diff --git a/backend/src/routes/v1/auth.ts b/backend/src/routes/v1/auth.ts
index ce21f5136..b633f82ea 100644
--- a/backend/src/routes/v1/auth.ts
+++ b/backend/src/routes/v1/auth.ts
@@ -8,7 +8,7 @@ import { AuthMode } from "../../variables";
 
 router.post("/token", validateRequest, authController.getNewToken);
 
-router.post( // deprecated (moved to api/v2/auth/login1)
+router.post( // TODO endpoint: deprecate (moved to api/v3/auth/login1)
   "/login1",
   authLimiter,
   body("email").exists().trim().notEmpty(),
@@ -17,7 +17,7 @@ router.post( // deprecated (moved to api/v2/auth/login1)
   authController.login1
 );
 
-router.post( // deprecated (moved to api/v2/auth/login2)
+router.post( // TODO endpoint: deprecate (moved to api/v3/auth/login2)
   "/login2",
   authLimiter,
   body("email").exists().trim().notEmpty(),
@@ -49,7 +49,7 @@ router.get(
   authController.getCommonPasswords
 );
 
-router.delete(
+router.delete( // TODO endpoint: deprecate (moved to DELETE v2/users/me/sessions)
   "/sessions",
   authLimiter,
   requireAuth({
diff --git a/backend/src/routes/v1/inviteOrg.ts b/backend/src/routes/v1/inviteOrg.ts
index 089c0e53a..f79ce61d1 100644
--- a/backend/src/routes/v1/inviteOrg.ts
+++ b/backend/src/routes/v1/inviteOrg.ts
@@ -5,6 +5,8 @@ import { requireAuth, validateRequest } from "../../middleware";
 import { membershipOrgController } from "../../controllers/v1";
 import { AuthMode } from "../../variables";
 
+// TODO endpoint: consider moving these endpoints to be under /organization to be more RESTful
+
 router.post(
 	"/signup",
 	requireAuth({
diff --git a/backend/src/routes/v1/key.ts b/backend/src/routes/v1/key.ts
index a12c8c0bb..2274b3c3f 100644
--- a/backend/src/routes/v1/key.ts
+++ b/backend/src/routes/v1/key.ts
@@ -9,6 +9,8 @@ import { body, param } from "express-validator";
 import { ADMIN, AuthMode, MEMBER } from "../../variables";
 import { keyController } from "../../controllers/v1";
 
+// TODO endpoint: consider moving these endpoints to be under /workspaces to be more RESTful
+
 router.post(
 	"/:workspaceId",
 	requireAuth({
diff --git a/backend/src/routes/v1/membership.ts b/backend/src/routes/v1/membership.ts
index be495b62c..ff4107022 100644
--- a/backend/src/routes/v1/membership.ts
+++ b/backend/src/routes/v1/membership.ts
@@ -7,6 +7,7 @@ import { membershipController as EEMembershipControllers } from "../../ee/contro
 import { AuthMode } from "../../variables";
 
 // note: ALL DEPRECIATED (moved to api/v2/workspace/:workspaceId/memberships/:membershipId)
+// TODO endpoint: consider moving these endpoints to be under /workspace to be more RESTful
 
 router.get( // used for old CLI (deprecate)
 	"/:workspaceId/connect",
@@ -18,7 +19,7 @@ router.get( // used for old CLI (deprecate)
 	membershipController.validateMembership
 );
 
-router.delete(
+router.delete( // TODO endpoint: check dashboard
 	"/:membershipId",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -28,7 +29,7 @@ router.delete(
 	membershipController.deleteMembership
 );
 
-router.post(
+router.post( // TODO endpoint: check dashboard
 	"/:membershipId/change-role",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -38,7 +39,7 @@ router.post(
 	membershipController.changeMembershipRole
 );
 
-router.post(
+router.post( // TODO endpoint: check dashboard
 	"/:membershipId/deny-permissions",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
diff --git a/backend/src/routes/v1/membershipOrg.ts b/backend/src/routes/v1/membershipOrg.ts
index 92472eb03..34899072b 100644
--- a/backend/src/routes/v1/membershipOrg.ts
+++ b/backend/src/routes/v1/membershipOrg.ts
@@ -5,8 +5,7 @@ import { requireAuth, validateRequest } from "../../middleware";
 import { membershipOrgController } from "../../controllers/v1";
 import { AuthMode } from "../../variables";
 
-router.post(
-	// TODO
+router.post( // TODO endpoint: check dashboard
 	"/membershipOrg/:membershipOrgId/change-role",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -17,7 +16,7 @@ router.post(
 );
 
 router.delete(
-	"/:membershipOrgId",
+	"/:membershipOrgId", // TODO endpoint: check dashboard
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
 	}),
diff --git a/backend/src/routes/v1/organization.ts b/backend/src/routes/v1/organization.ts
index 8f4a924e9..1c6b5b7e4 100644
--- a/backend/src/routes/v1/organization.ts
+++ b/backend/src/routes/v1/organization.ts
@@ -15,7 +15,7 @@ import {
 } from "../../variables";
 import { organizationController } from "../../controllers/v1";
 
-router.get( // deprecated (moved to api/v2/users/me/organizations)
+router.get( // TODO endpoint: deprecate (moved to api/v2/users/me/organizations)
 	"/",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -47,7 +47,7 @@ router.get(
 	organizationController.getOrganization
 );
 
-router.get( // deprecated (moved to api/v2/organizations/:organizationId/memberships)
+router.get( // TODO endpoint: deprecate (moved to api/v2/organizations/:organizationId/memberships)
 	"/:organizationId/users",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -61,7 +61,7 @@ router.get( // deprecated (moved to api/v2/organizations/:organizationId/members
 	organizationController.getOrganizationMembers
 );
 
-router.get(
+router.get( // TODO endpoint: move to /v2/users/me/organizations/:organizationId/workspaces
 	"/:organizationId/my-workspaces", // deprecated (moved to api/v2/organizations/:organizationId/workspaces)
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -135,7 +135,7 @@ router.delete(
 );
 
 router.post(
-	"/:organizationId/customer-portal-session",
+	"/:organizationId/customer-portal-session", // TODO endpoint: move to EE
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
 	}),
@@ -149,7 +149,7 @@ router.post(
 );
 
 router.get(
-	"/:organizationId/subscriptions",
+	"/:organizationId/subscriptions", // TODO endpoint: deprecate
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
 	}),
diff --git a/backend/src/routes/v1/secret.ts b/backend/src/routes/v1/secret.ts
index 10668de34..e2b63e9ef 100644
--- a/backend/src/routes/v1/secret.ts
+++ b/backend/src/routes/v1/secret.ts
@@ -14,9 +14,9 @@ import {
 	MEMBER
 } from "../../variables";
 
-// note to devs: these endpoints will be deprecated in favor of v2
+// note: endpoints deprecated in favor of v3/secrets
 
-router.post(
+router.post( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
 	"/:workspaceId",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -34,7 +34,7 @@ router.post(
 	secretController.pushSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
 	"/:workspaceId",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -50,7 +50,7 @@ router.get(
 	secretController.pullSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
 	"/:workspaceId/service-token",
 	requireServiceTokenAuth,
 	query("environment").exists().trim(),
diff --git a/backend/src/routes/v1/serviceToken.ts b/backend/src/routes/v1/serviceToken.ts
index aaf35e85f..e79d24ffa 100644
--- a/backend/src/routes/v1/serviceToken.ts
+++ b/backend/src/routes/v1/serviceToken.ts
@@ -16,13 +16,13 @@ import { serviceTokenController } from "../../controllers/v1";
 
 // note: deprecate service-token routes in favor of service-token data routes/structure
 
-router.get(
+router.get( // TODO endpoint: deprecate
 	"/",
 	requireServiceTokenAuth,
 	serviceTokenController.getServiceToken
 );
 
-router.post(
+router.post( // TODO endpoint: deprecate
 	"/",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
diff --git a/backend/src/routes/v1/signup.ts b/backend/src/routes/v1/signup.ts
index 1b82edd3a..80d250b1a 100644
--- a/backend/src/routes/v1/signup.ts
+++ b/backend/src/routes/v1/signup.ts
@@ -5,7 +5,9 @@ import { validateRequest } from "../../middleware";
 import { signupController } from "../../controllers/v1";
 import { authLimiter } from "../../helpers/rateLimiter";
 
-router.post(
+// TODO: consider moving to users/v3/signup
+
+router.post( // TODO endpoint: consider moving to v3/users/signup/mail
 	"/email/signup",
 	authLimiter,
 	body("email").exists().trim().notEmpty().isEmail(),
@@ -14,7 +16,7 @@ router.post(
 );
 
 router.post(
-	"/email/verify",
+	"/email/verify", // TODO endpoint: consider moving to v3/users/signup/verify
 	authLimiter,
 	body("email").exists().trim().notEmpty().isEmail(),
 	body("code").exists().trim().notEmpty(),
@@ -22,4 +24,4 @@ router.post(
 	signupController.verifyEmailSignup
 );
 
-export default router;
+export default router;
\ No newline at end of file
diff --git a/backend/src/routes/v1/user.ts b/backend/src/routes/v1/user.ts
index 73012c1ea..85333db9b 100644
--- a/backend/src/routes/v1/user.ts
+++ b/backend/src/routes/v1/user.ts
@@ -4,7 +4,7 @@ import { requireAuth } from "../../middleware";
 import { userController } from "../../controllers/v1";
 import { AuthMode } from "../../variables";
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to v2/users/me)
     "/", 
     requireAuth({
         acceptedAuthModes: [AuthMode.JWT],
diff --git a/backend/src/routes/v1/workspace.ts b/backend/src/routes/v1/workspace.ts
index 9a4554be6..f08d92865 100644
--- a/backend/src/routes/v1/workspace.ts
+++ b/backend/src/routes/v1/workspace.ts
@@ -147,7 +147,7 @@ router.get(
 );
 
 router.get(
-	"/:workspaceId/service-tokens", // deprecate
+	"/:workspaceId/service-tokens", // TODO endpoint: deprecate
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
 	}),
diff --git a/backend/src/routes/v2/auth.ts b/backend/src/routes/v2/auth.ts
index 444819f27..bf348c279 100644
--- a/backend/src/routes/v2/auth.ts
+++ b/backend/src/routes/v2/auth.ts
@@ -5,7 +5,7 @@ import { requireMfaAuth, validateRequest } from "../../middleware";
 import { authController } from "../../controllers/v2";
 import { authLimiter } from "../../helpers/rateLimiter";
 
-router.post(
+router.post( // TODO: deprecate (moved to api/v3/auth/login1)
   "/login1",
   authLimiter,
   body("email").isString().trim().notEmpty(),
@@ -14,7 +14,7 @@ router.post(
   authController.login1
 );
 
-router.post(
+router.post( // TODO: deprecate (moved to api/v3/auth/login1)
   "/login2",
   authLimiter,
   body("email").isString().trim().notEmpty(),
diff --git a/backend/src/routes/v2/organizations.ts b/backend/src/routes/v2/organizations.ts
index b305c1c0a..55f8606df 100644
--- a/backend/src/routes/v2/organizations.ts
+++ b/backend/src/routes/v2/organizations.ts
@@ -85,7 +85,7 @@ router.get(
     organizationsController.getOrganizationWorkspaces
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate service accounts
     "/:organizationId/service-accounts",
     param("organizationId").exists().trim(),
     validateRequest,
diff --git a/backend/src/routes/v2/secret.ts b/backend/src/routes/v2/secret.ts
index d9fedda20..1707a927f 100644
--- a/backend/src/routes/v2/secret.ts
+++ b/backend/src/routes/v2/secret.ts
@@ -1,4 +1,5 @@
 import express from "express";
+const router = express.Router();
 import { 
   requireAuth, 
   requireSecretAuth,
@@ -16,11 +17,9 @@ import {
 import { CreateSecretRequestBody, ModifySecretRequestBody } from "../../types/secret";
 import { secretController } from "../../controllers/v2";
 
-// note to devs: stop supporting these routes [deprecated]
+// note: endpoints deprecated in favor of v3/secrets
 
-const router = express.Router();
-
-router.post(
+router.post( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   "/batch-create/workspace/:workspaceId/environment/:environment",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT],
@@ -38,7 +37,7 @@ router.post(
 );
 
 router.post(
-  "/workspace/:workspaceId/environment/:environment",
+  "/workspace/:workspaceId/environment/:environment", // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT],
   }),
@@ -54,7 +53,7 @@ router.post(
   secretController.createSecret
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
   "/workspace/:workspaceId",
   param("workspaceId").exists().trim(),
   query("environment").exists(),
@@ -70,7 +69,7 @@ router.get(
   secretController.getSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   "/:secretId",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN],
@@ -83,7 +82,7 @@ router.get(
   secretController.getSecret
 );
 
-router.delete(
+router.delete( // TODO endpoint: deprecate (moved to DELETE api/v3/secrets)
   "/batch/workspace/:workspaceId/environment/:environmentName",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT],
@@ -99,7 +98,7 @@ router.delete(
   secretController.deleteSecrets
 );
 
-router.delete(
+router.delete( // TODO endpoint: deprecate (moved to DELETE api/v3/secrets)
   "/:secretId",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT],
@@ -113,7 +112,7 @@ router.delete(
   secretController.deleteSecret
 );
 
-router.patch(
+router.patch( // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
   "/batch-modify/workspace/:workspaceId/environment/:environmentName",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT],
@@ -129,7 +128,7 @@ router.patch(
   secretController.updateSecrets
 );
 
-router.patch(
+router.patch( // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
   "/workspace/:workspaceId/environment/:environmentName",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT],
diff --git a/backend/src/routes/v2/secrets.ts b/backend/src/routes/v2/secrets.ts
index 52196e983..cb60035a7 100644
--- a/backend/src/routes/v2/secrets.ts
+++ b/backend/src/routes/v2/secrets.ts
@@ -21,7 +21,7 @@ import {
 } from "../../variables";
 import { BatchSecretRequest } from "../../types/secret";
 
-router.post(
+router.post( // TODO endpoint: strongly consider deprecation in favor of a single operation experience on dashboard
   "/batch",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
@@ -56,7 +56,7 @@ router.post(
   secretsController.batchSecrets
 );
 
-router.post(
+router.post( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   "/",
   body("workspaceId").exists().isString().trim(),
   body("environment").exists().isString().trim(),
@@ -117,7 +117,7 @@ router.post(
   secretsController.createSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
   "/",
   query("workspaceId").exists().trim(),
   query("environment").exists().trim(),
@@ -138,7 +138,7 @@ router.get(
   secretsController.getSecrets
 );
 
-router.patch(
+router.patch( // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
   "/",
   body("secrets")
     .exists()
@@ -173,7 +173,7 @@ router.patch(
   secretsController.updateSecrets
 );
 
-router.delete(
+router.delete( // TODO endpoint: deprecate (moved to DELETE api/v3/secrets)
   "/",
   body("secretIds")
     .exists()
diff --git a/backend/src/routes/v2/serviceAccounts.ts b/backend/src/routes/v2/serviceAccounts.ts
index daf048a23..85b7c9350 100644
--- a/backend/src/routes/v2/serviceAccounts.ts
+++ b/backend/src/routes/v2/serviceAccounts.ts
@@ -1,5 +1,8 @@
 import express from "express";
 const router = express.Router();
+
+// TODO endpoint: deprecate all
+
 // import {
 //     requireAuth,
 //     requireOrganizationAuth,
diff --git a/backend/src/routes/v2/signup.ts b/backend/src/routes/v2/signup.ts
index cc701b034..eb376f56c 100644
--- a/backend/src/routes/v2/signup.ts
+++ b/backend/src/routes/v2/signup.ts
@@ -6,7 +6,7 @@ import { signupController } from "../../controllers/v2";
 import { authLimiter } from "../../helpers/rateLimiter";
 
 router.post(
-    "/complete-account/signup",
+    "/complete-account/signup", // TODO endpoint: deprecate (moved to v3/signup/complete/account-signup)
     authLimiter,
     requireSignupAuth,
     body("email").exists().isString().trim().notEmpty().isEmail(),
@@ -27,7 +27,7 @@ router.post(
 );
 
 router.post(
-	"/complete-account/invite",
+	"/complete-account/invite", // TODO: consider moving to v3/users/new/complete-account/invite
 	authLimiter,
 	requireSignupAuth,
 	body("email").exists().isString().trim().notEmpty().isEmail(),
diff --git a/backend/src/routes/v2/workspace.ts b/backend/src/routes/v2/workspace.ts
index 77ed75eb1..fde41d945 100644
--- a/backend/src/routes/v2/workspace.ts
+++ b/backend/src/routes/v2/workspace.ts
@@ -14,7 +14,7 @@ import {
 } from "../../variables";
 import { workspaceController } from "../../controllers/v2";
 
-router.post(
+router.post( // TODO endpoint: deprecate (moved to POST v3/secrets)
 	"/:workspaceId/secrets",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT],
@@ -32,7 +32,7 @@ router.post(
 	workspaceController.pushWorkspaceSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET v3/secrets)
 	"/:workspaceId/secrets",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN],
@@ -48,7 +48,7 @@ router.get(
 	workspaceController.pullSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: consider moving to v3/users/me/workspaces/:workspaceId/key
 	"/:workspaceId/encrypted-key",
 	requireAuth({
 		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
diff --git a/backend/src/routes/v3/signup.ts b/backend/src/routes/v3/signup.ts
index 52b3a8fa0..bfd0c9c4d 100644
--- a/backend/src/routes/v3/signup.ts
+++ b/backend/src/routes/v3/signup.ts
@@ -6,7 +6,7 @@ import { authLimiter } from "../../helpers/rateLimiter";
 import { validateRequest } from "../../middleware";
 
 router.post(
-    "/complete-account/signup",
+    "/complete-account/signup", // TODO: consider moving endpoint to v3/users/new/complete-account/signup
     authLimiter,
     body("email").exists().isString().trim().notEmpty().isEmail(),
 	body("firstName").exists().isString().trim().notEmpty(),