From a3076941d0f8dd72836aed671ba3fdee2f2c3e1d Mon Sep 17 00:00:00 2001
From: Anna Schreiner <anna.s.schreiner@gmail.com>
Date: Mon, 24 Nov 2025 11:15:16 +0100
Subject: [PATCH] fix mess up

---
 doc/index.html                                | 5375 +++++++++--------
 go/client/client.go                           |   11 +
 .../v2/adminv2connect/project.connect.go      |  114 +
 go/metalstack/admin/v2/project.pb.go          |  199 +
 go/permissions/servicepermissions.go          |    6 +
 go/tests/mock_clients.go                      |    9 +
 .../v2/adminv2connect/ProjectServiceClient.go |  107 +
 .../adminv2connect/ProjectServiceHandler.go   |  107 +
 proto/metalstack/admin/v2/project.proto       |   34 +
 python/metalstack/admin/v2/project_connect.py |  119 +
 python/metalstack/admin/v2/project_pb2.py     |   48 +
 python/metalstack/admin/v2/project_pb2.pyi    |   24 +
 python/metalstack/client/client.py            |    4 +
 13 files changed, 3525 insertions(+), 2632 deletions(-)
 create mode 100644 go/metalstack/admin/v2/adminv2connect/project.connect.go
 create mode 100644 go/metalstack/admin/v2/project.pb.go
 create mode 100644 go/tests/mocks/metalstack/admin/v2/adminv2connect/ProjectServiceClient.go
 create mode 100644 go/tests/mocks/metalstack/admin/v2/adminv2connect/ProjectServiceHandler.go
 create mode 100644 proto/metalstack/admin/v2/project.proto
 create mode 100644 python/metalstack/admin/v2/project_connect.py
 create mode 100644 python/metalstack/admin/v2/project_pb2.py
 create mode 100644 python/metalstack/admin/v2/project_pb2.pyi

diff --git a/doc/index.html b/doc/index.html
index 2d3ecf76..3d127898 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -1163,6 +1163,160 @@ <h2>Table of Contents</h2>
           </li>
         
           
+          <li>
+            <a href="#metalstack%2fapi%2fv2%2fproject.proto">metalstack/api/v2/project.proto</a>
+            <ul>
+              
+                <li>
+                  <a href="#metalstack.api.v2.Project"><span class="badge">M</span>Project</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectInvite"><span class="badge">M</span>ProjectInvite</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectMember"><span class="badge">M</span>ProjectMember</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceCreateRequest"><span class="badge">M</span>ProjectServiceCreateRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceCreateResponse"><span class="badge">M</span>ProjectServiceCreateResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceDeleteRequest"><span class="badge">M</span>ProjectServiceDeleteRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceDeleteResponse"><span class="badge">M</span>ProjectServiceDeleteResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceGetRequest"><span class="badge">M</span>ProjectServiceGetRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceGetResponse"><span class="badge">M</span>ProjectServiceGetResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInviteAcceptRequest"><span class="badge">M</span>ProjectServiceInviteAcceptRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInviteAcceptResponse"><span class="badge">M</span>ProjectServiceInviteAcceptResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInviteDeleteRequest"><span class="badge">M</span>ProjectServiceInviteDeleteRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInviteDeleteResponse"><span class="badge">M</span>ProjectServiceInviteDeleteResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInviteGetRequest"><span class="badge">M</span>ProjectServiceInviteGetRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInviteGetResponse"><span class="badge">M</span>ProjectServiceInviteGetResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInviteRequest"><span class="badge">M</span>ProjectServiceInviteRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInviteResponse"><span class="badge">M</span>ProjectServiceInviteResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInvitesListRequest"><span class="badge">M</span>ProjectServiceInvitesListRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceInvitesListResponse"><span class="badge">M</span>ProjectServiceInvitesListResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceLeaveRequest"><span class="badge">M</span>ProjectServiceLeaveRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceLeaveResponse"><span class="badge">M</span>ProjectServiceLeaveResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceListRequest"><span class="badge">M</span>ProjectServiceListRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceListResponse"><span class="badge">M</span>ProjectServiceListResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceRemoveMemberRequest"><span class="badge">M</span>ProjectServiceRemoveMemberRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceRemoveMemberResponse"><span class="badge">M</span>ProjectServiceRemoveMemberResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceUpdateMemberRequest"><span class="badge">M</span>ProjectServiceUpdateMemberRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceUpdateMemberResponse"><span class="badge">M</span>ProjectServiceUpdateMemberResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceUpdateRequest"><span class="badge">M</span>ProjectServiceUpdateRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectServiceUpdateResponse"><span class="badge">M</span>ProjectServiceUpdateResponse</a>
+                </li>
+              
+              
+              
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectService"><span class="badge">S</span>ProjectService</a>
+                </li>
+              
+            </ul>
+          </li>
+        
+          
+          <li>
+            <a href="#metalstack%2fadmin%2fv2%2fproject.proto">metalstack/admin/v2/project.proto</a>
+            <ul>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.ProjectServiceListRequest"><span class="badge">M</span>ProjectServiceListRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.ProjectServiceListResponse"><span class="badge">M</span>ProjectServiceListResponse</a>
+                </li>
+              
+              
+              
+              
+                <li>
+                  <a href="#metalstack.admin.v2.ProjectService"><span class="badge">S</span>ProjectService</a>
+                </li>
+              
+            </ul>
+          </li>
+        
+          
           <li>
             <a href="#metalstack%2fadmin%2fv2%2fsize.proto">metalstack/admin/v2/size.proto</a>
             <ul>
@@ -1715,258 +1869,127 @@ <h2>Table of Contents</h2>
         
           
           <li>
-            <a href="#metalstack%2fapi%2fv2%2fproject.proto">metalstack/api/v2/project.proto</a>
+            <a href="#metalstack%2fapi%2fv2%2fuser.proto">metalstack/api/v2/user.proto</a>
             <ul>
               
                 <li>
-                  <a href="#metalstack.api.v2.Project"><span class="badge">M</span>Project</a>
+                  <a href="#metalstack.api.v2.User"><span class="badge">M</span>User</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectInvite"><span class="badge">M</span>ProjectInvite</a>
+                  <a href="#metalstack.api.v2.UserServiceGetRequest"><span class="badge">M</span>UserServiceGetRequest</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectMember"><span class="badge">M</span>ProjectMember</a>
+                  <a href="#metalstack.api.v2.UserServiceGetResponse"><span class="badge">M</span>UserServiceGetResponse</a>
                 </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceCreateRequest"><span class="badge">M</span>ProjectServiceCreateRequest</a>
-                </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceCreateResponse"><span class="badge">M</span>ProjectServiceCreateResponse</a>
-                </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceDeleteRequest"><span class="badge">M</span>ProjectServiceDeleteRequest</a>
-                </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceDeleteResponse"><span class="badge">M</span>ProjectServiceDeleteResponse</a>
+                  <a href="#metalstack.api.v2.UserService"><span class="badge">S</span>UserService</a>
                 </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceGetRequest"><span class="badge">M</span>ProjectServiceGetRequest</a>
-                </li>
+            </ul>
+          </li>
+        
+          
+          <li>
+            <a href="#metalstack%2fapi%2fv2%2fversion.proto">metalstack/api/v2/version.proto</a>
+            <ul>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceGetResponse"><span class="badge">M</span>ProjectServiceGetResponse</a>
+                  <a href="#metalstack.api.v2.Version"><span class="badge">M</span>Version</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInviteAcceptRequest"><span class="badge">M</span>ProjectServiceInviteAcceptRequest</a>
+                  <a href="#metalstack.api.v2.VersionServiceGetRequest"><span class="badge">M</span>VersionServiceGetRequest</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInviteAcceptResponse"><span class="badge">M</span>ProjectServiceInviteAcceptResponse</a>
+                  <a href="#metalstack.api.v2.VersionServiceGetResponse"><span class="badge">M</span>VersionServiceGetResponse</a>
                 </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInviteDeleteRequest"><span class="badge">M</span>ProjectServiceInviteDeleteRequest</a>
-                </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInviteDeleteResponse"><span class="badge">M</span>ProjectServiceInviteDeleteResponse</a>
-                </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInviteGetRequest"><span class="badge">M</span>ProjectServiceInviteGetRequest</a>
-                </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInviteGetResponse"><span class="badge">M</span>ProjectServiceInviteGetResponse</a>
+                  <a href="#metalstack.api.v2.VersionService"><span class="badge">S</span>VersionService</a>
                 </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInviteRequest"><span class="badge">M</span>ProjectServiceInviteRequest</a>
-                </li>
+            </ul>
+          </li>
+        
+          
+          <li>
+            <a href="#metalstack%2finfra%2fv2%2fbmc.proto">metalstack/infra/v2/bmc.proto</a>
+            <ul>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInviteResponse"><span class="badge">M</span>ProjectServiceInviteResponse</a>
+                  <a href="#metalstack.infra.v2.UpdateBMCInfoRequest"><span class="badge">M</span>UpdateBMCInfoRequest</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInvitesListRequest"><span class="badge">M</span>ProjectServiceInvitesListRequest</a>
+                  <a href="#metalstack.infra.v2.UpdateBMCInfoResponse"><span class="badge">M</span>UpdateBMCInfoResponse</a>
                 </li>
               
-                <li>
-                  <a href="#metalstack.api.v2.ProjectServiceInvitesListResponse"><span class="badge">M</span>ProjectServiceInvitesListResponse</a>
-                </li>
+              
+              
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceLeaveRequest"><span class="badge">M</span>ProjectServiceLeaveRequest</a>
+                  <a href="#metalstack.infra.v2.BMCService"><span class="badge">S</span>BMCService</a>
                 </li>
               
+            </ul>
+          </li>
+        
+          
+          <li>
+            <a href="#metalstack%2finfra%2fv2%2fswitch.proto">metalstack/infra/v2/switch.proto</a>
+            <ul>
+              
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceLeaveResponse"><span class="badge">M</span>ProjectServiceLeaveResponse</a>
+                  <a href="#metalstack.infra.v2.SwitchServiceGetRequest"><span class="badge">M</span>SwitchServiceGetRequest</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceListRequest"><span class="badge">M</span>ProjectServiceListRequest</a>
+                  <a href="#metalstack.infra.v2.SwitchServiceGetResponse"><span class="badge">M</span>SwitchServiceGetResponse</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceListResponse"><span class="badge">M</span>ProjectServiceListResponse</a>
+                  <a href="#metalstack.infra.v2.SwitchServiceHeartbeatRequest"><span class="badge">M</span>SwitchServiceHeartbeatRequest</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceRemoveMemberRequest"><span class="badge">M</span>ProjectServiceRemoveMemberRequest</a>
+                  <a href="#metalstack.infra.v2.SwitchServiceHeartbeatRequest.BgpPortStatesEntry"><span class="badge">M</span>SwitchServiceHeartbeatRequest.BgpPortStatesEntry</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceRemoveMemberResponse"><span class="badge">M</span>ProjectServiceRemoveMemberResponse</a>
+                  <a href="#metalstack.infra.v2.SwitchServiceHeartbeatRequest.PortStatesEntry"><span class="badge">M</span>SwitchServiceHeartbeatRequest.PortStatesEntry</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceUpdateMemberRequest"><span class="badge">M</span>ProjectServiceUpdateMemberRequest</a>
+                  <a href="#metalstack.infra.v2.SwitchServiceHeartbeatResponse"><span class="badge">M</span>SwitchServiceHeartbeatResponse</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceUpdateMemberResponse"><span class="badge">M</span>ProjectServiceUpdateMemberResponse</a>
+                  <a href="#metalstack.infra.v2.SwitchServiceRegisterRequest"><span class="badge">M</span>SwitchServiceRegisterRequest</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceUpdateRequest"><span class="badge">M</span>ProjectServiceUpdateRequest</a>
+                  <a href="#metalstack.infra.v2.SwitchServiceRegisterResponse"><span class="badge">M</span>SwitchServiceRegisterResponse</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectServiceUpdateResponse"><span class="badge">M</span>ProjectServiceUpdateResponse</a>
+                  <a href="#metalstack.infra.v2.SwitchSync"><span class="badge">M</span>SwitchSync</a>
                 </li>
               
               
               
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectService"><span class="badge">S</span>ProjectService</a>
-                </li>
-              
-            </ul>
-          </li>
-        
-          
-          <li>
-            <a href="#metalstack%2fapi%2fv2%2fuser.proto">metalstack/api/v2/user.proto</a>
-            <ul>
-              
-                <li>
-                  <a href="#metalstack.api.v2.User"><span class="badge">M</span>User</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.api.v2.UserServiceGetRequest"><span class="badge">M</span>UserServiceGetRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.api.v2.UserServiceGetResponse"><span class="badge">M</span>UserServiceGetResponse</a>
-                </li>
-              
-              
-              
-              
-                <li>
-                  <a href="#metalstack.api.v2.UserService"><span class="badge">S</span>UserService</a>
-                </li>
-              
-            </ul>
-          </li>
-        
-          
-          <li>
-            <a href="#metalstack%2fapi%2fv2%2fversion.proto">metalstack/api/v2/version.proto</a>
-            <ul>
-              
-                <li>
-                  <a href="#metalstack.api.v2.Version"><span class="badge">M</span>Version</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.api.v2.VersionServiceGetRequest"><span class="badge">M</span>VersionServiceGetRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.api.v2.VersionServiceGetResponse"><span class="badge">M</span>VersionServiceGetResponse</a>
-                </li>
-              
-              
-              
-              
-                <li>
-                  <a href="#metalstack.api.v2.VersionService"><span class="badge">S</span>VersionService</a>
-                </li>
-              
-            </ul>
-          </li>
-        
-          
-          <li>
-            <a href="#metalstack%2finfra%2fv2%2fbmc.proto">metalstack/infra/v2/bmc.proto</a>
-            <ul>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.UpdateBMCInfoRequest"><span class="badge">M</span>UpdateBMCInfoRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.UpdateBMCInfoResponse"><span class="badge">M</span>UpdateBMCInfoResponse</a>
-                </li>
-              
-              
-              
-              
-                <li>
-                  <a href="#metalstack.infra.v2.BMCService"><span class="badge">S</span>BMCService</a>
-                </li>
-              
-            </ul>
-          </li>
-        
-          
-          <li>
-            <a href="#metalstack%2finfra%2fv2%2fswitch.proto">metalstack/infra/v2/switch.proto</a>
-            <ul>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchServiceGetRequest"><span class="badge">M</span>SwitchServiceGetRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchServiceGetResponse"><span class="badge">M</span>SwitchServiceGetResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchServiceHeartbeatRequest"><span class="badge">M</span>SwitchServiceHeartbeatRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchServiceHeartbeatRequest.BgpPortStatesEntry"><span class="badge">M</span>SwitchServiceHeartbeatRequest.BgpPortStatesEntry</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchServiceHeartbeatRequest.PortStatesEntry"><span class="badge">M</span>SwitchServiceHeartbeatRequest.PortStatesEntry</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchServiceHeartbeatResponse"><span class="badge">M</span>SwitchServiceHeartbeatResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchServiceRegisterRequest"><span class="badge">M</span>SwitchServiceRegisterRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchServiceRegisterResponse"><span class="badge">M</span>SwitchServiceRegisterResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchSync"><span class="badge">M</span>SwitchSync</a>
-                </li>
-              
-              
-              
-              
-                <li>
-                  <a href="#metalstack.infra.v2.SwitchService"><span class="badge">S</span>SwitchService</a>
+                  <a href="#metalstack.infra.v2.SwitchService"><span class="badge">S</span>SwitchService</a>
                 </li>
               
             </ul>
@@ -9979,13 +10002,13 @@ <h3 id="metalstack.admin.v2.PartitionService">PartitionService</h3>
     
       
       <div class="file-heading">
-        <h2 id="metalstack/admin/v2/size.proto">metalstack/admin/v2/size.proto</h2><a href="#title">Top</a>
+        <h2 id="metalstack/api/v2/project.proto">metalstack/api/v2/project.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
       
-        <h3 id="metalstack.admin.v2.SizeServiceCreateRequest">SizeServiceCreateRequest</h3>
-        <p>SizeServiceCreateRequest is the request payload for a size create request</p>
+        <h3 id="metalstack.api.v2.Project">Project</h3>
+        <p>Project defines a group of resources belonging to a tenant</p><p>a tenant can have multiple projects</p>
 
         
           <table class="field-table">
@@ -9995,58 +10018,45 @@ <h3 id="metalstack.admin.v2.SizeServiceCreateRequest">SizeServiceCreateRequest</
             <tbody>
               
                 <tr>
-                  <td>size</td>
-                  <td><a href="#metalstack.api.v2.Size">metalstack.api.v2.Size</a></td>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Size is the size to create </p></td>
+                  <td><p>Uuid of this project </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.admin.v2.SizeServiceCreateResponse">SizeServiceCreateResponse</h3>
-        <p>SizeServiceGetResponse is the response payload for a size create request</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+                <tr>
+                  <td>meta</td>
+                  <td><a href="#metalstack.api.v2.Meta">Meta</a></td>
+                  <td></td>
+                  <td><p>Meta for this project </p></td>
+                </tr>
               
                 <tr>
-                  <td>size</td>
-                  <td><a href="#metalstack.api.v2.Size">metalstack.api.v2.Size</a></td>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Size the size </p></td>
+                  <td><p>Name of this project must be unique per tenant </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.admin.v2.SizeServiceDeleteRequest">SizeServiceDeleteRequest</h3>
-        <p>SizeServiceDeleteRequest is the request payload for a size delete request</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Description of this project </p></td>
+                </tr>
               
                 <tr>
-                  <td>id</td>
+                  <td>tenant</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>ID of the size to delete </p></td>
+                  <td><p>Tenant this project belongs to </p></td>
+                </tr>
+              
+                <tr>
+                  <td>avatar_url</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>AvatarUrl of the Project </p></td>
                 </tr>
               
             </tbody>
@@ -10056,8 +10066,8 @@ <h3 id="metalstack.admin.v2.SizeServiceDeleteRequest">SizeServiceDeleteRequest</
 
         
       
-        <h3 id="metalstack.admin.v2.SizeServiceDeleteResponse">SizeServiceDeleteResponse</h3>
-        <p>SizeServiceDeleteResponse is the response payload for a size delete request</p>
+        <h3 id="metalstack.api.v2.ProjectInvite">ProjectInvite</h3>
+        <p>ProjectInvite defines invite to project</p>
 
         
           <table class="field-table">
@@ -10067,69 +10077,66 @@ <h3 id="metalstack.admin.v2.SizeServiceDeleteResponse">SizeServiceDeleteResponse
             <tbody>
               
                 <tr>
-                  <td>size</td>
-                  <td><a href="#metalstack.api.v2.Size">metalstack.api.v2.Size</a></td>
+                  <td>secret</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Size the size </p></td>
+                  <td><p>Secret is the secret part of the invite, typically part of the url </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.admin.v2.SizeServiceUpdateRequest">SizeServiceUpdateRequest</h3>
-        <p>SizeServiceUpdateRequest is the request payload for a size update request</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>id</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Id of this size </p></td>
+                  <td><p>Project is the project id for which this invite was created </p></td>
                 </tr>
               
                 <tr>
-                  <td>update_meta</td>
-                  <td><a href="#metalstack.api.v2.UpdateMeta">metalstack.api.v2.UpdateMeta</a></td>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
                   <td></td>
-                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request </p></td>
+                  <td><p>Role is the role in this project the user will get after accepting the invitation </p></td>
                 </tr>
               
                 <tr>
-                  <td>name</td>
+                  <td>joined</td>
+                  <td><a href="#bool">bool</a></td>
+                  <td></td>
+                  <td><p>Joined is false as long as a user has not accepted the invite </p></td>
+                </tr>
+              
+                <tr>
+                  <td>project_name</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Name of this size </p></td>
+                  <td></td>
+                  <td><p>ProjectName is the project name for which this invite was created </p></td>
                 </tr>
               
                 <tr>
-                  <td>description</td>
+                  <td>tenant</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Description of this size </p></td>
+                  <td></td>
+                  <td><p>Tenant is the login of tenant who invites to join this project </p></td>
                 </tr>
               
                 <tr>
-                  <td>constraints</td>
-                  <td><a href="#metalstack.api.v2.SizeConstraint">metalstack.api.v2.SizeConstraint</a></td>
-                  <td>repeated</td>
-                  <td><p>Constraints which must match that a specific machine is considered of this size </p></td>
+                  <td>tenant_name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>TenantName is the name of tenant who invites to join this project </p></td>
                 </tr>
               
                 <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.UpdateLabels">metalstack.api.v2.UpdateLabels</a></td>
-                  <td>optional</td>
-                  <td><p>Labels to update on this size </p></td>
+                  <td>expires_at</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>ExpiresAt the date when this invite expires </p></td>
+                </tr>
+              
+                <tr>
+                  <td>joined_at</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>JoinedAt the date when the member accepted this invite </p></td>
                 </tr>
               
             </tbody>
@@ -10139,8 +10146,8 @@ <h3 id="metalstack.admin.v2.SizeServiceUpdateRequest">SizeServiceUpdateRequest</
 
         
       
-        <h3 id="metalstack.admin.v2.SizeServiceUpdateResponse">SizeServiceUpdateResponse</h3>
-        <p>SizeServiceUpdateResponse is the response payload for a size update request</p>
+        <h3 id="metalstack.api.v2.ProjectMember">ProjectMember</h3>
+        <p>ProjectMember defines a user that participates at a project</p>
 
         
           <table class="field-table">
@@ -10150,10 +10157,33 @@ <h3 id="metalstack.admin.v2.SizeServiceUpdateResponse">SizeServiceUpdateResponse
             <tbody>
               
                 <tr>
-                  <td>size</td>
-                  <td><a href="#metalstack.api.v2.Size">metalstack.api.v2.Size</a></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Size the size </p></td>
+                  <td><p>Id is the user id of the member </p></td>
+                </tr>
+              
+                <tr>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
+                  <td></td>
+                  <td><p>Role is the role of the member </p></td>
+                </tr>
+              
+                <tr>
+                  <td>inherited_membership</td>
+                  <td><a href="#bool">bool</a></td>
+                  <td></td>
+                  <td><p>InheritedMembership indicates that this member has implicit permissions on the project through his membership within the tenant.
+This member does not have direct project membership but gains permissions on this project from the role he has in the tenant.
+Inherited memberships are not included in member lists for users with guest permission but only for direct tenant members. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>created_at</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>CreatedAt the date when the member was added to the project </p></td>
                 </tr>
               
             </tbody>
@@ -10163,55 +10193,8 @@ <h3 id="metalstack.admin.v2.SizeServiceUpdateResponse">SizeServiceUpdateResponse
 
         
       
-
-      
-
-      
-
-      
-        <h3 id="metalstack.admin.v2.SizeService">SizeService</h3>
-        <p>SizeService serves size related functions</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>Create</td>
-                <td><a href="#metalstack.admin.v2.SizeServiceCreateRequest">SizeServiceCreateRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SizeServiceCreateResponse">SizeServiceCreateResponse</a></td>
-                <td><p>Create a size</p></td>
-              </tr>
-            
-              <tr>
-                <td>Update</td>
-                <td><a href="#metalstack.admin.v2.SizeServiceUpdateRequest">SizeServiceUpdateRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SizeServiceUpdateResponse">SizeServiceUpdateResponse</a></td>
-                <td><p>Update a size</p></td>
-              </tr>
-            
-              <tr>
-                <td>Delete</td>
-                <td><a href="#metalstack.admin.v2.SizeServiceDeleteRequest">SizeServiceDeleteRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SizeServiceDeleteResponse">SizeServiceDeleteResponse</a></td>
-                <td><p>Delete a size</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-
-        
-    
-      
-      <div class="file-heading">
-        <h2 id="metalstack/api/v2/switch.proto">metalstack/api/v2/switch.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
-
-      
-        <h3 id="metalstack.api.v2.BGPFilter">BGPFilter</h3>
-        <p>BGPFilter can be used to restrict BGP based on CIDRs and VNIs.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceCreateRequest">ProjectServiceCreateRequest</h3>
+        <p>ProjectServiceCreateRequest is the request payload to Create a project</p>
 
         
           <table class="field-table">
@@ -10221,17 +10204,39 @@ <h3 id="metalstack.api.v2.BGPFilter">BGPFilter</h3>
             <tbody>
               
                 <tr>
-                  <td>cidrs</td>
+                  <td>login</td>
                   <td><a href="#string">string</a></td>
-                  <td>repeated</td>
-                  <td><p>CIDRs for which to allow BGP </p></td>
+                  <td></td>
+                  <td><p>Login is the tenant of this project
+TODO: is login really a good name? </p></td>
                 </tr>
               
                 <tr>
-                  <td>vnis</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
-                  <td>repeated</td>
-                  <td><p>VNIs for which to allow BGP </p></td>
+                  <td></td>
+                  <td><p>Name of this project, unique per tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Description of this project </p></td>
+                </tr>
+              
+                <tr>
+                  <td>avatar_url</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Avatar URL of the project </p></td>
+                </tr>
+              
+                <tr>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
+                  <td></td>
+                  <td><p>Labels on the project </p></td>
                 </tr>
               
             </tbody>
@@ -10241,8 +10246,8 @@ <h3 id="metalstack.api.v2.BGPFilter">BGPFilter</h3>
 
         
       
-        <h3 id="metalstack.api.v2.MachineConnection">MachineConnection</h3>
-        <p>MachineConnection associates a machine with the corresponding switch nic.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceCreateResponse">ProjectServiceCreateResponse</h3>
+        <p>ProjectServiceCreateResponse is the response payload of creation of a project</p>
 
         
           <table class="field-table">
@@ -10252,17 +10257,34 @@ <h3 id="metalstack.api.v2.MachineConnection">MachineConnection</h3>
             <tbody>
               
                 <tr>
-                  <td>machine_id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>project</td>
+                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
                   <td></td>
-                  <td><p>MachineId of the machine connected to the nic. </p></td>
+                  <td><p>Project is the project </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectServiceDeleteRequest">ProjectServiceDeleteRequest</h3>
+        <p>ProjectServiceDeleteRequest is the request payload to delete a project</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>nic</td>
-                  <td><a href="#metalstack.api.v2.SwitchNic">SwitchNic</a></td>
+                  <td>project</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Nic the machine is connected to. </p></td>
+                  <td><p>Project is the uuid of the project to get </p></td>
                 </tr>
               
             </tbody>
@@ -10272,8 +10294,8 @@ <h3 id="metalstack.api.v2.MachineConnection">MachineConnection</h3>
 
         
       
-        <h3 id="metalstack.api.v2.NicState">NicState</h3>
-        <p>NicState represents the current state of a switch port.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceDeleteResponse">ProjectServiceDeleteResponse</h3>
+        <p>ProjectServiceDeleteResponse is the response payload to delete a project</p>
 
         
           <table class="field-table">
@@ -10283,17 +10305,10 @@ <h3 id="metalstack.api.v2.NicState">NicState</h3>
             <tbody>
               
                 <tr>
-                  <td>desired</td>
-                  <td><a href="#metalstack.api.v2.SwitchPortStatus">SwitchPortStatus</a></td>
-                  <td>optional</td>
-                  <td><p>Desired is the desired port state. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>actual</td>
-                  <td><a href="#metalstack.api.v2.SwitchPortStatus">SwitchPortStatus</a></td>
+                  <td>project</td>
+                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
                   <td></td>
-                  <td><p>Actual is the actual port state. </p></td>
+                  <td><p>Project is the project </p></td>
                 </tr>
               
             </tbody>
@@ -10303,8 +10318,8 @@ <h3 id="metalstack.api.v2.NicState">NicState</h3>
 
         
       
-        <h3 id="metalstack.api.v2.Switch">Switch</h3>
-        <p>Switch represents a network switch.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceGetRequest">ProjectServiceGetRequest</h3>
+        <p>ProjectServiceGetRequest is the request payload to get a project</p>
 
         
           <table class="field-table">
@@ -10314,87 +10329,96 @@ <h3 id="metalstack.api.v2.Switch">Switch</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Id of the switch. </p></td>
+                  <td><p>Project is the uuid of the project to get </p></td>
                 </tr>
               
-                <tr>
-                  <td>meta</td>
-                  <td><a href="#metalstack.api.v2.Meta">Meta</a></td>
-                  <td></td>
-                  <td><p>Meta for this switch. </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectServiceGetResponse">ProjectServiceGetResponse</h3>
+        <p>ProjectServiceGetResponse is the response payload to get a projects</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
+                  <td>project</td>
+                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
                   <td></td>
-                  <td><p>Description of the switch. </p></td>
+                  <td><p>Project is the project </p></td>
                 </tr>
               
                 <tr>
-                  <td>rack</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Rack ID if the switch resides in a rack. </p></td>
+                  <td>project_members</td>
+                  <td><a href="#metalstack.api.v2.ProjectMember">ProjectMember</a></td>
+                  <td>repeated</td>
+                  <td><p>ProjectMembers in this project, projects guests will only see direct project members and not implicit memberships from tenant permissions </p></td>
                 </tr>
               
-                <tr>
-                  <td>partition</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Partition the switch belongs to. </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectServiceInviteAcceptRequest">ProjectServiceInviteAcceptRequest</h3>
+        <p>ProjectServiceInviteAcceptRequest is the request payload to a accept invite request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>replace_mode</td>
-                  <td><a href="#metalstack.api.v2.SwitchReplaceMode">SwitchReplaceMode</a></td>
+                  <td>secret</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>ReplaceMode is used to mark a switch ready for replacement. </p></td>
+                  <td><p>Secret is the invitation secret part of the invitation url </p></td>
                 </tr>
               
-                <tr>
-                  <td>management_ip</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>ManagementIp is the switch&#39;s IP for management access. </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectServiceInviteAcceptResponse">ProjectServiceInviteAcceptResponse</h3>
+        <p>ProjectServiceInvitesListResponse is the response payload to a accept invite request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>management_user</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>ManagementUser is the user name to use for management access. </p></td>
+                  <td></td>
+                  <td><p>Project ID of the project joined </p></td>
                 </tr>
               
                 <tr>
-                  <td>console_command</td>
+                  <td>project_name</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>ConsoleCommand is the command for accessing the switch&#39;s console. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>nics</td>
-                  <td><a href="#metalstack.api.v2.SwitchNic">SwitchNic</a></td>
-                  <td>repeated</td>
-                  <td><p>Nics are the front panel ports of the switch. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>os</td>
-                  <td><a href="#metalstack.api.v2.SwitchOS">SwitchOS</a></td>
                   <td></td>
-                  <td><p>SwitchOs is the OS running on the switch. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>machine_connections</td>
-                  <td><a href="#metalstack.api.v2.MachineConnection">MachineConnection</a></td>
-                  <td>repeated</td>
-                  <td><p>MachineConnections map machines to the nics they are connected to. </p></td>
+                  <td><p>ProjectName if the project joined </p></td>
                 </tr>
               
             </tbody>
@@ -10404,8 +10428,8 @@ <h3 id="metalstack.api.v2.Switch">Switch</h3>
 
         
       
-        <h3 id="metalstack.api.v2.SwitchBGPPortState">SwitchBGPPortState</h3>
-        <p>SwitchBGPPortState holds information about the BGP state of a port.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceInviteDeleteRequest">ProjectServiceInviteDeleteRequest</h3>
+        <p>ProjectServiceInviteDeleteRequest is the request payload to a delete invite</p>
 
         
           <table class="field-table">
@@ -10415,52 +10439,72 @@ <h3 id="metalstack.api.v2.SwitchBGPPortState">SwitchBGPPortState</h3>
             <tbody>
               
                 <tr>
-                  <td>neighbor</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Neighbor of this port. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>peer_group</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>PeerGroup of this port. </p></td>
+                  <td><p>Project is the uuid of the project </p></td>
                 </tr>
               
                 <tr>
-                  <td>vrf_name</td>
+                  <td>secret</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>VrfName of the VRF this port is bound to. </p></td>
+                  <td><p>Secret of the invite to delete </p></td>
                 </tr>
               
-                <tr>
-                  <td>bgp_state</td>
-                  <td><a href="#metalstack.api.v2.BGPState">BGPState</a></td>
-                  <td></td>
-                  <td><p>BgpState of the connection on this port. </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectServiceInviteDeleteResponse">ProjectServiceInviteDeleteResponse</h3>
+        <p>ProjectServiceInviteDeleteResponse is the response payload of a delete invite request</p>
+
+        
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectServiceInviteGetRequest">ProjectServiceInviteGetRequest</h3>
+        <p>ProjectServiceInviteGetRequest is the request payload to get a invite</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>bgp_timer_up_established</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td>secret</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>BgpTimerUpEstablished reports when this port&#39;s BGP connection was established. </p></td>
+                  <td><p>Secret of the invite to list </p></td>
                 </tr>
               
-                <tr>
-                  <td>sent_prefix_counter</td>
-                  <td><a href="#uint64">uint64</a></td>
-                  <td></td>
-                  <td><p>SentPrefixCounter counts the prefixes sent by the switch on this port. </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectServiceInviteGetResponse">ProjectServiceInviteGetResponse</h3>
+        <p>ProjectServiceInviteGetResponse is the response payload to a get invite request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>accepted_prefix_counter</td>
-                  <td><a href="#uint64">uint64</a></td>
+                  <td>invite</td>
+                  <td><a href="#metalstack.api.v2.ProjectInvite">ProjectInvite</a></td>
                   <td></td>
-                  <td><p>AcceptedPrefixCounter counts the prefixes received on this port. </p></td>
+                  <td><p>Invite is the invite </p></td>
                 </tr>
               
             </tbody>
@@ -10470,8 +10514,8 @@ <h3 id="metalstack.api.v2.SwitchBGPPortState">SwitchBGPPortState</h3>
 
         
       
-        <h3 id="metalstack.api.v2.SwitchNic">SwitchNic</h3>
-        <p>SwitchNic represents a front panel port and its configuration.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceInviteRequest">ProjectServiceInviteRequest</h3>
+        <p>ProjectServiceInviteRequest is used to invite a member to a project</p>
 
         
           <table class="field-table">
@@ -10481,52 +10525,17 @@ <h3 id="metalstack.api.v2.SwitchNic">SwitchNic</h3>
             <tbody>
               
                 <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Name of the switch port </p></td>
-                </tr>
-              
-                <tr>
-                  <td>identifier</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Identifier of the port </p></td>
+                  <td><p>Project is the uuid of the project </p></td>
                 </tr>
               
                 <tr>
-                  <td>mac</td>
-                  <td><a href="#string">string</a></td>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
                   <td></td>
-                  <td><p>MAC address of the port </p></td>
-                </tr>
-              
-                <tr>
-                  <td>vrf</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>VRF name if the port is bound in one </p></td>
-                </tr>
-              
-                <tr>
-                  <td>state</td>
-                  <td><a href="#metalstack.api.v2.NicState">NicState</a></td>
-                  <td>optional</td>
-                  <td><p>NicState describes the current state of the switch port. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>bgp_filter</td>
-                  <td><a href="#metalstack.api.v2.BGPFilter">BGPFilter</a></td>
-                  <td>optional</td>
-                  <td><p>BGPFilter optionally configured on a port. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>bgp_port_state</td>
-                  <td><a href="#metalstack.api.v2.SwitchBGPPortState">SwitchBGPPortState</a></td>
-                  <td>optional</td>
-                  <td><p>BGPPortState represents the current BGP status of the port. </p></td>
+                  <td><p>Role of this user in this project </p></td>
                 </tr>
               
             </tbody>
@@ -10536,8 +10545,8 @@ <h3 id="metalstack.api.v2.SwitchNic">SwitchNic</h3>
 
         
       
-        <h3 id="metalstack.api.v2.SwitchOS">SwitchOS</h3>
-        <p>SwitchOS holds information about the NOS and versions running on the switch.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceInviteResponse">ProjectServiceInviteResponse</h3>
+        <p>ProjectServiceInviteRequest is the response payload to a invite member request</p>
 
         
           <table class="field-table">
@@ -10547,24 +10556,36 @@ <h3 id="metalstack.api.v2.SwitchOS">SwitchOS</h3>
             <tbody>
               
                 <tr>
-                  <td>vendor</td>
-                  <td><a href="#metalstack.api.v2.SwitchOSVendor">SwitchOSVendor</a></td>
+                  <td>invite</td>
+                  <td><a href="#metalstack.api.v2.ProjectInvite">ProjectInvite</a></td>
                   <td></td>
-                  <td><p>Vendor identifies what NOS distribution is running on the switch, e.g. SONiC. </p></td>
+                  <td><p>Inviter contains a secret which can be sent to a potential user
+can be appended to the invitation endpoint at our cloud console like
+console.metalstack.cloud/invite/&lt;secret&gt; </p></td>
                 </tr>
               
-                <tr>
-                  <td>version</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Version specifies what NOS version is currently installed on the switch. </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectServiceInvitesListRequest">ProjectServiceInvitesListRequest</h3>
+        <p>ProjectServiceInvitesListRequest is the request payload to a list invites request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>metal_core_version</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>MetalCoreVersion is the currently running version of the metal-core. </p></td>
+                  <td><p>Project is the uuid of the project </p></td>
                 </tr>
               
             </tbody>
@@ -10574,8 +10595,8 @@ <h3 id="metalstack.api.v2.SwitchOS">SwitchOS</h3>
 
         
       
-        <h3 id="metalstack.api.v2.SwitchOSQuery">SwitchOSQuery</h3>
-        <p>SwitchOSQuery holds OS specific query parameters.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceInvitesListResponse">ProjectServiceInvitesListResponse</h3>
+        <p>ProjectServiceInvitesListResponse is the response payload to a list invites request</p>
 
         
           <table class="field-table">
@@ -10585,17 +10606,10 @@ <h3 id="metalstack.api.v2.SwitchOSQuery">SwitchOSQuery</h3>
             <tbody>
               
                 <tr>
-                  <td>vendor</td>
-                  <td><a href="#metalstack.api.v2.SwitchOSVendor">SwitchOSVendor</a></td>
-                  <td>optional</td>
-                  <td><p>OsVendor of the switch OS by which to filter the switches. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>version</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>OsVersion of the OS by which to filter the switches. </p></td>
+                  <td>invites</td>
+                  <td><a href="#metalstack.api.v2.ProjectInvite">ProjectInvite</a></td>
+                  <td>repeated</td>
+                  <td><p>Invites not already accepted the invitation to this project </p></td>
                 </tr>
               
             </tbody>
@@ -10605,8 +10619,8 @@ <h3 id="metalstack.api.v2.SwitchOSQuery">SwitchOSQuery</h3>
 
         
       
-        <h3 id="metalstack.api.v2.SwitchQuery">SwitchQuery</h3>
-        <p>SwitchQuery can be used to query a switch or a list of switches.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceLeaveRequest">ProjectServiceLeaveRequest</h3>
+        <p>ProjectServiceLeaveRequest is used to leave a project</p>
 
         
           <table class="field-table">
@@ -10616,31 +10630,10 @@ <h3 id="metalstack.api.v2.SwitchQuery">SwitchQuery</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Id of the switch to list. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>partition</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Partition of the switches to list. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>rack</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Rack of the switches to list. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>os</td>
-                  <td><a href="#metalstack.api.v2.SwitchOSQuery">SwitchOSQuery</a></td>
-                  <td>optional</td>
-                  <td><p>Switch OS specific queries. </p></td>
+                  <td></td>
+                  <td><p>Project is the uuid of the project </p></td>
                 </tr>
               
             </tbody>
@@ -10650,168 +10643,15 @@ <h3 id="metalstack.api.v2.SwitchQuery">SwitchQuery</h3>
 
         
       
+        <h3 id="metalstack.api.v2.ProjectServiceLeaveResponse">ProjectServiceLeaveResponse</h3>
+        <p>ProjectServiceLeaveResponse is the response payload to a leave project request</p>
 
-      
-        <h3 id="metalstack.api.v2.BGPState">BGPState</h3>
-        <p>BGPState represents the state of a BGP session.</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>BGP_STATE_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p>BGP_STATE_UNSPECIFIED is not specified.</p></td>
-              </tr>
-            
-              <tr>
-                <td>BGP_STATE_IDLE</td>
-                <td>1</td>
-                <td><p>BGP_STATE_IDLE is the Idle state of a BGP session.</p></td>
-              </tr>
-            
-              <tr>
-                <td>BGP_STATE_CONNECT</td>
-                <td>2</td>
-                <td><p>BGP_STATE_CONNECT is the Connect state of a BGP session.</p></td>
-              </tr>
-            
-              <tr>
-                <td>BGP_STATE_ACTIVE</td>
-                <td>3</td>
-                <td><p>BGP_STATE_ACTIVE is the Active state of a BGP session.</p></td>
-              </tr>
-            
-              <tr>
-                <td>BGP_STATE_OPEN_SENT</td>
-                <td>4</td>
-                <td><p>BGP_STATE_OPEN_SENT is the OpenSent state of a BGP session.</p></td>
-              </tr>
-            
-              <tr>
-                <td>BGP_STATE_OPEN_CONFIRM</td>
-                <td>5</td>
-                <td><p>BGP_STATE_OPEN_CONFIRM is the OpenConfirm state of a BGP session.</p></td>
-              </tr>
-            
-              <tr>
-                <td>BGP_STATE_ESTABLISHED</td>
-                <td>6</td>
-                <td><p>BGP_STATE_ESTABLISHED is the Established state of a BGP session.</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-        <h3 id="metalstack.api.v2.SwitchOSVendor">SwitchOSVendor</h3>
-        <p>SwitchOSVendor represents a NOS distribution.</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SWITCH_OS_VENDOR_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p>SWITCH_OS_VENDOR_UNSPECIFIED is not specified.</p></td>
-              </tr>
-            
-              <tr>
-                <td>SWITCH_OS_VENDOR_CUMULUS</td>
-                <td>1</td>
-                <td><p>SWITCH_OS_VENDOR_CUMULUS means this switch is running on Cumulus Linux.</p></td>
-              </tr>
-            
-              <tr>
-                <td>SWITCH_OS_VENDOR_SONIC</td>
-                <td>2</td>
-                <td><p>SWITCH_OS_VENDOR_SONIC means this switch is running on SONiC NOS.</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-        <h3 id="metalstack.api.v2.SwitchPortStatus">SwitchPortStatus</h3>
-        <p>SwitchPortStatus specifies the state of a switch port.</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SWITCH_PORT_STATUS_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p>SWITCH_PORT_STATUS_UNSPECIFIED is not specified.</p></td>
-              </tr>
-            
-              <tr>
-                <td>SWITCH_PORT_STATUS_UP</td>
-                <td>1</td>
-                <td><p>SWITCH_PORT_STATUS_UP means this port is up.</p></td>
-              </tr>
-            
-              <tr>
-                <td>SWITCH_PORT_STATUS_DOWN</td>
-                <td>2</td>
-                <td><p>SWITCH_PORT_STATUS_DOWN means this port is down.</p></td>
-              </tr>
-            
-              <tr>
-                <td>SWITCH_PORT_STATUS_UNKNOWN</td>
-                <td>3</td>
-                <td><p>SWITCH_PORT_STATUS_UNKNOWN means the status of this port is unknown.</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-        <h3 id="metalstack.api.v2.SwitchReplaceMode">SwitchReplaceMode</h3>
-        <p>SwitchReplaceMode is used to mark a switch ready for replacement.</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SWITCH_REPLACE_MODE_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p>SWITCH_REPLACE_MODE_UNSPECIFIED is not specified.</p></td>
-              </tr>
-            
-              <tr>
-                <td>SWITCH_REPLACE_MODE_REPLACE</td>
-                <td>1</td>
-                <td><p>SWITCH_REPLACE_MODE_REPLACE means this switch is waiting to be replaced.</p></td>
-              </tr>
-            
-              <tr>
-                <td>SWITCH_REPLACE_MODE_OPERATIONAL</td>
-                <td>2</td>
-                <td><p>SWITCH_REPLACE_MODE_OPERATIONAL means this switch is operational and cannot be replaced.</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-
-      
-
-      
-    
-      
-      <div class="file-heading">
-        <h2 id="metalstack/admin/v2/switch.proto">metalstack/admin/v2/switch.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
+        
 
+        
       
-        <h3 id="metalstack.admin.v2.SwitchServiceDeleteRequest">SwitchServiceDeleteRequest</h3>
-        <p>SwitchServiceDeleteRequest.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceListRequest">ProjectServiceListRequest</h3>
+        <p>ProjectServiceListRequest is the request payload to list all projects</p>
 
         
           <table class="field-table">
@@ -10823,15 +10663,29 @@ <h3 id="metalstack.admin.v2.SwitchServiceDeleteRequest">SwitchServiceDeleteReque
                 <tr>
                   <td>id</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Id of the switch. </p></td>
+                  <td>optional</td>
+                  <td><p>Id lists only projects with this id </p></td>
                 </tr>
               
                 <tr>
-                  <td>force</td>
-                  <td><a href="#bool">bool</a></td>
-                  <td></td>
-                  <td><p>Force will allow switch deletion despite existing machine connections. </p></td>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Name lists only projects with this name </p></td>
+                </tr>
+              
+                <tr>
+                  <td>tenant</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Tenant lists only projects of this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
+                  <td>optional</td>
+                  <td><p>Labels lists only projects containing the given labels </p></td>
                 </tr>
               
             </tbody>
@@ -10841,8 +10695,8 @@ <h3 id="metalstack.admin.v2.SwitchServiceDeleteRequest">SwitchServiceDeleteReque
 
         
       
-        <h3 id="metalstack.admin.v2.SwitchServiceDeleteResponse">SwitchServiceDeleteResponse</h3>
-        <p>SwitchServiceDeleteResponse.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceListResponse">ProjectServiceListResponse</h3>
+        <p>ProjectServiceListResponse is the response payload to list all projects</p>
 
         
           <table class="field-table">
@@ -10852,10 +10706,10 @@ <h3 id="metalstack.admin.v2.SwitchServiceDeleteResponse">SwitchServiceDeleteResp
             <tbody>
               
                 <tr>
-                  <td>switch</td>
-                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
-                  <td></td>
-                  <td><p>Switch that has been deleted. </p></td>
+                  <td>projects</td>
+                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
+                  <td>repeated</td>
+                  <td><p>Projects is a list of all your projects </p></td>
                 </tr>
               
             </tbody>
@@ -10865,8 +10719,8 @@ <h3 id="metalstack.admin.v2.SwitchServiceDeleteResponse">SwitchServiceDeleteResp
 
         
       
-        <h3 id="metalstack.admin.v2.SwitchServiceGetRequest">SwitchServiceGetRequest</h3>
-        <p>SwitchServiceGetRequest.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceRemoveMemberRequest">ProjectServiceRemoveMemberRequest</h3>
+        <p>ProjectServiceRemoveMemberRequest is used to remove a member from a project</p>
 
         
           <table class="field-table">
@@ -10876,10 +10730,17 @@ <h3 id="metalstack.admin.v2.SwitchServiceGetRequest">SwitchServiceGetRequest</h3
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Id of the switch to get. </p></td>
+                  <td><p>Project is the uuid of the project </p></td>
+                </tr>
+              
+                <tr>
+                  <td>member</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Member is the id of the member to remove from this project </p></td>
                 </tr>
               
             </tbody>
@@ -10889,32 +10750,15 @@ <h3 id="metalstack.admin.v2.SwitchServiceGetRequest">SwitchServiceGetRequest</h3
 
         
       
-        <h3 id="metalstack.admin.v2.SwitchServiceGetResponse">SwitchServiceGetResponse</h3>
-        <p>SwitchServiceGetResponse.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceRemoveMemberResponse">ProjectServiceRemoveMemberResponse</h3>
+        <p>ProjectServiceRemoveMemberResponse is the response payload to a remove member request</p>
 
         
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>switch</td>
-                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
-                  <td></td>
-                  <td><p>Switch that was requested. </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
 
         
       
-        <h3 id="metalstack.admin.v2.SwitchServiceListRequest">SwitchServiceListRequest</h3>
-        <p>SwitchServiceListRequest.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceUpdateMemberRequest">ProjectServiceUpdateMemberRequest</h3>
+        <p>ProjectServiceUpdateMemberRequest is used to update a member of a project</p>
 
         
           <table class="field-table">
@@ -10924,127 +10768,24 @@ <h3 id="metalstack.admin.v2.SwitchServiceListRequest">SwitchServiceListRequest</
             <tbody>
               
                 <tr>
-                  <td>query</td>
-                  <td><a href="#metalstack.api.v2.SwitchQuery">metalstack.api.v2.SwitchQuery</a></td>
-                  <td></td>
-                  <td><p>Query to filter the results. </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.admin.v2.SwitchServiceListResponse">SwitchServiceListResponse</h3>
-        <p>SwitchServiceListResponse.</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>switches</td>
-                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
-                  <td>repeated</td>
-                  <td><p>Switches that match the request query. </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.admin.v2.SwitchServiceMigrateRequest">SwitchServiceMigrateRequest</h3>
-        <p>SwitchServiceMigrateRequest.</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>old_switch</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>OldSwitch which to migrate away from. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>new_switch</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>NewSwitch which to migrate to. </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.admin.v2.SwitchServiceMigrateResponse">SwitchServiceMigrateResponse</h3>
-        <p>SwitchServiceMigrateResponse.</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>switch</td>
-                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
-                  <td></td>
-                  <td><p>Switch that was migrated to. </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.admin.v2.SwitchServicePortRequest">SwitchServicePortRequest</h3>
-        <p>SwitchServicePortRequest.</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>id</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Id of the switch. </p></td>
+                  <td><p>Project is the uuid of the project </p></td>
                 </tr>
               
                 <tr>
-                  <td>nic_name</td>
+                  <td>member</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>NicName of the port whose status should be changed. </p></td>
+                  <td><p>Member is the id of the member to remove from this project </p></td>
                 </tr>
               
                 <tr>
-                  <td>status</td>
-                  <td><a href="#metalstack.api.v2.SwitchPortStatus">metalstack.api.v2.SwitchPortStatus</a></td>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
                   <td></td>
-                  <td><p>Status that the port should have. </p></td>
+                  <td><p>Role is the role in this project the user will get after the update </p></td>
                 </tr>
               
             </tbody>
@@ -11054,8 +10795,8 @@ <h3 id="metalstack.admin.v2.SwitchServicePortRequest">SwitchServicePortRequest</
 
         
       
-        <h3 id="metalstack.admin.v2.SwitchServicePortResponse">SwitchServicePortResponse</h3>
-        <p>SwitchServicePortResponse.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceUpdateMemberResponse">ProjectServiceUpdateMemberResponse</h3>
+        <p>ProjectServiceUpdateMemberResponse is the response payload to a update member request</p>
 
         
           <table class="field-table">
@@ -11065,10 +10806,10 @@ <h3 id="metalstack.admin.v2.SwitchServicePortResponse">SwitchServicePortResponse
             <tbody>
               
                 <tr>
-                  <td>switch</td>
-                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
+                  <td>project_member</td>
+                  <td><a href="#metalstack.api.v2.ProjectMember">ProjectMember</a></td>
                   <td></td>
-                  <td><p>Switch after the port status toggle.. </p></td>
+                  <td><p>ProjectMember is the updated project member </p></td>
                 </tr>
               
             </tbody>
@@ -11078,8 +10819,8 @@ <h3 id="metalstack.admin.v2.SwitchServicePortResponse">SwitchServicePortResponse
 
         
       
-        <h3 id="metalstack.admin.v2.SwitchServiceUpdateRequest">SwitchServiceUpdateRequest</h3>
-        <p>SwitchServiceUpdateRequest.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceUpdateRequest">ProjectServiceUpdateRequest</h3>
+        <p>ProjectServiceUpdateRequest is the request payload to update a project</p>
 
         
           <table class="field-table">
@@ -11089,74 +10830,45 @@ <h3 id="metalstack.admin.v2.SwitchServiceUpdateRequest">SwitchServiceUpdateReque
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>project</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>ID of the switch. </p></td>
+                  <td><p>Project is the uuid of the project to get </p></td>
                 </tr>
               
                 <tr>
                   <td>update_meta</td>
-                  <td><a href="#metalstack.api.v2.UpdateMeta">metalstack.api.v2.UpdateMeta</a></td>
-                  <td></td>
-                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>updated_at</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td><a href="#metalstack.api.v2.UpdateMeta">UpdateMeta</a></td>
                   <td></td>
-                  <td><p>UpdatedAt is the date when this entity was updated.
-must be part of the update request to ensure optimistic locking. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Description of the switch. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>replace_mode</td>
-                  <td><a href="#metalstack.api.v2.SwitchReplaceMode">metalstack.api.v2.SwitchReplaceMode</a></td>
-                  <td>optional</td>
-                  <td><p>Replace mode is used to mark a switch ready for replacement. </p></td>
+                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request </p></td>
                 </tr>
               
                 <tr>
-                  <td>management_ip</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>Management IP is the switch&#39;s IP for management access. </p></td>
+                  <td><p>Name of this project unique per tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>management_user</td>
+                  <td>description</td>
                   <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>Management user is the user name to use for management access. </p></td>
+                  <td><p>Description of this project </p></td>
                 </tr>
               
                 <tr>
-                  <td>console_command</td>
+                  <td>avatar_url</td>
                   <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>Console command is the command for accessing the switch&#39;s console. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>nics</td>
-                  <td><a href="#metalstack.api.v2.SwitchNic">metalstack.api.v2.SwitchNic</a></td>
-                  <td>repeated</td>
-                  <td><p>Nics are the front panel ports of the switch. </p></td>
+                  <td><p>Avatar URL of the project </p></td>
                 </tr>
               
                 <tr>
-                  <td>os</td>
-                  <td><a href="#metalstack.api.v2.SwitchOS">metalstack.api.v2.SwitchOS</a></td>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.UpdateLabels">UpdateLabels</a></td>
                   <td>optional</td>
-                  <td><p>SwitchOs is the OS running on the switch. </p></td>
+                  <td><p>Labels on this project </p></td>
                 </tr>
               
             </tbody>
@@ -11166,8 +10878,8 @@ <h3 id="metalstack.admin.v2.SwitchServiceUpdateRequest">SwitchServiceUpdateReque
 
         
       
-        <h3 id="metalstack.admin.v2.SwitchServiceUpdateResponse">SwitchServiceUpdateResponse</h3>
-        <p>SwitchServiceUpdateResponse.</p>
+        <h3 id="metalstack.api.v2.ProjectServiceUpdateResponse">ProjectServiceUpdateResponse</h3>
+        <p>ProjectServiceUpdateResponse is the response payload to update a project</p>
 
         
           <table class="field-table">
@@ -11177,10 +10889,10 @@ <h3 id="metalstack.admin.v2.SwitchServiceUpdateResponse">SwitchServiceUpdateResp
             <tbody>
               
                 <tr>
-                  <td>switch</td>
-                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
+                  <td>project</td>
+                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
                   <td></td>
-                  <td><p>Switch that was updated. </p></td>
+                  <td><p>Project is the project </p></td>
                 </tr>
               
             </tbody>
@@ -11196,8 +10908,8 @@ <h3 id="metalstack.admin.v2.SwitchServiceUpdateResponse">SwitchServiceUpdateResp
       
 
       
-        <h3 id="metalstack.admin.v2.SwitchService">SwitchService</h3>
-        <p>SwitchService serves switch related functions.</p>
+        <h3 id="metalstack.api.v2.ProjectService">ProjectService</h3>
+        <p>ProjectService serves project related functions</p>
         <table class="enum-table">
           <thead>
             <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
@@ -11205,61 +10917,110 @@ <h3 id="metalstack.admin.v2.SwitchService">SwitchService</h3>
           <tbody>
             
               <tr>
-                <td>Get</td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceGetRequest">SwitchServiceGetRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceGetResponse">SwitchServiceGetResponse</a></td>
-                <td><p>Get a switch by ID.</p></td>
+                <td>List</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceListRequest">ProjectServiceListRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceListResponse">ProjectServiceListResponse</a></td>
+                <td><p>List all accessible projects</p></td>
               </tr>
             
               <tr>
-                <td>List</td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceListRequest">SwitchServiceListRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceListResponse">SwitchServiceListResponse</a></td>
-                <td><p>List switches.</p></td>
+                <td>Get</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceGetRequest">ProjectServiceGetRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceGetResponse">ProjectServiceGetResponse</a></td>
+                <td><p>Get a project</p></td>
               </tr>
             
               <tr>
-                <td>Update</td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceUpdateRequest">SwitchServiceUpdateRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceUpdateResponse">SwitchServiceUpdateResponse</a></td>
-                <td><p>Update a switch.</p></td>
+                <td>Create</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceCreateRequest">ProjectServiceCreateRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceCreateResponse">ProjectServiceCreateResponse</a></td>
+                <td><p>Create a project</p></td>
               </tr>
             
               <tr>
                 <td>Delete</td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceDeleteRequest">SwitchServiceDeleteRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceDeleteResponse">SwitchServiceDeleteResponse</a></td>
-                <td><p>Delete a switch.</p></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceDeleteRequest">ProjectServiceDeleteRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceDeleteResponse">ProjectServiceDeleteResponse</a></td>
+                <td><p>Delete a project</p></td>
               </tr>
             
               <tr>
-                <td>Migrate</td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceMigrateRequest">SwitchServiceMigrateRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SwitchServiceMigrateResponse">SwitchServiceMigrateResponse</a></td>
-                <td><p>Migrate a switch.</p></td>
+                <td>Update</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceUpdateRequest">ProjectServiceUpdateRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceUpdateResponse">ProjectServiceUpdateResponse</a></td>
+                <td><p>Update a project</p></td>
               </tr>
             
               <tr>
-                <td>Port</td>
-                <td><a href="#metalstack.admin.v2.SwitchServicePortRequest">SwitchServicePortRequest</a></td>
-                <td><a href="#metalstack.admin.v2.SwitchServicePortResponse">SwitchServicePortResponse</a></td>
-                <td><p>Port set the port status of a switch port.</p></td>
+                <td>Leave</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceLeaveRequest">ProjectServiceLeaveRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceLeaveResponse">ProjectServiceLeaveResponse</a></td>
+                <td><p>Leave project</p></td>
               </tr>
             
-          </tbody>
-        </table>
-
-        
-    
-      
-      <div class="file-heading">
-        <h2 id="metalstack/api/v2/tenant.proto">metalstack/api/v2/tenant.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
+              <tr>
+                <td>RemoveMember</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceRemoveMemberRequest">ProjectServiceRemoveMemberRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceRemoveMemberResponse">ProjectServiceRemoveMemberResponse</a></td>
+                <td><p>RemoveMember remove a user from a project</p></td>
+              </tr>
+            
+              <tr>
+                <td>UpdateMember</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceUpdateMemberRequest">ProjectServiceUpdateMemberRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceUpdateMemberResponse">ProjectServiceUpdateMemberResponse</a></td>
+                <td><p>UpdateMember update a user for a project</p></td>
+              </tr>
+            
+              <tr>
+                <td>Invite</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInviteRequest">ProjectServiceInviteRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInviteResponse">ProjectServiceInviteResponse</a></td>
+                <td><p>Invite a user to a project</p></td>
+              </tr>
+            
+              <tr>
+                <td>InviteAccept</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInviteAcceptRequest">ProjectServiceInviteAcceptRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInviteAcceptResponse">ProjectServiceInviteAcceptResponse</a></td>
+                <td><p>InviteAccept is called from a user to accept a invitation</p></td>
+              </tr>
+            
+              <tr>
+                <td>InviteDelete</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInviteDeleteRequest">ProjectServiceInviteDeleteRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInviteDeleteResponse">ProjectServiceInviteDeleteResponse</a></td>
+                <td><p>InviteDelete deletes a pending invitation</p></td>
+              </tr>
+            
+              <tr>
+                <td>InvitesList</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInvitesListRequest">ProjectServiceInvitesListRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInvitesListResponse">ProjectServiceInvitesListResponse</a></td>
+                <td><p>InvitesList list all invites to a project</p></td>
+              </tr>
+            
+              <tr>
+                <td>InviteGet</td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInviteGetRequest">ProjectServiceInviteGetRequest</a></td>
+                <td><a href="#metalstack.api.v2.ProjectServiceInviteGetResponse">ProjectServiceInviteGetResponse</a></td>
+                <td><p>InviteGet get an invite</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
 
+        
+    
       
-        <h3 id="metalstack.api.v2.Tenant">Tenant</h3>
-        <p>Tenant is a customer of the platform</p>
+      <div class="file-heading">
+        <h2 id="metalstack/admin/v2/project.proto">metalstack/admin/v2/project.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.admin.v2.ProjectServiceListRequest">ProjectServiceListRequest</h3>
+        <p>ProjectServiceListRequest is the request payload for the project list request</p>
 
         
           <table class="field-table">
@@ -11269,52 +11030,122 @@ <h3 id="metalstack.api.v2.Tenant">Tenant</h3>
             <tbody>
               
                 <tr>
-                  <td>login</td>
+                  <td>tenant</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Login of the tenant </p></td>
+                  <td>optional</td>
+                  <td><p>Tenant lists only projects of this tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>meta</td>
-                  <td><a href="#metalstack.api.v2.Meta">Meta</a></td>
-                  <td></td>
-                  <td><p>Meta for this tenant </p></td>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.Labels">metalstack.api.v2.Labels</a></td>
+                  <td>optional</td>
+                  <td><p>Labels lists only projects containing the given labels </p></td>
                 </tr>
               
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Name of the tenant </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.ProjectServiceListResponse">ProjectServiceListResponse</h3>
+        <p>ProjectServiceListResponse is the response payload for the project list request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>email</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Email of the tenant </p></td>
+                  <td>projects</td>
+                  <td><a href="#metalstack.api.v2.Project">metalstack.api.v2.Project</a></td>
+                  <td>repeated</td>
+                  <td><p>Projects is a list of all projects </p></td>
                 </tr>
               
-                <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Description of this tenant </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+
+      
+
+      
+
+      
+        <h3 id="metalstack.admin.v2.ProjectService">ProjectService</h3>
+        <p>ProjectService serves project related functions</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>List</td>
+                <td><a href="#metalstack.admin.v2.ProjectServiceListRequest">ProjectServiceListRequest</a></td>
+                <td><a href="#metalstack.admin.v2.ProjectServiceListResponse">ProjectServiceListResponse</a></td>
+                <td><p>List projects based on various filter criteria</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="metalstack/admin/v2/size.proto">metalstack/admin/v2/size.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.admin.v2.SizeServiceCreateRequest">SizeServiceCreateRequest</h3>
+        <p>SizeServiceCreateRequest is the request payload for a size create request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>avatar_url</td>
-                  <td><a href="#string">string</a></td>
+                  <td>size</td>
+                  <td><a href="#metalstack.api.v2.Size">metalstack.api.v2.Size</a></td>
                   <td></td>
-                  <td><p>AvatarUrl of the tenant </p></td>
+                  <td><p>Size is the size to create </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.SizeServiceCreateResponse">SizeServiceCreateResponse</h3>
+        <p>SizeServiceGetResponse is the response payload for a size create request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>created_by</td>
-                  <td><a href="#string">string</a></td>
+                  <td>size</td>
+                  <td><a href="#metalstack.api.v2.Size">metalstack.api.v2.Size</a></td>
                   <td></td>
-                  <td><p>CreatedBy stores who created this tenant </p></td>
+                  <td><p>Size the size </p></td>
                 </tr>
               
             </tbody>
@@ -11324,8 +11155,8 @@ <h3 id="metalstack.api.v2.Tenant">Tenant</h3>
 
         
       
-        <h3 id="metalstack.api.v2.TenantInvite">TenantInvite</h3>
-        <p>TenantInvite defines invite to tenant</p>
+        <h3 id="metalstack.admin.v2.SizeServiceDeleteRequest">SizeServiceDeleteRequest</h3>
+        <p>SizeServiceDeleteRequest is the request payload for a size delete request</p>
 
         
           <table class="field-table">
@@ -11335,66 +11166,93 @@ <h3 id="metalstack.api.v2.TenantInvite">TenantInvite</h3>
             <tbody>
               
                 <tr>
-                  <td>secret</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Secret is the secret part of the invite, typically part of the url </p></td>
+                  <td><p>ID of the size to delete </p></td>
                 </tr>
               
-                <tr>
-                  <td>target_tenant</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>TargetTenant is the tenant id for which this invite was created </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.SizeServiceDeleteResponse">SizeServiceDeleteResponse</h3>
+        <p>SizeServiceDeleteResponse is the response payload for a size delete request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>role</td>
-                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
+                  <td>size</td>
+                  <td><a href="#metalstack.api.v2.Size">metalstack.api.v2.Size</a></td>
                   <td></td>
-                  <td><p>Role is the role in this tenant the user will get after accepting the invitation </p></td>
+                  <td><p>Size the size </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.SizeServiceUpdateRequest">SizeServiceUpdateRequest</h3>
+        <p>SizeServiceUpdateRequest is the request payload for a size update request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>joined</td>
-                  <td><a href="#bool">bool</a></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Joined is false as long as a user has not accepted the invite </p></td>
+                  <td><p>Id of this size </p></td>
                 </tr>
               
                 <tr>
-                  <td>target_tenant_name</td>
-                  <td><a href="#string">string</a></td>
+                  <td>update_meta</td>
+                  <td><a href="#metalstack.api.v2.UpdateMeta">metalstack.api.v2.UpdateMeta</a></td>
                   <td></td>
-                  <td><p>TargetTenantName is the tenant name for which this invite was created </p></td>
+                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request </p></td>
                 </tr>
               
                 <tr>
-                  <td>tenant</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Tenant is the login of tenant who invites to join this tenant </p></td>
+                  <td>optional</td>
+                  <td><p>Name of this size </p></td>
                 </tr>
               
                 <tr>
-                  <td>tenant_name</td>
+                  <td>description</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>TenantName is the name of tenant who invites to join this tenant </p></td>
+                  <td>optional</td>
+                  <td><p>Description of this size </p></td>
                 </tr>
               
                 <tr>
-                  <td>expires_at</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
-                  <td></td>
-                  <td><p>ExpiresAt the date when this invite expires </p></td>
+                  <td>constraints</td>
+                  <td><a href="#metalstack.api.v2.SizeConstraint">metalstack.api.v2.SizeConstraint</a></td>
+                  <td>repeated</td>
+                  <td><p>Constraints which must match that a specific machine is considered of this size </p></td>
                 </tr>
               
                 <tr>
-                  <td>joined_at</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
-                  <td></td>
-                  <td><p>JoinedAt the date when the member accepted this invite </p></td>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.UpdateLabels">metalstack.api.v2.UpdateLabels</a></td>
+                  <td>optional</td>
+                  <td><p>Labels to update on this size </p></td>
                 </tr>
               
             </tbody>
@@ -11404,8 +11262,8 @@ <h3 id="metalstack.api.v2.TenantInvite">TenantInvite</h3>
 
         
       
-        <h3 id="metalstack.api.v2.TenantMember">TenantMember</h3>
-        <p>TenantMember defines a user that participates at a tenant</p>
+        <h3 id="metalstack.admin.v2.SizeServiceUpdateResponse">SizeServiceUpdateResponse</h3>
+        <p>SizeServiceUpdateResponse is the response payload for a size update request</p>
 
         
           <table class="field-table">
@@ -11415,31 +11273,88 @@ <h3 id="metalstack.api.v2.TenantMember">TenantMember</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>size</td>
+                  <td><a href="#metalstack.api.v2.Size">metalstack.api.v2.Size</a></td>
                   <td></td>
-                  <td><p>Id is the user id of the member </p></td>
+                  <td><p>Size the size </p></td>
                 </tr>
               
-                <tr>
-                  <td>role</td>
-                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
-                  <td></td>
-                  <td><p>Role is the role of the member </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+
+      
+
+      
+
+      
+        <h3 id="metalstack.admin.v2.SizeService">SizeService</h3>
+        <p>SizeService serves size related functions</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>Create</td>
+                <td><a href="#metalstack.admin.v2.SizeServiceCreateRequest">SizeServiceCreateRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SizeServiceCreateResponse">SizeServiceCreateResponse</a></td>
+                <td><p>Create a size</p></td>
+              </tr>
+            
+              <tr>
+                <td>Update</td>
+                <td><a href="#metalstack.admin.v2.SizeServiceUpdateRequest">SizeServiceUpdateRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SizeServiceUpdateResponse">SizeServiceUpdateResponse</a></td>
+                <td><p>Update a size</p></td>
+              </tr>
+            
+              <tr>
+                <td>Delete</td>
+                <td><a href="#metalstack.admin.v2.SizeServiceDeleteRequest">SizeServiceDeleteRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SizeServiceDeleteResponse">SizeServiceDeleteResponse</a></td>
+                <td><p>Delete a size</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="metalstack/api/v2/switch.proto">metalstack/api/v2/switch.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.api.v2.BGPFilter">BGPFilter</h3>
+        <p>BGPFilter can be used to restrict BGP based on CIDRs and VNIs.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>projects</td>
+                  <td>cidrs</td>
                   <td><a href="#string">string</a></td>
                   <td>repeated</td>
-                  <td><p>Projects for the projects in which a user is a direct member </p></td>
+                  <td><p>CIDRs for which to allow BGP </p></td>
                 </tr>
               
                 <tr>
-                  <td>created_at</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
-                  <td></td>
-                  <td><p>CreatedAt the date when the member was added to the tenant </p></td>
+                  <td>vnis</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>VNIs for which to allow BGP </p></td>
                 </tr>
               
             </tbody>
@@ -11449,8 +11364,8 @@ <h3 id="metalstack.api.v2.TenantMember">TenantMember</h3>
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</h3>
-        <p>TenantServiceCreateRequest is the request payload of the tenant create request</p>
+        <h3 id="metalstack.api.v2.MachineConnection">MachineConnection</h3>
+        <p>MachineConnection associates a machine with the corresponding switch nic.</p>
 
         
           <table class="field-table">
@@ -11460,38 +11375,17 @@ <h3 id="metalstack.api.v2.TenantServiceCreateRequest">TenantServiceCreateRequest
             <tbody>
               
                 <tr>
-                  <td>name</td>
+                  <td>machine_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Name of this tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Description of this tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>email</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Email of the tenant, if not set will be inherited from the creator </p></td>
-                </tr>
-              
-                <tr>
-                  <td>avatar_url</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>AvatarUrl of the tenant </p></td>
+                  <td><p>MachineId of the machine connected to the nic. </p></td>
                 </tr>
               
                 <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
+                  <td>nic</td>
+                  <td><a href="#metalstack.api.v2.SwitchNic">SwitchNic</a></td>
                   <td></td>
-                  <td><p>Labels on the tenant </p></td>
+                  <td><p>Nic the machine is connected to. </p></td>
                 </tr>
               
             </tbody>
@@ -11501,8 +11395,8 @@ <h3 id="metalstack.api.v2.TenantServiceCreateRequest">TenantServiceCreateRequest
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceCreateResponse">TenantServiceCreateResponse</h3>
-        <p>TenantServiceCreateResponse is the response payload of the tenant create request</p>
+        <h3 id="metalstack.api.v2.NicState">NicState</h3>
+        <p>NicState represents the current state of a switch port.</p>
 
         
           <table class="field-table">
@@ -11512,10 +11406,17 @@ <h3 id="metalstack.api.v2.TenantServiceCreateResponse">TenantServiceCreateRespon
             <tbody>
               
                 <tr>
-                  <td>tenant</td>
-                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
+                  <td>desired</td>
+                  <td><a href="#metalstack.api.v2.SwitchPortStatus">SwitchPortStatus</a></td>
+                  <td>optional</td>
+                  <td><p>Desired is the desired port state. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>actual</td>
+                  <td><a href="#metalstack.api.v2.SwitchPortStatus">SwitchPortStatus</a></td>
                   <td></td>
-                  <td><p>Tenant is the tenant </p></td>
+                  <td><p>Actual is the actual port state. </p></td>
                 </tr>
               
             </tbody>
@@ -11525,8 +11426,8 @@ <h3 id="metalstack.api.v2.TenantServiceCreateResponse">TenantServiceCreateRespon
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceDeleteRequest">TenantServiceDeleteRequest</h3>
-        <p>TenantServiceDeleteRequest is the request payload of the tenant delete request</p>
+        <h3 id="metalstack.api.v2.Switch">Switch</h3>
+        <p>Switch represents a network switch.</p>
 
         
           <table class="field-table">
@@ -11536,10 +11437,87 @@ <h3 id="metalstack.api.v2.TenantServiceDeleteRequest">TenantServiceDeleteRequest
             <tbody>
               
                 <tr>
-                  <td>login</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Login of the tenant </p></td>
+                  <td><p>Id of the switch. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>meta</td>
+                  <td><a href="#metalstack.api.v2.Meta">Meta</a></td>
+                  <td></td>
+                  <td><p>Meta for this switch. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Description of the switch. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>rack</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Rack ID if the switch resides in a rack. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>partition</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Partition the switch belongs to. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>replace_mode</td>
+                  <td><a href="#metalstack.api.v2.SwitchReplaceMode">SwitchReplaceMode</a></td>
+                  <td></td>
+                  <td><p>ReplaceMode is used to mark a switch ready for replacement. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>management_ip</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>ManagementIp is the switch&#39;s IP for management access. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>management_user</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>ManagementUser is the user name to use for management access. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>console_command</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>ConsoleCommand is the command for accessing the switch&#39;s console. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>nics</td>
+                  <td><a href="#metalstack.api.v2.SwitchNic">SwitchNic</a></td>
+                  <td>repeated</td>
+                  <td><p>Nics are the front panel ports of the switch. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>os</td>
+                  <td><a href="#metalstack.api.v2.SwitchOS">SwitchOS</a></td>
+                  <td></td>
+                  <td><p>SwitchOs is the OS running on the switch. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>machine_connections</td>
+                  <td><a href="#metalstack.api.v2.MachineConnection">MachineConnection</a></td>
+                  <td>repeated</td>
+                  <td><p>MachineConnections map machines to the nics they are connected to. </p></td>
                 </tr>
               
             </tbody>
@@ -11549,8 +11527,8 @@ <h3 id="metalstack.api.v2.TenantServiceDeleteRequest">TenantServiceDeleteRequest
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceDeleteResponse">TenantServiceDeleteResponse</h3>
-        <p>TenantServiceDeleteResponse is the response payload of the tenant delete request</p>
+        <h3 id="metalstack.api.v2.SwitchBGPPortState">SwitchBGPPortState</h3>
+        <p>SwitchBGPPortState holds information about the BGP state of a port.</p>
 
         
           <table class="field-table">
@@ -11560,89 +11538,52 @@ <h3 id="metalstack.api.v2.TenantServiceDeleteResponse">TenantServiceDeleteRespon
             <tbody>
               
                 <tr>
-                  <td>tenant</td>
-                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
+                  <td>neighbor</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Tenant is the tenant </p></td>
+                  <td><p>Neighbor of this port. </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceGetRequest">TenantServiceGetRequest</h3>
-        <p>TenantServiceGetRequest is the request payload of the tenant get request</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>login</td>
+                  <td>peer_group</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Login of the tenant </p></td>
+                  <td><p>PeerGroup of this port. </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceGetResponse">TenantServiceGetResponse</h3>
-        <p>TenantServiceGetResponse is the response payload of the tenant get request</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+                <tr>
+                  <td>vrf_name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>VrfName of the VRF this port is bound to. </p></td>
+                </tr>
               
                 <tr>
-                  <td>tenant</td>
-                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
+                  <td>bgp_state</td>
+                  <td><a href="#metalstack.api.v2.BGPState">BGPState</a></td>
                   <td></td>
-                  <td><p>Tenant is the tenant </p></td>
+                  <td><p>BgpState of the connection on this port. </p></td>
                 </tr>
               
                 <tr>
-                  <td>tenant_members</td>
-                  <td><a href="#metalstack.api.v2.TenantMember">TenantMember</a></td>
-                  <td>repeated</td>
-                  <td><p>TenantMembers of this tenant </p></td>
+                  <td>bgp_timer_up_established</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>BgpTimerUpEstablished reports when this port&#39;s BGP connection was established. </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceInviteAcceptRequest">TenantServiceInviteAcceptRequest</h3>
-        <p>TenantServiceInviteAcceptRequest is the request payload to a accept invite request</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+                <tr>
+                  <td>sent_prefix_counter</td>
+                  <td><a href="#uint64">uint64</a></td>
+                  <td></td>
+                  <td><p>SentPrefixCounter counts the prefixes sent by the switch on this port. </p></td>
+                </tr>
               
                 <tr>
-                  <td>secret</td>
-                  <td><a href="#string">string</a></td>
+                  <td>accepted_prefix_counter</td>
+                  <td><a href="#uint64">uint64</a></td>
                   <td></td>
-                  <td><p>Secret is the invitation secret part of the invitation url </p></td>
+                  <td><p>AcceptedPrefixCounter counts the prefixes received on this port. </p></td>
                 </tr>
               
             </tbody>
@@ -11652,8 +11593,8 @@ <h3 id="metalstack.api.v2.TenantServiceInviteAcceptRequest">TenantServiceInviteA
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceInviteAcceptResponse">TenantServiceInviteAcceptResponse</h3>
-        <p>TenantServiceInvitesListResponse is the response payload to a accept invite request</p>
+        <h3 id="metalstack.api.v2.SwitchNic">SwitchNic</h3>
+        <p>SwitchNic represents a front panel port and its configuration.</p>
 
         
           <table class="field-table">
@@ -11663,79 +11604,52 @@ <h3 id="metalstack.api.v2.TenantServiceInviteAcceptResponse">TenantServiceInvite
             <tbody>
               
                 <tr>
-                  <td>tenant</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Tenant ID of the joined tenant </p></td>
+                  <td><p>Name of the switch port </p></td>
                 </tr>
               
                 <tr>
-                  <td>tenant_name</td>
+                  <td>identifier</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>TenantName of the joined tenant </p></td>
+                  <td><p>Identifier of the port </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceInviteDeleteRequest">TenantServiceInviteDeleteRequest</h3>
-        <p>TenantServiceInviteDeleteRequest is the request payload to a delete invite</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>login</td>
+                  <td>mac</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Login of the tenant </p></td>
+                  <td><p>MAC address of the port </p></td>
                 </tr>
               
                 <tr>
-                  <td>secret</td>
+                  <td>vrf</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Secret of the invite to delete </p></td>
+                  <td>optional</td>
+                  <td><p>VRF name if the port is bound in one </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceInviteDeleteResponse">TenantServiceInviteDeleteResponse</h3>
-        <p>TenantServiceInviteDeleteResponse is the response payload of a delete invite request</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceInviteGetRequest">TenantServiceInviteGetRequest</h3>
-        <p>TenantServiceInviteGetRequest is the request payload to get a invite</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+                <tr>
+                  <td>state</td>
+                  <td><a href="#metalstack.api.v2.NicState">NicState</a></td>
+                  <td>optional</td>
+                  <td><p>NicState describes the current state of the switch port. </p></td>
+                </tr>
               
                 <tr>
-                  <td>secret</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Secret of the invite to get </p></td>
+                  <td>bgp_filter</td>
+                  <td><a href="#metalstack.api.v2.BGPFilter">BGPFilter</a></td>
+                  <td>optional</td>
+                  <td><p>BGPFilter optionally configured on a port. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>bgp_port_state</td>
+                  <td><a href="#metalstack.api.v2.SwitchBGPPortState">SwitchBGPPortState</a></td>
+                  <td>optional</td>
+                  <td><p>BGPPortState represents the current BGP status of the port. </p></td>
                 </tr>
               
             </tbody>
@@ -11745,8 +11659,8 @@ <h3 id="metalstack.api.v2.TenantServiceInviteGetRequest">TenantServiceInviteGetR
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceInviteGetResponse">TenantServiceInviteGetResponse</h3>
-        <p>TenantServiceInviteGetResponse is the response payload to a get invite request</p>
+        <h3 id="metalstack.api.v2.SwitchOS">SwitchOS</h3>
+        <p>SwitchOS holds information about the NOS and versions running on the switch.</p>
 
         
           <table class="field-table">
@@ -11756,41 +11670,24 @@ <h3 id="metalstack.api.v2.TenantServiceInviteGetResponse">TenantServiceInviteGet
             <tbody>
               
                 <tr>
-                  <td>invite</td>
-                  <td><a href="#metalstack.api.v2.TenantInvite">TenantInvite</a></td>
+                  <td>vendor</td>
+                  <td><a href="#metalstack.api.v2.SwitchOSVendor">SwitchOSVendor</a></td>
                   <td></td>
-                  <td><p>Invite is the invite </p></td>
+                  <td><p>Vendor identifies what NOS distribution is running on the switch, e.g. SONiC. </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceInviteRequest">TenantServiceInviteRequest</h3>
-        <p>TenantServiceInviteRequest is used to invite a member to a tenant</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>login</td>
+                  <td>version</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Login of the tenant </p></td>
+                  <td><p>Version specifies what NOS version is currently installed on the switch. </p></td>
                 </tr>
               
                 <tr>
-                  <td>role</td>
-                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
+                  <td>metal_core_version</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Role of this user in this tenant </p></td>
+                  <td><p>MetalCoreVersion is the currently running version of the metal-core. </p></td>
                 </tr>
               
             </tbody>
@@ -11800,8 +11697,8 @@ <h3 id="metalstack.api.v2.TenantServiceInviteRequest">TenantServiceInviteRequest
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceInviteResponse">TenantServiceInviteResponse</h3>
-        <p>TenantServiceInviteRequest is the response payload to a invite member request</p>
+        <h3 id="metalstack.api.v2.SwitchOSQuery">SwitchOSQuery</h3>
+        <p>SwitchOSQuery holds OS specific query parameters.</p>
 
         
           <table class="field-table">
@@ -11811,36 +11708,17 @@ <h3 id="metalstack.api.v2.TenantServiceInviteResponse">TenantServiceInviteRespon
             <tbody>
               
                 <tr>
-                  <td>invite</td>
-                  <td><a href="#metalstack.api.v2.TenantInvite">TenantInvite</a></td>
-                  <td></td>
-                  <td><p>Invite contains a secret which can be sent to a potential user
-can be appended to the invitation endpoint at our cloud console like
-console.metalstack.cloud/invite/&lt;secret&gt; </p></td>
+                  <td>vendor</td>
+                  <td><a href="#metalstack.api.v2.SwitchOSVendor">SwitchOSVendor</a></td>
+                  <td>optional</td>
+                  <td><p>OsVendor of the switch OS by which to filter the switches. </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceInvitesListRequest">TenantServiceInvitesListRequest</h3>
-        <p>TenantServiceInvitesListRequest is the request payload to a list invites request</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>login</td>
+                  <td>version</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Login of the tenant </p></td>
+                  <td>optional</td>
+                  <td><p>OsVersion of the OS by which to filter the switches. </p></td>
                 </tr>
               
             </tbody>
@@ -11850,8 +11728,8 @@ <h3 id="metalstack.api.v2.TenantServiceInvitesListRequest">TenantServiceInvitesL
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceInvitesListResponse">TenantServiceInvitesListResponse</h3>
-        <p>TenantServiceInvitesListResponse is the response payload to a list invites request</p>
+        <h3 id="metalstack.api.v2.SwitchQuery">SwitchQuery</h3>
+        <p>SwitchQuery can be used to query a switch or a list of switches.</p>
 
         
           <table class="field-table">
@@ -11861,10 +11739,31 @@ <h3 id="metalstack.api.v2.TenantServiceInvitesListResponse">TenantServiceInvites
             <tbody>
               
                 <tr>
-                  <td>invites</td>
-                  <td><a href="#metalstack.api.v2.TenantInvite">TenantInvite</a></td>
-                  <td>repeated</td>
-                  <td><p>Invites not already accepted the invitation to this tenant </p></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Id of the switch to list. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>partition</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Partition of the switches to list. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>rack</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Rack of the switches to list. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>os</td>
+                  <td><a href="#metalstack.api.v2.SwitchOSQuery">SwitchOSQuery</a></td>
+                  <td>optional</td>
+                  <td><p>Switch OS specific queries. </p></td>
                 </tr>
               
             </tbody>
@@ -11874,8 +11773,168 @@ <h3 id="metalstack.api.v2.TenantServiceInvitesListResponse">TenantServiceInvites
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceLeaveRequest">TenantServiceLeaveRequest</h3>
-        <p>TenantServiceLeaveTenantRequest is used to leave a tenant</p>
+
+      
+        <h3 id="metalstack.api.v2.BGPState">BGPState</h3>
+        <p>BGPState represents the state of a BGP session.</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>BGP_STATE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>BGP_STATE_UNSPECIFIED is not specified.</p></td>
+              </tr>
+            
+              <tr>
+                <td>BGP_STATE_IDLE</td>
+                <td>1</td>
+                <td><p>BGP_STATE_IDLE is the Idle state of a BGP session.</p></td>
+              </tr>
+            
+              <tr>
+                <td>BGP_STATE_CONNECT</td>
+                <td>2</td>
+                <td><p>BGP_STATE_CONNECT is the Connect state of a BGP session.</p></td>
+              </tr>
+            
+              <tr>
+                <td>BGP_STATE_ACTIVE</td>
+                <td>3</td>
+                <td><p>BGP_STATE_ACTIVE is the Active state of a BGP session.</p></td>
+              </tr>
+            
+              <tr>
+                <td>BGP_STATE_OPEN_SENT</td>
+                <td>4</td>
+                <td><p>BGP_STATE_OPEN_SENT is the OpenSent state of a BGP session.</p></td>
+              </tr>
+            
+              <tr>
+                <td>BGP_STATE_OPEN_CONFIRM</td>
+                <td>5</td>
+                <td><p>BGP_STATE_OPEN_CONFIRM is the OpenConfirm state of a BGP session.</p></td>
+              </tr>
+            
+              <tr>
+                <td>BGP_STATE_ESTABLISHED</td>
+                <td>6</td>
+                <td><p>BGP_STATE_ESTABLISHED is the Established state of a BGP session.</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+        <h3 id="metalstack.api.v2.SwitchOSVendor">SwitchOSVendor</h3>
+        <p>SwitchOSVendor represents a NOS distribution.</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SWITCH_OS_VENDOR_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>SWITCH_OS_VENDOR_UNSPECIFIED is not specified.</p></td>
+              </tr>
+            
+              <tr>
+                <td>SWITCH_OS_VENDOR_CUMULUS</td>
+                <td>1</td>
+                <td><p>SWITCH_OS_VENDOR_CUMULUS means this switch is running on Cumulus Linux.</p></td>
+              </tr>
+            
+              <tr>
+                <td>SWITCH_OS_VENDOR_SONIC</td>
+                <td>2</td>
+                <td><p>SWITCH_OS_VENDOR_SONIC means this switch is running on SONiC NOS.</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+        <h3 id="metalstack.api.v2.SwitchPortStatus">SwitchPortStatus</h3>
+        <p>SwitchPortStatus specifies the state of a switch port.</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SWITCH_PORT_STATUS_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>SWITCH_PORT_STATUS_UNSPECIFIED is not specified.</p></td>
+              </tr>
+            
+              <tr>
+                <td>SWITCH_PORT_STATUS_UP</td>
+                <td>1</td>
+                <td><p>SWITCH_PORT_STATUS_UP means this port is up.</p></td>
+              </tr>
+            
+              <tr>
+                <td>SWITCH_PORT_STATUS_DOWN</td>
+                <td>2</td>
+                <td><p>SWITCH_PORT_STATUS_DOWN means this port is down.</p></td>
+              </tr>
+            
+              <tr>
+                <td>SWITCH_PORT_STATUS_UNKNOWN</td>
+                <td>3</td>
+                <td><p>SWITCH_PORT_STATUS_UNKNOWN means the status of this port is unknown.</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+        <h3 id="metalstack.api.v2.SwitchReplaceMode">SwitchReplaceMode</h3>
+        <p>SwitchReplaceMode is used to mark a switch ready for replacement.</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SWITCH_REPLACE_MODE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>SWITCH_REPLACE_MODE_UNSPECIFIED is not specified.</p></td>
+              </tr>
+            
+              <tr>
+                <td>SWITCH_REPLACE_MODE_REPLACE</td>
+                <td>1</td>
+                <td><p>SWITCH_REPLACE_MODE_REPLACE means this switch is waiting to be replaced.</p></td>
+              </tr>
+            
+              <tr>
+                <td>SWITCH_REPLACE_MODE_OPERATIONAL</td>
+                <td>2</td>
+                <td><p>SWITCH_REPLACE_MODE_OPERATIONAL means this switch is operational and cannot be replaced.</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+
+      
+
+      
+    
+      
+      <div class="file-heading">
+        <h2 id="metalstack/admin/v2/switch.proto">metalstack/admin/v2/switch.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.admin.v2.SwitchServiceDeleteRequest">SwitchServiceDeleteRequest</h3>
+        <p>SwitchServiceDeleteRequest.</p>
 
         
           <table class="field-table">
@@ -11885,10 +11944,17 @@ <h3 id="metalstack.api.v2.TenantServiceLeaveRequest">TenantServiceLeaveRequest</
             <tbody>
               
                 <tr>
-                  <td>login</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Login of the tenant </p></td>
+                  <td><p>Id of the switch. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>force</td>
+                  <td><a href="#bool">bool</a></td>
+                  <td></td>
+                  <td><p>Force will allow switch deletion despite existing machine connections. </p></td>
                 </tr>
               
             </tbody>
@@ -11898,15 +11964,8 @@ <h3 id="metalstack.api.v2.TenantServiceLeaveRequest">TenantServiceLeaveRequest</
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceLeaveResponse">TenantServiceLeaveResponse</h3>
-        <p>TenantServiceLeaveTenantResponse is the response payload to a leave tenant request</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceListRequest">TenantServiceListRequest</h3>
-        <p>TenantServiceListRequest is the request payload of the tenant list request</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceDeleteResponse">SwitchServiceDeleteResponse</h3>
+        <p>SwitchServiceDeleteResponse.</p>
 
         
           <table class="field-table">
@@ -11916,24 +11975,10 @@ <h3 id="metalstack.api.v2.TenantServiceListRequest">TenantServiceListRequest</h3
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Id filters tenants by id </p></td>
-                </tr>
-              
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Name filters tenants by name </p></td>
-                </tr>
-              
-                <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
-                  <td>optional</td>
-                  <td><p>Labels lists only projects containing the given labels </p></td>
+                  <td>switch</td>
+                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
+                  <td></td>
+                  <td><p>Switch that has been deleted. </p></td>
                 </tr>
               
             </tbody>
@@ -11943,8 +11988,8 @@ <h3 id="metalstack.api.v2.TenantServiceListRequest">TenantServiceListRequest</h3
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceListResponse">TenantServiceListResponse</h3>
-        <p>TenantServiceListResponse is the response payload of the tenant list request</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceGetRequest">SwitchServiceGetRequest</h3>
+        <p>SwitchServiceGetRequest.</p>
 
         
           <table class="field-table">
@@ -11954,10 +11999,10 @@ <h3 id="metalstack.api.v2.TenantServiceListResponse">TenantServiceListResponse</
             <tbody>
               
                 <tr>
-                  <td>tenants</td>
-                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
-                  <td>repeated</td>
-                  <td><p>Tenants is the list of tenants </p></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Id of the switch to get. </p></td>
                 </tr>
               
             </tbody>
@@ -11967,8 +12012,8 @@ <h3 id="metalstack.api.v2.TenantServiceListResponse">TenantServiceListResponse</
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceRemoveMemberRequest">TenantServiceRemoveMemberRequest</h3>
-        <p>TenantServiceRemoveMemberRequest is used to remove a member from a tenant</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceGetResponse">SwitchServiceGetResponse</h3>
+        <p>SwitchServiceGetResponse.</p>
 
         
           <table class="field-table">
@@ -11978,17 +12023,10 @@ <h3 id="metalstack.api.v2.TenantServiceRemoveMemberRequest">TenantServiceRemoveM
             <tbody>
               
                 <tr>
-                  <td>login</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Login of the tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>member</td>
-                  <td><a href="#string">string</a></td>
+                  <td>switch</td>
+                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
                   <td></td>
-                  <td><p>Member is the id of the member to remove from this tenant </p></td>
+                  <td><p>Switch that was requested. </p></td>
                 </tr>
               
             </tbody>
@@ -11998,15 +12036,8 @@ <h3 id="metalstack.api.v2.TenantServiceRemoveMemberRequest">TenantServiceRemoveM
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceRemoveMemberResponse">TenantServiceRemoveMemberResponse</h3>
-        <p>TenantServiceRemoveMemberResponse is the response payload to a remove member request</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.TenantServiceUpdateMemberRequest">TenantServiceUpdateMemberRequest</h3>
-        <p>TenantServiceUpdateMemberRequest is used to update a member from a tenant</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceListRequest">SwitchServiceListRequest</h3>
+        <p>SwitchServiceListRequest.</p>
 
         
           <table class="field-table">
@@ -12016,24 +12047,10 @@ <h3 id="metalstack.api.v2.TenantServiceUpdateMemberRequest">TenantServiceUpdateM
             <tbody>
               
                 <tr>
-                  <td>login</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Login of the tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>member</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Member is the id of the member to update in this tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>role</td>
-                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
+                  <td>query</td>
+                  <td><a href="#metalstack.api.v2.SwitchQuery">metalstack.api.v2.SwitchQuery</a></td>
                   <td></td>
-                  <td><p>Role of this user in this tenant </p></td>
+                  <td><p>Query to filter the results. </p></td>
                 </tr>
               
             </tbody>
@@ -12043,8 +12060,8 @@ <h3 id="metalstack.api.v2.TenantServiceUpdateMemberRequest">TenantServiceUpdateM
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceUpdateMemberResponse">TenantServiceUpdateMemberResponse</h3>
-        <p>TenantServiceUpdateMemberResponse is the response payload to a update member request</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceListResponse">SwitchServiceListResponse</h3>
+        <p>SwitchServiceListResponse.</p>
 
         
           <table class="field-table">
@@ -12054,10 +12071,10 @@ <h3 id="metalstack.api.v2.TenantServiceUpdateMemberResponse">TenantServiceUpdate
             <tbody>
               
                 <tr>
-                  <td>tenant_member</td>
-                  <td><a href="#metalstack.api.v2.TenantMember">TenantMember</a></td>
-                  <td></td>
-                  <td><p>TenantMember is the updated membership </p></td>
+                  <td>switches</td>
+                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
+                  <td>repeated</td>
+                  <td><p>Switches that match the request query. </p></td>
                 </tr>
               
             </tbody>
@@ -12067,8 +12084,8 @@ <h3 id="metalstack.api.v2.TenantServiceUpdateMemberResponse">TenantServiceUpdate
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceUpdateRequest">TenantServiceUpdateRequest</h3>
-        <p>TenantServiceUpdateRequest is the request payload of the tenant update request</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceMigrateRequest">SwitchServiceMigrateRequest</h3>
+        <p>SwitchServiceMigrateRequest.</p>
 
         
           <table class="field-table">
@@ -12078,52 +12095,17 @@ <h3 id="metalstack.api.v2.TenantServiceUpdateRequest">TenantServiceUpdateRequest
             <tbody>
               
                 <tr>
-                  <td>login</td>
+                  <td>old_switch</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Login of the tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>update_meta</td>
-                  <td><a href="#metalstack.api.v2.UpdateMeta">UpdateMeta</a></td>
-                  <td></td>
-                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request </p></td>
-                </tr>
-              
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Name of the tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>email</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Email of the tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Description of this tenant </p></td>
+                  <td><p>OldSwitch which to migrate away from. </p></td>
                 </tr>
               
                 <tr>
-                  <td>avatar_url</td>
+                  <td>new_switch</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>AvatarUrl of the tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.UpdateLabels">UpdateLabels</a></td>
-                  <td>optional</td>
-                  <td><p>Labels on the tenant </p></td>
+                  <td></td>
+                  <td><p>NewSwitch which to migrate to. </p></td>
                 </tr>
               
             </tbody>
@@ -12133,8 +12115,8 @@ <h3 id="metalstack.api.v2.TenantServiceUpdateRequest">TenantServiceUpdateRequest
 
         
       
-        <h3 id="metalstack.api.v2.TenantServiceUpdateResponse">TenantServiceUpdateResponse</h3>
-        <p>TenantServiceUpdateResponse is the response payload of the tenant update request</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceMigrateResponse">SwitchServiceMigrateResponse</h3>
+        <p>SwitchServiceMigrateResponse.</p>
 
         
           <table class="field-table">
@@ -12144,10 +12126,10 @@ <h3 id="metalstack.api.v2.TenantServiceUpdateResponse">TenantServiceUpdateRespon
             <tbody>
               
                 <tr>
-                  <td>tenant</td>
-                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
+                  <td>switch</td>
+                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
                   <td></td>
-                  <td><p>Tenant is the tenant </p></td>
+                  <td><p>Switch that was migrated to. </p></td>
                 </tr>
               
             </tbody>
@@ -12157,125 +12139,8 @@ <h3 id="metalstack.api.v2.TenantServiceUpdateResponse">TenantServiceUpdateRespon
 
         
       
-
-      
-
-      
-
-      
-        <h3 id="metalstack.api.v2.TenantService">TenantService</h3>
-        <p>TenantService serves tenant related functions</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>Create</td>
-                <td><a href="#metalstack.api.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceCreateResponse">TenantServiceCreateResponse</a></td>
-                <td><p>Create a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>List</td>
-                <td><a href="#metalstack.api.v2.TenantServiceListRequest">TenantServiceListRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceListResponse">TenantServiceListResponse</a></td>
-                <td><p>List tenants</p></td>
-              </tr>
-            
-              <tr>
-                <td>Get</td>
-                <td><a href="#metalstack.api.v2.TenantServiceGetRequest">TenantServiceGetRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceGetResponse">TenantServiceGetResponse</a></td>
-                <td><p>Get a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>Update</td>
-                <td><a href="#metalstack.api.v2.TenantServiceUpdateRequest">TenantServiceUpdateRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceUpdateResponse">TenantServiceUpdateResponse</a></td>
-                <td><p>Update a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>Delete</td>
-                <td><a href="#metalstack.api.v2.TenantServiceDeleteRequest">TenantServiceDeleteRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceDeleteResponse">TenantServiceDeleteResponse</a></td>
-                <td><p>Delete a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>Leave</td>
-                <td><a href="#metalstack.api.v2.TenantServiceLeaveRequest">TenantServiceLeaveRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceLeaveResponse">TenantServiceLeaveResponse</a></td>
-                <td><p>Leave remove a member of a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>RemoveMember</td>
-                <td><a href="#metalstack.api.v2.TenantServiceRemoveMemberRequest">TenantServiceRemoveMemberRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceRemoveMemberResponse">TenantServiceRemoveMemberResponse</a></td>
-                <td><p>RemoveMember remove a member of a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>UpdateMember</td>
-                <td><a href="#metalstack.api.v2.TenantServiceUpdateMemberRequest">TenantServiceUpdateMemberRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceUpdateMemberResponse">TenantServiceUpdateMemberResponse</a></td>
-                <td><p>UpdateMember update a member of a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>Invite</td>
-                <td><a href="#metalstack.api.v2.TenantServiceInviteRequest">TenantServiceInviteRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceInviteResponse">TenantServiceInviteResponse</a></td>
-                <td><p>Invite a user to a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>InviteAccept</td>
-                <td><a href="#metalstack.api.v2.TenantServiceInviteAcceptRequest">TenantServiceInviteAcceptRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceInviteAcceptResponse">TenantServiceInviteAcceptResponse</a></td>
-                <td><p>InviteAccept is called from a user to accept an invitation</p></td>
-              </tr>
-            
-              <tr>
-                <td>InviteDelete</td>
-                <td><a href="#metalstack.api.v2.TenantServiceInviteDeleteRequest">TenantServiceInviteDeleteRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceInviteDeleteResponse">TenantServiceInviteDeleteResponse</a></td>
-                <td><p>InviteDelete deletes a pending invitation</p></td>
-              </tr>
-            
-              <tr>
-                <td>InvitesList</td>
-                <td><a href="#metalstack.api.v2.TenantServiceInvitesListRequest">TenantServiceInvitesListRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceInvitesListResponse">TenantServiceInvitesListResponse</a></td>
-                <td><p>InvitesList list all invites to a tenant</p></td>
-              </tr>
-            
-              <tr>
-                <td>InviteGet</td>
-                <td><a href="#metalstack.api.v2.TenantServiceInviteGetRequest">TenantServiceInviteGetRequest</a></td>
-                <td><a href="#metalstack.api.v2.TenantServiceInviteGetResponse">TenantServiceInviteGetResponse</a></td>
-                <td><p>InviteGet get an invite</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-
-        
-    
-      
-      <div class="file-heading">
-        <h2 id="metalstack/admin/v2/tenant.proto">metalstack/admin/v2/tenant.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
-
-      
-        <h3 id="metalstack.admin.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</h3>
-        <p>TenantServiceCreateRequest is the request payload of the tenant create request</p>
+        <h3 id="metalstack.admin.v2.SwitchServicePortRequest">SwitchServicePortRequest</h3>
+        <p>SwitchServicePortRequest.</p>
 
         
           <table class="field-table">
@@ -12285,31 +12150,24 @@ <h3 id="metalstack.admin.v2.TenantServiceCreateRequest">TenantServiceCreateReque
             <tbody>
               
                 <tr>
-                  <td>name</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Name of this tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Description of this tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>email</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Email of the tenant, if not set will be inherited from the creator </p></td>
+                  <td><p>Id of the switch. </p></td>
                 </tr>
               
                 <tr>
-                  <td>avatar_url</td>
+                  <td>nic_name</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>AvatarUrl of the tenant </p></td>
+                  <td></td>
+                  <td><p>NicName of the port whose status should be changed. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>status</td>
+                  <td><a href="#metalstack.api.v2.SwitchPortStatus">metalstack.api.v2.SwitchPortStatus</a></td>
+                  <td></td>
+                  <td><p>Status that the port should have. </p></td>
                 </tr>
               
             </tbody>
@@ -12319,8 +12177,8 @@ <h3 id="metalstack.admin.v2.TenantServiceCreateRequest">TenantServiceCreateReque
 
         
       
-        <h3 id="metalstack.admin.v2.TenantServiceCreateResponse">TenantServiceCreateResponse</h3>
-        <p>TenantServiceCreateResponse is the response payload of the tenant create request</p>
+        <h3 id="metalstack.admin.v2.SwitchServicePortResponse">SwitchServicePortResponse</h3>
+        <p>SwitchServicePortResponse.</p>
 
         
           <table class="field-table">
@@ -12330,10 +12188,10 @@ <h3 id="metalstack.admin.v2.TenantServiceCreateResponse">TenantServiceCreateResp
             <tbody>
               
                 <tr>
-                  <td>tenant</td>
-                  <td><a href="#metalstack.api.v2.Tenant">metalstack.api.v2.Tenant</a></td>
+                  <td>switch</td>
+                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
                   <td></td>
-                  <td><p>Tenant is the tenant </p></td>
+                  <td><p>Switch after the port status toggle.. </p></td>
                 </tr>
               
             </tbody>
@@ -12343,8 +12201,8 @@ <h3 id="metalstack.admin.v2.TenantServiceCreateResponse">TenantServiceCreateResp
 
         
       
-        <h3 id="metalstack.admin.v2.TenantServiceListRequest">TenantServiceListRequest</h3>
-        <p>TenantServiceListRequest is the request payload for a tenant list request</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceUpdateRequest">SwitchServiceUpdateRequest</h3>
+        <p>SwitchServiceUpdateRequest.</p>
 
         
           <table class="field-table">
@@ -12354,31 +12212,74 @@ <h3 id="metalstack.admin.v2.TenantServiceListRequest">TenantServiceListRequest</
             <tbody>
               
                 <tr>
-                  <td>login</td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>ID of the switch. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>update_meta</td>
+                  <td><a href="#metalstack.api.v2.UpdateMeta">metalstack.api.v2.UpdateMeta</a></td>
+                  <td></td>
+                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>updated_at</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>UpdatedAt is the date when this entity was updated.
+must be part of the update request to ensure optimistic locking. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
                   <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>Login of the tenant to list </p></td>
+                  <td><p>Description of the switch. </p></td>
                 </tr>
               
                 <tr>
-                  <td>name</td>
+                  <td>replace_mode</td>
+                  <td><a href="#metalstack.api.v2.SwitchReplaceMode">metalstack.api.v2.SwitchReplaceMode</a></td>
+                  <td>optional</td>
+                  <td><p>Replace mode is used to mark a switch ready for replacement. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>management_ip</td>
                   <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>Name of the tenant to list </p></td>
+                  <td><p>Management IP is the switch&#39;s IP for management access. </p></td>
                 </tr>
               
                 <tr>
-                  <td>email</td>
+                  <td>management_user</td>
                   <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>Email of the tenant to list </p></td>
+                  <td><p>Management user is the user name to use for management access. </p></td>
                 </tr>
               
                 <tr>
-                  <td>paging</td>
-                  <td><a href="#metalstack.api.v2.Paging">metalstack.api.v2.Paging</a></td>
-                  <td></td>
-                  <td><p>Paging details for the list request </p></td>
+                  <td>console_command</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Console command is the command for accessing the switch&#39;s console. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>nics</td>
+                  <td><a href="#metalstack.api.v2.SwitchNic">metalstack.api.v2.SwitchNic</a></td>
+                  <td>repeated</td>
+                  <td><p>Nics are the front panel ports of the switch. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>os</td>
+                  <td><a href="#metalstack.api.v2.SwitchOS">metalstack.api.v2.SwitchOS</a></td>
+                  <td>optional</td>
+                  <td><p>SwitchOs is the OS running on the switch. </p></td>
                 </tr>
               
             </tbody>
@@ -12388,8 +12289,8 @@ <h3 id="metalstack.admin.v2.TenantServiceListRequest">TenantServiceListRequest</
 
         
       
-        <h3 id="metalstack.admin.v2.TenantServiceListResponse">TenantServiceListResponse</h3>
-        <p>TenantServiceListResponse is the response payload for a tenant list request</p>
+        <h3 id="metalstack.admin.v2.SwitchServiceUpdateResponse">SwitchServiceUpdateResponse</h3>
+        <p>SwitchServiceUpdateResponse.</p>
 
         
           <table class="field-table">
@@ -12399,17 +12300,10 @@ <h3 id="metalstack.admin.v2.TenantServiceListResponse">TenantServiceListResponse
             <tbody>
               
                 <tr>
-                  <td>tenants</td>
-                  <td><a href="#metalstack.api.v2.Tenant">metalstack.api.v2.Tenant</a></td>
-                  <td>repeated</td>
-                  <td><p>Tenants are the list of tenants </p></td>
-                </tr>
-              
-                <tr>
-                  <td>next_page</td>
-                  <td><a href="#uint64">uint64</a></td>
-                  <td>optional</td>
-                  <td><p>NextPage is used for pagination, returns the next page to be fetched and must then be provided in the list request. </p></td>
+                  <td>switch</td>
+                  <td><a href="#metalstack.api.v2.Switch">metalstack.api.v2.Switch</a></td>
+                  <td></td>
+                  <td><p>Switch that was updated. </p></td>
                 </tr>
               
             </tbody>
@@ -12425,8 +12319,8 @@ <h3 id="metalstack.admin.v2.TenantServiceListResponse">TenantServiceListResponse
       
 
       
-        <h3 id="metalstack.admin.v2.TenantService">TenantService</h3>
-        <p>TenantService serves tenant related functions</p>
+        <h3 id="metalstack.admin.v2.SwitchService">SwitchService</h3>
+        <p>SwitchService serves switch related functions.</p>
         <table class="enum-table">
           <thead>
             <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
@@ -12434,17 +12328,45 @@ <h3 id="metalstack.admin.v2.TenantService">TenantService</h3>
           <tbody>
             
               <tr>
-                <td>Create</td>
-                <td><a href="#metalstack.admin.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</a></td>
-                <td><a href="#metalstack.admin.v2.TenantServiceCreateResponse">TenantServiceCreateResponse</a></td>
-                <td><p>Create a tenant</p></td>
+                <td>Get</td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceGetRequest">SwitchServiceGetRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceGetResponse">SwitchServiceGetResponse</a></td>
+                <td><p>Get a switch by ID.</p></td>
               </tr>
             
               <tr>
                 <td>List</td>
-                <td><a href="#metalstack.admin.v2.TenantServiceListRequest">TenantServiceListRequest</a></td>
-                <td><a href="#metalstack.admin.v2.TenantServiceListResponse">TenantServiceListResponse</a></td>
-                <td><p>List all tenants</p></td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceListRequest">SwitchServiceListRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceListResponse">SwitchServiceListResponse</a></td>
+                <td><p>List switches.</p></td>
+              </tr>
+            
+              <tr>
+                <td>Update</td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceUpdateRequest">SwitchServiceUpdateRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceUpdateResponse">SwitchServiceUpdateResponse</a></td>
+                <td><p>Update a switch.</p></td>
+              </tr>
+            
+              <tr>
+                <td>Delete</td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceDeleteRequest">SwitchServiceDeleteRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceDeleteResponse">SwitchServiceDeleteResponse</a></td>
+                <td><p>Delete a switch.</p></td>
+              </tr>
+            
+              <tr>
+                <td>Migrate</td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceMigrateRequest">SwitchServiceMigrateRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SwitchServiceMigrateResponse">SwitchServiceMigrateResponse</a></td>
+                <td><p>Migrate a switch.</p></td>
+              </tr>
+            
+              <tr>
+                <td>Port</td>
+                <td><a href="#metalstack.admin.v2.SwitchServicePortRequest">SwitchServicePortRequest</a></td>
+                <td><a href="#metalstack.admin.v2.SwitchServicePortResponse">SwitchServicePortResponse</a></td>
+                <td><p>Port set the port status of a switch port.</p></td>
               </tr>
             
           </tbody>
@@ -12454,13 +12376,13 @@ <h3 id="metalstack.admin.v2.TenantService">TenantService</h3>
     
       
       <div class="file-heading">
-        <h2 id="metalstack/api/v2/token.proto">metalstack/api/v2/token.proto</h2><a href="#title">Top</a>
+        <h2 id="metalstack/api/v2/tenant.proto">metalstack/api/v2/tenant.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
       
-        <h3 id="metalstack.api.v2.MethodPermission">MethodPermission</h3>
-        <p>MethodPermission is a mapping from a subject/project to a service method</p>
+        <h3 id="metalstack.api.v2.Tenant">Tenant</h3>
+        <p>Tenant is a customer of the platform</p>
 
         
           <table class="field-table">
@@ -12470,22 +12392,52 @@ <h3 id="metalstack.api.v2.MethodPermission">MethodPermission</h3>
             <tbody>
               
                 <tr>
-                  <td>subject</td>
+                  <td>login</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Subject maybe either the project or the tenant
-for which the methods should be allowed
-
-asterisk (*) can be specified to match any subject
-empty string (&#34;&#34;) can be specified for requests that do not require a subject, e.g. partition list
-otherwise either a projectid or a tenant login should be specified </p></td>
+                  <td><p>Login of the tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>methods</td>
+                  <td>meta</td>
+                  <td><a href="#metalstack.api.v2.Meta">Meta</a></td>
+                  <td></td>
+                  <td><p>Meta for this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
-                  <td>repeated</td>
-                  <td><p>Methods which should be accessible </p></td>
+                  <td></td>
+                  <td><p>Name of the tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>email</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Email of the tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Description of this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>avatar_url</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>AvatarUrl of the tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>created_by</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>CreatedBy stores who created this tenant </p></td>
                 </tr>
               
             </tbody>
@@ -12495,8 +12447,8 @@ <h3 id="metalstack.api.v2.MethodPermission">MethodPermission</h3>
 
         
       
-        <h3 id="metalstack.api.v2.Token">Token</h3>
-        <p>Token generates a jwt authentication token to access the api</p><p>There are two different types of tokens, api- and user- tokens</p><p>A user token is used to authenticate end user requests for example from a cli.</p><p>The configured roles in a user token are expanded in the api server</p><p>based on the memberships in other projects and tenants based on the role granted there.</p><p>User tokens will never contain permissions.</p><p>Permissions are always derived from the tenant and project roles and memberships.</p><p>The api token should be used to authenticate services.</p><p>In contrast to a user token, the api token permissions and roles apply as configured during the token create process.</p>
+        <h3 id="metalstack.api.v2.TenantInvite">TenantInvite</h3>
+        <p>TenantInvite defines invite to tenant</p>
 
         
           <table class="field-table">
@@ -12506,87 +12458,66 @@ <h3 id="metalstack.api.v2.Token">Token</h3>
             <tbody>
               
                 <tr>
-                  <td>uuid</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Uuid of the jwt token, used to reference it by revoke </p></td>
-                </tr>
-              
-                <tr>
-                  <td>user</td>
+                  <td>secret</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>User who created this token </p></td>
-                </tr>
-              
-                <tr>
-                  <td>meta</td>
-                  <td><a href="#metalstack.api.v2.Meta">Meta</a></td>
-                  <td></td>
-                  <td><p>Meta for this token </p></td>
+                  <td><p>Secret is the secret part of the invite, typically part of the url </p></td>
                 </tr>
               
                 <tr>
-                  <td>description</td>
+                  <td>target_tenant</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Description is a user given description of this token. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>permissions</td>
-                  <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
-                  <td>repeated</td>
-                  <td><p>Permissions is a list of service methods this token can be used for </p></td>
+                  <td><p>TargetTenant is the tenant id for which this invite was created </p></td>
                 </tr>
               
                 <tr>
-                  <td>expires</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
                   <td></td>
-                  <td><p>Expires gives the date in the future after which this token can not be used anymore </p></td>
+                  <td><p>Role is the role in this tenant the user will get after accepting the invitation </p></td>
                 </tr>
               
                 <tr>
-                  <td>issued_at</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td>joined</td>
+                  <td><a href="#bool">bool</a></td>
                   <td></td>
-                  <td><p>IssuedAt gives the date when this token was created </p></td>
+                  <td><p>Joined is false as long as a user has not accepted the invite </p></td>
                 </tr>
               
                 <tr>
-                  <td>token_type</td>
-                  <td><a href="#metalstack.api.v2.TokenType">TokenType</a></td>
+                  <td>target_tenant_name</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>TokenType describes the type of this token </p></td>
+                  <td><p>TargetTenantName is the tenant name for which this invite was created </p></td>
                 </tr>
               
                 <tr>
-                  <td>project_roles</td>
-                  <td><a href="#metalstack.api.v2.Token.ProjectRolesEntry">Token.ProjectRolesEntry</a></td>
-                  <td>repeated</td>
-                  <td><p>ProjectRoles associates a project id with the corresponding role of the token owner </p></td>
+                  <td>tenant</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Tenant is the login of tenant who invites to join this tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>tenant_roles</td>
-                  <td><a href="#metalstack.api.v2.Token.TenantRolesEntry">Token.TenantRolesEntry</a></td>
-                  <td>repeated</td>
-                  <td><p>TenantRoles associates a tenant id with the corresponding role of the token owner </p></td>
+                  <td>tenant_name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>TenantName is the name of tenant who invites to join this tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>admin_role</td>
-                  <td><a href="#metalstack.api.v2.AdminRole">AdminRole</a></td>
-                  <td>optional</td>
-                  <td><p>AdminRole defines the admin role of the token owner </p></td>
+                  <td>expires_at</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>ExpiresAt the date when this invite expires </p></td>
                 </tr>
               
                 <tr>
-                  <td>infra_role</td>
-                  <td><a href="#metalstack.api.v2.InfraRole">InfraRole</a></td>
-                  <td>optional</td>
-                  <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
+                  <td>joined_at</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>JoinedAt the date when the member accepted this invite </p></td>
                 </tr>
               
             </tbody>
@@ -12596,8 +12527,8 @@ <h3 id="metalstack.api.v2.Token">Token</h3>
 
         
       
-        <h3 id="metalstack.api.v2.Token.ProjectRolesEntry">Token.ProjectRolesEntry</h3>
-        <p></p>
+        <h3 id="metalstack.api.v2.TenantMember">TenantMember</h3>
+        <p>TenantMember defines a user that participates at a tenant</p>
 
         
           <table class="field-table">
@@ -12607,48 +12538,31 @@ <h3 id="metalstack.api.v2.Token.ProjectRolesEntry">Token.ProjectRolesEntry</h3>
             <tbody>
               
                 <tr>
-                  <td>key</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Id is the user id of the member </p></td>
                 </tr>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Role is the role of the member </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.Token.TenantRolesEntry">Token.TenantRolesEntry</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>key</td>
+                  <td>projects</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
+                  <td>repeated</td>
+                  <td><p>Projects for the projects in which a user is a direct member </p></td>
                 </tr>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
+                  <td>created_at</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>CreatedAt the date when the member was added to the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -12658,8 +12572,8 @@ <h3 id="metalstack.api.v2.Token.TenantRolesEntry">Token.TenantRolesEntry</h3>
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</h3>
-        <p>TokenServiceCreateRequest is the request payload to create a token</p>
+        <h3 id="metalstack.api.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</h3>
+        <p>TenantServiceCreateRequest is the request payload of the tenant create request</p>
 
         
           <table class="field-table">
@@ -12669,59 +12583,38 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</
             <tbody>
               
                 <tr>
-                  <td>description</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Description of the token </p></td>
-                </tr>
-              
-                <tr>
-                  <td>permissions</td>
-                  <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
-                  <td>repeated</td>
-                  <td><p>Permissions is a list of service methods this token can be used for </p></td>
-                </tr>
-              
-                <tr>
-                  <td>expires</td>
-                  <td><a href="#google.protobuf.Duration">google.protobuf.Duration</a></td>
-                  <td></td>
-                  <td><p>Expires gives the duration since now, after which this token can not be used anymore </p></td>
-                </tr>
-              
-                <tr>
-                  <td>project_roles</td>
-                  <td><a href="#metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry">TokenServiceCreateRequest.ProjectRolesEntry</a></td>
-                  <td>repeated</td>
-                  <td><p>ProjectRoles associates a project id with the corresponding role of the token owner </p></td>
+                  <td><p>Name of this tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>tenant_roles</td>
-                  <td><a href="#metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry">TokenServiceCreateRequest.TenantRolesEntry</a></td>
-                  <td>repeated</td>
-                  <td><p>TenantRoles associates a tenant id with the corresponding role of the token owner </p></td>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Description of this tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>admin_role</td>
-                  <td><a href="#metalstack.api.v2.AdminRole">AdminRole</a></td>
+                  <td>email</td>
+                  <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>AdminRole defines the admin role of the token owner </p></td>
+                  <td><p>Email of the tenant, if not set will be inherited from the creator </p></td>
                 </tr>
               
                 <tr>
-                  <td>infra_role</td>
-                  <td><a href="#metalstack.api.v2.InfraRole">InfraRole</a></td>
+                  <td>avatar_url</td>
+                  <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
+                  <td><p>AvatarUrl of the tenant </p></td>
                 </tr>
               
                 <tr>
                   <td>labels</td>
                   <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
                   <td></td>
-                  <td><p>Labels on this token </p></td>
+                  <td><p>Labels on the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -12731,8 +12624,8 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry">TokenServiceCreateRequest.ProjectRolesEntry</h3>
-        <p></p>
+        <h3 id="metalstack.api.v2.TenantServiceCreateResponse">TenantServiceCreateResponse</h3>
+        <p>TenantServiceCreateResponse is the response payload of the tenant create request</p>
 
         
           <table class="field-table">
@@ -12742,17 +12635,34 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry">TokenServ
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#string">string</a></td>
+                  <td>tenant</td>
+                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Tenant is the tenant </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.TenantServiceDeleteRequest">TenantServiceDeleteRequest</h3>
+        <p>TenantServiceDeleteRequest is the request payload of the tenant delete request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>value</td>
-                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Login of the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -12762,8 +12672,8 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry">TokenServ
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry">TokenServiceCreateRequest.TenantRolesEntry</h3>
-        <p></p>
+        <h3 id="metalstack.api.v2.TenantServiceDeleteResponse">TenantServiceDeleteResponse</h3>
+        <p>TenantServiceDeleteResponse is the response payload of the tenant delete request</p>
 
         
           <table class="field-table">
@@ -12773,17 +12683,34 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry">TokenServi
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#string">string</a></td>
+                  <td>tenant</td>
+                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Tenant is the tenant </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.TenantServiceGetRequest">TenantServiceGetRequest</h3>
+        <p>TenantServiceGetRequest is the request payload of the tenant get request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>value</td>
-                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Login of the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -12793,8 +12720,8 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry">TokenServi
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceCreateResponse">TokenServiceCreateResponse</h3>
-        <p>TokenServiceCreateResponse is the response payload of a token create request</p>
+        <h3 id="metalstack.api.v2.TenantServiceGetResponse">TenantServiceGetResponse</h3>
+        <p>TenantServiceGetResponse is the response payload of the tenant get request</p>
 
         
           <table class="field-table">
@@ -12804,17 +12731,17 @@ <h3 id="metalstack.api.v2.TokenServiceCreateResponse">TokenServiceCreateResponse
             <tbody>
               
                 <tr>
-                  <td>token</td>
-                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
+                  <td>tenant</td>
+                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
                   <td></td>
-                  <td><p>Token which was created </p></td>
+                  <td><p>Tenant is the tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>secret</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Secret is the body if the jwt token, should be used in api requests as bearer token </p></td>
+                  <td>tenant_members</td>
+                  <td><a href="#metalstack.api.v2.TenantMember">TenantMember</a></td>
+                  <td>repeated</td>
+                  <td><p>TenantMembers of this tenant </p></td>
                 </tr>
               
             </tbody>
@@ -12824,8 +12751,8 @@ <h3 id="metalstack.api.v2.TokenServiceCreateResponse">TokenServiceCreateResponse
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceGetRequest">TokenServiceGetRequest</h3>
-        <p>TokenServiceGetRequest is the request payload of a token get request</p>
+        <h3 id="metalstack.api.v2.TenantServiceInviteAcceptRequest">TenantServiceInviteAcceptRequest</h3>
+        <p>TenantServiceInviteAcceptRequest is the request payload to a accept invite request</p>
 
         
           <table class="field-table">
@@ -12835,10 +12762,10 @@ <h3 id="metalstack.api.v2.TokenServiceGetRequest">TokenServiceGetRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>uuid</td>
+                  <td>secret</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Uuid of the token to get </p></td>
+                  <td><p>Secret is the invitation secret part of the invitation url </p></td>
                 </tr>
               
             </tbody>
@@ -12848,8 +12775,8 @@ <h3 id="metalstack.api.v2.TokenServiceGetRequest">TokenServiceGetRequest</h3>
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceGetResponse">TokenServiceGetResponse</h3>
-        <p>TokenServiceGetResponse is the response payload of a token get request</p>
+        <h3 id="metalstack.api.v2.TenantServiceInviteAcceptResponse">TenantServiceInviteAcceptResponse</h3>
+        <p>TenantServiceInvitesListResponse is the response payload to a accept invite request</p>
 
         
           <table class="field-table">
@@ -12859,10 +12786,17 @@ <h3 id="metalstack.api.v2.TokenServiceGetResponse">TokenServiceGetResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>token</td>
-                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
+                  <td>tenant</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Token is the token </p></td>
+                  <td><p>Tenant ID of the joined tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>tenant_name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>TenantName of the joined tenant </p></td>
                 </tr>
               
             </tbody>
@@ -12872,15 +12806,8 @@ <h3 id="metalstack.api.v2.TokenServiceGetResponse">TokenServiceGetResponse</h3>
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceListRequest">TokenServiceListRequest</h3>
-        <p>TokenServiceListRequest is the request payload to list tokens</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.TokenServiceListResponse">TokenServiceListResponse</h3>
-        <p>TokenServiceListResponse is the response payload of a token list request</p>
+        <h3 id="metalstack.api.v2.TenantServiceInviteDeleteRequest">TenantServiceInviteDeleteRequest</h3>
+        <p>TenantServiceInviteDeleteRequest is the request payload to a delete invite</p>
 
         
           <table class="field-table">
@@ -12890,10 +12817,17 @@ <h3 id="metalstack.api.v2.TokenServiceListResponse">TokenServiceListResponse</h3
             <tbody>
               
                 <tr>
-                  <td>tokens</td>
-                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
-                  <td>repeated</td>
-                  <td><p>Tokens is a list of tokens without the secrets </p></td>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login of the tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>secret</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Secret of the invite to delete </p></td>
                 </tr>
               
             </tbody>
@@ -12903,15 +12837,15 @@ <h3 id="metalstack.api.v2.TokenServiceListResponse">TokenServiceListResponse</h3
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceRefreshRequest">TokenServiceRefreshRequest</h3>
-        <p>TokenServiceRefreshRequest is the request payload of a token refresh request</p><p>Permissions, Roles and Expiration duration and all other properties are inherited from the calling token.</p><p>The expiration duration will be calculated from the existing token (exp - iat)</p>
+        <h3 id="metalstack.api.v2.TenantServiceInviteDeleteResponse">TenantServiceInviteDeleteResponse</h3>
+        <p>TenantServiceInviteDeleteResponse is the response payload of a delete invite request</p>
 
         
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceRefreshResponse">TokenServiceRefreshResponse</h3>
-        <p>TokenServiceRefreshResponse is the response payload of a token refresh request</p>
+        <h3 id="metalstack.api.v2.TenantServiceInviteGetRequest">TenantServiceInviteGetRequest</h3>
+        <p>TenantServiceInviteGetRequest is the request payload to get a invite</p>
 
         
           <table class="field-table">
@@ -12920,18 +12854,11 @@ <h3 id="metalstack.api.v2.TokenServiceRefreshResponse">TokenServiceRefreshRespon
             </thead>
             <tbody>
               
-                <tr>
-                  <td>token</td>
-                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
-                  <td></td>
-                  <td><p>Token which was refreshed </p></td>
-                </tr>
-              
                 <tr>
                   <td>secret</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Secret is the body if the jwt token, should be used in api requests as bearer token </p></td>
+                  <td><p>Secret of the invite to get </p></td>
                 </tr>
               
             </tbody>
@@ -12941,8 +12868,8 @@ <h3 id="metalstack.api.v2.TokenServiceRefreshResponse">TokenServiceRefreshRespon
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</h3>
-        <p>TokenServiceRevokeRequest is the request payload of a token revoke request</p>
+        <h3 id="metalstack.api.v2.TenantServiceInviteGetResponse">TenantServiceInviteGetResponse</h3>
+        <p>TenantServiceInviteGetResponse is the response payload to a get invite request</p>
 
         
           <table class="field-table">
@@ -12952,10 +12879,10 @@ <h3 id="metalstack.api.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</
             <tbody>
               
                 <tr>
-                  <td>uuid</td>
-                  <td><a href="#string">string</a></td>
+                  <td>invite</td>
+                  <td><a href="#metalstack.api.v2.TenantInvite">TenantInvite</a></td>
                   <td></td>
-                  <td><p>Uuid of the token to revoke </p></td>
+                  <td><p>Invite is the invite </p></td>
                 </tr>
               
             </tbody>
@@ -12965,15 +12892,8 @@ <h3 id="metalstack.api.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceRevokeResponse">TokenServiceRevokeResponse</h3>
-        <p>TokenServiceRevokeResponse is the response payload of a token revoke request</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</h3>
-        <p>TokenServiceUpdateRequest is the request payload of a token update request</p>
+        <h3 id="metalstack.api.v2.TenantServiceInviteRequest">TenantServiceInviteRequest</h3>
+        <p>TenantServiceInviteRequest is used to invite a member to a tenant</p>
 
         
           <table class="field-table">
@@ -12983,67 +12903,43 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</
             <tbody>
               
                 <tr>
-                  <td>uuid</td>
+                  <td>login</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Uuid of the token to update </p></td>
+                  <td><p>Login of the tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>update_meta</td>
-                  <td><a href="#metalstack.api.v2.UpdateMeta">UpdateMeta</a></td>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
                   <td></td>
-                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request
-TokenUpdate is not guarded with optlock in the backend </p></td>
-                </tr>
-              
-                <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Description is a user given description of this token. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>permissions</td>
-                  <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
-                  <td>repeated</td>
-                  <td><p>Permissions is a list of service methods this token can be used for </p></td>
-                </tr>
-              
-                <tr>
-                  <td>project_roles</td>
-                  <td><a href="#metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry">TokenServiceUpdateRequest.ProjectRolesEntry</a></td>
-                  <td>repeated</td>
-                  <td><p>ProjectRoles associates a project id with the corresponding role of the token owner </p></td>
-                </tr>
-              
-                <tr>
-                  <td>tenant_roles</td>
-                  <td><a href="#metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry">TokenServiceUpdateRequest.TenantRolesEntry</a></td>
-                  <td>repeated</td>
-                  <td><p>TenantRoles associates a tenant id with the corresponding role of the token owner </p></td>
-                </tr>
-              
-                <tr>
-                  <td>admin_role</td>
-                  <td><a href="#metalstack.api.v2.AdminRole">AdminRole</a></td>
-                  <td>optional</td>
-                  <td><p>AdminRole defines the admin role of the token owner </p></td>
+                  <td><p>Role of this user in this tenant </p></td>
                 </tr>
               
-                <tr>
-                  <td>infra_role</td>
-                  <td><a href="#metalstack.api.v2.InfraRole">InfraRole</a></td>
-                  <td>optional</td>
-                  <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.TenantServiceInviteResponse">TenantServiceInviteResponse</h3>
+        <p>TenantServiceInviteRequest is the response payload to a invite member request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.UpdateLabels">UpdateLabels</a></td>
+                  <td>invite</td>
+                  <td><a href="#metalstack.api.v2.TenantInvite">TenantInvite</a></td>
                   <td></td>
-                  <td><p>Labels on this token </p></td>
+                  <td><p>Invite contains a secret which can be sent to a potential user
+can be appended to the invitation endpoint at our cloud console like
+console.metalstack.cloud/invite/&lt;secret&gt; </p></td>
                 </tr>
               
             </tbody>
@@ -13053,8 +12949,8 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry">TokenServiceUpdateRequest.ProjectRolesEntry</h3>
-        <p></p>
+        <h3 id="metalstack.api.v2.TenantServiceInvitesListRequest">TenantServiceInvitesListRequest</h3>
+        <p>TenantServiceInvitesListRequest is the request payload to a list invites request</p>
 
         
           <table class="field-table">
@@ -13064,17 +12960,10 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry">TokenServ
             <tbody>
               
                 <tr>
-                  <td>key</td>
+                  <td>login</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>value</td>
-                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
-                  <td></td>
-                  <td><p> </p></td>
+                  <td><p>Login of the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -13084,8 +12973,8 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry">TokenServ
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry">TokenServiceUpdateRequest.TenantRolesEntry</h3>
-        <p></p>
+        <h3 id="metalstack.api.v2.TenantServiceInvitesListResponse">TenantServiceInvitesListResponse</h3>
+        <p>TenantServiceInvitesListResponse is the response payload to a list invites request</p>
 
         
           <table class="field-table">
@@ -13095,17 +12984,10 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry">TokenServi
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>value</td>
-                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
-                  <td></td>
-                  <td><p> </p></td>
+                  <td>invites</td>
+                  <td><a href="#metalstack.api.v2.TenantInvite">TenantInvite</a></td>
+                  <td>repeated</td>
+                  <td><p>Invites not already accepted the invitation to this tenant </p></td>
                 </tr>
               
             </tbody>
@@ -13115,8 +12997,8 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry">TokenServi
 
         
       
-        <h3 id="metalstack.api.v2.TokenServiceUpdateResponse">TokenServiceUpdateResponse</h3>
-        <p>TokenServiceUpdateResponse is the response payload of a token update request</p>
+        <h3 id="metalstack.api.v2.TenantServiceLeaveRequest">TenantServiceLeaveRequest</h3>
+        <p>TenantServiceLeaveTenantRequest is used to leave a tenant</p>
 
         
           <table class="field-table">
@@ -13126,10 +13008,10 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateResponse">TokenServiceUpdateResponse
             <tbody>
               
                 <tr>
-                  <td>token</td>
-                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Token is the updated token </p></td>
+                  <td><p>Login of the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -13139,105 +13021,15 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateResponse">TokenServiceUpdateResponse
 
         
       
-
-      
-        <h3 id="metalstack.api.v2.TokenType">TokenType</h3>
-        <p>TokenType specifies different use cases of tokens</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>TOKEN_TYPE_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p>TOKEN_TYPE_UNSPECIFIED is not specified</p></td>
-              </tr>
-            
-              <tr>
-                <td>TOKEN_TYPE_API</td>
-                <td>1</td>
-                <td><p>TOKEN_TYPE_API is a token for api usage</p></td>
-              </tr>
-            
-              <tr>
-                <td>TOKEN_TYPE_USER</td>
-                <td>2</td>
-                <td><p>TOKEN_TYPE_USER is a token to access the api with cli, a web application or other user induced actions.</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-
-      
-
-      
-        <h3 id="metalstack.api.v2.TokenService">TokenService</h3>
-        <p>TokenService serves token related functions</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>Get</td>
-                <td><a href="#metalstack.api.v2.TokenServiceGetRequest">TokenServiceGetRequest</a></td>
-                <td><a href="#metalstack.api.v2.TokenServiceGetResponse">TokenServiceGetResponse</a></td>
-                <td><p>Get a token</p></td>
-              </tr>
-            
-              <tr>
-                <td>Create</td>
-                <td><a href="#metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</a></td>
-                <td><a href="#metalstack.api.v2.TokenServiceCreateResponse">TokenServiceCreateResponse</a></td>
-                <td><p>Create a token to authenticate against the platform, the secret will be only visible in the response.</p></td>
-              </tr>
-            
-              <tr>
-                <td>Update</td>
-                <td><a href="#metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</a></td>
-                <td><a href="#metalstack.api.v2.TokenServiceUpdateResponse">TokenServiceUpdateResponse</a></td>
-                <td><p>Update a token</p></td>
-              </tr>
-            
-              <tr>
-                <td>List</td>
-                <td><a href="#metalstack.api.v2.TokenServiceListRequest">TokenServiceListRequest</a></td>
-                <td><a href="#metalstack.api.v2.TokenServiceListResponse">TokenServiceListResponse</a></td>
-                <td><p>List all your tokens</p></td>
-              </tr>
-            
-              <tr>
-                <td>Revoke</td>
-                <td><a href="#metalstack.api.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</a></td>
-                <td><a href="#metalstack.api.v2.TokenServiceRevokeResponse">TokenServiceRevokeResponse</a></td>
-                <td><p>Revoke a token, no further usage is possible afterwards</p></td>
-              </tr>
-            
-              <tr>
-                <td>Refresh</td>
-                <td><a href="#metalstack.api.v2.TokenServiceRefreshRequest">TokenServiceRefreshRequest</a></td>
-                <td><a href="#metalstack.api.v2.TokenServiceRefreshResponse">TokenServiceRefreshResponse</a></td>
-                <td><p>Refresh a token, this will create a new token with the exact same permissions as the calling token contains</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
+        <h3 id="metalstack.api.v2.TenantServiceLeaveResponse">TenantServiceLeaveResponse</h3>
+        <p>TenantServiceLeaveTenantResponse is the response payload to a leave tenant request</p>
 
         
-    
-      
-      <div class="file-heading">
-        <h2 id="metalstack/admin/v2/token.proto">metalstack/admin/v2/token.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
 
+        
       
-        <h3 id="metalstack.admin.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</h3>
-        <p>TokenServiceCreateRequest is the request payload to create a token</p>
+        <h3 id="metalstack.api.v2.TenantServiceListRequest">TenantServiceListRequest</h3>
+        <p>TenantServiceListRequest is the request payload of the tenant list request</p>
 
         
           <table class="field-table">
@@ -13247,17 +13039,24 @@ <h3 id="metalstack.admin.v2.TokenServiceCreateRequest">TokenServiceCreateRequest
             <tbody>
               
                 <tr>
-                  <td>user</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td>optional</td>
-                  <td><p>User this token should be created for, if omitted, user is derived from caller </p></td>
+                  <td><p>Id filters tenants by id </p></td>
                 </tr>
               
                 <tr>
-                  <td>token_create_request</td>
-                  <td><a href="#metalstack.api.v2.TokenServiceCreateRequest">metalstack.api.v2.TokenServiceCreateRequest</a></td>
-                  <td></td>
-                  <td><p>TokenCreateRequest which should be created </p></td>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Name filters tenants by name </p></td>
+                </tr>
+              
+                <tr>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
+                  <td>optional</td>
+                  <td><p>Labels lists only projects containing the given labels </p></td>
                 </tr>
               
             </tbody>
@@ -13267,8 +13066,8 @@ <h3 id="metalstack.admin.v2.TokenServiceCreateRequest">TokenServiceCreateRequest
 
         
       
-        <h3 id="metalstack.admin.v2.TokenServiceCreateResponse">TokenServiceCreateResponse</h3>
-        <p>TokenServiceCreateResponse is the response payload of a token create request</p>
+        <h3 id="metalstack.api.v2.TenantServiceListResponse">TenantServiceListResponse</h3>
+        <p>TenantServiceListResponse is the response payload of the tenant list request</p>
 
         
           <table class="field-table">
@@ -13278,17 +13077,41 @@ <h3 id="metalstack.admin.v2.TokenServiceCreateResponse">TokenServiceCreateRespon
             <tbody>
               
                 <tr>
-                  <td>token</td>
-                  <td><a href="#metalstack.api.v2.Token">metalstack.api.v2.Token</a></td>
+                  <td>tenants</td>
+                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
+                  <td>repeated</td>
+                  <td><p>Tenants is the list of tenants </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.TenantServiceRemoveMemberRequest">TenantServiceRemoveMemberRequest</h3>
+        <p>TenantServiceRemoveMemberRequest is used to remove a member from a tenant</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Token which was created </p></td>
+                  <td><p>Login of the tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>secret</td>
+                  <td>member</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Secret is the body if the jwt token, should be used in api requests as bearer token </p></td>
+                  <td><p>Member is the id of the member to remove from this tenant </p></td>
                 </tr>
               
             </tbody>
@@ -13298,8 +13121,15 @@ <h3 id="metalstack.admin.v2.TokenServiceCreateResponse">TokenServiceCreateRespon
 
         
       
-        <h3 id="metalstack.admin.v2.TokenServiceListRequest">TokenServiceListRequest</h3>
-        <p>TokenServiceListRequest is the request payload for the token list request</p>
+        <h3 id="metalstack.api.v2.TenantServiceRemoveMemberResponse">TenantServiceRemoveMemberResponse</h3>
+        <p>TenantServiceRemoveMemberResponse is the response payload to a remove member request</p>
+
+        
+
+        
+      
+        <h3 id="metalstack.api.v2.TenantServiceUpdateMemberRequest">TenantServiceUpdateMemberRequest</h3>
+        <p>TenantServiceUpdateMemberRequest is used to update a member from a tenant</p>
 
         
           <table class="field-table">
@@ -13309,10 +13139,24 @@ <h3 id="metalstack.admin.v2.TokenServiceListRequest">TokenServiceListRequest</h3
             <tbody>
               
                 <tr>
-                  <td>user</td>
+                  <td>login</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>User is the id of the user for which the tokens should be listed </p></td>
+                  <td></td>
+                  <td><p>Login of the tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>member</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Member is the id of the member to update in this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
+                  <td></td>
+                  <td><p>Role of this user in this tenant </p></td>
                 </tr>
               
             </tbody>
@@ -13322,8 +13166,8 @@ <h3 id="metalstack.admin.v2.TokenServiceListRequest">TokenServiceListRequest</h3
 
         
       
-        <h3 id="metalstack.admin.v2.TokenServiceListResponse">TokenServiceListResponse</h3>
-        <p>TokenServiceListResponse is the response payload for the token list request</p>
+        <h3 id="metalstack.api.v2.TenantServiceUpdateMemberResponse">TenantServiceUpdateMemberResponse</h3>
+        <p>TenantServiceUpdateMemberResponse is the response payload to a update member request</p>
 
         
           <table class="field-table">
@@ -13333,10 +13177,10 @@ <h3 id="metalstack.admin.v2.TokenServiceListResponse">TokenServiceListResponse</
             <tbody>
               
                 <tr>
-                  <td>tokens</td>
-                  <td><a href="#metalstack.api.v2.Token">metalstack.api.v2.Token</a></td>
-                  <td>repeated</td>
-                  <td><p>Tokens is the list of tokens </p></td>
+                  <td>tenant_member</td>
+                  <td><a href="#metalstack.api.v2.TenantMember">TenantMember</a></td>
+                  <td></td>
+                  <td><p>TenantMember is the updated membership </p></td>
                 </tr>
               
             </tbody>
@@ -13346,8 +13190,8 @@ <h3 id="metalstack.admin.v2.TokenServiceListResponse">TokenServiceListResponse</
 
         
       
-        <h3 id="metalstack.admin.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</h3>
-        <p>TokenServiceRevokeRequest is the request payload for the token revoke request</p>
+        <h3 id="metalstack.api.v2.TenantServiceUpdateRequest">TenantServiceUpdateRequest</h3>
+        <p>TenantServiceUpdateRequest is the request payload of the tenant update request</p>
 
         
           <table class="field-table">
@@ -13357,17 +13201,52 @@ <h3 id="metalstack.admin.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest
             <tbody>
               
                 <tr>
-                  <td>uuid</td>
+                  <td>login</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Uuid is the uuid of the token which should be revoked </p></td>
+                  <td><p>Login of the tenant </p></td>
                 </tr>
               
                 <tr>
-                  <td>user</td>
-                  <td><a href="#string">string</a></td>
+                  <td>update_meta</td>
+                  <td><a href="#metalstack.api.v2.UpdateMeta">UpdateMeta</a></td>
                   <td></td>
-                  <td><p>User is the id of the user for which the token should be revoked </p></td>
+                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Name of the tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>email</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Email of the tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Description of this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>avatar_url</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>AvatarUrl of the tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.UpdateLabels">UpdateLabels</a></td>
+                  <td>optional</td>
+                  <td><p>Labels on the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -13377,10 +13256,27 @@ <h3 id="metalstack.admin.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest
 
         
       
-        <h3 id="metalstack.admin.v2.TokenServiceRevokeResponse">TokenServiceRevokeResponse</h3>
-        <p>TokenServiceRevokeResponse is the response payload for the token revoke request</p>
+        <h3 id="metalstack.api.v2.TenantServiceUpdateResponse">TenantServiceUpdateResponse</h3>
+        <p>TenantServiceUpdateResponse is the response payload of the tenant update request</p>
 
         
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>tenant</td>
+                  <td><a href="#metalstack.api.v2.Tenant">Tenant</a></td>
+                  <td></td>
+                  <td><p>Tenant is the tenant </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
 
         
       
@@ -13390,34 +13286,103 @@ <h3 id="metalstack.admin.v2.TokenServiceRevokeResponse">TokenServiceRevokeRespon
       
 
       
-        <h3 id="metalstack.admin.v2.TokenService">TokenService</h3>
-        <p>TokenService serves token related functions</p>
+        <h3 id="metalstack.api.v2.TenantService">TenantService</h3>
+        <p>TenantService serves tenant related functions</p>
         <table class="enum-table">
           <thead>
             <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
           </thead>
           <tbody>
             
+              <tr>
+                <td>Create</td>
+                <td><a href="#metalstack.api.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceCreateResponse">TenantServiceCreateResponse</a></td>
+                <td><p>Create a tenant</p></td>
+              </tr>
+            
               <tr>
                 <td>List</td>
-                <td><a href="#metalstack.admin.v2.TokenServiceListRequest">TokenServiceListRequest</a></td>
-                <td><a href="#metalstack.admin.v2.TokenServiceListResponse">TokenServiceListResponse</a></td>
-                <td><p>List tokens</p></td>
+                <td><a href="#metalstack.api.v2.TenantServiceListRequest">TenantServiceListRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceListResponse">TenantServiceListResponse</a></td>
+                <td><p>List tenants</p></td>
+              </tr>
+            
+              <tr>
+                <td>Get</td>
+                <td><a href="#metalstack.api.v2.TenantServiceGetRequest">TenantServiceGetRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceGetResponse">TenantServiceGetResponse</a></td>
+                <td><p>Get a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>Update</td>
+                <td><a href="#metalstack.api.v2.TenantServiceUpdateRequest">TenantServiceUpdateRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceUpdateResponse">TenantServiceUpdateResponse</a></td>
+                <td><p>Update a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>Delete</td>
+                <td><a href="#metalstack.api.v2.TenantServiceDeleteRequest">TenantServiceDeleteRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceDeleteResponse">TenantServiceDeleteResponse</a></td>
+                <td><p>Delete a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>Leave</td>
+                <td><a href="#metalstack.api.v2.TenantServiceLeaveRequest">TenantServiceLeaveRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceLeaveResponse">TenantServiceLeaveResponse</a></td>
+                <td><p>Leave remove a member of a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>RemoveMember</td>
+                <td><a href="#metalstack.api.v2.TenantServiceRemoveMemberRequest">TenantServiceRemoveMemberRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceRemoveMemberResponse">TenantServiceRemoveMemberResponse</a></td>
+                <td><p>RemoveMember remove a member of a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>UpdateMember</td>
+                <td><a href="#metalstack.api.v2.TenantServiceUpdateMemberRequest">TenantServiceUpdateMemberRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceUpdateMemberResponse">TenantServiceUpdateMemberResponse</a></td>
+                <td><p>UpdateMember update a member of a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>Invite</td>
+                <td><a href="#metalstack.api.v2.TenantServiceInviteRequest">TenantServiceInviteRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceInviteResponse">TenantServiceInviteResponse</a></td>
+                <td><p>Invite a user to a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>InviteAccept</td>
+                <td><a href="#metalstack.api.v2.TenantServiceInviteAcceptRequest">TenantServiceInviteAcceptRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceInviteAcceptResponse">TenantServiceInviteAcceptResponse</a></td>
+                <td><p>InviteAccept is called from a user to accept an invitation</p></td>
               </tr>
             
               <tr>
-                <td>Revoke</td>
-                <td><a href="#metalstack.admin.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</a></td>
-                <td><a href="#metalstack.admin.v2.TokenServiceRevokeResponse">TokenServiceRevokeResponse</a></td>
-                <td><p>Revoke a token</p></td>
+                <td>InviteDelete</td>
+                <td><a href="#metalstack.api.v2.TenantServiceInviteDeleteRequest">TenantServiceInviteDeleteRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceInviteDeleteResponse">TenantServiceInviteDeleteResponse</a></td>
+                <td><p>InviteDelete deletes a pending invitation</p></td>
               </tr>
             
               <tr>
-                <td>Create</td>
-                <td><a href="#metalstack.admin.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</a></td>
-                <td><a href="#metalstack.admin.v2.TokenServiceCreateResponse">TokenServiceCreateResponse</a></td>
-                <td><p>Create a token to authenticate against the platform, the secret will be only visible in the response.
-This service is suitable to create tokens for other users instead of deriving users from tokens directly.</p></td>
+                <td>InvitesList</td>
+                <td><a href="#metalstack.api.v2.TenantServiceInvitesListRequest">TenantServiceInvitesListRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceInvitesListResponse">TenantServiceInvitesListResponse</a></td>
+                <td><p>InvitesList list all invites to a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>InviteGet</td>
+                <td><a href="#metalstack.api.v2.TenantServiceInviteGetRequest">TenantServiceInviteGetRequest</a></td>
+                <td><a href="#metalstack.api.v2.TenantServiceInviteGetResponse">TenantServiceInviteGetResponse</a></td>
+                <td><p>InviteGet get an invite</p></td>
               </tr>
             
           </tbody>
@@ -13427,13 +13392,13 @@ <h3 id="metalstack.admin.v2.TokenService">TokenService</h3>
     
       
       <div class="file-heading">
-        <h2 id="metalstack/api/v2/health.proto">metalstack/api/v2/health.proto</h2><a href="#title">Top</a>
+        <h2 id="metalstack/admin/v2/tenant.proto">metalstack/admin/v2/tenant.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
       
-        <h3 id="metalstack.api.v2.Health">Health</h3>
-        <p>Health reports the health status of all services</p>
+        <h3 id="metalstack.admin.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</h3>
+        <p>TenantServiceCreateRequest is the request payload of the tenant create request</p>
 
         
           <table class="field-table">
@@ -13443,10 +13408,31 @@ <h3 id="metalstack.api.v2.Health">Health</h3>
             <tbody>
               
                 <tr>
-                  <td>services</td>
-                  <td><a href="#metalstack.api.v2.HealthStatus">HealthStatus</a></td>
-                  <td>repeated</td>
-                  <td><p>Services the health of all individual services </p></td>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Name of this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Description of this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>email</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Email of the tenant, if not set will be inherited from the creator </p></td>
+                </tr>
+              
+                <tr>
+                  <td>avatar_url</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>AvatarUrl of the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -13456,15 +13442,8 @@ <h3 id="metalstack.api.v2.Health">Health</h3>
 
         
       
-        <h3 id="metalstack.api.v2.HealthServiceGetRequest">HealthServiceGetRequest</h3>
-        <p>HealthServiceGetRequest is request payload to get the health of the system</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.HealthServiceGetResponse">HealthServiceGetResponse</h3>
-        <p>HealthServiceGetRequest is the response payload with the health of the system</p>
+        <h3 id="metalstack.admin.v2.TenantServiceCreateResponse">TenantServiceCreateResponse</h3>
+        <p>TenantServiceCreateResponse is the response payload of the tenant create request</p>
 
         
           <table class="field-table">
@@ -13474,10 +13453,10 @@ <h3 id="metalstack.api.v2.HealthServiceGetResponse">HealthServiceGetResponse</h3
             <tbody>
               
                 <tr>
-                  <td>health</td>
-                  <td><a href="#metalstack.api.v2.Health">Health</a></td>
+                  <td>tenant</td>
+                  <td><a href="#metalstack.api.v2.Tenant">metalstack.api.v2.Tenant</a></td>
                   <td></td>
-                  <td><p>Health is the overall health of the system </p></td>
+                  <td><p>Tenant is the tenant </p></td>
                 </tr>
               
             </tbody>
@@ -13487,8 +13466,8 @@ <h3 id="metalstack.api.v2.HealthServiceGetResponse">HealthServiceGetResponse</h3
 
         
       
-        <h3 id="metalstack.api.v2.HealthStatus">HealthStatus</h3>
-        <p>HealthStatus the health of one service</p>
+        <h3 id="metalstack.admin.v2.TenantServiceListRequest">TenantServiceListRequest</h3>
+        <p>TenantServiceListRequest is the request payload for a tenant list request</p>
 
         
           <table class="field-table">
@@ -13498,62 +13477,31 @@ <h3 id="metalstack.api.v2.HealthStatus">HealthStatus</h3>
             <tbody>
               
                 <tr>
-                  <td>name</td>
-                  <td><a href="#metalstack.api.v2.Service">Service</a></td>
-                  <td></td>
-                  <td><p>Name the name of the service </p></td>
-                </tr>
-              
-                <tr>
-                  <td>status</td>
-                  <td><a href="#metalstack.api.v2.ServiceStatus">ServiceStatus</a></td>
-                  <td></td>
-                  <td><p>Status the status of this service </p></td>
-                </tr>
-              
-                <tr>
-                  <td>message</td>
+                  <td>login</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Message describes the reason for the unhealthy status if possible </p></td>
+                  <td>optional</td>
+                  <td><p>Login of the tenant to list </p></td>
                 </tr>
               
                 <tr>
-                  <td>partitions</td>
-                  <td><a href="#metalstack.api.v2.HealthStatus.PartitionsEntry">HealthStatus.PartitionsEntry</a></td>
-                  <td>repeated</td>
-                  <td><p>Partitions describes the health of the service by partition </p></td>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Name of the tenant to list </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.HealthStatus.PartitionsEntry">HealthStatus.PartitionsEntry</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>key</td>
+                  <td>email</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
+                  <td>optional</td>
+                  <td><p>Email of the tenant to list </p></td>
                 </tr>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#metalstack.api.v2.PartitionHealth">PartitionHealth</a></td>
+                  <td>paging</td>
+                  <td><a href="#metalstack.api.v2.Paging">metalstack.api.v2.Paging</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Paging details for the list request </p></td>
                 </tr>
               
             </tbody>
@@ -13563,8 +13511,8 @@ <h3 id="metalstack.api.v2.HealthStatus.PartitionsEntry">HealthStatus.PartitionsE
 
         
       
-        <h3 id="metalstack.api.v2.PartitionHealth">PartitionHealth</h3>
-        <p>PartitionHealth the status of a specific service in this partition</p>
+        <h3 id="metalstack.admin.v2.TenantServiceListResponse">TenantServiceListResponse</h3>
+        <p>TenantServiceListResponse is the response payload for a tenant list request</p>
 
         
           <table class="field-table">
@@ -13574,17 +13522,17 @@ <h3 id="metalstack.api.v2.PartitionHealth">PartitionHealth</h3>
             <tbody>
               
                 <tr>
-                  <td>status</td>
-                  <td><a href="#metalstack.api.v2.ServiceStatus">ServiceStatus</a></td>
-                  <td></td>
-                  <td><p>Status the health status of the service in this partition </p></td>
+                  <td>tenants</td>
+                  <td><a href="#metalstack.api.v2.Tenant">metalstack.api.v2.Tenant</a></td>
+                  <td>repeated</td>
+                  <td><p>Tenants are the list of tenants </p></td>
                 </tr>
               
                 <tr>
-                  <td>message</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Message describes the reason for the unhealthy status if possible </p></td>
+                  <td>next_page</td>
+                  <td><a href="#uint64">uint64</a></td>
+                  <td>optional</td>
+                  <td><p>NextPage is used for pagination, returns the next page to be fetched and must then be provided in the list request. </p></td>
                 </tr>
               
             </tbody>
@@ -13596,100 +13544,12 @@ <h3 id="metalstack.api.v2.PartitionHealth">PartitionHealth</h3>
       
 
       
-        <h3 id="metalstack.api.v2.Service">Service</h3>
-        <p>Service defines the service for which the healtyness is reported</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SERVICE_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p>SERVICE_UNSPECIFIED is a unknown service</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_IPAM</td>
-                <td>1</td>
-                <td><p>SERVICE_IPAM the ipam service</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_RETHINK</td>
-                <td>2</td>
-                <td><p>SERVICE_RETHINK the rethinkdb</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_MASTERDATA</td>
-                <td>3</td>
-                <td><p>SERVICE_MASTERDATA the masterdata-api</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_MACHINES</td>
-                <td>4</td>
-                <td><p>SERVICE_MACHINES the machine service</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_AUDIT</td>
-                <td>5</td>
-                <td><p>SERVICE_AUDIT the auditing</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_VPN</td>
-                <td>6</td>
-                <td><p>SERVICE_VPN the vpn service</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-        <h3 id="metalstack.api.v2.ServiceStatus">ServiceStatus</h3>
-        <p>ServiceStatus defines the status of a service</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SERVICE_STATUS_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p>SERVICE_STATUS_UNSPECIFIED service status is not known or unspecified</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_STATUS_DEGRADED</td>
-                <td>1</td>
-                <td><p>SERVICE_STATUS_DEGRADED the service is in degraded status, not the whole functionality is available</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_STATUS_UNHEALTHY</td>
-                <td>2</td>
-                <td><p>SERVICE_STATUS_UNHEALTHY the service is in unhealthy status, serious impact is expected</p></td>
-              </tr>
-            
-              <tr>
-                <td>SERVICE_STATUS_HEALTHY</td>
-                <td>3</td>
-                <td><p>SERVICE_STATUS_HEALTHY the service is in healthy status e.g. fully functional</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
 
       
 
       
-        <h3 id="metalstack.api.v2.HealthService">HealthService</h3>
-        <p>HealthService serves health related functions</p>
+        <h3 id="metalstack.admin.v2.TenantService">TenantService</h3>
+        <p>TenantService serves tenant related functions</p>
         <table class="enum-table">
           <thead>
             <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
@@ -13697,10 +13557,17 @@ <h3 id="metalstack.api.v2.HealthService">HealthService</h3>
           <tbody>
             
               <tr>
-                <td>Get</td>
-                <td><a href="#metalstack.api.v2.HealthServiceGetRequest">HealthServiceGetRequest</a></td>
-                <td><a href="#metalstack.api.v2.HealthServiceGetResponse">HealthServiceGetResponse</a></td>
-                <td><p>Get the health of the platform</p></td>
+                <td>Create</td>
+                <td><a href="#metalstack.admin.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</a></td>
+                <td><a href="#metalstack.admin.v2.TenantServiceCreateResponse">TenantServiceCreateResponse</a></td>
+                <td><p>Create a tenant</p></td>
+              </tr>
+            
+              <tr>
+                <td>List</td>
+                <td><a href="#metalstack.admin.v2.TenantServiceListRequest">TenantServiceListRequest</a></td>
+                <td><a href="#metalstack.admin.v2.TenantServiceListResponse">TenantServiceListResponse</a></td>
+                <td><p>List all tenants</p></td>
               </tr>
             
           </tbody>
@@ -13710,20 +13577,13 @@ <h3 id="metalstack.api.v2.HealthService">HealthService</h3>
     
       
       <div class="file-heading">
-        <h2 id="metalstack/api/v2/method.proto">metalstack/api/v2/method.proto</h2><a href="#title">Top</a>
+        <h2 id="metalstack/api/v2/token.proto">metalstack/api/v2/token.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
       
-        <h3 id="metalstack.api.v2.MethodServiceListRequest">MethodServiceListRequest</h3>
-        <p>MethodServiceListRequest is the request payload to list all public methods</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.MethodServiceListResponse">MethodServiceListResponse</h3>
-        <p>MethodServiceListResponse is the response payload with all public visible methods</p>
+        <h3 id="metalstack.api.v2.MethodPermission">MethodPermission</h3>
+        <p>MethodPermission is a mapping from a subject/project to a service method</p>
 
         
           <table class="field-table">
@@ -13732,11 +13592,23 @@ <h3 id="metalstack.api.v2.MethodServiceListResponse">MethodServiceListResponse</
             </thead>
             <tbody>
               
+                <tr>
+                  <td>subject</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Subject maybe either the project or the tenant
+for which the methods should be allowed
+
+asterisk (*) can be specified to match any subject
+empty string (&#34;&#34;) can be specified for requests that do not require a subject, e.g. partition list
+otherwise either a projectid or a tenant login should be specified </p></td>
+                </tr>
+              
                 <tr>
                   <td>methods</td>
                   <td><a href="#string">string</a></td>
                   <td>repeated</td>
-                  <td><p>Methods is a list of methods public callable </p></td>
+                  <td><p>Methods which should be accessible </p></td>
                 </tr>
               
             </tbody>
@@ -13746,15 +13618,8 @@ <h3 id="metalstack.api.v2.MethodServiceListResponse">MethodServiceListResponse</
 
         
       
-        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListRequest">MethodServiceTokenScopedListRequest</h3>
-        <p>MethodServiceTokenScopedListRequest is the request payload to list all methods callable with the token present in the request</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse">MethodServiceTokenScopedListResponse</h3>
-        <p>MethodServiceTokenScopedListResponse is the response payload which contains all methods which are callable with the given token</p>
+        <h3 id="metalstack.api.v2.Token">Token</h3>
+        <p>Token generates a jwt authentication token to access the api</p><p>There are two different types of tokens, api- and user- tokens</p><p>A user token is used to authenticate end user requests for example from a cli.</p><p>The configured roles in a user token are expanded in the api server</p><p>based on the memberships in other projects and tenants based on the role granted there.</p><p>User tokens will never contain permissions.</p><p>Permissions are always derived from the tenant and project roles and memberships.</p><p>The api token should be used to authenticate services.</p><p>In contrast to a user token, the api token permissions and roles apply as configured during the token create process.</p>
 
         
           <table class="field-table">
@@ -13763,23 +13628,72 @@ <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse">MethodServiceTok
             </thead>
             <tbody>
               
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Uuid of the jwt token, used to reference it by revoke </p></td>
+                </tr>
+              
+                <tr>
+                  <td>user</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>User who created this token </p></td>
+                </tr>
+              
+                <tr>
+                  <td>meta</td>
+                  <td><a href="#metalstack.api.v2.Meta">Meta</a></td>
+                  <td></td>
+                  <td><p>Meta for this token </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Description is a user given description of this token. </p></td>
+                </tr>
+              
                 <tr>
                   <td>permissions</td>
                   <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
                   <td>repeated</td>
-                  <td><p>Permissions a list of methods which can be called </p></td>
+                  <td><p>Permissions is a list of service methods this token can be used for </p></td>
+                </tr>
+              
+                <tr>
+                  <td>expires</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>Expires gives the date in the future after which this token can not be used anymore </p></td>
+                </tr>
+              
+                <tr>
+                  <td>issued_at</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>IssuedAt gives the date when this token was created </p></td>
+                </tr>
+              
+                <tr>
+                  <td>token_type</td>
+                  <td><a href="#metalstack.api.v2.TokenType">TokenType</a></td>
+                  <td></td>
+                  <td><p>TokenType describes the type of this token </p></td>
                 </tr>
               
                 <tr>
                   <td>project_roles</td>
-                  <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry">MethodServiceTokenScopedListResponse.ProjectRolesEntry</a></td>
+                  <td><a href="#metalstack.api.v2.Token.ProjectRolesEntry">Token.ProjectRolesEntry</a></td>
                   <td>repeated</td>
                   <td><p>ProjectRoles associates a project id with the corresponding role of the token owner </p></td>
                 </tr>
               
                 <tr>
                   <td>tenant_roles</td>
-                  <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry">MethodServiceTokenScopedListResponse.TenantRolesEntry</a></td>
+                  <td><a href="#metalstack.api.v2.Token.TenantRolesEntry">Token.TenantRolesEntry</a></td>
                   <td>repeated</td>
                   <td><p>TenantRoles associates a tenant id with the corresponding role of the token owner </p></td>
                 </tr>
@@ -13805,7 +13719,7 @@ <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse">MethodServiceTok
 
         
       
-        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry">MethodServiceTokenScopedListResponse.ProjectRolesEntry</h3>
+        <h3 id="metalstack.api.v2.Token.ProjectRolesEntry">Token.ProjectRolesEntry</h3>
         <p></p>
 
         
@@ -13836,7 +13750,7 @@ <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry
 
         
       
-        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry">MethodServiceTokenScopedListResponse.TenantRolesEntry</h3>
+        <h3 id="metalstack.api.v2.Token.TenantRolesEntry">Token.TenantRolesEntry</h3>
         <p></p>
 
         
@@ -13867,48 +13781,8 @@ <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry"
 
         
       
-
-      
-
-      
-
-      
-        <h3 id="metalstack.api.v2.MethodService">MethodService</h3>
-        <p>MethodService serves method related functions</p><p>methods are functions in services</p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>List</td>
-                <td><a href="#metalstack.api.v2.MethodServiceListRequest">MethodServiceListRequest</a></td>
-                <td><a href="#metalstack.api.v2.MethodServiceListResponse">MethodServiceListResponse</a></td>
-                <td><p>List all public visible methods</p></td>
-              </tr>
-            
-              <tr>
-                <td>TokenScopedList</td>
-                <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListRequest">MethodServiceTokenScopedListRequest</a></td>
-                <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse">MethodServiceTokenScopedListResponse</a></td>
-                <td><p>TokenScopedList all methods callable with the token present in the request</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-
-        
-    
-      
-      <div class="file-heading">
-        <h2 id="metalstack/api/v2/project.proto">metalstack/api/v2/project.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
-
-      
-        <h3 id="metalstack.api.v2.Project">Project</h3>
-        <p>Project defines a group of resources belonging to a tenant</p><p>a tenant can have multiple projects</p>
+        <h3 id="metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</h3>
+        <p>TokenServiceCreateRequest is the request payload to create a token</p>
 
         
           <table class="field-table">
@@ -13918,45 +13792,59 @@ <h3 id="metalstack.api.v2.Project">Project</h3>
             <tbody>
               
                 <tr>
-                  <td>uuid</td>
+                  <td>description</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Uuid of this project </p></td>
+                  <td><p>Description of the token </p></td>
                 </tr>
               
                 <tr>
-                  <td>meta</td>
-                  <td><a href="#metalstack.api.v2.Meta">Meta</a></td>
-                  <td></td>
-                  <td><p>Meta for this project </p></td>
+                  <td>permissions</td>
+                  <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
+                  <td>repeated</td>
+                  <td><p>Permissions is a list of service methods this token can be used for </p></td>
                 </tr>
               
                 <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
+                  <td>expires</td>
+                  <td><a href="#google.protobuf.Duration">google.protobuf.Duration</a></td>
                   <td></td>
-                  <td><p>Name of this project must be unique per tenant </p></td>
+                  <td><p>Expires gives the duration since now, after which this token can not be used anymore </p></td>
                 </tr>
               
                 <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Description of this project </p></td>
+                  <td>project_roles</td>
+                  <td><a href="#metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry">TokenServiceCreateRequest.ProjectRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>ProjectRoles associates a project id with the corresponding role of the token owner </p></td>
                 </tr>
               
                 <tr>
-                  <td>tenant</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Tenant this project belongs to </p></td>
+                  <td>tenant_roles</td>
+                  <td><a href="#metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry">TokenServiceCreateRequest.TenantRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>TenantRoles associates a tenant id with the corresponding role of the token owner </p></td>
                 </tr>
               
                 <tr>
-                  <td>avatar_url</td>
-                  <td><a href="#string">string</a></td>
+                  <td>admin_role</td>
+                  <td><a href="#metalstack.api.v2.AdminRole">AdminRole</a></td>
                   <td>optional</td>
-                  <td><p>AvatarUrl of the Project </p></td>
+                  <td><p>AdminRole defines the admin role of the token owner </p></td>
+                </tr>
+              
+                <tr>
+                  <td>infra_role</td>
+                  <td><a href="#metalstack.api.v2.InfraRole">InfraRole</a></td>
+                  <td>optional</td>
+                  <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
+                </tr>
+              
+                <tr>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
+                  <td></td>
+                  <td><p>Labels on this token </p></td>
                 </tr>
               
             </tbody>
@@ -13966,8 +13854,8 @@ <h3 id="metalstack.api.v2.Project">Project</h3>
 
         
       
-        <h3 id="metalstack.api.v2.ProjectInvite">ProjectInvite</h3>
-        <p>ProjectInvite defines invite to project</p>
+        <h3 id="metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry">TokenServiceCreateRequest.ProjectRolesEntry</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -13977,66 +13865,17 @@ <h3 id="metalstack.api.v2.ProjectInvite">ProjectInvite</h3>
             <tbody>
               
                 <tr>
-                  <td>secret</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Secret is the secret part of the invite, typically part of the url </p></td>
-                </tr>
-              
-                <tr>
-                  <td>project</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Project is the project id for which this invite was created </p></td>
-                </tr>
-              
-                <tr>
-                  <td>role</td>
-                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
-                  <td></td>
-                  <td><p>Role is the role in this project the user will get after accepting the invitation </p></td>
-                </tr>
-              
-                <tr>
-                  <td>joined</td>
-                  <td><a href="#bool">bool</a></td>
-                  <td></td>
-                  <td><p>Joined is false as long as a user has not accepted the invite </p></td>
-                </tr>
-              
-                <tr>
-                  <td>project_name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>ProjectName is the project name for which this invite was created </p></td>
-                </tr>
-              
-                <tr>
-                  <td>tenant</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Tenant is the login of tenant who invites to join this project </p></td>
-                </tr>
-              
-                <tr>
-                  <td>tenant_name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>TenantName is the name of tenant who invites to join this project </p></td>
-                </tr>
-              
-                <tr>
-                  <td>expires_at</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>ExpiresAt the date when this invite expires </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>joined_at</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
                   <td></td>
-                  <td><p>JoinedAt the date when the member accepted this invite </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14046,8 +13885,8 @@ <h3 id="metalstack.api.v2.ProjectInvite">ProjectInvite</h3>
 
         
       
-        <h3 id="metalstack.api.v2.ProjectMember">ProjectMember</h3>
-        <p>ProjectMember defines a user that participates at a project</p>
+        <h3 id="metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry">TokenServiceCreateRequest.TenantRolesEntry</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -14057,33 +13896,48 @@ <h3 id="metalstack.api.v2.ProjectMember">ProjectMember</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>key</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Id is the user id of the member </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>role</td>
-                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
                   <td></td>
-                  <td><p>Role is the role of the member </p></td>
+                  <td><p> </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.TokenServiceCreateResponse">TokenServiceCreateResponse</h3>
+        <p>TokenServiceCreateResponse is the response payload of a token create request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>inherited_membership</td>
-                  <td><a href="#bool">bool</a></td>
+                  <td>token</td>
+                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
                   <td></td>
-                  <td><p>InheritedMembership indicates that this member has implicit permissions on the project through his membership within the tenant.
-This member does not have direct project membership but gains permissions on this project from the role he has in the tenant.
-Inherited memberships are not included in member lists for users with guest permission but only for direct tenant members. </p></td>
+                  <td><p>Token which was created </p></td>
                 </tr>
               
                 <tr>
-                  <td>created_at</td>
-                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td>secret</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>CreatedAt the date when the member was added to the project </p></td>
+                  <td><p>Secret is the body if the jwt token, should be used in api requests as bearer token </p></td>
                 </tr>
               
             </tbody>
@@ -14093,8 +13947,8 @@ <h3 id="metalstack.api.v2.ProjectMember">ProjectMember</h3>
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceCreateRequest">ProjectServiceCreateRequest</h3>
-        <p>ProjectServiceCreateRequest is the request payload to Create a project</p>
+        <h3 id="metalstack.api.v2.TokenServiceGetRequest">TokenServiceGetRequest</h3>
+        <p>TokenServiceGetRequest is the request payload of a token get request</p>
 
         
           <table class="field-table">
@@ -14104,39 +13958,65 @@ <h3 id="metalstack.api.v2.ProjectServiceCreateRequest">ProjectServiceCreateReque
             <tbody>
               
                 <tr>
-                  <td>login</td>
+                  <td>uuid</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Login is the tenant of this project
-TODO: is login really a good name? </p></td>
+                  <td><p>Uuid of the token to get </p></td>
                 </tr>
               
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Name of this project, unique per tenant </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.TokenServiceGetResponse">TokenServiceGetResponse</h3>
+        <p>TokenServiceGetResponse is the response payload of a token get request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
+                  <td>token</td>
+                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
                   <td></td>
-                  <td><p>Description of this project </p></td>
+                  <td><p>Token is the token </p></td>
                 </tr>
               
-                <tr>
-                  <td>avatar_url</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Avatar URL of the project </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.TokenServiceListRequest">TokenServiceListRequest</h3>
+        <p>TokenServiceListRequest is the request payload to list tokens</p>
+
+        
+
+        
+      
+        <h3 id="metalstack.api.v2.TokenServiceListResponse">TokenServiceListResponse</h3>
+        <p>TokenServiceListResponse is the response payload of a token list request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
-                  <td></td>
-                  <td><p>Labels on the project </p></td>
+                  <td>tokens</td>
+                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
+                  <td>repeated</td>
+                  <td><p>Tokens is a list of tokens without the secrets </p></td>
                 </tr>
               
             </tbody>
@@ -14146,8 +14026,15 @@ <h3 id="metalstack.api.v2.ProjectServiceCreateRequest">ProjectServiceCreateReque
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceCreateResponse">ProjectServiceCreateResponse</h3>
-        <p>ProjectServiceCreateResponse is the response payload of creation of a project</p>
+        <h3 id="metalstack.api.v2.TokenServiceRefreshRequest">TokenServiceRefreshRequest</h3>
+        <p>TokenServiceRefreshRequest is the request payload of a token refresh request</p><p>Permissions, Roles and Expiration duration and all other properties are inherited from the calling token.</p><p>The expiration duration will be calculated from the existing token (exp - iat)</p>
+
+        
+
+        
+      
+        <h3 id="metalstack.api.v2.TokenServiceRefreshResponse">TokenServiceRefreshResponse</h3>
+        <p>TokenServiceRefreshResponse is the response payload of a token refresh request</p>
 
         
           <table class="field-table">
@@ -14157,10 +14044,17 @@ <h3 id="metalstack.api.v2.ProjectServiceCreateResponse">ProjectServiceCreateResp
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
+                  <td>token</td>
+                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
                   <td></td>
-                  <td><p>Project is the project </p></td>
+                  <td><p>Token which was refreshed </p></td>
+                </tr>
+              
+                <tr>
+                  <td>secret</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Secret is the body if the jwt token, should be used in api requests as bearer token </p></td>
                 </tr>
               
             </tbody>
@@ -14170,8 +14064,8 @@ <h3 id="metalstack.api.v2.ProjectServiceCreateResponse">ProjectServiceCreateResp
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceDeleteRequest">ProjectServiceDeleteRequest</h3>
-        <p>ProjectServiceDeleteRequest is the request payload to delete a project</p>
+        <h3 id="metalstack.api.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</h3>
+        <p>TokenServiceRevokeRequest is the request payload of a token revoke request</p>
 
         
           <table class="field-table">
@@ -14181,10 +14075,10 @@ <h3 id="metalstack.api.v2.ProjectServiceDeleteRequest">ProjectServiceDeleteReque
             <tbody>
               
                 <tr>
-                  <td>project</td>
+                  <td>uuid</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Project is the uuid of the project to get </p></td>
+                  <td><p>Uuid of the token to revoke </p></td>
                 </tr>
               
             </tbody>
@@ -14194,8 +14088,15 @@ <h3 id="metalstack.api.v2.ProjectServiceDeleteRequest">ProjectServiceDeleteReque
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceDeleteResponse">ProjectServiceDeleteResponse</h3>
-        <p>ProjectServiceDeleteResponse is the response payload to delete a project</p>
+        <h3 id="metalstack.api.v2.TokenServiceRevokeResponse">TokenServiceRevokeResponse</h3>
+        <p>TokenServiceRevokeResponse is the response payload of a token revoke request</p>
+
+        
+
+        
+      
+        <h3 id="metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</h3>
+        <p>TokenServiceUpdateRequest is the request payload of a token update request</p>
 
         
           <table class="field-table">
@@ -14205,10 +14106,67 @@ <h3 id="metalstack.api.v2.ProjectServiceDeleteResponse">ProjectServiceDeleteResp
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Project is the project </p></td>
+                  <td><p>Uuid of the token to update </p></td>
+                </tr>
+              
+                <tr>
+                  <td>update_meta</td>
+                  <td><a href="#metalstack.api.v2.UpdateMeta">UpdateMeta</a></td>
+                  <td></td>
+                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request
+TokenUpdate is not guarded with optlock in the backend </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Description is a user given description of this token. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>permissions</td>
+                  <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
+                  <td>repeated</td>
+                  <td><p>Permissions is a list of service methods this token can be used for </p></td>
+                </tr>
+              
+                <tr>
+                  <td>project_roles</td>
+                  <td><a href="#metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry">TokenServiceUpdateRequest.ProjectRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>ProjectRoles associates a project id with the corresponding role of the token owner </p></td>
+                </tr>
+              
+                <tr>
+                  <td>tenant_roles</td>
+                  <td><a href="#metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry">TokenServiceUpdateRequest.TenantRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>TenantRoles associates a tenant id with the corresponding role of the token owner </p></td>
+                </tr>
+              
+                <tr>
+                  <td>admin_role</td>
+                  <td><a href="#metalstack.api.v2.AdminRole">AdminRole</a></td>
+                  <td>optional</td>
+                  <td><p>AdminRole defines the admin role of the token owner </p></td>
+                </tr>
+              
+                <tr>
+                  <td>infra_role</td>
+                  <td><a href="#metalstack.api.v2.InfraRole">InfraRole</a></td>
+                  <td>optional</td>
+                  <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
+                </tr>
+              
+                <tr>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.UpdateLabels">UpdateLabels</a></td>
+                  <td></td>
+                  <td><p>Labels on this token </p></td>
                 </tr>
               
             </tbody>
@@ -14218,8 +14176,8 @@ <h3 id="metalstack.api.v2.ProjectServiceDeleteResponse">ProjectServiceDeleteResp
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceGetRequest">ProjectServiceGetRequest</h3>
-        <p>ProjectServiceGetRequest is the request payload to get a project</p>
+        <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry">TokenServiceUpdateRequest.ProjectRolesEntry</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -14229,10 +14187,17 @@ <h3 id="metalstack.api.v2.ProjectServiceGetRequest">ProjectServiceGetRequest</h3
             <tbody>
               
                 <tr>
-                  <td>project</td>
+                  <td>key</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Project is the uuid of the project to get </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14242,8 +14207,8 @@ <h3 id="metalstack.api.v2.ProjectServiceGetRequest">ProjectServiceGetRequest</h3
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceGetResponse">ProjectServiceGetResponse</h3>
-        <p>ProjectServiceGetResponse is the response payload to get a projects</p>
+        <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry">TokenServiceUpdateRequest.TenantRolesEntry</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -14253,17 +14218,17 @@ <h3 id="metalstack.api.v2.ProjectServiceGetResponse">ProjectServiceGetResponse</
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Project is the project </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>project_members</td>
-                  <td><a href="#metalstack.api.v2.ProjectMember">ProjectMember</a></td>
-                  <td>repeated</td>
-                  <td><p>ProjectMembers in this project, projects guests will only see direct project members and not implicit memberships from tenant permissions </p></td>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14273,8 +14238,8 @@ <h3 id="metalstack.api.v2.ProjectServiceGetResponse">ProjectServiceGetResponse</
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInviteAcceptRequest">ProjectServiceInviteAcceptRequest</h3>
-        <p>ProjectServiceInviteAcceptRequest is the request payload to a accept invite request</p>
+        <h3 id="metalstack.api.v2.TokenServiceUpdateResponse">TokenServiceUpdateResponse</h3>
+        <p>TokenServiceUpdateResponse is the response payload of a token update request</p>
 
         
           <table class="field-table">
@@ -14284,10 +14249,10 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteAcceptRequest">ProjectServiceInvit
             <tbody>
               
                 <tr>
-                  <td>secret</td>
-                  <td><a href="#string">string</a></td>
+                  <td>token</td>
+                  <td><a href="#metalstack.api.v2.Token">Token</a></td>
                   <td></td>
-                  <td><p>Secret is the invitation secret part of the invitation url </p></td>
+                  <td><p>Token is the updated token </p></td>
                 </tr>
               
             </tbody>
@@ -14297,8 +14262,105 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteAcceptRequest">ProjectServiceInvit
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInviteAcceptResponse">ProjectServiceInviteAcceptResponse</h3>
-        <p>ProjectServiceInvitesListResponse is the response payload to a accept invite request</p>
+
+      
+        <h3 id="metalstack.api.v2.TokenType">TokenType</h3>
+        <p>TokenType specifies different use cases of tokens</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>TOKEN_TYPE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>TOKEN_TYPE_UNSPECIFIED is not specified</p></td>
+              </tr>
+            
+              <tr>
+                <td>TOKEN_TYPE_API</td>
+                <td>1</td>
+                <td><p>TOKEN_TYPE_API is a token for api usage</p></td>
+              </tr>
+            
+              <tr>
+                <td>TOKEN_TYPE_USER</td>
+                <td>2</td>
+                <td><p>TOKEN_TYPE_USER is a token to access the api with cli, a web application or other user induced actions.</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+
+      
+
+      
+        <h3 id="metalstack.api.v2.TokenService">TokenService</h3>
+        <p>TokenService serves token related functions</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>Get</td>
+                <td><a href="#metalstack.api.v2.TokenServiceGetRequest">TokenServiceGetRequest</a></td>
+                <td><a href="#metalstack.api.v2.TokenServiceGetResponse">TokenServiceGetResponse</a></td>
+                <td><p>Get a token</p></td>
+              </tr>
+            
+              <tr>
+                <td>Create</td>
+                <td><a href="#metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</a></td>
+                <td><a href="#metalstack.api.v2.TokenServiceCreateResponse">TokenServiceCreateResponse</a></td>
+                <td><p>Create a token to authenticate against the platform, the secret will be only visible in the response.</p></td>
+              </tr>
+            
+              <tr>
+                <td>Update</td>
+                <td><a href="#metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</a></td>
+                <td><a href="#metalstack.api.v2.TokenServiceUpdateResponse">TokenServiceUpdateResponse</a></td>
+                <td><p>Update a token</p></td>
+              </tr>
+            
+              <tr>
+                <td>List</td>
+                <td><a href="#metalstack.api.v2.TokenServiceListRequest">TokenServiceListRequest</a></td>
+                <td><a href="#metalstack.api.v2.TokenServiceListResponse">TokenServiceListResponse</a></td>
+                <td><p>List all your tokens</p></td>
+              </tr>
+            
+              <tr>
+                <td>Revoke</td>
+                <td><a href="#metalstack.api.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</a></td>
+                <td><a href="#metalstack.api.v2.TokenServiceRevokeResponse">TokenServiceRevokeResponse</a></td>
+                <td><p>Revoke a token, no further usage is possible afterwards</p></td>
+              </tr>
+            
+              <tr>
+                <td>Refresh</td>
+                <td><a href="#metalstack.api.v2.TokenServiceRefreshRequest">TokenServiceRefreshRequest</a></td>
+                <td><a href="#metalstack.api.v2.TokenServiceRefreshResponse">TokenServiceRefreshResponse</a></td>
+                <td><p>Refresh a token, this will create a new token with the exact same permissions as the calling token contains</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="metalstack/admin/v2/token.proto">metalstack/admin/v2/token.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.admin.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</h3>
+        <p>TokenServiceCreateRequest is the request payload to create a token</p>
 
         
           <table class="field-table">
@@ -14308,17 +14370,17 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteAcceptResponse">ProjectServiceInvi
             <tbody>
               
                 <tr>
-                  <td>project</td>
+                  <td>user</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Project ID of the project joined </p></td>
+                  <td>optional</td>
+                  <td><p>User this token should be created for, if omitted, user is derived from caller </p></td>
                 </tr>
               
                 <tr>
-                  <td>project_name</td>
-                  <td><a href="#string">string</a></td>
+                  <td>token_create_request</td>
+                  <td><a href="#metalstack.api.v2.TokenServiceCreateRequest">metalstack.api.v2.TokenServiceCreateRequest</a></td>
                   <td></td>
-                  <td><p>ProjectName if the project joined </p></td>
+                  <td><p>TokenCreateRequest which should be created </p></td>
                 </tr>
               
             </tbody>
@@ -14328,8 +14390,8 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteAcceptResponse">ProjectServiceInvi
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInviteDeleteRequest">ProjectServiceInviteDeleteRequest</h3>
-        <p>ProjectServiceInviteDeleteRequest is the request payload to a delete invite</p>
+        <h3 id="metalstack.admin.v2.TokenServiceCreateResponse">TokenServiceCreateResponse</h3>
+        <p>TokenServiceCreateResponse is the response payload of a token create request</p>
 
         
           <table class="field-table">
@@ -14339,17 +14401,17 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteDeleteRequest">ProjectServiceInvit
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#string">string</a></td>
+                  <td>token</td>
+                  <td><a href="#metalstack.api.v2.Token">metalstack.api.v2.Token</a></td>
                   <td></td>
-                  <td><p>Project is the uuid of the project </p></td>
+                  <td><p>Token which was created </p></td>
                 </tr>
               
                 <tr>
                   <td>secret</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Secret of the invite to delete </p></td>
+                  <td><p>Secret is the body if the jwt token, should be used in api requests as bearer token </p></td>
                 </tr>
               
             </tbody>
@@ -14359,15 +14421,32 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteDeleteRequest">ProjectServiceInvit
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInviteDeleteResponse">ProjectServiceInviteDeleteResponse</h3>
-        <p>ProjectServiceInviteDeleteResponse is the response payload of a delete invite request</p>
+        <h3 id="metalstack.admin.v2.TokenServiceListRequest">TokenServiceListRequest</h3>
+        <p>TokenServiceListRequest is the request payload for the token list request</p>
 
         
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>user</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>User is the id of the user for which the tokens should be listed </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInviteGetRequest">ProjectServiceInviteGetRequest</h3>
-        <p>ProjectServiceInviteGetRequest is the request payload to get a invite</p>
+        <h3 id="metalstack.admin.v2.TokenServiceListResponse">TokenServiceListResponse</h3>
+        <p>TokenServiceListResponse is the response payload for the token list request</p>
 
         
           <table class="field-table">
@@ -14377,10 +14456,10 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteGetRequest">ProjectServiceInviteGe
             <tbody>
               
                 <tr>
-                  <td>secret</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Secret of the invite to list </p></td>
+                  <td>tokens</td>
+                  <td><a href="#metalstack.api.v2.Token">metalstack.api.v2.Token</a></td>
+                  <td>repeated</td>
+                  <td><p>Tokens is the list of tokens </p></td>
                 </tr>
               
             </tbody>
@@ -14390,8 +14469,8 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteGetRequest">ProjectServiceInviteGe
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInviteGetResponse">ProjectServiceInviteGetResponse</h3>
-        <p>ProjectServiceInviteGetResponse is the response payload to a get invite request</p>
+        <h3 id="metalstack.admin.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</h3>
+        <p>TokenServiceRevokeRequest is the request payload for the token revoke request</p>
 
         
           <table class="field-table">
@@ -14401,10 +14480,17 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteGetResponse">ProjectServiceInviteG
             <tbody>
               
                 <tr>
-                  <td>invite</td>
-                  <td><a href="#metalstack.api.v2.ProjectInvite">ProjectInvite</a></td>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Invite is the invite </p></td>
+                  <td><p>Uuid is the uuid of the token which should be revoked </p></td>
+                </tr>
+              
+                <tr>
+                  <td>user</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>User is the id of the user for which the token should be revoked </p></td>
                 </tr>
               
             </tbody>
@@ -14414,8 +14500,63 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteGetResponse">ProjectServiceInviteG
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInviteRequest">ProjectServiceInviteRequest</h3>
-        <p>ProjectServiceInviteRequest is used to invite a member to a project</p>
+        <h3 id="metalstack.admin.v2.TokenServiceRevokeResponse">TokenServiceRevokeResponse</h3>
+        <p>TokenServiceRevokeResponse is the response payload for the token revoke request</p>
+
+        
+
+        
+      
+
+      
+
+      
+
+      
+        <h3 id="metalstack.admin.v2.TokenService">TokenService</h3>
+        <p>TokenService serves token related functions</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>List</td>
+                <td><a href="#metalstack.admin.v2.TokenServiceListRequest">TokenServiceListRequest</a></td>
+                <td><a href="#metalstack.admin.v2.TokenServiceListResponse">TokenServiceListResponse</a></td>
+                <td><p>List tokens</p></td>
+              </tr>
+            
+              <tr>
+                <td>Revoke</td>
+                <td><a href="#metalstack.admin.v2.TokenServiceRevokeRequest">TokenServiceRevokeRequest</a></td>
+                <td><a href="#metalstack.admin.v2.TokenServiceRevokeResponse">TokenServiceRevokeResponse</a></td>
+                <td><p>Revoke a token</p></td>
+              </tr>
+            
+              <tr>
+                <td>Create</td>
+                <td><a href="#metalstack.admin.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</a></td>
+                <td><a href="#metalstack.admin.v2.TokenServiceCreateResponse">TokenServiceCreateResponse</a></td>
+                <td><p>Create a token to authenticate against the platform, the secret will be only visible in the response.
+This service is suitable to create tokens for other users instead of deriving users from tokens directly.</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="metalstack/api/v2/health.proto">metalstack/api/v2/health.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.api.v2.Health">Health</h3>
+        <p>Health reports the health status of all services</p>
 
         
           <table class="field-table">
@@ -14425,17 +14566,10 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteRequest">ProjectServiceInviteReque
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Project is the uuid of the project </p></td>
-                </tr>
-              
-                <tr>
-                  <td>role</td>
-                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
-                  <td></td>
-                  <td><p>Role of this user in this project </p></td>
+                  <td>services</td>
+                  <td><a href="#metalstack.api.v2.HealthStatus">HealthStatus</a></td>
+                  <td>repeated</td>
+                  <td><p>Services the health of all individual services </p></td>
                 </tr>
               
             </tbody>
@@ -14445,34 +14579,15 @@ <h3 id="metalstack.api.v2.ProjectServiceInviteRequest">ProjectServiceInviteReque
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInviteResponse">ProjectServiceInviteResponse</h3>
-        <p>ProjectServiceInviteRequest is the response payload to a invite member request</p>
+        <h3 id="metalstack.api.v2.HealthServiceGetRequest">HealthServiceGetRequest</h3>
+        <p>HealthServiceGetRequest is request payload to get the health of the system</p>
 
         
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>invite</td>
-                  <td><a href="#metalstack.api.v2.ProjectInvite">ProjectInvite</a></td>
-                  <td></td>
-                  <td><p>Inviter contains a secret which can be sent to a potential user
-can be appended to the invitation endpoint at our cloud console like
-console.metalstack.cloud/invite/&lt;secret&gt; </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInvitesListRequest">ProjectServiceInvitesListRequest</h3>
-        <p>ProjectServiceInvitesListRequest is the request payload to a list invites request</p>
+        <h3 id="metalstack.api.v2.HealthServiceGetResponse">HealthServiceGetResponse</h3>
+        <p>HealthServiceGetRequest is the response payload with the health of the system</p>
 
         
           <table class="field-table">
@@ -14482,10 +14597,10 @@ <h3 id="metalstack.api.v2.ProjectServiceInvitesListRequest">ProjectServiceInvite
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#string">string</a></td>
+                  <td>health</td>
+                  <td><a href="#metalstack.api.v2.Health">Health</a></td>
                   <td></td>
-                  <td><p>Project is the uuid of the project </p></td>
+                  <td><p>Health is the overall health of the system </p></td>
                 </tr>
               
             </tbody>
@@ -14495,8 +14610,8 @@ <h3 id="metalstack.api.v2.ProjectServiceInvitesListRequest">ProjectServiceInvite
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceInvitesListResponse">ProjectServiceInvitesListResponse</h3>
-        <p>ProjectServiceInvitesListResponse is the response payload to a list invites request</p>
+        <h3 id="metalstack.api.v2.HealthStatus">HealthStatus</h3>
+        <p>HealthStatus the health of one service</p>
 
         
           <table class="field-table">
@@ -14506,10 +14621,31 @@ <h3 id="metalstack.api.v2.ProjectServiceInvitesListResponse">ProjectServiceInvit
             <tbody>
               
                 <tr>
-                  <td>invites</td>
-                  <td><a href="#metalstack.api.v2.ProjectInvite">ProjectInvite</a></td>
+                  <td>name</td>
+                  <td><a href="#metalstack.api.v2.Service">Service</a></td>
+                  <td></td>
+                  <td><p>Name the name of the service </p></td>
+                </tr>
+              
+                <tr>
+                  <td>status</td>
+                  <td><a href="#metalstack.api.v2.ServiceStatus">ServiceStatus</a></td>
+                  <td></td>
+                  <td><p>Status the status of this service </p></td>
+                </tr>
+              
+                <tr>
+                  <td>message</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Message describes the reason for the unhealthy status if possible </p></td>
+                </tr>
+              
+                <tr>
+                  <td>partitions</td>
+                  <td><a href="#metalstack.api.v2.HealthStatus.PartitionsEntry">HealthStatus.PartitionsEntry</a></td>
                   <td>repeated</td>
-                  <td><p>Invites not already accepted the invitation to this project </p></td>
+                  <td><p>Partitions describes the health of the service by partition </p></td>
                 </tr>
               
             </tbody>
@@ -14519,8 +14655,8 @@ <h3 id="metalstack.api.v2.ProjectServiceInvitesListResponse">ProjectServiceInvit
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceLeaveRequest">ProjectServiceLeaveRequest</h3>
-        <p>ProjectServiceLeaveRequest is used to leave a project</p>
+        <h3 id="metalstack.api.v2.HealthStatus.PartitionsEntry">HealthStatus.PartitionsEntry</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -14530,10 +14666,17 @@ <h3 id="metalstack.api.v2.ProjectServiceLeaveRequest">ProjectServiceLeaveRequest
             <tbody>
               
                 <tr>
-                  <td>project</td>
+                  <td>key</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Project is the uuid of the project </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.PartitionHealth">PartitionHealth</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14543,15 +14686,8 @@ <h3 id="metalstack.api.v2.ProjectServiceLeaveRequest">ProjectServiceLeaveRequest
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceLeaveResponse">ProjectServiceLeaveResponse</h3>
-        <p>ProjectServiceLeaveResponse is the response payload to a leave project request</p>
-
-        
-
-        
-      
-        <h3 id="metalstack.api.v2.ProjectServiceListRequest">ProjectServiceListRequest</h3>
-        <p>ProjectServiceListRequest is the request payload to list all projects</p>
+        <h3 id="metalstack.api.v2.PartitionHealth">PartitionHealth</h3>
+        <p>PartitionHealth the status of a specific service in this partition</p>
 
         
           <table class="field-table">
@@ -14561,31 +14697,17 @@ <h3 id="metalstack.api.v2.ProjectServiceListRequest">ProjectServiceListRequest</
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Id lists only projects with this id </p></td>
-                </tr>
-              
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Name lists only projects with this name </p></td>
+                  <td>status</td>
+                  <td><a href="#metalstack.api.v2.ServiceStatus">ServiceStatus</a></td>
+                  <td></td>
+                  <td><p>Status the health status of the service in this partition </p></td>
                 </tr>
               
                 <tr>
-                  <td>tenant</td>
+                  <td>message</td>
                   <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Tenant lists only projects of this tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
-                  <td>optional</td>
-                  <td><p>Labels lists only projects containing the given labels </p></td>
+                  <td></td>
+                  <td><p>Message describes the reason for the unhealthy status if possible </p></td>
                 </tr>
               
             </tbody>
@@ -14593,34 +14715,138 @@ <h3 id="metalstack.api.v2.ProjectServiceListRequest">ProjectServiceListRequest</
 
           
 
-        
+        
+      
+
+      
+        <h3 id="metalstack.api.v2.Service">Service</h3>
+        <p>Service defines the service for which the healtyness is reported</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SERVICE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>SERVICE_UNSPECIFIED is a unknown service</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_IPAM</td>
+                <td>1</td>
+                <td><p>SERVICE_IPAM the ipam service</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_RETHINK</td>
+                <td>2</td>
+                <td><p>SERVICE_RETHINK the rethinkdb</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_MASTERDATA</td>
+                <td>3</td>
+                <td><p>SERVICE_MASTERDATA the masterdata-api</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_MACHINES</td>
+                <td>4</td>
+                <td><p>SERVICE_MACHINES the machine service</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_AUDIT</td>
+                <td>5</td>
+                <td><p>SERVICE_AUDIT the auditing</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_VPN</td>
+                <td>6</td>
+                <td><p>SERVICE_VPN the vpn service</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+        <h3 id="metalstack.api.v2.ServiceStatus">ServiceStatus</h3>
+        <p>ServiceStatus defines the status of a service</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SERVICE_STATUS_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>SERVICE_STATUS_UNSPECIFIED service status is not known or unspecified</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_STATUS_DEGRADED</td>
+                <td>1</td>
+                <td><p>SERVICE_STATUS_DEGRADED the service is in degraded status, not the whole functionality is available</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_STATUS_UNHEALTHY</td>
+                <td>2</td>
+                <td><p>SERVICE_STATUS_UNHEALTHY the service is in unhealthy status, serious impact is expected</p></td>
+              </tr>
+            
+              <tr>
+                <td>SERVICE_STATUS_HEALTHY</td>
+                <td>3</td>
+                <td><p>SERVICE_STATUS_HEALTHY the service is in healthy status e.g. fully functional</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+
+      
+
+      
+        <h3 id="metalstack.api.v2.HealthService">HealthService</h3>
+        <p>HealthService serves health related functions</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>Get</td>
+                <td><a href="#metalstack.api.v2.HealthServiceGetRequest">HealthServiceGetRequest</a></td>
+                <td><a href="#metalstack.api.v2.HealthServiceGetResponse">HealthServiceGetResponse</a></td>
+                <td><p>Get the health of the platform</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="metalstack/api/v2/method.proto">metalstack/api/v2/method.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
       
-        <h3 id="metalstack.api.v2.ProjectServiceListResponse">ProjectServiceListResponse</h3>
-        <p>ProjectServiceListResponse is the response payload to list all projects</p>
+        <h3 id="metalstack.api.v2.MethodServiceListRequest">MethodServiceListRequest</h3>
+        <p>MethodServiceListRequest is the request payload to list all public methods</p>
 
         
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>projects</td>
-                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
-                  <td>repeated</td>
-                  <td><p>Projects is a list of all your projects </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceRemoveMemberRequest">ProjectServiceRemoveMemberRequest</h3>
-        <p>ProjectServiceRemoveMemberRequest is used to remove a member from a project</p>
+        <h3 id="metalstack.api.v2.MethodServiceListResponse">MethodServiceListResponse</h3>
+        <p>MethodServiceListResponse is the response payload with all public visible methods</p>
 
         
           <table class="field-table">
@@ -14630,17 +14856,10 @@ <h3 id="metalstack.api.v2.ProjectServiceRemoveMemberRequest">ProjectServiceRemov
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Project is the uuid of the project </p></td>
-                </tr>
-              
-                <tr>
-                  <td>member</td>
+                  <td>methods</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Member is the id of the member to remove from this project </p></td>
+                  <td>repeated</td>
+                  <td><p>Methods is a list of methods public callable </p></td>
                 </tr>
               
             </tbody>
@@ -14650,15 +14869,15 @@ <h3 id="metalstack.api.v2.ProjectServiceRemoveMemberRequest">ProjectServiceRemov
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceRemoveMemberResponse">ProjectServiceRemoveMemberResponse</h3>
-        <p>ProjectServiceRemoveMemberResponse is the response payload to a remove member request</p>
+        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListRequest">MethodServiceTokenScopedListRequest</h3>
+        <p>MethodServiceTokenScopedListRequest is the request payload to list all methods callable with the token present in the request</p>
 
         
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceUpdateMemberRequest">ProjectServiceUpdateMemberRequest</h3>
-        <p>ProjectServiceUpdateMemberRequest is used to update a member of a project</p>
+        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse">MethodServiceTokenScopedListResponse</h3>
+        <p>MethodServiceTokenScopedListResponse is the response payload which contains all methods which are callable with the given token</p>
 
         
           <table class="field-table">
@@ -14668,48 +14887,38 @@ <h3 id="metalstack.api.v2.ProjectServiceUpdateMemberRequest">ProjectServiceUpdat
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Project is the uuid of the project </p></td>
+                  <td>permissions</td>
+                  <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
+                  <td>repeated</td>
+                  <td><p>Permissions a list of methods which can be called </p></td>
                 </tr>
               
                 <tr>
-                  <td>member</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Member is the id of the member to remove from this project </p></td>
+                  <td>project_roles</td>
+                  <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry">MethodServiceTokenScopedListResponse.ProjectRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>ProjectRoles associates a project id with the corresponding role of the token owner </p></td>
                 </tr>
               
                 <tr>
-                  <td>role</td>
-                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
-                  <td></td>
-                  <td><p>Role is the role in this project the user will get after the update </p></td>
+                  <td>tenant_roles</td>
+                  <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry">MethodServiceTokenScopedListResponse.TenantRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>TenantRoles associates a tenant id with the corresponding role of the token owner </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="metalstack.api.v2.ProjectServiceUpdateMemberResponse">ProjectServiceUpdateMemberResponse</h3>
-        <p>ProjectServiceUpdateMemberResponse is the response payload to a update member request</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+                <tr>
+                  <td>admin_role</td>
+                  <td><a href="#metalstack.api.v2.AdminRole">AdminRole</a></td>
+                  <td>optional</td>
+                  <td><p>AdminRole defines the admin role of the token owner </p></td>
+                </tr>
               
                 <tr>
-                  <td>project_member</td>
-                  <td><a href="#metalstack.api.v2.ProjectMember">ProjectMember</a></td>
-                  <td></td>
-                  <td><p>ProjectMember is the updated project member </p></td>
+                  <td>infra_role</td>
+                  <td><a href="#metalstack.api.v2.InfraRole">InfraRole</a></td>
+                  <td>optional</td>
+                  <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
                 </tr>
               
             </tbody>
@@ -14719,8 +14928,8 @@ <h3 id="metalstack.api.v2.ProjectServiceUpdateMemberResponse">ProjectServiceUpda
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceUpdateRequest">ProjectServiceUpdateRequest</h3>
-        <p>ProjectServiceUpdateRequest is the request payload to update a project</p>
+        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry">MethodServiceTokenScopedListResponse.ProjectRolesEntry</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -14730,45 +14939,17 @@ <h3 id="metalstack.api.v2.ProjectServiceUpdateRequest">ProjectServiceUpdateReque
             <tbody>
               
                 <tr>
-                  <td>project</td>
+                  <td>key</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Project is the uuid of the project to get </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>update_meta</td>
-                  <td><a href="#metalstack.api.v2.UpdateMeta">UpdateMeta</a></td>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
                   <td></td>
-                  <td><p>UpdateMeta contains the timestamp and strategy to be used in this update request </p></td>
-                </tr>
-              
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Name of this project unique per tenant </p></td>
-                </tr>
-              
-                <tr>
-                  <td>description</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Description of this project </p></td>
-                </tr>
-              
-                <tr>
-                  <td>avatar_url</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>Avatar URL of the project </p></td>
-                </tr>
-              
-                <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.UpdateLabels">UpdateLabels</a></td>
-                  <td>optional</td>
-                  <td><p>Labels on this project </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14778,8 +14959,8 @@ <h3 id="metalstack.api.v2.ProjectServiceUpdateRequest">ProjectServiceUpdateReque
 
         
       
-        <h3 id="metalstack.api.v2.ProjectServiceUpdateResponse">ProjectServiceUpdateResponse</h3>
-        <p>ProjectServiceUpdateResponse is the response payload to update a project</p>
+        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry">MethodServiceTokenScopedListResponse.TenantRolesEntry</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -14789,10 +14970,17 @@ <h3 id="metalstack.api.v2.ProjectServiceUpdateResponse">ProjectServiceUpdateResp
             <tbody>
               
                 <tr>
-                  <td>project</td>
-                  <td><a href="#metalstack.api.v2.Project">Project</a></td>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Project is the project </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.TenantRole">TenantRole</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14808,8 +14996,8 @@ <h3 id="metalstack.api.v2.ProjectServiceUpdateResponse">ProjectServiceUpdateResp
       
 
       
-        <h3 id="metalstack.api.v2.ProjectService">ProjectService</h3>
-        <p>ProjectService serves project related functions</p>
+        <h3 id="metalstack.api.v2.MethodService">MethodService</h3>
+        <p>MethodService serves method related functions</p><p>methods are functions in services</p>
         <table class="enum-table">
           <thead>
             <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
@@ -14818,93 +15006,16 @@ <h3 id="metalstack.api.v2.ProjectService">ProjectService</h3>
             
               <tr>
                 <td>List</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceListRequest">ProjectServiceListRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceListResponse">ProjectServiceListResponse</a></td>
-                <td><p>List all accessible projects</p></td>
-              </tr>
-            
-              <tr>
-                <td>Get</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceGetRequest">ProjectServiceGetRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceGetResponse">ProjectServiceGetResponse</a></td>
-                <td><p>Get a project</p></td>
-              </tr>
-            
-              <tr>
-                <td>Create</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceCreateRequest">ProjectServiceCreateRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceCreateResponse">ProjectServiceCreateResponse</a></td>
-                <td><p>Create a project</p></td>
-              </tr>
-            
-              <tr>
-                <td>Delete</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceDeleteRequest">ProjectServiceDeleteRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceDeleteResponse">ProjectServiceDeleteResponse</a></td>
-                <td><p>Delete a project</p></td>
-              </tr>
-            
-              <tr>
-                <td>Update</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceUpdateRequest">ProjectServiceUpdateRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceUpdateResponse">ProjectServiceUpdateResponse</a></td>
-                <td><p>Update a project</p></td>
-              </tr>
-            
-              <tr>
-                <td>Leave</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceLeaveRequest">ProjectServiceLeaveRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceLeaveResponse">ProjectServiceLeaveResponse</a></td>
-                <td><p>Leave project</p></td>
-              </tr>
-            
-              <tr>
-                <td>RemoveMember</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceRemoveMemberRequest">ProjectServiceRemoveMemberRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceRemoveMemberResponse">ProjectServiceRemoveMemberResponse</a></td>
-                <td><p>RemoveMember remove a user from a project</p></td>
-              </tr>
-            
-              <tr>
-                <td>UpdateMember</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceUpdateMemberRequest">ProjectServiceUpdateMemberRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceUpdateMemberResponse">ProjectServiceUpdateMemberResponse</a></td>
-                <td><p>UpdateMember update a user for a project</p></td>
-              </tr>
-            
-              <tr>
-                <td>Invite</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInviteRequest">ProjectServiceInviteRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInviteResponse">ProjectServiceInviteResponse</a></td>
-                <td><p>Invite a user to a project</p></td>
-              </tr>
-            
-              <tr>
-                <td>InviteAccept</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInviteAcceptRequest">ProjectServiceInviteAcceptRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInviteAcceptResponse">ProjectServiceInviteAcceptResponse</a></td>
-                <td><p>InviteAccept is called from a user to accept a invitation</p></td>
-              </tr>
-            
-              <tr>
-                <td>InviteDelete</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInviteDeleteRequest">ProjectServiceInviteDeleteRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInviteDeleteResponse">ProjectServiceInviteDeleteResponse</a></td>
-                <td><p>InviteDelete deletes a pending invitation</p></td>
-              </tr>
-            
-              <tr>
-                <td>InvitesList</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInvitesListRequest">ProjectServiceInvitesListRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInvitesListResponse">ProjectServiceInvitesListResponse</a></td>
-                <td><p>InvitesList list all invites to a project</p></td>
+                <td><a href="#metalstack.api.v2.MethodServiceListRequest">MethodServiceListRequest</a></td>
+                <td><a href="#metalstack.api.v2.MethodServiceListResponse">MethodServiceListResponse</a></td>
+                <td><p>List all public visible methods</p></td>
               </tr>
             
               <tr>
-                <td>InviteGet</td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInviteGetRequest">ProjectServiceInviteGetRequest</a></td>
-                <td><a href="#metalstack.api.v2.ProjectServiceInviteGetResponse">ProjectServiceInviteGetResponse</a></td>
-                <td><p>InviteGet get an invite</p></td>
+                <td>TokenScopedList</td>
+                <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListRequest">MethodServiceTokenScopedListRequest</a></td>
+                <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse">MethodServiceTokenScopedListResponse</a></td>
+                <td><p>TokenScopedList all methods callable with the token present in the request</p></td>
               </tr>
             
           </tbody>
diff --git a/go/client/client.go b/go/client/client.go
index c62a25ef..47ccc67d 100755
--- a/go/client/client.go
+++ b/go/client/client.go
@@ -33,6 +33,7 @@ type (
 		Machine() adminv2connect.MachineServiceClient
 		Network() adminv2connect.NetworkServiceClient
 		Partition() adminv2connect.PartitionServiceClient
+		Project() adminv2connect.ProjectServiceClient
 		Size() adminv2connect.SizeServiceClient
 		Switch() adminv2connect.SwitchServiceClient
 		Tenant() adminv2connect.TenantServiceClient
@@ -46,6 +47,7 @@ type (
 		machineservice    adminv2connect.MachineServiceClient
 		networkservice    adminv2connect.NetworkServiceClient
 		partitionservice  adminv2connect.PartitionServiceClient
+		projectservice    adminv2connect.ProjectServiceClient
 		sizeservice       adminv2connect.SizeServiceClient
 		switchservice     adminv2connect.SwitchServiceClient
 		tenantservice     adminv2connect.TenantServiceClient
@@ -178,6 +180,12 @@ func (c *client) Adminv2() Adminv2 {
 			connect.WithInterceptors(c.interceptors...),
 			compress.WithAll(compress.LevelBalanced),
 		),
+		projectservice: adminv2connect.NewProjectServiceClient(
+			c.config.HttpClient(),
+			c.config.BaseURL,
+			connect.WithInterceptors(c.interceptors...),
+			compress.WithAll(compress.LevelBalanced),
+		),
 		sizeservice: adminv2connect.NewSizeServiceClient(
 			c.config.HttpClient(),
 			c.config.BaseURL,
@@ -224,6 +232,9 @@ func (c *adminv2) Network() adminv2connect.NetworkServiceClient {
 func (c *adminv2) Partition() adminv2connect.PartitionServiceClient {
 	return c.partitionservice
 }
+func (c *adminv2) Project() adminv2connect.ProjectServiceClient {
+	return c.projectservice
+}
 func (c *adminv2) Size() adminv2connect.SizeServiceClient {
 	return c.sizeservice
 }
diff --git a/go/metalstack/admin/v2/adminv2connect/project.connect.go b/go/metalstack/admin/v2/adminv2connect/project.connect.go
new file mode 100644
index 00000000..8dfddbc4
--- /dev/null
+++ b/go/metalstack/admin/v2/adminv2connect/project.connect.go
@@ -0,0 +1,114 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: metalstack/admin/v2/project.proto
+
+package adminv2connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v2 "github.com/metal-stack/api/go/metalstack/admin/v2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// ProjectServiceName is the fully-qualified name of the ProjectService service.
+	ProjectServiceName = "metalstack.admin.v2.ProjectService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// ProjectServiceListProcedure is the fully-qualified name of the ProjectService's List RPC.
+	ProjectServiceListProcedure = "/metalstack.admin.v2.ProjectService/List"
+)
+
+// ProjectServiceClient is a client for the metalstack.admin.v2.ProjectService service.
+type ProjectServiceClient interface {
+	// List projects based on various filter criteria
+	List(context.Context, *v2.ProjectServiceListRequest) (*v2.ProjectServiceListResponse, error)
+}
+
+// NewProjectServiceClient constructs a client for the metalstack.admin.v2.ProjectService service.
+// By default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped
+// responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewProjectServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) ProjectServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	projectServiceMethods := v2.File_metalstack_admin_v2_project_proto.Services().ByName("ProjectService").Methods()
+	return &projectServiceClient{
+		list: connect.NewClient[v2.ProjectServiceListRequest, v2.ProjectServiceListResponse](
+			httpClient,
+			baseURL+ProjectServiceListProcedure,
+			connect.WithSchema(projectServiceMethods.ByName("List")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// projectServiceClient implements ProjectServiceClient.
+type projectServiceClient struct {
+	list *connect.Client[v2.ProjectServiceListRequest, v2.ProjectServiceListResponse]
+}
+
+// List calls metalstack.admin.v2.ProjectService.List.
+func (c *projectServiceClient) List(ctx context.Context, req *v2.ProjectServiceListRequest) (*v2.ProjectServiceListResponse, error) {
+	response, err := c.list.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// ProjectServiceHandler is an implementation of the metalstack.admin.v2.ProjectService service.
+type ProjectServiceHandler interface {
+	// List projects based on various filter criteria
+	List(context.Context, *v2.ProjectServiceListRequest) (*v2.ProjectServiceListResponse, error)
+}
+
+// NewProjectServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewProjectServiceHandler(svc ProjectServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	projectServiceMethods := v2.File_metalstack_admin_v2_project_proto.Services().ByName("ProjectService").Methods()
+	projectServiceListHandler := connect.NewUnaryHandlerSimple(
+		ProjectServiceListProcedure,
+		svc.List,
+		connect.WithSchema(projectServiceMethods.ByName("List")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/metalstack.admin.v2.ProjectService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case ProjectServiceListProcedure:
+			projectServiceListHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedProjectServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedProjectServiceHandler struct{}
+
+func (UnimplementedProjectServiceHandler) List(context.Context, *v2.ProjectServiceListRequest) (*v2.ProjectServiceListResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.admin.v2.ProjectService.List is not implemented"))
+}
diff --git a/go/metalstack/admin/v2/project.pb.go b/go/metalstack/admin/v2/project.pb.go
new file mode 100644
index 00000000..a9a57b6b
--- /dev/null
+++ b/go/metalstack/admin/v2/project.pb.go
@@ -0,0 +1,199 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.10
+// 	protoc        (unknown)
+// source: metalstack/admin/v2/project.proto
+
+package adminv2
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	v2 "github.com/metal-stack/api/go/metalstack/api/v2"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ProjectServiceListRequest is the request payload for the project list request
+type ProjectServiceListRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Tenant lists only projects of this tenant
+	Tenant *string `protobuf:"bytes,1,opt,name=tenant,proto3,oneof" json:"tenant,omitempty"`
+	// Labels lists only projects containing the given labels
+	Labels        *v2.Labels `protobuf:"bytes,2,opt,name=labels,proto3,oneof" json:"labels,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ProjectServiceListRequest) Reset() {
+	*x = ProjectServiceListRequest{}
+	mi := &file_metalstack_admin_v2_project_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ProjectServiceListRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProjectServiceListRequest) ProtoMessage() {}
+
+func (x *ProjectServiceListRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_project_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProjectServiceListRequest.ProtoReflect.Descriptor instead.
+func (*ProjectServiceListRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_project_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ProjectServiceListRequest) GetTenant() string {
+	if x != nil && x.Tenant != nil {
+		return *x.Tenant
+	}
+	return ""
+}
+
+func (x *ProjectServiceListRequest) GetLabels() *v2.Labels {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+// ProjectServiceListResponse is the response payload for the project list request
+type ProjectServiceListResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Projects is a list of all projects
+	Projects      []*v2.Project `protobuf:"bytes,1,rep,name=projects,proto3" json:"projects,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ProjectServiceListResponse) Reset() {
+	*x = ProjectServiceListResponse{}
+	mi := &file_metalstack_admin_v2_project_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ProjectServiceListResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProjectServiceListResponse) ProtoMessage() {}
+
+func (x *ProjectServiceListResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_project_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProjectServiceListResponse.ProtoReflect.Descriptor instead.
+func (*ProjectServiceListResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_project_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ProjectServiceListResponse) GetProjects() []*v2.Project {
+	if x != nil {
+		return x.Projects
+	}
+	return nil
+}
+
+var File_metalstack_admin_v2_project_proto protoreflect.FileDescriptor
+
+const file_metalstack_admin_v2_project_proto_rawDesc = "" +
+	"\n" +
+	"!metalstack/admin/v2/project.proto\x12\x13metalstack.admin.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/project.proto\"\x92\x01\n" +
+	"\x19ProjectServiceListRequest\x12'\n" +
+	"\x06tenant\x18\x01 \x01(\tB\n" +
+	"\xbaH\ar\x05\x10\x02\x18\x80\x01H\x00R\x06tenant\x88\x01\x01\x126\n" +
+	"\x06labels\x18\x02 \x01(\v2\x19.metalstack.api.v2.LabelsH\x01R\x06labels\x88\x01\x01B\t\n" +
+	"\a_tenantB\t\n" +
+	"\a_labels\"T\n" +
+	"\x1aProjectServiceListResponse\x126\n" +
+	"\bprojects\x18\x01 \x03(\v2\x1a.metalstack.api.v2.ProjectR\bprojects2\x85\x01\n" +
+	"\x0eProjectService\x12s\n" +
+	"\x04List\x12..metalstack.admin.v2.ProjectServiceListRequest\x1a/.metalstack.admin.v2.ProjectServiceListResponse\"\n" +
+	"\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x02B\xd0\x01\n" +
+	"\x17com.metalstack.admin.v2B\fProjectProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3"
+
+var (
+	file_metalstack_admin_v2_project_proto_rawDescOnce sync.Once
+	file_metalstack_admin_v2_project_proto_rawDescData []byte
+)
+
+func file_metalstack_admin_v2_project_proto_rawDescGZIP() []byte {
+	file_metalstack_admin_v2_project_proto_rawDescOnce.Do(func() {
+		file_metalstack_admin_v2_project_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metalstack_admin_v2_project_proto_rawDesc), len(file_metalstack_admin_v2_project_proto_rawDesc)))
+	})
+	return file_metalstack_admin_v2_project_proto_rawDescData
+}
+
+var file_metalstack_admin_v2_project_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_metalstack_admin_v2_project_proto_goTypes = []any{
+	(*ProjectServiceListRequest)(nil),  // 0: metalstack.admin.v2.ProjectServiceListRequest
+	(*ProjectServiceListResponse)(nil), // 1: metalstack.admin.v2.ProjectServiceListResponse
+	(*v2.Labels)(nil),                  // 2: metalstack.api.v2.Labels
+	(*v2.Project)(nil),                 // 3: metalstack.api.v2.Project
+}
+var file_metalstack_admin_v2_project_proto_depIdxs = []int32{
+	2, // 0: metalstack.admin.v2.ProjectServiceListRequest.labels:type_name -> metalstack.api.v2.Labels
+	3, // 1: metalstack.admin.v2.ProjectServiceListResponse.projects:type_name -> metalstack.api.v2.Project
+	0, // 2: metalstack.admin.v2.ProjectService.List:input_type -> metalstack.admin.v2.ProjectServiceListRequest
+	1, // 3: metalstack.admin.v2.ProjectService.List:output_type -> metalstack.admin.v2.ProjectServiceListResponse
+	3, // [3:4] is the sub-list for method output_type
+	2, // [2:3] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_metalstack_admin_v2_project_proto_init() }
+func file_metalstack_admin_v2_project_proto_init() {
+	if File_metalstack_admin_v2_project_proto != nil {
+		return
+	}
+	file_metalstack_admin_v2_project_proto_msgTypes[0].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_admin_v2_project_proto_rawDesc), len(file_metalstack_admin_v2_project_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_metalstack_admin_v2_project_proto_goTypes,
+		DependencyIndexes: file_metalstack_admin_v2_project_proto_depIdxs,
+		MessageInfos:      file_metalstack_admin_v2_project_proto_msgTypes,
+	}.Build()
+	File_metalstack_admin_v2_project_proto = out.File
+	file_metalstack_admin_v2_project_proto_goTypes = nil
+	file_metalstack_admin_v2_project_proto_depIdxs = nil
+}
diff --git a/go/permissions/servicepermissions.go b/go/permissions/servicepermissions.go
index fe43b278..553e2146 100755
--- a/go/permissions/servicepermissions.go
+++ b/go/permissions/servicepermissions.go
@@ -13,6 +13,7 @@ func GetServices() []string {
 		"metalstack.admin.v2.MachineService",
 		"metalstack.admin.v2.NetworkService",
 		"metalstack.admin.v2.PartitionService",
+		"metalstack.admin.v2.ProjectService",
 		"metalstack.admin.v2.SizeService",
 		"metalstack.admin.v2.SwitchService",
 		"metalstack.admin.v2.TenantService",
@@ -60,6 +61,7 @@ func GetServicePermissions() *ServicePermissions {
 					"/metalstack.admin.v2.PartitionService/Update",
 					"/metalstack.admin.v2.PartitionService/Delete",
 					"/metalstack.admin.v2.PartitionService/Capacity",
+					"/metalstack.admin.v2.ProjectService/List",
 					"/metalstack.admin.v2.SizeService/Create",
 					"/metalstack.admin.v2.SizeService/Update",
 					"/metalstack.admin.v2.SizeService/Delete",
@@ -83,6 +85,7 @@ func GetServicePermissions() *ServicePermissions {
 					"/metalstack.admin.v2.NetworkService/Get",
 					"/metalstack.admin.v2.NetworkService/List",
 					"/metalstack.admin.v2.PartitionService/Capacity",
+					"/metalstack.admin.v2.ProjectService/List",
 					"/metalstack.admin.v2.SwitchService/Get",
 					"/metalstack.admin.v2.SwitchService/List",
 					"/metalstack.admin.v2.TenantService/List",
@@ -208,6 +211,7 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.admin.v2.PartitionService/Create":                   true,
 			"/metalstack.admin.v2.PartitionService/Delete":                   true,
 			"/metalstack.admin.v2.PartitionService/Update":                   true,
+			"/metalstack.admin.v2.ProjectService/List":                       true,
 			"/metalstack.admin.v2.SizeService/Create":                        true,
 			"/metalstack.admin.v2.SizeService/Delete":                        true,
 			"/metalstack.admin.v2.SizeService/Update":                        true,
@@ -345,6 +349,7 @@ func GetServicePermissions() *ServicePermissions {
 				"/metalstack.admin.v2.PartitionService/Create":   true,
 				"/metalstack.admin.v2.PartitionService/Delete":   true,
 				"/metalstack.admin.v2.PartitionService/Update":   true,
+				"/metalstack.admin.v2.ProjectService/List":       true,
 				"/metalstack.admin.v2.SizeService/Create":        true,
 				"/metalstack.admin.v2.SizeService/Delete":        true,
 				"/metalstack.admin.v2.SizeService/Update":        true,
@@ -426,6 +431,7 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.admin.v2.PartitionService/Create":       true,
 			"/metalstack.admin.v2.PartitionService/Delete":       true,
 			"/metalstack.admin.v2.PartitionService/Update":       true,
+			"/metalstack.admin.v2.ProjectService/List":           false,
 			"/metalstack.admin.v2.SizeService/Create":            true,
 			"/metalstack.admin.v2.SizeService/Delete":            true,
 			"/metalstack.admin.v2.SizeService/Update":            true,
diff --git a/go/tests/mock_clients.go b/go/tests/mock_clients.go
index d41a425e..b5ebec8d 100755
--- a/go/tests/mock_clients.go
+++ b/go/tests/mock_clients.go
@@ -38,6 +38,7 @@ type (
 		machineservice    *adminv2mocks.MachineServiceClient
 		networkservice    *adminv2mocks.NetworkServiceClient
 		partitionservice  *adminv2mocks.PartitionServiceClient
+		projectservice    *adminv2mocks.ProjectServiceClient
 		sizeservice       *adminv2mocks.SizeServiceClient
 		switchservice     *adminv2mocks.SwitchServiceClient
 		tenantservice     *adminv2mocks.TenantServiceClient
@@ -51,6 +52,7 @@ type (
 		Machine    func(m *mock.Mock)
 		Network    func(m *mock.Mock)
 		Partition  func(m *mock.Mock)
+		Project    func(m *mock.Mock)
 		Size       func(m *mock.Mock)
 		Switch     func(m *mock.Mock)
 		Tenant     func(m *mock.Mock)
@@ -134,6 +136,7 @@ func newadminv2(t *testing.T, fns *Adminv2MockFns) *adminv2 {
 		machineservice:    adminv2mocks.NewMachineServiceClient(t),
 		networkservice:    adminv2mocks.NewNetworkServiceClient(t),
 		partitionservice:  adminv2mocks.NewPartitionServiceClient(t),
+		projectservice:    adminv2mocks.NewProjectServiceClient(t),
 		sizeservice:       adminv2mocks.NewSizeServiceClient(t),
 		switchservice:     adminv2mocks.NewSwitchServiceClient(t),
 		tenantservice:     adminv2mocks.NewTenantServiceClient(t),
@@ -159,6 +162,9 @@ func newadminv2(t *testing.T, fns *Adminv2MockFns) *adminv2 {
 		if fns.Partition != nil {
 			fns.Partition(&a.partitionservice.Mock)
 		}
+		if fns.Project != nil {
+			fns.Project(&a.projectservice.Mock)
+		}
 		if fns.Size != nil {
 			fns.Size(&a.sizeservice.Mock)
 		}
@@ -195,6 +201,9 @@ func (c *adminv2) Network() adminv2connect.NetworkServiceClient {
 func (c *adminv2) Partition() adminv2connect.PartitionServiceClient {
 	return c.partitionservice
 }
+func (c *adminv2) Project() adminv2connect.ProjectServiceClient {
+	return c.projectservice
+}
 func (c *adminv2) Size() adminv2connect.SizeServiceClient {
 	return c.sizeservice
 }
diff --git a/go/tests/mocks/metalstack/admin/v2/adminv2connect/ProjectServiceClient.go b/go/tests/mocks/metalstack/admin/v2/adminv2connect/ProjectServiceClient.go
new file mode 100644
index 00000000..eadd5601
--- /dev/null
+++ b/go/tests/mocks/metalstack/admin/v2/adminv2connect/ProjectServiceClient.go
@@ -0,0 +1,107 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package adminv2connect
+
+import (
+	"context"
+
+	"github.com/metal-stack/api/go/metalstack/admin/v2"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewProjectServiceClient creates a new instance of ProjectServiceClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewProjectServiceClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *ProjectServiceClient {
+	mock := &ProjectServiceClient{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// ProjectServiceClient is an autogenerated mock type for the ProjectServiceClient type
+type ProjectServiceClient struct {
+	mock.Mock
+}
+
+type ProjectServiceClient_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *ProjectServiceClient) EXPECT() *ProjectServiceClient_Expecter {
+	return &ProjectServiceClient_Expecter{mock: &_m.Mock}
+}
+
+// List provides a mock function for the type ProjectServiceClient
+func (_mock *ProjectServiceClient) List(context1 context.Context, projectServiceListRequest *adminv2.ProjectServiceListRequest) (*adminv2.ProjectServiceListResponse, error) {
+	ret := _mock.Called(context1, projectServiceListRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for List")
+	}
+
+	var r0 *adminv2.ProjectServiceListResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.ProjectServiceListRequest) (*adminv2.ProjectServiceListResponse, error)); ok {
+		return returnFunc(context1, projectServiceListRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.ProjectServiceListRequest) *adminv2.ProjectServiceListResponse); ok {
+		r0 = returnFunc(context1, projectServiceListRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.ProjectServiceListResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.ProjectServiceListRequest) error); ok {
+		r1 = returnFunc(context1, projectServiceListRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// ProjectServiceClient_List_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'List'
+type ProjectServiceClient_List_Call struct {
+	*mock.Call
+}
+
+// List is a helper method to define mock.On call
+//   - context1 context.Context
+//   - projectServiceListRequest *adminv2.ProjectServiceListRequest
+func (_e *ProjectServiceClient_Expecter) List(context1 interface{}, projectServiceListRequest interface{}) *ProjectServiceClient_List_Call {
+	return &ProjectServiceClient_List_Call{Call: _e.mock.On("List", context1, projectServiceListRequest)}
+}
+
+func (_c *ProjectServiceClient_List_Call) Run(run func(context1 context.Context, projectServiceListRequest *adminv2.ProjectServiceListRequest)) *ProjectServiceClient_List_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.ProjectServiceListRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.ProjectServiceListRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *ProjectServiceClient_List_Call) Return(projectServiceListResponse *adminv2.ProjectServiceListResponse, err error) *ProjectServiceClient_List_Call {
+	_c.Call.Return(projectServiceListResponse, err)
+	return _c
+}
+
+func (_c *ProjectServiceClient_List_Call) RunAndReturn(run func(context1 context.Context, projectServiceListRequest *adminv2.ProjectServiceListRequest) (*adminv2.ProjectServiceListResponse, error)) *ProjectServiceClient_List_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/go/tests/mocks/metalstack/admin/v2/adminv2connect/ProjectServiceHandler.go b/go/tests/mocks/metalstack/admin/v2/adminv2connect/ProjectServiceHandler.go
new file mode 100644
index 00000000..3d5e8e0b
--- /dev/null
+++ b/go/tests/mocks/metalstack/admin/v2/adminv2connect/ProjectServiceHandler.go
@@ -0,0 +1,107 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package adminv2connect
+
+import (
+	"context"
+
+	"github.com/metal-stack/api/go/metalstack/admin/v2"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewProjectServiceHandler creates a new instance of ProjectServiceHandler. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewProjectServiceHandler(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *ProjectServiceHandler {
+	mock := &ProjectServiceHandler{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// ProjectServiceHandler is an autogenerated mock type for the ProjectServiceHandler type
+type ProjectServiceHandler struct {
+	mock.Mock
+}
+
+type ProjectServiceHandler_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *ProjectServiceHandler) EXPECT() *ProjectServiceHandler_Expecter {
+	return &ProjectServiceHandler_Expecter{mock: &_m.Mock}
+}
+
+// List provides a mock function for the type ProjectServiceHandler
+func (_mock *ProjectServiceHandler) List(context1 context.Context, projectServiceListRequest *adminv2.ProjectServiceListRequest) (*adminv2.ProjectServiceListResponse, error) {
+	ret := _mock.Called(context1, projectServiceListRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for List")
+	}
+
+	var r0 *adminv2.ProjectServiceListResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.ProjectServiceListRequest) (*adminv2.ProjectServiceListResponse, error)); ok {
+		return returnFunc(context1, projectServiceListRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.ProjectServiceListRequest) *adminv2.ProjectServiceListResponse); ok {
+		r0 = returnFunc(context1, projectServiceListRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.ProjectServiceListResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.ProjectServiceListRequest) error); ok {
+		r1 = returnFunc(context1, projectServiceListRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// ProjectServiceHandler_List_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'List'
+type ProjectServiceHandler_List_Call struct {
+	*mock.Call
+}
+
+// List is a helper method to define mock.On call
+//   - context1 context.Context
+//   - projectServiceListRequest *adminv2.ProjectServiceListRequest
+func (_e *ProjectServiceHandler_Expecter) List(context1 interface{}, projectServiceListRequest interface{}) *ProjectServiceHandler_List_Call {
+	return &ProjectServiceHandler_List_Call{Call: _e.mock.On("List", context1, projectServiceListRequest)}
+}
+
+func (_c *ProjectServiceHandler_List_Call) Run(run func(context1 context.Context, projectServiceListRequest *adminv2.ProjectServiceListRequest)) *ProjectServiceHandler_List_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.ProjectServiceListRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.ProjectServiceListRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *ProjectServiceHandler_List_Call) Return(projectServiceListResponse *adminv2.ProjectServiceListResponse, err error) *ProjectServiceHandler_List_Call {
+	_c.Call.Return(projectServiceListResponse, err)
+	return _c
+}
+
+func (_c *ProjectServiceHandler_List_Call) RunAndReturn(run func(context1 context.Context, projectServiceListRequest *adminv2.ProjectServiceListRequest) (*adminv2.ProjectServiceListResponse, error)) *ProjectServiceHandler_List_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/proto/metalstack/admin/v2/project.proto b/proto/metalstack/admin/v2/project.proto
new file mode 100644
index 00000000..1a73f3a8
--- /dev/null
+++ b/proto/metalstack/admin/v2/project.proto
@@ -0,0 +1,34 @@
+syntax = "proto3";
+
+package metalstack.admin.v2;
+
+import "buf/validate/validate.proto";
+import "metalstack/api/v2/common.proto";
+import "metalstack/api/v2/project.proto";
+
+// ProjectService serves project related functions
+service ProjectService {
+  // List projects based on various filter criteria
+  rpc List(ProjectServiceListRequest) returns (ProjectServiceListResponse) {
+    option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_EDITOR;
+    option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_VIEWER;
+    option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
+  }
+}
+
+// ProjectServiceListRequest is the request payload for the project list request
+message ProjectServiceListRequest {
+  // Tenant lists only projects of this tenant
+  optional string tenant = 1 [(buf.validate.field).string = {
+    min_len: 2
+    max_len: 128
+  }];
+  // Labels lists only projects containing the given labels
+  optional metalstack.api.v2.Labels labels = 2;
+}
+
+// ProjectServiceListResponse is the response payload for the project list request
+message ProjectServiceListResponse {
+  // Projects is a list of all projects
+  repeated metalstack.api.v2.Project projects = 1;
+}
diff --git a/python/metalstack/admin/v2/project_connect.py b/python/metalstack/admin/v2/project_connect.py
new file mode 100644
index 00000000..abb8efa1
--- /dev/null
+++ b/python/metalstack/admin/v2/project_connect.py
@@ -0,0 +1,119 @@
+# -*- coding: utf-8 -*-
+# Generated by https://github.com/connectrpc/connect-python.  DO NOT EDIT!
+# source: metalstack/admin/v2/project.proto
+
+from collections.abc import AsyncIterator, Iterable, Iterator, Mapping
+from typing import Protocol
+
+from connectrpc.client import ConnectClient, ConnectClientSync
+from connectrpc.code import Code
+from connectrpc.errors import ConnectError
+from connectrpc.interceptor import Interceptor, InterceptorSync
+from connectrpc.method import IdempotencyLevel, MethodInfo
+from connectrpc.request import Headers, RequestContext
+from connectrpc.server import ConnectASGIApplication, ConnectWSGIApplication, Endpoint, EndpointSync
+import metalstack.admin.v2.project_pb2 as metalstack_dot_admin_dot_v2_dot_project__pb2
+
+
+class ProjectService(Protocol):
+    async def list(self, request: metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class ProjectServiceASGIApplication(ConnectASGIApplication):
+    def __init__(self, service: ProjectService, *, interceptors: Iterable[Interceptor]=(), read_max_bytes: int | None = None) -> None:
+        super().__init__(
+            endpoints={
+                "/metalstack.admin.v2.ProjectService/List": Endpoint.unary(
+                    method=MethodInfo(
+                        name="List",
+                        service_name="metalstack.admin.v2.ProjectService",
+                        input=metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.list,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/metalstack.admin.v2.ProjectService"
+
+
+class ProjectServiceClient(ConnectClient):
+    async def list(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="List",
+                service_name="metalstack.admin.v2.ProjectService",
+                input=metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListRequest,
+                output=metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+
+class ProjectServiceSync(Protocol):
+    def list(self, request: metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class ProjectServiceWSGIApplication(ConnectWSGIApplication):
+    def __init__(self, service: ProjectServiceSync, interceptors: Iterable[InterceptorSync]=(), read_max_bytes: int | None = None) -> None:
+        super().__init__(
+            endpoints={
+                "/metalstack.admin.v2.ProjectService/List": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="List",
+                        service_name="metalstack.admin.v2.ProjectService",
+                        input=metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.list,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/metalstack.admin.v2.ProjectService"
+
+
+class ProjectServiceClientSync(ConnectClientSync):
+    def list(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="List",
+                service_name="metalstack.admin.v2.ProjectService",
+                input=metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListRequest,
+                output=metalstack_dot_admin_dot_v2_dot_project__pb2.ProjectServiceListResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
diff --git a/python/metalstack/admin/v2/project_pb2.py b/python/metalstack/admin/v2/project_pb2.py
new file mode 100644
index 00000000..6f38e349
--- /dev/null
+++ b/python/metalstack/admin/v2/project_pb2.py
@@ -0,0 +1,48 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# NO CHECKED-IN PROTOBUF GENCODE
+# source: metalstack/admin/v2/project.proto
+# Protobuf Python Version: 6.32.1
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import runtime_version as _runtime_version
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+_runtime_version.ValidateProtobufRuntimeVersion(
+    _runtime_version.Domain.PUBLIC,
+    6,
+    32,
+    1,
+    '',
+    'metalstack/admin/v2/project.proto'
+)
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
+from metalstack.api.v2 import common_pb2 as metalstack_dot_api_dot_v2_dot_common__pb2
+from metalstack.api.v2 import project_pb2 as metalstack_dot_api_dot_v2_dot_project__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!metalstack/admin/v2/project.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/project.proto\"\x92\x01\n\x19ProjectServiceListRequest\x12\'\n\x06tenant\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x00R\x06tenant\x88\x01\x01\x12\x36\n\x06labels\x18\x02 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x01R\x06labels\x88\x01\x01\x42\t\n\x07_tenantB\t\n\x07_labels\"T\n\x1aProjectServiceListResponse\x12\x36\n\x08projects\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.ProjectR\x08projects2\x85\x01\n\x0eProjectService\x12s\n\x04List\x12..metalstack.admin.v2.ProjectServiceListRequest\x1a/.metalstack.admin.v2.ProjectServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x02\x42\xd0\x01\n\x17\x63om.metalstack.admin.v2B\x0cProjectProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'metalstack.admin.v2.project_pb2', _globals)
+if not _descriptor._USE_C_DESCRIPTORS:
+  _globals['DESCRIPTOR']._loaded_options = None
+  _globals['DESCRIPTOR']._serialized_options = b'\n\027com.metalstack.admin.v2B\014ProjectProtoP\001Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\242\002\003MAX\252\002\023Metalstack.Admin.V2\312\002\023Metalstack\\Admin\\V2\342\002\037Metalstack\\Admin\\V2\\GPBMetadata\352\002\025Metalstack::Admin::V2'
+  _globals['_PROJECTSERVICELISTREQUEST'].fields_by_name['tenant']._loaded_options = None
+  _globals['_PROJECTSERVICELISTREQUEST'].fields_by_name['tenant']._serialized_options = b'\272H\007r\005\020\002\030\200\001'
+  _globals['_PROJECTSERVICE'].methods_by_name['List']._loaded_options = None
+  _globals['_PROJECTSERVICE'].methods_by_name['List']._serialized_options = b'\322\363\030\002\001\002\340\363\030\002'
+  _globals['_PROJECTSERVICELISTREQUEST']._serialized_start=153
+  _globals['_PROJECTSERVICELISTREQUEST']._serialized_end=299
+  _globals['_PROJECTSERVICELISTRESPONSE']._serialized_start=301
+  _globals['_PROJECTSERVICELISTRESPONSE']._serialized_end=385
+  _globals['_PROJECTSERVICE']._serialized_start=388
+  _globals['_PROJECTSERVICE']._serialized_end=521
+# @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/admin/v2/project_pb2.pyi b/python/metalstack/admin/v2/project_pb2.pyi
new file mode 100644
index 00000000..0e89c975
--- /dev/null
+++ b/python/metalstack/admin/v2/project_pb2.pyi
@@ -0,0 +1,24 @@
+from buf.validate import validate_pb2 as _validate_pb2
+from metalstack.api.v2 import common_pb2 as _common_pb2
+from metalstack.api.v2 import project_pb2 as _project_pb2
+from google.protobuf.internal import containers as _containers
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from collections.abc import Iterable as _Iterable, Mapping as _Mapping
+from typing import ClassVar as _ClassVar, Optional as _Optional, Union as _Union
+
+DESCRIPTOR: _descriptor.FileDescriptor
+
+class ProjectServiceListRequest(_message.Message):
+    __slots__ = ("tenant", "labels")
+    TENANT_FIELD_NUMBER: _ClassVar[int]
+    LABELS_FIELD_NUMBER: _ClassVar[int]
+    tenant: str
+    labels: _common_pb2.Labels
+    def __init__(self, tenant: _Optional[str] = ..., labels: _Optional[_Union[_common_pb2.Labels, _Mapping]] = ...) -> None: ...
+
+class ProjectServiceListResponse(_message.Message):
+    __slots__ = ("projects",)
+    PROJECTS_FIELD_NUMBER: _ClassVar[int]
+    projects: _containers.RepeatedCompositeFieldContainer[_project_pb2.Project]
+    def __init__(self, projects: _Optional[_Iterable[_Union[_project_pb2.Project, _Mapping]]] = ...) -> None: ...
diff --git a/python/metalstack/client/client.py b/python/metalstack/client/client.py
index 35fcdd58..75f7d338 100755
--- a/python/metalstack/client/client.py
+++ b/python/metalstack/client/client.py
@@ -8,6 +8,7 @@
 import metalstack.admin.v2.machine_connect as admin_machine_connect
 import metalstack.admin.v2.network_connect as admin_network_connect
 import metalstack.admin.v2.partition_connect as admin_partition_connect
+import metalstack.admin.v2.project_connect as admin_project_connect
 import metalstack.admin.v2.size_connect as admin_size_connect
 import metalstack.admin.v2.switch_connect as admin_switch_connect
 import metalstack.admin.v2.tenant_connect as admin_tenant_connect
@@ -79,6 +80,9 @@ def network(self):
         def partition(self):
             return admin_partition_connect.PartitionServiceClientSync(address=self._baseurl, session=self._session)
 
+        def project(self):
+            return admin_project_connect.ProjectServiceClientSync(address=self._baseurl, session=self._session)
+
         def size(self):
             return admin_size_connect.SizeServiceClientSync(address=self._baseurl, session=self._session)