feat: corrected v1 and v2 server name conflict and added all routes

backend/src/server/routes/index.ts

@@ -241,6 +241,8 @@ import { identityTokenAuthServiceFactory } from "@app/services/identity-token-au
 import { identityUaClientSecretDALFactory } from "@app/services/identity-ua/identity-ua-client-secret-dal";
 import { identityUaDALFactory } from "@app/services/identity-ua/identity-ua-dal";
 import { identityUaServiceFactory } from "@app/services/identity-ua/identity-ua-service";
+import { identityV2DALFactory } from "@app/services/identity-v2/identity-dal";
+import { identityV2ServiceFactory } from "@app/services/identity-v2/identity-service";
 import { integrationDALFactory } from "@app/services/integration/integration-dal";
 import { integrationServiceFactory } from "@app/services/integration/integration-service";
 import { integrationAuthDALFactory } from "@app/services/integration-auth/integration-auth-dal";
@@ -445,6 +447,7 @@ export const registerRoutes = async (
   const serviceTokenDAL = serviceTokenDALFactory(db);
 
   const identityDAL = identityDALFactory(db);
+  const identityV2DAL = identityV2DALFactory(db);
   const identityMetadataDAL = identityMetadataDALFactory(db);
   const identityAccessTokenDAL = identityAccessTokenDALFactory(db);
   const identityOrgMembershipDAL = identityOrgDALFactory(db);
@@ -1656,6 +1659,16 @@ export const registerRoutes = async (
     membershipIdentityDAL,
     membershipRoleDAL
   });
+
+  const identityV2Service = identityV2ServiceFactory({
+    membershipIdentityDAL,
+    membershipRoleDAL,
+    identityMetadataDAL,
+    licenseService,
+    permissionService,
+    identityDAL: identityV2DAL
+  });
+
   const identityProjectService = identityProjectServiceFactory({
     identityProjectDAL,
     membershipIdentityDAL,
@@ -2459,7 +2472,8 @@ export const registerRoutes = async (
     integrationAuth: integrationAuthService,
     webhook: webhookService,
     serviceToken: serviceTokenService,
-    identity: identityService,
+    identityV1: identityService,
+    identityV2: identityV2Service,
     identityAuthTemplate: identityAuthTemplateService,
     identityAccessToken: identityAccessTokenService,
     identityTokenAuth: identityTokenAuthService,

backend/src/server/routes/v1/identity-org-membership-router.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { AccessScope, IdentitiesSchema, MembershipRolesSchema, TemporaryPermissionMode } from "@app/db/schemas";
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags, ORG_IDENTITY_MEMBERSHIP } from "@app/lib/api-docs";
 import { ms } from "@app/lib/ms";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -15,7 +16,7 @@ const sanitizedOrgIdentityMembershipSchema = z.object({
   updatedAt: z.date()
 });
 
-export const registerOrgIdentityMembershipRouter = async (server: FastifyZodProvider) => {
+export const registerIdentityOrgMembershipRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
     url: "/identity-memberships/:identityId",
@@ -87,6 +88,18 @@ export const registerOrgIdentityMembershipRouter = async (server: FastifyZodProv
         }
       });
 
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.CREATE_IDENTITY_ORG_MEMBERSHIP,
+          metadata: {
+            identityId: req.params.identityId,
+            roles: req.body.roles
+          }
+        }
+      });
+
       return {
         identityMembership: { ...membership, identityId: req.params.identityId, orgId: req.permission.orgId }
       };
@@ -166,6 +179,18 @@ export const registerOrgIdentityMembershipRouter = async (server: FastifyZodProv
         }
       });
 
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.UPDATE_IDENTITY_ORG_MEMBERSHIP,
+          metadata: {
+            identityId: req.params.identityId,
+            roles: req.body.roles
+          }
+        }
+      });
+
       return {
         roles: membership.roles.map((el) => ({ ...el, membershipId: membership.id }))
       };
@@ -209,6 +234,17 @@ export const registerOrgIdentityMembershipRouter = async (server: FastifyZodProv
         }
       });
 
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.DELETE_IDENTITY_ORG_MEMBERSHIP,
+          metadata: {
+            identityId: req.params.identityId
+          }
+        }
+      });
+
       return {
         identityMembership: { ...membership, identityId: req.params.identityId, orgId: req.permission.orgId }
       };

backend/src/server/routes/v1/identity-project-membership-router.ts

@@ -1,438 +0,0 @@
-import { z } from "zod";
-
-import { AccessScope, IdentitiesSchema, MembershipRolesSchema, TemporaryPermissionMode } from "@app/db/schemas";
-import { ApiDocsTags, PROJECT_IDENTITY_MEMBERSHIP } from "@app/lib/api-docs";
-import { ms } from "@app/lib/ms";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-const sanitizedProjectIdentityMembershipSchema = z.object({
-  id: z.string().uuid(),
-  projectId: z.string(),
-  identityId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export const registerProjectIdentityMembershipRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "POST",
-    url: "/:projectId/identity-memberships/:identityId",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.ProjectIdentityMembership],
-      description: "Create project identity membership",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.projectId),
-        identityId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.identityId)
-      }),
-      body: z.object({
-        roles: z
-          .array(
-            z.union([
-              z.object({
-                role: z.string().describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.roles.role),
-                isTemporary: z
-                  .literal(false)
-                  .default(false)
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.roles.isTemporary)
-              }),
-              z.object({
-                role: z.string().describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.roles.role),
-                isTemporary: z
-                  .literal(true)
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.roles.isTemporary),
-                temporaryMode: z
-                  .nativeEnum(TemporaryPermissionMode)
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.roles.temporaryMode),
-                temporaryRange: z
-                  .string()
-                  .refine((val) => ms(val) > 0, "Temporary range must be a positive number")
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.roles.temporaryRange),
-                temporaryAccessStartTime: z
-                  .string()
-                  .datetime()
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.roles.temporaryAccessStartTime)
-              })
-            ])
-          )
-          .describe(PROJECT_IDENTITY_MEMBERSHIP.CREATE_IDENTITY_MEMBERSHIP.roles.description)
-          .min(1)
-      }),
-      response: {
-        200: z.object({
-          identityMembership: sanitizedProjectIdentityMembershipSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const { membership } = await server.services.membershipIdentity.createMembership({
-        permission: req.permission,
-        scopeData: {
-          scope: AccessScope.Project,
-          orgId: req.permission.orgId,
-          projectId: req.params.projectId
-        },
-        data: {
-          identityId: req.params.identityId,
-          roles: req.body.roles
-        }
-      });
-
-      return {
-        identityMembership: { ...membership, identityId: req.params.identityId, projectId: req.params.projectId }
-      };
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/:projectId/identity-memberships/:identityId",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.ProjectIdentityMembership],
-      description: "Update project identity membership",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.projectId),
-        identityId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.identityId)
-      }),
-      body: z.object({
-        roles: z
-          .array(
-            z.union([
-              z.object({
-                role: z.string().describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.roles.role),
-                isTemporary: z
-                  .literal(false)
-                  .default(false)
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.roles.isTemporary)
-              }),
-              z.object({
-                role: z.string().describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.roles.role),
-                isTemporary: z
-                  .literal(true)
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.roles.isTemporary),
-                temporaryMode: z
-                  .nativeEnum(TemporaryPermissionMode)
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.roles.temporaryMode),
-                temporaryRange: z
-                  .string()
-                  .refine((val) => ms(val) > 0, "Temporary range must be a positive number")
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.roles.temporaryRange),
-                temporaryAccessStartTime: z
-                  .string()
-                  .datetime()
-                  .describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.roles.temporaryAccessStartTime)
-              })
-            ])
-          )
-          .min(1)
-          .describe(PROJECT_IDENTITY_MEMBERSHIP.UPDATE_IDENTITY_MEMBERSHIP.roles.description)
-      }),
-      response: {
-        200: z.object({
-          roles: MembershipRolesSchema.array()
-        })
-      }
-    },
-    handler: async (req) => {
-      const { membership } = await server.services.membershipIdentity.updateMembership({
-        permission: req.permission,
-        scopeData: {
-          scope: AccessScope.Project,
-          orgId: req.permission.orgId,
-          projectId: req.params.projectId
-        },
-        selector: {
-          identityId: req.params.identityId
-        },
-        data: {
-          roles: req.body.roles
-        }
-      });
-
-      return {
-        roles: membership.roles.map((el) => ({ ...el, membershipId: membership.id }))
-      };
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: "/:projectId/identity-memberships/:identityId",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.ProjectIdentityMembership],
-      description: "Delete project identity membership",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.DELETE_IDENTITY_MEMBERSHIP.projectId),
-        identityId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.DELETE_IDENTITY_MEMBERSHIP.identityId)
-      }),
-      response: {
-        200: z.object({
-          identityMembership: sanitizedProjectIdentityMembershipSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const { membership } = await server.services.membershipIdentity.deleteMembership({
-        permission: req.permission,
-        scopeData: {
-          scope: AccessScope.Project,
-          orgId: req.permission.orgId,
-          projectId: req.params.projectId
-        },
-        selector: {
-          identityId: req.params.identityId
-        }
-      });
-
-      return {
-        identityMembership: { ...membership, identityId: req.params.identityId, projectId: req.params.projectId }
-      };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:projectId/identity-memberships",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.ProjectIdentityMembership],
-      description: "List project identity memberships",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.projectId)
-      }),
-      querystring: z.object({
-        offset: z.coerce
-          .number()
-          .min(0)
-          .default(0)
-          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.offset)
-          .optional(),
-        limit: z.coerce
-          .number()
-          .min(1)
-          .max(100)
-          .default(20)
-          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.limit)
-          .optional(),
-        identityName: z
-          .string()
-          .trim()
-          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.identityName)
-          .optional(),
-        roles: z
-          .string()
-          .transform((val) => val.split(",").map((role) => role.trim()))
-          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.roles)
-          .optional()
-      }),
-      response: {
-        200: z.object({
-          identityMemberships: z
-            .object({
-              id: z.string(),
-              identityId: z.string(),
-              createdAt: z.date(),
-              updatedAt: z.date(),
-              roles: z.array(
-                z.object({
-                  id: z.string(),
-                  role: z.string(),
-                  customRoleId: z.string().optional().nullable(),
-                  customRoleName: z.string().optional().nullable(),
-                  customRoleSlug: z.string().optional().nullable(),
-                  isTemporary: z.boolean(),
-                  temporaryMode: z.string().optional().nullable(),
-                  temporaryRange: z.string().nullable().optional(),
-                  temporaryAccessStartTime: z.date().nullable().optional(),
-                  temporaryAccessEndTime: z.date().nullable().optional()
-                })
-              ),
-              identity: IdentitiesSchema.pick({ name: true, id: true, orgId: true, projectId: true })
-            })
-            .array(),
-          totalCount: z.number()
-        })
-      }
-    },
-    handler: async (req) => {
-      const { data: identityMemberships, totalCount } = await server.services.membershipIdentity.listMemberships({
-        permission: req.permission,
-        scopeData: {
-          scope: AccessScope.Project,
-          orgId: req.permission.orgId,
-          projectId: req.params.projectId
-        },
-        data: {
-          offset: req.query.offset,
-          limit: req.query.limit,
-          identityName: req.query.identityName,
-          roles: req.query.roles
-        }
-      });
-
-      return { identityMemberships, totalCount };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:projectId/identity-memberships/:identityId",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.ProjectIdentityMembership],
-      description: "Get project identity membership by identity ID",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.GET_IDENTITY_MEMBERSHIP_BY_ID.projectId),
-        identityId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.GET_IDENTITY_MEMBERSHIP_BY_ID.identityId)
-      }),
-      response: {
-        200: z.object({
-          identityMembership: z.object({
-            id: z.string(),
-            createdAt: z.date(),
-            updatedAt: z.date(),
-            roles: z.array(
-              z.object({
-                id: z.string(),
-                role: z.string(),
-                customRoleId: z.string().optional().nullable(),
-                customRoleName: z.string().optional().nullable(),
-                customRoleSlug: z.string().optional().nullable(),
-                isTemporary: z.boolean(),
-                temporaryMode: z.string().optional().nullable(),
-                temporaryRange: z.string().nullable().optional(),
-                temporaryAccessStartTime: z.date().nullable().optional(),
-                temporaryAccessEndTime: z.date().nullable().optional()
-              })
-            ),
-            identity: IdentitiesSchema.pick({ name: true, id: true, orgId: true, projectId: true }).extend({
-              authMethods: z.array(z.string())
-            })
-          })
-        })
-      }
-    },
-    handler: async (req) => {
-      const identityMembership = await server.services.membershipIdentity.getMembershipByIdentityId({
-        permission: req.permission,
-        scopeData: {
-          scope: AccessScope.Project,
-          orgId: req.permission.orgId,
-          projectId: req.params.projectId
-        },
-        selector: {
-          identityId: req.params.identityId
-        }
-      });
-
-      return { identityMembership };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:projectId/available-identities",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.ProjectIdentityMembership],
-      description: "List available identities for project membership",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_AVAILABLE_IDENTITIES.projectId)
-      }),
-      querystring: z.object({
-        offset: z.coerce
-          .number()
-          .min(0)
-          .default(0)
-          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_AVAILABLE_IDENTITIES.offset)
-          .optional(),
-        limit: z.coerce
-          .number()
-          .min(1)
-          .max(100)
-          .default(20)
-          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_AVAILABLE_IDENTITIES.limit)
-          .optional()
-      }),
-      response: {
-        200: z.object({
-          identities: IdentitiesSchema.pick({ id: true, name: true }).array()
-        })
-      }
-    },
-    handler: async (req) => {
-      const { identities } = await server.services.membershipIdentity.listAvailableIdentities({
-        permission: req.permission,
-        scopeData: {
-          scope: AccessScope.Project,
-          orgId: req.permission.orgId,
-          projectId: req.params.projectId
-        },
-        data: {
-          offset: req.query.offset,
-          limit: req.query.limit
-        }
-      });
-
-      return { identities };
-    }
-  });
-};

backend/src/server/routes/v1/identity-project-router.ts

@@ -8,7 +8,7 @@ import {
   ProjectUserMembershipRolesSchema,
   TemporaryPermissionMode
 } from "@app/db/schemas";
-import { ApiDocsTags, ORGANIZATIONS, PROJECT_IDENTITIES } from "@app/lib/api-docs";
+import { ApiDocsTags, ORGANIZATIONS, PROJECT_IDENTITIES, PROJECT_IDENTITY_MEMBERSHIP } from "@app/lib/api-docs";
 import { BadRequestError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { OrderByDirection } from "@app/lib/types";
@@ -19,7 +19,7 @@ import { ProjectIdentityOrderBy } from "@app/services/identity-project/identity-
 
 import { SanitizedProjectSchema } from "../sanitizedSchemas";
 
-export const registerIdentityProjectRouter = async (server: FastifyZodProvider) => {
+export const registerIdentityProjectMembershipRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
     url: "/:projectId/identity-memberships/:identityId",
@@ -436,4 +436,62 @@ export const registerIdentityProjectRouter = async (server: FastifyZodProvider)
       return { identityMembership };
     }
   });
+
+  server.route({
+    method: "GET",
+    url: "/:projectId/available-identities",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.IdentityProjectMembership],
+      description: "List available identities for project membership",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_AVAILABLE_IDENTITIES.projectId)
+      }),
+      querystring: z.object({
+        offset: z.coerce
+          .number()
+          .min(0)
+          .default(0)
+          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_AVAILABLE_IDENTITIES.offset)
+          .optional(),
+        limit: z.coerce
+          .number()
+          .min(1)
+          .max(100)
+          .default(20)
+          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_AVAILABLE_IDENTITIES.limit)
+          .optional()
+      }),
+      response: {
+        200: z.object({
+          identities: IdentitiesSchema.pick({ id: true, name: true }).array()
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identities } = await server.services.membershipIdentity.listAvailableIdentities({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          orgId: req.permission.orgId,
+          projectId: req.params.projectId
+        },
+        data: {
+          offset: req.query.offset,
+          limit: req.query.limit
+        }
+      });
+
+      return { identities };
+    }
+  });
 };

backend/src/server/routes/v1/identity-router.ts

@@ -60,7 +60,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const identity = await server.services.identity.createIdentity({
+      const identity = await server.services.identityV1.createIdentity({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -136,7 +136,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const identity = await server.services.identity.updateIdentity({
+      const identity = await server.services.identityV1.updateIdentity({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -189,7 +189,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const identity = await server.services.identity.deleteIdentity({
+      const identity = await server.services.identityV1.deleteIdentity({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -258,7 +258,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const identity = await server.services.identity.getIdentityById({
+      const identity = await server.services.identityV1.getIdentityById({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -308,7 +308,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { identityMemberships, totalCount } = await server.services.identity.listOrgIdentities({
+      const { identityMemberships, totalCount } = await server.services.identityV1.listOrgIdentities({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -402,7 +402,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { identityMemberships, totalCount } = await server.services.identity.searchOrgIdentities({
+      const { identityMemberships, totalCount } = await server.services.identityV1.searchOrgIdentities({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -468,7 +468,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const identityMemberships = await server.services.identity.listProjectIdentitiesByIdentityId({
+      const identityMemberships = await server.services.identityV1.listProjectIdentitiesByIdentityId({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,

backend/src/server/routes/v1/index.ts

@@ -33,8 +33,8 @@ import { registerIdentityKubernetesRouter } from "./identity-kubernetes-auth-rou
 import { registerIdentityLdapAuthRouter } from "./identity-ldap-auth-router";
 import { registerIdentityOciAuthRouter } from "./identity-oci-auth-router";
 import { registerIdentityOidcAuthRouter } from "./identity-oidc-auth-router";
-import { registerOrgIdentityMembershipRouter } from "./identity-org-membership-router";
-import { registerIdentityProjectRouter } from "./identity-project-router";
+import { registerIdentityOrgMembershipRouter } from "./identity-org-membership-router";
+import { registerIdentityProjectMembershipRouter } from "./identity-project-router";
 import { registerIdentityRouter } from "./identity-router";
 import { registerIdentityTlsCertAuthRouter } from "./identity-tls-cert-auth-router";
 import { registerIdentityTokenAuthRouter } from "./identity-token-auth-router";
@@ -45,6 +45,7 @@ import { registerInviteOrgRouter } from "./invite-org-router";
 import { registerMicrosoftTeamsRouter } from "./microsoft-teams-router";
 import { registerNotificationRouter } from "./notification-router";
 import { registerOrgAdminRouter } from "./org-admin-router";
+import { registerOrgIdentityRouter } from "./org-identity-router";
 import { registerOrgRouter } from "./organization-router";
 import { registerPasswordRouter } from "./password-router";
 import { registerPkiAlertRouter } from "./pki-alert-router";
@@ -52,6 +53,7 @@ import { registerPkiCollectionRouter } from "./pki-collection-router";
 import { registerPkiSubscriberRouter } from "./pki-subscriber-router";
 import { PKI_SYNC_REGISTER_ROUTER_MAP, registerPkiSyncRouter } from "./pki-sync-routers";
 import { registerProjectEnvRouter } from "./project-env-router";
+import { registerProjectIdentityRouter } from "./project-identity-router";
 import { registerProjectKeyRouter } from "./project-key-router";
 import { registerProjectMembershipRouter } from "./project-membership-router";
 import { registerProjectRouter } from "./project-router";
@@ -90,8 +92,14 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
     { prefix: "/auth" }
   );
   await server.register(registerPasswordRouter, { prefix: "/password" });
-  await server.register(registerOrgRouter, { prefix: "/organization" });
-  await server.register(registerOrgIdentityMembershipRouter, { prefix: "/organization" });
+  await server.register(
+    async (orgRouter) => {
+      await orgRouter.register(registerOrgRouter);
+      await orgRouter.register(registerOrgIdentityRouter);
+      await orgRouter.register(registerIdentityOrgMembershipRouter);
+    },
+    { prefix: "/organization" }
+  );
   await server.register(registerAdminRouter, { prefix: "/admin" });
   await server.register(registerOrgAdminRouter, { prefix: "/organization-admin" });
   await server.register(registerUserRouter, { prefix: "/user" });
@@ -126,10 +134,11 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
     async (projectRouter) => {
       await projectRouter.register(registerProjectRouter);
       await projectRouter.register(registerProjectMembershipRouter);
+      await projectRouter.register(registerProjectIdentityRouter);
       await projectRouter.register(registerProjectEnvRouter);
       await projectRouter.register(registerSecretTagRouter);
       await projectRouter.register(registerGroupProjectRouter);
-      await projectRouter.register(registerIdentityProjectRouter);
+      await projectRouter.register(registerIdentityProjectMembershipRouter);
     },
     { prefix: "/projects" }
   );

backend/src/server/routes/v1/org-identity-router.ts

@@ -0,0 +1,286 @@
+import { z } from "zod";
+
+import { AccessScope, IdentitiesSchema } from "@app/db/schemas";
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { ApiDocsTags, IDENTITIES } from "@app/lib/api-docs";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+const metadataSchema = z.object({
+  key: z.string().trim().min(1, "Metadata key cannot be empty"),
+  value: z.string().trim().min(1, "Metadata value cannot be empty")
+});
+
+const sanitizedIdentitySchema = IdentitiesSchema.pick({
+  id: true,
+  name: true,
+  orgId: true,
+  projectId: true,
+  createdAt: true,
+  updatedAt: true,
+  hasDeleteProtection: true
+}).extend({
+  authMethods: z.array(z.string()).optional(),
+  metadata: z.array(metadataSchema).optional()
+});
+
+export const registerOrgIdentityRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "POST",
+    url: "/identities",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "Create an identity",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      body: z.object({
+        name: z.string().trim().min(1).describe(IDENTITIES.CREATE.name),
+        hasDeleteProtection: z.boolean().default(false).describe(IDENTITIES.CREATE.hasDeleteProtection),
+        metadata: z.array(metadataSchema).optional().describe(IDENTITIES.CREATE.metadata)
+      }),
+      response: {
+        200: z.object({
+          identity: sanitizedIdentitySchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identity } = await server.services.identityV2.createIdentity({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Organization,
+          orgId: req.permission.orgId
+        },
+        data: {
+          name: req.body.name,
+          hasDeleteProtection: req.body.hasDeleteProtection,
+          metadata: req.body.metadata
+        }
+      });
+
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.CREATE_IDENTITY,
+          metadata: {
+            identityId: identity.id,
+            name: req.body.name,
+            hasDeleteProtection: req.body.hasDeleteProtection,
+            metadata: req.body.metadata
+          }
+        }
+      });
+
+      return { identity };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/identities/:identityId",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "Update an identity",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        identityId: z.string().trim().describe(IDENTITIES.UPDATE.identityId)
+      }),
+      body: z.object({
+        name: z.string().trim().min(1).optional().describe(IDENTITIES.UPDATE.name),
+        hasDeleteProtection: z.boolean().optional().describe(IDENTITIES.UPDATE.hasDeleteProtection),
+        metadata: z.array(metadataSchema).optional().describe(IDENTITIES.UPDATE.metadata)
+      }),
+      response: {
+        200: z.object({
+          identity: sanitizedIdentitySchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identity } = await server.services.identityV2.updateIdentity({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Organization,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          identityId: req.params.identityId
+        },
+        data: {
+          name: req.body.name,
+          hasDeleteProtection: req.body.hasDeleteProtection,
+          metadata: req.body.metadata
+        }
+      });
+
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.UPDATE_IDENTITY,
+          metadata: {
+            identityId: req.params.identityId,
+            name: req.body.name,
+            hasDeleteProtection: req.body.hasDeleteProtection,
+            metadata: req.body.metadata
+          }
+        }
+      });
+
+      return { identity };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/identities/:identityId",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "Delete an identity",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        identityId: z.string().trim().describe(IDENTITIES.DELETE.identityId)
+      }),
+      response: {
+        200: z.object({
+          identity: sanitizedIdentitySchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identity } = await server.services.identityV2.deleteIdentity({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Organization,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          identityId: req.params.identityId
+        }
+      });
+
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.DELETE_IDENTITY,
+          metadata: {
+            identityId: req.params.identityId
+          }
+        }
+      });
+
+      return { identity };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/identities/:identityId",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "Get an identity by ID",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        identityId: z.string().trim().describe(IDENTITIES.GET_BY_ID.identityId)
+      }),
+      response: {
+        200: z.object({
+          identity: sanitizedIdentitySchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identity } = await server.services.identityV2.getIdentityById({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Organization,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          identityId: req.params.identityId
+        }
+      });
+
+      return { identity };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/identities",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "List identities",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      querystring: z.object({
+        offset: z.coerce.number().min(0).default(0).describe(IDENTITIES.LIST.offset).optional(),
+        limit: z.coerce.number().min(1).max(1000).default(20).describe(IDENTITIES.LIST.limit).optional(),
+        search: z.string().trim().describe(IDENTITIES.LIST.search).optional()
+      }),
+      response: {
+        200: z.object({
+          identities: z.array(sanitizedIdentitySchema),
+          totalCount: z.number()
+        })
+      }
+    },
+    handler: async (req) => {
+      const { docs: identities, count: totalCount } = await server.services.identityV2.listIdentities({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Organization,
+          orgId: req.permission.orgId
+        },
+        data: {
+          offset: req.query.offset,
+          limit: req.query.limit,
+          search: req.query.search
+        }
+      });
+
+      return { identities, totalCount };
+    }
+  });
+};

backend/src/server/routes/v1/project-identity-router.ts

@@ -0,0 +1,306 @@
+import { z } from "zod";
+
+import { AccessScope, IdentitiesSchema } from "@app/db/schemas";
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { ApiDocsTags, IDENTITIES } from "@app/lib/api-docs";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+const metadataSchema = z.object({
+  key: z.string().trim().min(1, "Metadata key cannot be empty"),
+  value: z.string().trim().min(1, "Metadata value cannot be empty")
+});
+
+const sanitizedIdentitySchema = IdentitiesSchema.pick({
+  id: true,
+  name: true,
+  orgId: true,
+  projectId: true,
+  createdAt: true,
+  updatedAt: true,
+  hasDeleteProtection: true
+}).extend({
+  metadata: z
+    .object({
+      key: z.string(),
+      value: z.string(),
+      id: z.string()
+    })
+    .array()
+    .optional()
+});
+
+export const registerProjectIdentityRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "POST",
+    url: "/:projectId/identities",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "Create an identity in a project",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectId: z.string().trim().describe("The ID of the project to create the identity in")
+      }),
+      body: z.object({
+        name: z.string().trim().min(1).describe(IDENTITIES.CREATE.name),
+        hasDeleteProtection: z.boolean().default(false).describe(IDENTITIES.CREATE.hasDeleteProtection),
+        metadata: z.array(metadataSchema).optional().describe(IDENTITIES.CREATE.metadata)
+      }),
+      response: {
+        200: z.object({
+          identity: sanitizedIdentitySchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identity } = await server.services.identityV2.createIdentity({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          orgId: req.permission.orgId,
+          projectId: req.params.projectId
+        },
+        data: {
+          name: req.body.name,
+          hasDeleteProtection: req.body.hasDeleteProtection,
+          metadata: req.body.metadata
+        }
+      });
+
+      await server.services.auditLog.createAuditLog({
+        projectId: req.params.projectId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.CREATE_IDENTITY,
+          metadata: {
+            identityId: identity.id,
+            name: req.body.name,
+            hasDeleteProtection: req.body.hasDeleteProtection,
+            metadata: req.body.metadata
+          }
+        }
+      });
+
+      return { identity };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:projectId/identities/:identityId",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "Update an identity in a project",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectId: z.string().trim().describe("The ID of the project"),
+        identityId: z.string().trim().describe(IDENTITIES.UPDATE.identityId)
+      }),
+      body: z.object({
+        name: z.string().trim().min(1).optional().describe(IDENTITIES.UPDATE.name),
+        hasDeleteProtection: z.boolean().optional().describe(IDENTITIES.UPDATE.hasDeleteProtection),
+        metadata: z.array(metadataSchema).optional().describe(IDENTITIES.UPDATE.metadata)
+      }),
+      response: {
+        200: z.object({
+          identity: sanitizedIdentitySchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identity } = await server.services.identityV2.updateIdentity({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: req.params.projectId,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          identityId: req.params.identityId
+        },
+        data: {
+          name: req.body.name,
+          hasDeleteProtection: req.body.hasDeleteProtection,
+          metadata: req.body.metadata
+        }
+      });
+
+      await server.services.auditLog.createAuditLog({
+        projectId: req.params.projectId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.UPDATE_IDENTITY,
+          metadata: {
+            identityId: req.params.identityId,
+            name: req.body.name,
+            hasDeleteProtection: req.body.hasDeleteProtection,
+            metadata: req.body.metadata
+          }
+        }
+      });
+
+      return { identity };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:projectId/identities/:identityId",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "Delete an identity from a project",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectId: z.string().trim().describe("The ID of the project"),
+        identityId: z.string().trim().describe(IDENTITIES.DELETE.identityId)
+      }),
+      response: {
+        200: z.object({
+          identity: sanitizedIdentitySchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identity } = await server.services.identityV2.deleteIdentity({
+        permission: req.permission,
+        scopeData: {
+          orgId: req.permission.orgId,
+          scope: AccessScope.Project,
+          projectId: req.params.projectId
+        },
+        selector: {
+          identityId: req.params.identityId
+        }
+      });
+
+      await server.services.auditLog.createAuditLog({
+        projectId: req.params.projectId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.DELETE_IDENTITY,
+          metadata: {
+            identityId: req.params.identityId
+          }
+        }
+      });
+
+      return { identity };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectId/identities/:identityId",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "Get an identity by ID in a project",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectId: z.string().trim().describe("The ID of the project"),
+        identityId: z.string().trim().describe(IDENTITIES.GET_BY_ID.identityId)
+      }),
+      response: {
+        200: z.object({
+          identity: sanitizedIdentitySchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { identity } = await server.services.identityV2.getIdentityById({
+        permission: req.permission,
+        scopeData: {
+          orgId: req.permission.orgId,
+          scope: AccessScope.Project,
+          projectId: req.params.projectId
+        },
+        selector: {
+          identityId: req.params.identityId
+        }
+      });
+
+      return { identity };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectId/identities",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      tags: [ApiDocsTags.Identities],
+      description: "List identities in a project",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectId: z.string().trim().describe("The ID of the project")
+      }),
+      querystring: z.object({
+        offset: z.coerce.number().min(0).default(0).describe(IDENTITIES.LIST.offset).optional(),
+        limit: z.coerce.number().min(1).max(1000).default(20).describe(IDENTITIES.LIST.limit).optional(),
+        search: z.string().trim().describe(IDENTITIES.LIST.search).optional()
+      }),
+      response: {
+        200: z.object({
+          identities: z.array(sanitizedIdentitySchema),
+          totalCount: z.number()
+        })
+      }
+    },
+    handler: async (req) => {
+      const { docs: identities, count: totalCount } = await server.services.identityV2.listIdentities({
+        permission: req.permission,
+        scopeData: {
+          orgId: req.permission.orgId,
+          scope: AccessScope.Project,
+          projectId: req.params.projectId
+        },
+        data: {
+          offset: req.query.offset,
+          limit: req.query.limit,
+          search: req.query.search
+        }
+      });
+
+      return { identities, totalCount };
+    }
+  });
+};

backend/src/server/routes/v2/identity-org-router.ts

@@ -70,7 +70,7 @@ export const registerIdentityOrgRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { identityMemberships, totalCount } = await server.services.identity.listOrgIdentities({
+      const { identityMemberships, totalCount } = await server.services.identityV1.listOrgIdentities({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,

backend/src/server/routes/v2/identity-project-membership-router.ts

@@ -0,0 +1,166 @@
+import { z } from "zod";
+
+import { AccessScope, IdentitiesSchema } from "@app/db/schemas";
+import { ApiDocsTags, PROJECT_IDENTITY_MEMBERSHIP } from "@app/lib/api-docs";
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerIdentityProjectMembershipRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "GET",
+    url: "/:projectId/identity-memberships",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.IdentityProjectMembership],
+      description: "List project identity memberships",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.projectId)
+      }),
+      querystring: z.object({
+        offset: z.coerce
+          .number()
+          .min(0)
+          .default(0)
+          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.offset)
+          .optional(),
+        limit: z.coerce
+          .number()
+          .min(1)
+          .max(100)
+          .default(20)
+          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.limit)
+          .optional(),
+        identityName: z
+          .string()
+          .trim()
+          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.identityName)
+          .optional(),
+        roles: z
+          .string()
+          .transform((val) => val.split(",").map((role) => role.trim()))
+          .describe(PROJECT_IDENTITY_MEMBERSHIP.LIST_IDENTITY_MEMBERSHIPS.roles)
+          .optional()
+      }),
+      response: {
+        200: z.object({
+          identityMemberships: z
+            .object({
+              id: z.string(),
+              identityId: z.string(),
+              createdAt: z.date(),
+              updatedAt: z.date(),
+              roles: z.array(
+                z.object({
+                  id: z.string(),
+                  role: z.string(),
+                  customRoleId: z.string().optional().nullable(),
+                  customRoleName: z.string().optional().nullable(),
+                  customRoleSlug: z.string().optional().nullable(),
+                  isTemporary: z.boolean(),
+                  temporaryMode: z.string().optional().nullable(),
+                  temporaryRange: z.string().nullable().optional(),
+                  temporaryAccessStartTime: z.date().nullable().optional(),
+                  temporaryAccessEndTime: z.date().nullable().optional()
+                })
+              ),
+              identity: IdentitiesSchema.pick({ name: true, id: true, orgId: true, projectId: true })
+            })
+            .array(),
+          totalCount: z.number()
+        })
+      }
+    },
+    handler: async (req) => {
+      const { data: identityMemberships, totalCount } = await server.services.membershipIdentity.listMemberships({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          orgId: req.permission.orgId,
+          projectId: req.params.projectId
+        },
+        data: {
+          offset: req.query.offset,
+          limit: req.query.limit,
+          identityName: req.query.identityName,
+          roles: req.query.roles
+        }
+      });
+
+      return { identityMemberships, totalCount };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectId/identity-memberships/:identityId",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.IdentityProjectMembership],
+      description: "Get project identity membership by identity ID",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.GET_IDENTITY_MEMBERSHIP_BY_ID.projectId),
+        identityId: z.string().trim().describe(PROJECT_IDENTITY_MEMBERSHIP.GET_IDENTITY_MEMBERSHIP_BY_ID.identityId)
+      }),
+      response: {
+        200: z.object({
+          identityMembership: z.object({
+            id: z.string(),
+            createdAt: z.date(),
+            updatedAt: z.date(),
+            roles: z.array(
+              z.object({
+                id: z.string(),
+                role: z.string(),
+                customRoleId: z.string().optional().nullable(),
+                customRoleName: z.string().optional().nullable(),
+                customRoleSlug: z.string().optional().nullable(),
+                isTemporary: z.boolean(),
+                temporaryMode: z.string().optional().nullable(),
+                temporaryRange: z.string().nullable().optional(),
+                temporaryAccessStartTime: z.date().nullable().optional(),
+                temporaryAccessEndTime: z.date().nullable().optional()
+              })
+            ),
+            identity: IdentitiesSchema.pick({ name: true, id: true, orgId: true, projectId: true }).extend({
+              authMethods: z.array(z.string())
+            })
+          })
+        })
+      }
+    },
+    handler: async (req) => {
+      const identityMembership = await server.services.membershipIdentity.getMembershipByIdentityId({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          orgId: req.permission.orgId,
+          projectId: req.params.projectId
+        },
+        selector: {
+          identityId: req.params.identityId
+        }
+      });
+
+      return { identityMembership };
+    }
+  });
+};

backend/src/server/routes/v2/index.ts

@@ -5,6 +5,7 @@ import { registerDeprecatedIdentityProjectRouter } from "./deprecated-identity-p
 import { registerDeprecatedProjectMembershipRouter } from "./deprecated-project-membership-router";
 import { registerDeprecatedProjectRouter } from "./deprecated-project-router";
 import { registerIdentityOrgRouter } from "./identity-org-router";
+import { registerIdentityProjectMembershipRouter } from "./identity-project-membership-router";
 import { registerMfaRouter } from "./mfa-router";
 import { registerOrgRouter } from "./organization-router";
 import { registerPasswordRouter } from "./password-router";
@@ -21,6 +22,13 @@ export const registerV2Routes = async (server: FastifyZodProvider) => {
   await server.register(registerServiceTokenRouter, { prefix: "/service-token" });
   await server.register(registerPasswordRouter, { prefix: "/password" });
 
+  await server.register(
+    async (projectRouter) => {
+      await projectRouter.register(registerIdentityProjectMembershipRouter);
+    },
+    { prefix: "/projects" }
+  );
+
   await server.register(registerCertificateTemplatesV2Router, { prefix: "/certificate-templates" });
 
   await server.register(