(),
+            siteId: z.number(),
+            orgId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}",
+    description: "Get a specific site resource by siteResourceId.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: z.object({
@@ -230,6 +230,33 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/site-resources",
    description: "List all site resources for an organization.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listAllSiteResourcesByOrgParamsSchema,
+        query: listAllSiteResourcesByOrgQuerySchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/private-resources",
+    description: "List all site resources for an organization.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: listAllSiteResourcesByOrgParamsSchema,
@@ -39,6 +39,32 @@ registry.registerPath({
    method: "get",
    path: "/site-resource/{siteResourceId}/clients",
    description: "List all clients for a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listSiteResourceClientsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/clients",
+    description: "List all clients for a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
    request: {
        params: listSiteResourceClientsSchema
@@ -40,6 +40,32 @@ registry.registerPath({
    method: "get",
    path: "/site-resource/{siteResourceId}/roles",
    description: "List all roles for a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listSiteResourceRolesSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/roles",
+    description: "List all roles for a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
    request: {
        params: listSiteResourceRolesSchema
@@ -43,6 +43,32 @@ registry.registerPath({
    method: "get",
    path: "/site-resource/{siteResourceId}/users",
    description: "List all users for a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listSiteResourceUsersSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/private-resource/{siteResourceId}/users",
+    description: "List all users for a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
    request: {
        params: listSiteResourceUsersSchema
@@ -67,6 +67,33 @@ registry.registerPath({
    method: "get",
    path: "/org/{orgId}/site/{siteId}/resources",
    description: "List site resources for a site.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: listSiteResourcesParamsSchema,
+        query: listSiteResourcesQuerySchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/site/{siteId}/private-resources",
+    description: "List site resources for a site.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: listSiteResourcesParamsSchema,
@@ -31,6 +31,40 @@ const removeClientFromSiteResourceParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/clients/remove",
+    description:
+        "Remove a single client from a site resource. Clients with a userId cannot be removed.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: removeClientFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeClientFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients/remove",
    description:
        "Remove a single client from a site resource. Clients with a userId cannot be removed.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
@@ -33,6 +33,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/roles/remove",
    description: "Remove a single role from a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: removeRoleFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeRoleFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles/remove",
+    description: "Remove a single role from a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
    request: {
        params: removeRoleFromSiteResourceParamsSchema,
@@ -33,6 +33,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/users/remove",
    description: "Remove a single user from a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: removeUserFromSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeUserFromSiteResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users/remove",
+    description: "Remove a single user from a site resource.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
    request: {
        params: removeUserFromSiteResourceParamsSchema,
@@ -31,6 +31,40 @@ const setSiteResourceClientsParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/clients",
+    description:
+        "Set clients for a site resource. This will replace all existing clients. Clients with a userId cannot be added.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: setSiteResourceClientsParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceClientsBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/clients",
    description:
        "Set clients for a site resource. This will replace all existing clients. Clients with a userId cannot be added.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
@@ -32,6 +32,40 @@ const setSiteResourceRolesParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/roles",
+    description:
+        "Set roles for a site resource. This will replace all existing roles.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: setSiteResourceRolesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceRolesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/roles",
    description:
        "Set roles for a site resource. This will replace all existing roles.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
@@ -33,6 +33,40 @@ const setSiteResourceUsersParamsSchema = z
 registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}/users",
+    description:
+        "Set users for a site resource. This will replace all existing users.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: setSiteResourceUsersParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setSiteResourceUsersBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}/users",
    description:
        "Set users for a site resource. This will replace all existing users.",
    tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
@@ -213,6 +213,39 @@ registry.registerPath({
    method: "post",
    path: "/site-resource/{siteResourceId}",
    description: "Update a site resource.",
+    tags: [OpenAPITags.PrivateResourceLegacy],
+    request: {
+        params: updateSiteResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateSiteResourceSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/private-resource/{siteResourceId}",
+    description: "Update a site resource.",
    tags: [OpenAPITags.PrivateResource],
    request: {
        params: updateSiteResourceParamsSchema,
@@ -93,6 +93,39 @@ registry.registerPath({
    method: "put",
    path: "/resource/{resourceId}/target",
    description: "Create a target for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: createTargetParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createTargetSchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource/{resourceId}/target",
+    description: "Create a target for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
    request: {
        params: createTargetParamsSchema,
@@ -92,6 +92,33 @@ registry.registerPath({
    method: "get",
    path: "/resource/{resourceId}/targets",
    description: "List targets for a resource.",
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listTargetsParamsSchema,
+        query: listTargetsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/targets",
+    description: "List targets for a resource.",
    tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
    request: {
        params: listTargetsParamsSchema,
@@ -27,6 +27,7 @@ import m18 from "./scriptsPg/1.18.3";
 import m19 from "./scriptsPg/1.18.4";
 import m20 from "./scriptsPg/1.19.0";
 import m21 from "./scriptsPg/1.20.0";
+import m22 from "./scriptsPg/1.21.0";

 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -53,7 +54,8 @@ const migrations = [
    { version: "1.18.3", run: m18 },
    { version: "1.18.4", run: m19 },
    { version: "1.19.0", run: m20 },
-    { version: "1.20.0", run: m21 }
+    { version: "1.20.0", run: m21 },
+    { version: "1.21.0", run: m22 }
    // Add new migrations here as they are created
 ] as {
    version: string;
@@ -46,6 +46,7 @@ import m40 from "./scriptsSqlite/1.18.4";
 import m41 from "./scriptsSqlite/1.19.0";
 import m42 from "./scriptsSqlite/1.19.1";
 import m43 from "./scriptsSqlite/1.20.0";
+import m44 from "./scriptsSqlite/1.21.0";

 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -89,7 +90,8 @@ const migrations = [
    { version: "1.18.4", run: m40 },
    { version: "1.19.0", run: m41 },
    { version: "1.19.1", run: m42 },
-    { version: "1.20.0", run: m43 }
+    { version: "1.20.0", run: m43 },
+    { version: "1.21.0", run: m44 }
    // Add new migrations here as they are created
 ] as const;

@@ -0,0 +1,95 @@
+import { db } from "@server/db/pg/driver";
+import { APP_PATH } from "@server/lib/consts";
+import { sql } from "drizzle-orm";
+import fs from "fs";
+import yaml from "js-yaml";
+import path from "path";
+import z from "zod";
+import { fromZodError } from "zod-validation-error";
+
+const version = "1.21.0";
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    try {
+        await db.execute(sql`BEGIN`);
+
+        await db.execute(sql`
+            ALTER TABLE "resourceAccessToken" ADD COLUMN "userId" varchar;
+        `);
+
+        await db.execute(sql`
+            ALTER TABLE "resourceAccessToken" ADD COLUMN "persistSession" boolean DEFAULT false NOT NULL;
+        `);
+
+        await db.execute(sql`
+            ALTER TABLE "resources" ADD COLUMN "status" varchar DEFAULT 'approved';
+        `);
+
+        await db.execute(sql`
+            ALTER TABLE "siteResources" ADD COLUMN "status" varchar DEFAULT 'approved';
+        `);
+
+        await db.execute(sql`
+            ALTER TABLE "sites" ADD COLUMN "localEndpoints" varchar;
+        `);
+
+        await db.execute(sql`
+            ALTER TABLE "resourceAccessToken" ADD CONSTRAINT "resourceAccessToken_userId_user_id_fk" FOREIGN KEY ("userId") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;
+        `);
+
+        await db.execute(sql`COMMIT`);
+        console.log("Migrated database");
+    } catch (e) {
+        await db.execute(sql`ROLLBACK`);
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    }
+
+    try {
+        const traefikPath = path.join(
+            APP_PATH,
+            "traefik",
+            "traefik_config.yml"
+        );
+
+        const schema = z.object({
+            experimental: z.object({
+                plugins: z.object({
+                    badger: z.object({
+                        moduleName: z.string(),
+                        version: z.string()
+                    })
+                })
+            })
+        });
+
+        const traefikFileContents = fs.readFileSync(traefikPath, "utf8");
+        const traefikConfig = yaml.load(traefikFileContents) as any;
+
+        const parsedConfig = schema.safeParse(traefikConfig);
+
+        if (!parsedConfig.success) {
+            throw new Error(fromZodError(parsedConfig.error).toString());
+        }
+
+        traefikConfig.experimental.plugins.badger.version = "v1.5.0";
+
+        const updatedTraefikYaml = yaml.dump(traefikConfig);
+
+        fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");
+
+        console.log(
+            "Updated the version of Badger in your Traefik configuration to v1.5.0"
+        );
+    } catch (e) {
+        console.log(
+            "We were unable to update the version of Badger in your Traefik configuration. Please update it manually. Check the release notes for this version for more information."
+        );
+        console.error(e);
+    }
+
+    console.log(`${version} migration complete`);
+}
@@ -0,0 +1,104 @@
+import { APP_PATH } from "@server/lib/consts";
+import Database from "better-sqlite3";
+import fs from "fs";
+import yaml from "js-yaml";
+import path from "path";
+import z from "zod";
+import { fromZodError } from "zod-validation-error";
+
+const version = "1.21.0";
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    const location = path.join(APP_PATH, "db", "db.sqlite");
+    const db = new Database(location);
+
+    try {
+        db.pragma("foreign_keys = OFF");
+
+        db.transaction(() => {
+            db.prepare(
+                `
+            ALTER TABLE 'resourceAccessToken' ADD 'userId' text REFERENCES user(id);
+                `
+            ).run();
+
+            db.prepare(
+                `
+            ALTER TABLE 'resourceAccessToken' ADD 'persistSession' integer DEFAULT false NOT NULL;
+                `
+            ).run();
+
+            db.prepare(
+                `
+            ALTER TABLE 'resources' ADD 'status' text DEFAULT 'approved';
+                `
+            ).run();
+
+            db.prepare(
+                `
+            ALTER TABLE 'siteResources' ADD 'status' text DEFAULT 'approved';
+                `
+            ).run();
+
+            db.prepare(
+                `
+            ALTER TABLE 'sites' ADD 'localEndpoints' text;
+                `
+            ).run();
+        })();
+
+        db.pragma("foreign_keys = ON");
+
+        console.log("Migrated database");
+    } catch (e) {
+        console.log("Failed to migrate db:", e);
+        throw e;
+    }
+
+    try {
+        const traefikPath = path.join(
+            APP_PATH,
+            "traefik",
+            "traefik_config.yml"
+        );
+
+        const schema = z.object({
+            experimental: z.object({
+                plugins: z.object({
+                    badger: z.object({
+                        moduleName: z.string(),
+                        version: z.string()
+                    })
+                })
+            })
+        });
+
+        const traefikFileContents = fs.readFileSync(traefikPath, "utf8");
+        const traefikConfig = yaml.load(traefikFileContents) as any;
+
+        const parsedConfig = schema.safeParse(traefikConfig);
+
+        if (!parsedConfig.success) {
+            throw new Error(fromZodError(parsedConfig.error).toString());
+        }
+
+        traefikConfig.experimental.plugins.badger.version = "v1.5.0";
+
+        const updatedTraefikYaml = yaml.dump(traefikConfig);
+
+        fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");
+
+        console.log(
+            "Updated the version of Badger in your Traefik configuration to v1.5.0"
+        );
+    } catch (e) {
+        console.log(
+            "We were unable to update the version of Badger in your Traefik configuration. Please update it manually. Check the release notes for this version for more information."
+        );
+        console.error(e);
+    }
+
+    console.log(`${version} migration complete`);
+}
@@ -1,6 +1,6 @@
 "use client";

-import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent } from "@/components/ui/card";
 import {
@@ -43,10 +43,12 @@ import {
    CheckCircle2,
    ChevronsUpDown,
    ExternalLink,
+    Globe,
    KeyRound,
    Zap
 } from "lucide-react";
 import { useTranslations } from "next-intl";
+import Link from "next/link";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { usePaidStatus } from "@/hooks/usePaidStatus";
 import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix";
@@ -494,6 +496,28 @@ export default function DomainPicker({
    const hasMoreProvided =
        sortedAvailableOptions.length > providedDomainsShown;

+    const noDomainsAvailable =
+        !loadingDomains &&
+        organizationDomains.length === 0 &&
+        (build === "oss" || hideFreeDomain || requiresPaywall);
+
+    if (noDomainsAvailable) {
+        return (
+            <Alert>
+                <Globe className="h-4 w-4" />
+                <AlertTitle>{t("domainPickerNoDomainsAvailableTitle")}</AlertTitle>
+                <AlertDescription className="space-y-3">
+                    <p>{t("domainPickerNoDomainsAvailableDescription")}</p>
+                    <Button asChild size="sm" variant="outline">
+                        <Link href={`/${orgId}/settings/domains`}>
+                            {t("domainPickerNoDomainsAvailableAction")}
+                        </Link>
+                    </Button>
+                </AlertDescription>
+            </Alert>
+        );
+    }
+
    return (
        <div className="space-y-4">
            <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
Author	SHA1	Message	Date
dependabot[bot]	72f179578b	Bump axios from 1.16.1 to 1.18.0 Bumps [axios](https://github.com/axios/axios) from 1.16.1 to 1.18.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.16.1...v1.18.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-20 19:06:46 +00:00
Owen Schwartz	41c68148a9	Merge pull request #3467 from fosrl/dev 1.21.0	2026-07-20 11:46:48 -04:00
Owen Schwartz	5d38059b95	Merge pull request #3466 from fosrl/api-improvements api improvements	2026-07-20 11:44:25 -04:00
Owen	df0198df9c	Update internal -> private	2026-07-20 11:44:07 -04:00
Owen	26713b53f6	Fix #3462	2026-07-20 11:44:07 -04:00
Owen	2bc6b28978	Unify put vs post	2026-07-20 11:44:07 -04:00
Owen	f1ed4da8a4	Move to legacy	2026-07-20 11:44:07 -04:00
Owen	adeefb9dbd	Add missing endpoints to api	2026-07-20 11:44:05 -04:00
Owen	bf1cc705a5	Update tags	2026-07-20 11:43:10 -04:00
Owen	0b82dae01e	More route cleanup	2026-07-20 11:43:09 -04:00
Owen	75afe6ece2	Order more api routes	2026-07-20 11:43:09 -04:00
Owen	70e2fe1e4e	Just add ordering	2026-07-20 11:43:06 -04:00
Owen	17e03457e1	Recategorize	2026-07-20 11:42:37 -04:00
Owen	4d8cb7e231	Add aliaes for public/private resources	2026-07-20 11:42:35 -04:00
Owen	9561d23f1e	Resovle endcoding issue	2026-07-19 14:41:07 -04:00
Owen	a2e1c7b751	Go to domains if no domains	2026-07-18 16:30:29 -04:00
Owen	9e2ec72ced	Fix missing resource id in cache	2026-07-18 16:15:30 -04:00
Owen	02fe1f3abd	Claify that this is only for the cloud	2026-07-18 11:53:56 -04:00
Milo Schwartz	c30fe5b574	Merge pull request #3457 from fosrl/dev 1.21.0	2026-07-17 17:17:35 -04:00
miloschwartz	a0b9ea76a3	add badger to migration	2026-07-17 16:22:15 -04:00
miloschwartz	eb3a3eac98	add 1.21 migrations	2026-07-17 15:58:13 -04:00
Owen Schwartz	113b7a0b84	Merge pull request #3453 from fosrl/dev 1.20.0-s.3	2026-07-16 21:39:00 -04:00
Owen Schwartz	5d20956a0e	Merge pull request #3450 from fosrl/dev 1.20.0-s.2	2026-07-15 20:55:40 -04:00
Milo Schwartz	e5398d441e	Merge pull request #3425 from fosrl/dev Dev	2026-07-09 21:33:17 -04:00
Milo Schwartz	d4138e2141	Merge pull request #3421 from fosrl/dev 1.20.0	2026-07-09 10:40:35 -04:00
Milo Schwartz	09d5d9082e	Merge pull request #3413 from fosrl/dev 1.20.0	2026-07-08 15:30:03 -04:00
Owen Schwartz	5cb316f4e9	Merge pull request #3404 from fosrl/dev Add ? to support undefined	2026-07-07 10:59:56 -04:00
Owen Schwartz	6b6c9cf4d8	Merge pull request #3403 from fosrl/dev Move jit mode to a config param	2026-07-07 10:41:59 -04:00
Owen Schwartz	05617c63c0	Merge pull request #3402 from fosrl/dev 1.19.4-s.5	2026-07-07 10:21:57 -04:00
Owen Schwartz	d4c52bbf2f	Merge pull request #3396 from fosrl/dev 1.19.4-s.5	2026-07-03 16:15:18 -04:00
Owen Schwartz	87f50bf0cc	Merge pull request #3389 from fosrl/dev 1.19.4-s.3	2026-07-03 10:29:15 -04:00
Owen Schwartz	2c66da1b19	Merge pull request #3386 from v1rusnl/main Upgrade Traefik image to version 3.7	2026-07-03 10:18:44 -04:00
v1rusnl	ab19955502	Upgrade Traefik image to version 3.7	2026-07-03 08:22:13 +02:00
v1rusnl	1db9dcec81	Update Traefik image version to v3.7	2026-07-03 08:21:12 +02:00
Owen Schwartz	49c2d3163e	Merge pull request #3381 from fosrl/dev dev	2026-07-02 10:56:39 -04:00
Owen Schwartz	45b9e13a13	Merge pull request #3378 from fosrl/dev 1.19.4-s.1	2026-07-01 21:48:01 -04:00