diff --git a/doc/index.html b/doc/index.html
index 30a1d3c4..cb262375 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -236,6 +236,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
               
             </ul>
           </li>
@@ -438,6 +442,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.Token.TenantRolesEntry"><span class="badge">M</span>Token.TenantRolesEntry</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.TokenQuery"><span class="badge">M</span>TokenQuery</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.TokenServiceCreateRequest"><span class="badge">M</span>TokenServiceCreateRequest</a>
                 </li>
@@ -2816,6 +2824,14 @@ <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensio
                 <td><p>IsUri validates if the given string is a valid URI</p></td>
               </tr>
             
+              <tr>
+                <td>is_user</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048959</td>
+                <td><p>IsUser returns true if name field satisfies our requirements</p></td>
+              </tr>
+            
               <tr>
                 <td>macaddress</td>
                 <td><a href="#bool">bool</a></td>
@@ -4145,6 +4161,59 @@ <h3 id="metalstack.api.v2.Token.TenantRolesEntry">Token.TenantRolesEntry</h3>
 
         
       
+        <h3 id="metalstack.api.v2.TokenQuery">TokenQuery</h3>
+        <p>TokenQuery is used to search tokens</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>UUID of the token to get </p></td>
+                </tr>
+              
+                <tr>
+                  <td>user</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Name of the token user to query
+Only useful for admins. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>description</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Description of the token to query </p></td>
+                </tr>
+              
+                <tr>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
+                  <td>optional</td>
+                  <td><p>Labels lists only tokens containing the given labels </p></td>
+                </tr>
+              
+                <tr>
+                  <td>token_type</td>
+                  <td><a href="#metalstack.api.v2.TokenType">TokenType</a></td>
+                  <td>optional</td>
+                  <td><p>Token type of the token to query </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</h3>
         <p>TokenServiceCreateRequest is the request payload to create a token</p>
 
@@ -4401,6 +4470,23 @@ <h3 id="metalstack.api.v2.TokenServiceListRequest">TokenServiceListRequest</h3>
         <p>TokenServiceListRequest is the request payload to list tokens</p>
 
         
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>query</td>
+                  <td><a href="#metalstack.api.v2.TokenQuery">TokenQuery</a></td>
+                  <td></td>
+                  <td><p>Query for tokens </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
 
         
       
@@ -19066,10 +19152,10 @@ <h3 id="metalstack.admin.v2.TokenServiceListRequest">TokenServiceListRequest</h3
             <tbody>
               
                 <tr>
-                  <td>user</td>
-                  <td><a href="#string">string</a></td>
-                  <td>optional</td>
-                  <td><p>User is the id of the user for which the tokens should be listed </p></td>
+                  <td>query</td>
+                  <td><a href="#metalstack.api.v2.TokenQuery">metalstack.api.v2.TokenQuery</a></td>
+                  <td></td>
+                  <td><p>Query for tokens </p></td>
                 </tr>
               
             </tbody>
diff --git a/go/metalstack/admin/v2/token.pb.go b/go/metalstack/admin/v2/token.pb.go
index 5ac4d6f0..c5ad5f0c 100644
--- a/go/metalstack/admin/v2/token.pb.go
+++ b/go/metalstack/admin/v2/token.pb.go
@@ -26,8 +26,8 @@ const (
 // TokenServiceListRequest is the request payload for listing tokens.
 type TokenServiceListRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// User is the id of the user for which the tokens should be listed
-	User          *string `protobuf:"bytes,1,opt,name=user,proto3,oneof" json:"user,omitempty"`
+	// Query for tokens
+	Query         *v2.TokenQuery `protobuf:"bytes,1,opt,name=query,proto3" json:"query,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -62,11 +62,11 @@ func (*TokenServiceListRequest) Descriptor() ([]byte, []int) {
 	return file_metalstack_admin_v2_token_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *TokenServiceListRequest) GetUser() string {
-	if x != nil && x.User != nil {
-		return *x.User
+func (x *TokenServiceListRequest) GetQuery() *v2.TokenQuery {
+	if x != nil {
+		return x.Query
 	}
-	return ""
+	return nil
 }
 
 // TokenServiceListResponse is the response payload for listing tokens.
@@ -321,20 +321,17 @@ var File_metalstack_admin_v2_token_proto protoreflect.FileDescriptor
 
 const file_metalstack_admin_v2_token_proto_rawDesc = "" +
 	"\n" +
-	"\x1fmetalstack/admin/v2/token.proto\x12\x13metalstack.admin.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1dmetalstack/api/v2/token.proto\";\n" +
-	"\x17TokenServiceListRequest\x12\x17\n" +
-	"\x04user\x18\x01 \x01(\tH\x00R\x04user\x88\x01\x01B\a\n" +
-	"\x05_user\"L\n" +
+	"\x1fmetalstack/admin/v2/token.proto\x12\x13metalstack.admin.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1dmetalstack/api/v2/token.proto\"N\n" +
+	"\x17TokenServiceListRequest\x123\n" +
+	"\x05query\x18\x01 \x01(\v2\x1d.metalstack.api.v2.TokenQueryR\x05query\"L\n" +
 	"\x18TokenServiceListResponse\x120\n" +
-	"\x06tokens\x18\x01 \x03(\v2\x18.metalstack.api.v2.TokenR\x06tokens\"Y\n" +
+	"\x06tokens\x18\x01 \x03(\v2\x18.metalstack.api.v2.TokenR\x06tokens\"Z\n" +
 	"\x19TokenServiceRevokeRequest\x12\x1c\n" +
-	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n" +
-	"\x04user\x18\x02 \x01(\tB\n" +
-	"\xbaH\ar\x05\x10\x02\x18\x80\x04R\x04user\"\x1c\n" +
-	"\x1aTokenServiceRevokeResponse\"\xa9\x01\n" +
-	"\x19TokenServiceCreateRequest\x12#\n" +
-	"\x04user\x18\x01 \x01(\tB\n" +
-	"\xbaH\ar\x05\x10\x02\x18\x80\x04H\x00R\x04user\x88\x01\x01\x12^\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n" +
+	"\x04user\x18\x02 \x01(\tB\v\xbaH\br\x06\xf8\xb3\xae\xb1\x02\x01R\x04user\"\x1c\n" +
+	"\x1aTokenServiceRevokeResponse\"\xaa\x01\n" +
+	"\x19TokenServiceCreateRequest\x12$\n" +
+	"\x04user\x18\x01 \x01(\tB\v\xbaH\br\x06\xf8\xb3\xae\xb1\x02\x01H\x00R\x04user\x88\x01\x01\x12^\n" +
 	"\x14token_create_request\x18\x02 \x01(\v2,.metalstack.api.v2.TokenServiceCreateRequestR\x12tokenCreateRequestB\a\n" +
 	"\x05_user\"d\n" +
 	"\x1aTokenServiceCreateResponse\x12.\n" +
@@ -368,24 +365,26 @@ var file_metalstack_admin_v2_token_proto_goTypes = []any{
 	(*TokenServiceRevokeResponse)(nil),   // 3: metalstack.admin.v2.TokenServiceRevokeResponse
 	(*TokenServiceCreateRequest)(nil),    // 4: metalstack.admin.v2.TokenServiceCreateRequest
 	(*TokenServiceCreateResponse)(nil),   // 5: metalstack.admin.v2.TokenServiceCreateResponse
-	(*v2.Token)(nil),                     // 6: metalstack.api.v2.Token
-	(*v2.TokenServiceCreateRequest)(nil), // 7: metalstack.api.v2.TokenServiceCreateRequest
+	(*v2.TokenQuery)(nil),                // 6: metalstack.api.v2.TokenQuery
+	(*v2.Token)(nil),                     // 7: metalstack.api.v2.Token
+	(*v2.TokenServiceCreateRequest)(nil), // 8: metalstack.api.v2.TokenServiceCreateRequest
 }
 var file_metalstack_admin_v2_token_proto_depIdxs = []int32{
-	6, // 0: metalstack.admin.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
-	7, // 1: metalstack.admin.v2.TokenServiceCreateRequest.token_create_request:type_name -> metalstack.api.v2.TokenServiceCreateRequest
-	6, // 2: metalstack.admin.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
-	0, // 3: metalstack.admin.v2.TokenService.List:input_type -> metalstack.admin.v2.TokenServiceListRequest
-	2, // 4: metalstack.admin.v2.TokenService.Revoke:input_type -> metalstack.admin.v2.TokenServiceRevokeRequest
-	4, // 5: metalstack.admin.v2.TokenService.Create:input_type -> metalstack.admin.v2.TokenServiceCreateRequest
-	1, // 6: metalstack.admin.v2.TokenService.List:output_type -> metalstack.admin.v2.TokenServiceListResponse
-	3, // 7: metalstack.admin.v2.TokenService.Revoke:output_type -> metalstack.admin.v2.TokenServiceRevokeResponse
-	5, // 8: metalstack.admin.v2.TokenService.Create:output_type -> metalstack.admin.v2.TokenServiceCreateResponse
-	6, // [6:9] is the sub-list for method output_type
-	3, // [3:6] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	3, // [3:3] is the sub-list for extension extendee
-	0, // [0:3] is the sub-list for field type_name
+	6, // 0: metalstack.admin.v2.TokenServiceListRequest.query:type_name -> metalstack.api.v2.TokenQuery
+	7, // 1: metalstack.admin.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
+	8, // 2: metalstack.admin.v2.TokenServiceCreateRequest.token_create_request:type_name -> metalstack.api.v2.TokenServiceCreateRequest
+	7, // 3: metalstack.admin.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
+	0, // 4: metalstack.admin.v2.TokenService.List:input_type -> metalstack.admin.v2.TokenServiceListRequest
+	2, // 5: metalstack.admin.v2.TokenService.Revoke:input_type -> metalstack.admin.v2.TokenServiceRevokeRequest
+	4, // 6: metalstack.admin.v2.TokenService.Create:input_type -> metalstack.admin.v2.TokenServiceCreateRequest
+	1, // 7: metalstack.admin.v2.TokenService.List:output_type -> metalstack.admin.v2.TokenServiceListResponse
+	3, // 8: metalstack.admin.v2.TokenService.Revoke:output_type -> metalstack.admin.v2.TokenServiceRevokeResponse
+	5, // 9: metalstack.admin.v2.TokenService.Create:output_type -> metalstack.admin.v2.TokenServiceCreateResponse
+	7, // [7:10] is the sub-list for method output_type
+	4, // [4:7] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_admin_v2_token_proto_init() }
@@ -393,7 +392,6 @@ func file_metalstack_admin_v2_token_proto_init() {
 	if File_metalstack_admin_v2_token_proto != nil {
 		return
 	}
-	file_metalstack_admin_v2_token_proto_msgTypes[0].OneofWrappers = []any{}
 	file_metalstack_admin_v2_token_proto_msgTypes[4].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
diff --git a/go/metalstack/api/v2/predefined_rules.pb.go b/go/metalstack/api/v2/predefined_rules.pb.go
index d62740be..ba21829b 100644
--- a/go/metalstack/api/v2/predefined_rules.pb.go
+++ b/go/metalstack/api/v2/predefined_rules.pb.go
@@ -86,6 +86,14 @@ var file_metalstack_api_v2_predefined_rules_proto_extTypes = []protoimpl.Extensi
 		Tag:           "varint,80048958,opt,name=trimmed",
 		Filename:      "metalstack/api/v2/predefined_rules.proto",
 	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048959,
+		Name:          "metalstack.api.v2.is_user",
+		Tag:           "varint,80048959,opt,name=is_user",
+		Filename:      "metalstack/api/v2/predefined_rules.proto",
+	},
 	{
 		ExtendedType:  (*validate.RepeatedRules)(nil),
 		ExtensionType: (*bool)(nil),
@@ -170,6 +178,10 @@ var (
 	//
 	// optional bool trimmed = 80048958;
 	E_Trimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[7]
+	// IsUser returns true if name field satisfies our requirements
+	//
+	// optional bool is_user = 80048959;
+	E_IsUser = &file_metalstack_api_v2_predefined_rules_proto_extTypes[8]
 )
 
 // Extension fields to validate.RepeatedRules.
@@ -177,19 +189,19 @@ var (
 	// Prefixes validates if a slice of prefixes in string form are valid
 	//
 	// optional bool prefixes = 80058951;
-	E_Prefixes = &file_metalstack_api_v2_predefined_rules_proto_extTypes[8]
+	E_Prefixes = &file_metalstack_api_v2_predefined_rules_proto_extTypes[9]
 	// Ips validates if a slice of ips in string form are valid
 	//
 	// optional bool ips = 80058952;
-	E_Ips = &file_metalstack_api_v2_predefined_rules_proto_extTypes[9]
+	E_Ips = &file_metalstack_api_v2_predefined_rules_proto_extTypes[10]
 	// AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
 	//
 	// optional bool are_host_and_port = 80058953;
-	E_AreHostAndPort = &file_metalstack_api_v2_predefined_rules_proto_extTypes[10]
+	E_AreHostAndPort = &file_metalstack_api_v2_predefined_rules_proto_extTypes[11]
 	// All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool all_trimmed = 80058954;
-	E_AllTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[11]
+	E_AllTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[12]
 )
 
 // Extension fields to validate.MapRules.
@@ -197,11 +209,11 @@ var (
 	// Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool keys_and_values_trimmed = 80068951;
-	E_KeysAndValuesTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[12]
+	E_KeysAndValuesTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[13]
 	// Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool keys_trimmed = 80068952;
-	E_KeysTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[13]
+	E_KeysTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[14]
 )
 
 var File_metalstack_api_v2_predefined_rules_proto protoreflect.FileDescriptor
@@ -235,7 +247,10 @@ const file_metalstack_api_v2_predefined_rules_proto_rawDesc = "" +
 	"\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n" +
 	"\atrimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\bBe\xc2Hb\n" +
 	"`\n" +
-	"\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\atrimmed:\x8f\x01\n" +
+	"\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\atrimmed:\x99\x01\n" +
+	"\ais_user\x12\x19.buf.validate.StringRules\x18\xbf\xe6\x95& \x01(\bBb\xc2H_\n" +
+	"]\n" +
+	"\x0estring.is_user\x12#must be within 2 and 512 characters\x1a&this.size() >= 2 && this.size() <= 512R\x06isUser:\x8f\x01\n" +
 	"\bprefixes\x12\x1b.buf.validate.RepeatedRules\x18Ǵ\x96& \x01(\bBS\xc2HP\n" +
 	"N\n" +
 	"\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\bprefixes:u\n" +
@@ -271,16 +286,17 @@ var file_metalstack_api_v2_predefined_rules_proto_depIdxs = []int32{
 	0,  // 5: metalstack.api.v2.is_uri:extendee -> buf.validate.StringRules
 	0,  // 6: metalstack.api.v2.is_ip_or_hostname:extendee -> buf.validate.StringRules
 	0,  // 7: metalstack.api.v2.trimmed:extendee -> buf.validate.StringRules
-	1,  // 8: metalstack.api.v2.prefixes:extendee -> buf.validate.RepeatedRules
-	1,  // 9: metalstack.api.v2.ips:extendee -> buf.validate.RepeatedRules
-	1,  // 10: metalstack.api.v2.are_host_and_port:extendee -> buf.validate.RepeatedRules
-	1,  // 11: metalstack.api.v2.all_trimmed:extendee -> buf.validate.RepeatedRules
-	2,  // 12: metalstack.api.v2.keys_and_values_trimmed:extendee -> buf.validate.MapRules
-	2,  // 13: metalstack.api.v2.keys_trimmed:extendee -> buf.validate.MapRules
-	14, // [14:14] is the sub-list for method output_type
-	14, // [14:14] is the sub-list for method input_type
-	14, // [14:14] is the sub-list for extension type_name
-	0,  // [0:14] is the sub-list for extension extendee
+	0,  // 8: metalstack.api.v2.is_user:extendee -> buf.validate.StringRules
+	1,  // 9: metalstack.api.v2.prefixes:extendee -> buf.validate.RepeatedRules
+	1,  // 10: metalstack.api.v2.ips:extendee -> buf.validate.RepeatedRules
+	1,  // 11: metalstack.api.v2.are_host_and_port:extendee -> buf.validate.RepeatedRules
+	1,  // 12: metalstack.api.v2.all_trimmed:extendee -> buf.validate.RepeatedRules
+	2,  // 13: metalstack.api.v2.keys_and_values_trimmed:extendee -> buf.validate.MapRules
+	2,  // 14: metalstack.api.v2.keys_trimmed:extendee -> buf.validate.MapRules
+	15, // [15:15] is the sub-list for method output_type
+	15, // [15:15] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	0,  // [0:15] is the sub-list for extension extendee
 	0,  // [0:0] is the sub-list for field type_name
 }
 
@@ -296,7 +312,7 @@ func file_metalstack_api_v2_predefined_rules_proto_init() {
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_predefined_rules_proto_rawDesc), len(file_metalstack_api_v2_predefined_rules_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   0,
-			NumExtensions: 14,
+			NumExtensions: 15,
 			NumServices:   0,
 		},
 		GoTypes:           file_metalstack_api_v2_predefined_rules_proto_goTypes,
diff --git a/go/metalstack/api/v2/token.pb.go b/go/metalstack/api/v2/token.pb.go
index 94c9552e..726b2b22 100644
--- a/go/metalstack/api/v2/token.pb.go
+++ b/go/metalstack/api/v2/token.pb.go
@@ -478,7 +478,9 @@ func (x *TokenServiceCreateResponse) GetSecret() string {
 
 // TokenServiceListRequest is the request payload to list tokens
 type TokenServiceListRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Query for tokens
+	Query         *TokenQuery `protobuf:"bytes,1,opt,name=query,proto3" json:"query,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -513,6 +515,13 @@ func (*TokenServiceListRequest) Descriptor() ([]byte, []int) {
 	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{4}
 }
 
+func (x *TokenServiceListRequest) GetQuery() *TokenQuery {
+	if x != nil {
+		return x.Query
+	}
+	return nil
+}
+
 // TokenServiceListResponse is the response payload of a token list request
 type TokenServiceListResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1002,16 +1011,98 @@ func (x *TokenServiceRefreshResponse) GetSecret() string {
 	return ""
 }
 
+// TokenQuery is used to search tokens
+type TokenQuery struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UUID of the token to get
+	Uuid *string `protobuf:"bytes,1,opt,name=uuid,proto3,oneof" json:"uuid,omitempty"`
+	// Name of the token user to query
+	// Only useful for admins.
+	User *string `protobuf:"bytes,2,opt,name=user,proto3,oneof" json:"user,omitempty"`
+	// Description of the token to query
+	Description *string `protobuf:"bytes,3,opt,name=description,proto3,oneof" json:"description,omitempty"`
+	// Labels lists only tokens containing the given labels
+	Labels *Labels `protobuf:"bytes,4,opt,name=labels,proto3,oneof" json:"labels,omitempty"`
+	// Token type of the token to query
+	TokenType     *TokenType `protobuf:"varint,5,opt,name=token_type,json=tokenType,proto3,enum=metalstack.api.v2.TokenType,oneof" json:"token_type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TokenQuery) Reset() {
+	*x = TokenQuery{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TokenQuery) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TokenQuery) ProtoMessage() {}
+
+func (x *TokenQuery) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TokenQuery.ProtoReflect.Descriptor instead.
+func (*TokenQuery) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *TokenQuery) GetUuid() string {
+	if x != nil && x.Uuid != nil {
+		return *x.Uuid
+	}
+	return ""
+}
+
+func (x *TokenQuery) GetUser() string {
+	if x != nil && x.User != nil {
+		return *x.User
+	}
+	return ""
+}
+
+func (x *TokenQuery) GetDescription() string {
+	if x != nil && x.Description != nil {
+		return *x.Description
+	}
+	return ""
+}
+
+func (x *TokenQuery) GetLabels() *Labels {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *TokenQuery) GetTokenType() TokenType {
+	if x != nil && x.TokenType != nil {
+		return *x.TokenType
+	}
+	return TokenType_TOKEN_TYPE_UNSPECIFIED
+}
+
 var File_metalstack_api_v2_token_proto protoreflect.FileDescriptor
 
 const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\n" +
-	"\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x92\n" +
+	"\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x93\n" +
 	"\n" +
 	"\x05Token\x12\x1c\n" +
-	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n" +
-	"\x04user\x18\x02 \x01(\tB\n" +
-	"\xbaH\ar\x05\x10\x02\x18\x80\x04R\x04user\x12+\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n" +
+	"\x04user\x18\x02 \x01(\tB\v\xbaH\br\x06\xf8\xb3\xae\xb1\x02\x01R\x04user\x12+\n" +
 	"\x04meta\x18\x03 \x01(\v2\x17.metalstack.api.v2.MetaR\x04meta\x12-\n" +
 	"\vdescription\x18\x04 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12P\n" +
 	"\vpermissions\x18\x05 \x03(\v2#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\vpermissions\x124\n" +
@@ -1069,8 +1160,9 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"d\n" +
 	"\x1aTokenServiceCreateResponse\x12.\n" +
 	"\x05token\x18\x01 \x01(\v2\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n" +
-	"\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n" +
-	"\x17TokenServiceListRequest\"L\n" +
+	"\x06secret\x18\x02 \x01(\tR\x06secret\"N\n" +
+	"\x17TokenServiceListRequest\x123\n" +
+	"\x05query\x18\x01 \x01(\v2\x1d.metalstack.api.v2.TokenQueryR\x05query\"L\n" +
 	"\x18TokenServiceListResponse\x120\n" +
 	"\x06tokens\x18\x01 \x03(\v2\x18.metalstack.api.v2.TokenR\x06tokens\"9\n" +
 	"\x19TokenServiceRevokeRequest\x12\x1c\n" +
@@ -1114,7 +1206,20 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\x1aTokenServiceRefreshRequest\"e\n" +
 	"\x1bTokenServiceRefreshResponse\x12.\n" +
 	"\x05token\x18\x01 \x01(\v2\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n" +
-	"\x06secret\x18\x02 \x01(\tR\x06secret*P\n" +
+	"\x06secret\x18\x02 \x01(\tR\x06secret\"\xc9\x02\n" +
+	"\n" +
+	"TokenQuery\x12!\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n" +
+	"\x04user\x18\x02 \x01(\tB\v\xbaH\br\x06\xf8\xb3\xae\xb1\x02\x01H\x01R\x04user\x88\x01\x01\x122\n" +
+	"\vdescription\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x02R\vdescription\x88\x01\x01\x126\n" +
+	"\x06labels\x18\x04 \x01(\v2\x19.metalstack.api.v2.LabelsH\x03R\x06labels\x88\x01\x01\x12J\n" +
+	"\n" +
+	"token_type\x18\x05 \x01(\x0e2\x1c.metalstack.api.v2.TokenTypeB\b\xbaH\x05\x82\x01\x02\x10\x01H\x04R\ttokenType\x88\x01\x01B\a\n" +
+	"\x05_uuidB\a\n" +
+	"\x05_userB\x0e\n" +
+	"\f_descriptionB\t\n" +
+	"\a_labelsB\r\n" +
+	"\v_token_type*P\n" +
 	"\tTokenType\x12\x1a\n" +
 	"\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n" +
 	"\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n" +
@@ -1142,7 +1247,7 @@ func file_metalstack_api_v2_token_proto_rawDescGZIP() []byte {
 }
 
 var file_metalstack_api_v2_token_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_metalstack_api_v2_token_proto_msgTypes = make([]protoimpl.MessageInfo, 23)
+var file_metalstack_api_v2_token_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_metalstack_api_v2_token_proto_goTypes = []any{
 	(TokenType)(0),                      // 0: metalstack.api.v2.TokenType
 	(*Token)(nil),                       // 1: metalstack.api.v2.Token
@@ -1159,85 +1264,89 @@ var file_metalstack_api_v2_token_proto_goTypes = []any{
 	(*TokenServiceGetResponse)(nil),     // 12: metalstack.api.v2.TokenServiceGetResponse
 	(*TokenServiceRefreshRequest)(nil),  // 13: metalstack.api.v2.TokenServiceRefreshRequest
 	(*TokenServiceRefreshResponse)(nil), // 14: metalstack.api.v2.TokenServiceRefreshResponse
-	nil,                                 // 15: metalstack.api.v2.Token.ProjectRolesEntry
-	nil,                                 // 16: metalstack.api.v2.Token.TenantRolesEntry
-	nil,                                 // 17: metalstack.api.v2.Token.MachineRolesEntry
-	nil,                                 // 18: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
-	nil,                                 // 19: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
-	nil,                                 // 20: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
-	nil,                                 // 21: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
-	nil,                                 // 22: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
-	nil,                                 // 23: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
-	(*Meta)(nil),                        // 24: metalstack.api.v2.Meta
-	(*timestamppb.Timestamp)(nil),       // 25: google.protobuf.Timestamp
-	(AdminRole)(0),                      // 26: metalstack.api.v2.AdminRole
-	(InfraRole)(0),                      // 27: metalstack.api.v2.InfraRole
-	(*durationpb.Duration)(nil),         // 28: google.protobuf.Duration
-	(*Labels)(nil),                      // 29: metalstack.api.v2.Labels
-	(*UpdateMeta)(nil),                  // 30: metalstack.api.v2.UpdateMeta
-	(*UpdateLabels)(nil),                // 31: metalstack.api.v2.UpdateLabels
-	(ProjectRole)(0),                    // 32: metalstack.api.v2.ProjectRole
-	(TenantRole)(0),                     // 33: metalstack.api.v2.TenantRole
-	(MachineRole)(0),                    // 34: metalstack.api.v2.MachineRole
+	(*TokenQuery)(nil),                  // 15: metalstack.api.v2.TokenQuery
+	nil,                                 // 16: metalstack.api.v2.Token.ProjectRolesEntry
+	nil,                                 // 17: metalstack.api.v2.Token.TenantRolesEntry
+	nil,                                 // 18: metalstack.api.v2.Token.MachineRolesEntry
+	nil,                                 // 19: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
+	nil,                                 // 20: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
+	nil,                                 // 21: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
+	nil,                                 // 22: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
+	nil,                                 // 23: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
+	nil,                                 // 24: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
+	(*Meta)(nil),                        // 25: metalstack.api.v2.Meta
+	(*timestamppb.Timestamp)(nil),       // 26: google.protobuf.Timestamp
+	(AdminRole)(0),                      // 27: metalstack.api.v2.AdminRole
+	(InfraRole)(0),                      // 28: metalstack.api.v2.InfraRole
+	(*durationpb.Duration)(nil),         // 29: google.protobuf.Duration
+	(*Labels)(nil),                      // 30: metalstack.api.v2.Labels
+	(*UpdateMeta)(nil),                  // 31: metalstack.api.v2.UpdateMeta
+	(*UpdateLabels)(nil),                // 32: metalstack.api.v2.UpdateLabels
+	(ProjectRole)(0),                    // 33: metalstack.api.v2.ProjectRole
+	(TenantRole)(0),                     // 34: metalstack.api.v2.TenantRole
+	(MachineRole)(0),                    // 35: metalstack.api.v2.MachineRole
 }
 var file_metalstack_api_v2_token_proto_depIdxs = []int32{
-	24, // 0: metalstack.api.v2.Token.meta:type_name -> metalstack.api.v2.Meta
+	25, // 0: metalstack.api.v2.Token.meta:type_name -> metalstack.api.v2.Meta
 	3,  // 1: metalstack.api.v2.Token.permissions:type_name -> metalstack.api.v2.MethodPermission
-	25, // 2: metalstack.api.v2.Token.expires:type_name -> google.protobuf.Timestamp
-	25, // 3: metalstack.api.v2.Token.issued_at:type_name -> google.protobuf.Timestamp
+	26, // 2: metalstack.api.v2.Token.expires:type_name -> google.protobuf.Timestamp
+	26, // 3: metalstack.api.v2.Token.issued_at:type_name -> google.protobuf.Timestamp
 	0,  // 4: metalstack.api.v2.Token.token_type:type_name -> metalstack.api.v2.TokenType
-	15, // 5: metalstack.api.v2.Token.project_roles:type_name -> metalstack.api.v2.Token.ProjectRolesEntry
-	16, // 6: metalstack.api.v2.Token.tenant_roles:type_name -> metalstack.api.v2.Token.TenantRolesEntry
-	26, // 7: metalstack.api.v2.Token.admin_role:type_name -> metalstack.api.v2.AdminRole
-	27, // 8: metalstack.api.v2.Token.infra_role:type_name -> metalstack.api.v2.InfraRole
-	17, // 9: metalstack.api.v2.Token.machine_roles:type_name -> metalstack.api.v2.Token.MachineRolesEntry
+	16, // 5: metalstack.api.v2.Token.project_roles:type_name -> metalstack.api.v2.Token.ProjectRolesEntry
+	17, // 6: metalstack.api.v2.Token.tenant_roles:type_name -> metalstack.api.v2.Token.TenantRolesEntry
+	27, // 7: metalstack.api.v2.Token.admin_role:type_name -> metalstack.api.v2.AdminRole
+	28, // 8: metalstack.api.v2.Token.infra_role:type_name -> metalstack.api.v2.InfraRole
+	18, // 9: metalstack.api.v2.Token.machine_roles:type_name -> metalstack.api.v2.Token.MachineRolesEntry
 	3,  // 10: metalstack.api.v2.TokenServiceCreateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
-	28, // 11: metalstack.api.v2.TokenServiceCreateRequest.expires:type_name -> google.protobuf.Duration
-	18, // 12: metalstack.api.v2.TokenServiceCreateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
-	19, // 13: metalstack.api.v2.TokenServiceCreateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
-	26, // 14: metalstack.api.v2.TokenServiceCreateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
-	27, // 15: metalstack.api.v2.TokenServiceCreateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
-	20, // 16: metalstack.api.v2.TokenServiceCreateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
-	29, // 17: metalstack.api.v2.TokenServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
+	29, // 11: metalstack.api.v2.TokenServiceCreateRequest.expires:type_name -> google.protobuf.Duration
+	19, // 12: metalstack.api.v2.TokenServiceCreateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
+	20, // 13: metalstack.api.v2.TokenServiceCreateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
+	27, // 14: metalstack.api.v2.TokenServiceCreateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
+	28, // 15: metalstack.api.v2.TokenServiceCreateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
+	21, // 16: metalstack.api.v2.TokenServiceCreateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
+	30, // 17: metalstack.api.v2.TokenServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
 	1,  // 18: metalstack.api.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
-	1,  // 19: metalstack.api.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
-	30, // 20: metalstack.api.v2.TokenServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
-	3,  // 21: metalstack.api.v2.TokenServiceUpdateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
-	21, // 22: metalstack.api.v2.TokenServiceUpdateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
-	22, // 23: metalstack.api.v2.TokenServiceUpdateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
-	26, // 24: metalstack.api.v2.TokenServiceUpdateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
-	27, // 25: metalstack.api.v2.TokenServiceUpdateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
-	23, // 26: metalstack.api.v2.TokenServiceUpdateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
-	31, // 27: metalstack.api.v2.TokenServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
-	1,  // 28: metalstack.api.v2.TokenServiceUpdateResponse.token:type_name -> metalstack.api.v2.Token
-	1,  // 29: metalstack.api.v2.TokenServiceGetResponse.token:type_name -> metalstack.api.v2.Token
-	1,  // 30: metalstack.api.v2.TokenServiceRefreshResponse.token:type_name -> metalstack.api.v2.Token
-	32, // 31: metalstack.api.v2.Token.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	33, // 32: metalstack.api.v2.Token.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	34, // 33: metalstack.api.v2.Token.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
-	32, // 34: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	33, // 35: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	34, // 36: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
-	32, // 37: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	33, // 38: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	34, // 39: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
-	11, // 40: metalstack.api.v2.TokenService.Get:input_type -> metalstack.api.v2.TokenServiceGetRequest
-	2,  // 41: metalstack.api.v2.TokenService.Create:input_type -> metalstack.api.v2.TokenServiceCreateRequest
-	9,  // 42: metalstack.api.v2.TokenService.Update:input_type -> metalstack.api.v2.TokenServiceUpdateRequest
-	5,  // 43: metalstack.api.v2.TokenService.List:input_type -> metalstack.api.v2.TokenServiceListRequest
-	7,  // 44: metalstack.api.v2.TokenService.Revoke:input_type -> metalstack.api.v2.TokenServiceRevokeRequest
-	13, // 45: metalstack.api.v2.TokenService.Refresh:input_type -> metalstack.api.v2.TokenServiceRefreshRequest
-	12, // 46: metalstack.api.v2.TokenService.Get:output_type -> metalstack.api.v2.TokenServiceGetResponse
-	4,  // 47: metalstack.api.v2.TokenService.Create:output_type -> metalstack.api.v2.TokenServiceCreateResponse
-	10, // 48: metalstack.api.v2.TokenService.Update:output_type -> metalstack.api.v2.TokenServiceUpdateResponse
-	6,  // 49: metalstack.api.v2.TokenService.List:output_type -> metalstack.api.v2.TokenServiceListResponse
-	8,  // 50: metalstack.api.v2.TokenService.Revoke:output_type -> metalstack.api.v2.TokenServiceRevokeResponse
-	14, // 51: metalstack.api.v2.TokenService.Refresh:output_type -> metalstack.api.v2.TokenServiceRefreshResponse
-	46, // [46:52] is the sub-list for method output_type
-	40, // [40:46] is the sub-list for method input_type
-	40, // [40:40] is the sub-list for extension type_name
-	40, // [40:40] is the sub-list for extension extendee
-	0,  // [0:40] is the sub-list for field type_name
+	15, // 19: metalstack.api.v2.TokenServiceListRequest.query:type_name -> metalstack.api.v2.TokenQuery
+	1,  // 20: metalstack.api.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
+	31, // 21: metalstack.api.v2.TokenServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
+	3,  // 22: metalstack.api.v2.TokenServiceUpdateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
+	22, // 23: metalstack.api.v2.TokenServiceUpdateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
+	23, // 24: metalstack.api.v2.TokenServiceUpdateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
+	27, // 25: metalstack.api.v2.TokenServiceUpdateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
+	28, // 26: metalstack.api.v2.TokenServiceUpdateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
+	24, // 27: metalstack.api.v2.TokenServiceUpdateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
+	32, // 28: metalstack.api.v2.TokenServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
+	1,  // 29: metalstack.api.v2.TokenServiceUpdateResponse.token:type_name -> metalstack.api.v2.Token
+	1,  // 30: metalstack.api.v2.TokenServiceGetResponse.token:type_name -> metalstack.api.v2.Token
+	1,  // 31: metalstack.api.v2.TokenServiceRefreshResponse.token:type_name -> metalstack.api.v2.Token
+	30, // 32: metalstack.api.v2.TokenQuery.labels:type_name -> metalstack.api.v2.Labels
+	0,  // 33: metalstack.api.v2.TokenQuery.token_type:type_name -> metalstack.api.v2.TokenType
+	33, // 34: metalstack.api.v2.Token.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	34, // 35: metalstack.api.v2.Token.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	35, // 36: metalstack.api.v2.Token.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	33, // 37: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	34, // 38: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	35, // 39: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	33, // 40: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	34, // 41: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	35, // 42: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	11, // 43: metalstack.api.v2.TokenService.Get:input_type -> metalstack.api.v2.TokenServiceGetRequest
+	2,  // 44: metalstack.api.v2.TokenService.Create:input_type -> metalstack.api.v2.TokenServiceCreateRequest
+	9,  // 45: metalstack.api.v2.TokenService.Update:input_type -> metalstack.api.v2.TokenServiceUpdateRequest
+	5,  // 46: metalstack.api.v2.TokenService.List:input_type -> metalstack.api.v2.TokenServiceListRequest
+	7,  // 47: metalstack.api.v2.TokenService.Revoke:input_type -> metalstack.api.v2.TokenServiceRevokeRequest
+	13, // 48: metalstack.api.v2.TokenService.Refresh:input_type -> metalstack.api.v2.TokenServiceRefreshRequest
+	12, // 49: metalstack.api.v2.TokenService.Get:output_type -> metalstack.api.v2.TokenServiceGetResponse
+	4,  // 50: metalstack.api.v2.TokenService.Create:output_type -> metalstack.api.v2.TokenServiceCreateResponse
+	10, // 51: metalstack.api.v2.TokenService.Update:output_type -> metalstack.api.v2.TokenServiceUpdateResponse
+	6,  // 52: metalstack.api.v2.TokenService.List:output_type -> metalstack.api.v2.TokenServiceListResponse
+	8,  // 53: metalstack.api.v2.TokenService.Revoke:output_type -> metalstack.api.v2.TokenServiceRevokeResponse
+	14, // 54: metalstack.api.v2.TokenService.Refresh:output_type -> metalstack.api.v2.TokenServiceRefreshResponse
+	49, // [49:55] is the sub-list for method output_type
+	43, // [43:49] is the sub-list for method input_type
+	43, // [43:43] is the sub-list for extension type_name
+	43, // [43:43] is the sub-list for extension extendee
+	0,  // [0:43] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_api_v2_token_proto_init() }
@@ -1250,13 +1359,14 @@ func file_metalstack_api_v2_token_proto_init() {
 	file_metalstack_api_v2_token_proto_msgTypes[0].OneofWrappers = []any{}
 	file_metalstack_api_v2_token_proto_msgTypes[1].OneofWrappers = []any{}
 	file_metalstack_api_v2_token_proto_msgTypes[8].OneofWrappers = []any{}
+	file_metalstack_api_v2_token_proto_msgTypes[14].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_token_proto_rawDesc), len(file_metalstack_api_v2_token_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   23,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/js/metalstack/admin/v2/token_pb.d.ts b/js/metalstack/admin/v2/token_pb.d.ts
index 48a8ecb7..17280c88 100644
--- a/js/metalstack/admin/v2/token_pb.d.ts
+++ b/js/metalstack/admin/v2/token_pb.d.ts
@@ -1,5 +1,5 @@
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { Token, TokenServiceCreateRequest as TokenServiceCreateRequest$1 } from "../../api/v2/token_pb";
+import type { Token, TokenQuery, TokenServiceCreateRequest as TokenServiceCreateRequest$1 } from "../../api/v2/token_pb";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file metalstack/admin/v2/token.proto.
@@ -12,11 +12,11 @@ export declare const file_metalstack_admin_v2_token: GenFile;
  */
 export type TokenServiceListRequest = Message<"metalstack.admin.v2.TokenServiceListRequest"> & {
     /**
-     * User is the id of the user for which the tokens should be listed
+     * Query for tokens
      *
-     * @generated from field: optional string user = 1;
+     * @generated from field: metalstack.api.v2.TokenQuery query = 1;
      */
-    user?: string | undefined;
+    query?: TokenQuery | undefined;
 };
 /**
  * Describes the message metalstack.admin.v2.TokenServiceListRequest.
diff --git a/js/metalstack/admin/v2/token_pb.js b/js/metalstack/admin/v2/token_pb.js
index 6edf5c70..6c33a770 100644
--- a/js/metalstack/admin/v2/token_pb.js
+++ b/js/metalstack/admin/v2/token_pb.js
@@ -4,11 +4,12 @@
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
+import { file_metalstack_api_v2_predefined_rules } from "../../api/v2/predefined_rules_pb";
 import { file_metalstack_api_v2_token } from "../../api/v2/token_pb";
 /**
  * Describes the file metalstack/admin/v2/token.proto.
  */
-export const file_metalstack_admin_v2_token = /*@__PURE__*/ fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL3Rva2VuLnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIjUKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0EhEKBHVzZXIYASABKAlIAIgBAUIHCgVfdXNlciJEChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USKAoGdG9rZW5zGAEgAygLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iTQoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARIYCgR1c2VyGAIgASgJQgq6SAdyBRACGIAEIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIo8BChlUb2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Eh0KBHVzZXIYASABKAlCCrpIB3IFEAIYgARIAIgBARJKChR0b2tlbl9jcmVhdGVfcmVxdWVzdBgCIAEoCzIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3RCBwoFX3VzZXIiVQoaVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbhIOCgZzZWNyZXQYAiABKAky6wIKDFRva2VuU2VydmljZRJvCgRMaXN0EiwubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBotLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgBEnQKBlJldm9rZRIuLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBovLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiCdLzGAEB4PMYARJ0CgZDcmVhdGUSLi5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QaLy5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgnS8xgBAeDzGAFCzgEKF2NvbS5tZXRhbHN0YWNrLmFkbWluLnYyQgpUb2tlblByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_token]);
+export const file_metalstack_admin_v2_token = /*@__PURE__*/ fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL3Rva2VuLnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIkcKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0EiwKBXF1ZXJ5GAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5RdWVyeSJEChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USKAoGdG9rZW5zGAEgAygLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iTgoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARIZCgR1c2VyGAIgASgJQgu6SAhyBvizrrECASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSKQAQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIeCgR1c2VyGAEgASgJQgu6SAhyBvizrrECAUgAiAEBEkoKFHRva2VuX2NyZWF0ZV9yZXF1ZXN0GAIgASgLMiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdEIHCgVfdXNlciJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCTLrAgoMVG9rZW5TZXJ2aWNlEm8KBExpc3QSLC5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUxpc3RSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCtLzGAIBAuDzGAESdAoGUmV2b2tlEi4ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi8ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSIJ0vMYAQHg8xgBEnQKBkNyZWF0ZRIuLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBovLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiCdLzGAEB4PMYAULOAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCClRva2VuUHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_token]);
 /**
  * Describes the message metalstack.admin.v2.TokenServiceListRequest.
  * Use `create(TokenServiceListRequestSchema)` to create a new message.
diff --git a/js/metalstack/admin/v2/token_pb.ts b/js/metalstack/admin/v2/token_pb.ts
index 2fc84ed6..3e7d2910 100644
--- a/js/metalstack/admin/v2/token_pb.ts
+++ b/js/metalstack/admin/v2/token_pb.ts
@@ -6,7 +6,8 @@ import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegen
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
-import type { Token, TokenServiceCreateRequest as TokenServiceCreateRequest$1 } from "../../api/v2/token_pb";
+import { file_metalstack_api_v2_predefined_rules } from "../../api/v2/predefined_rules_pb";
+import type { Token, TokenQuery, TokenServiceCreateRequest as TokenServiceCreateRequest$1 } from "../../api/v2/token_pb";
 import { file_metalstack_api_v2_token } from "../../api/v2/token_pb";
 import type { Message } from "@bufbuild/protobuf";
 
@@ -14,7 +15,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/admin/v2/token.proto.
  */
 export const file_metalstack_admin_v2_token: GenFile = /*@__PURE__*/
-  fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL3Rva2VuLnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIjUKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0EhEKBHVzZXIYASABKAlIAIgBAUIHCgVfdXNlciJEChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USKAoGdG9rZW5zGAEgAygLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iTQoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARIYCgR1c2VyGAIgASgJQgq6SAdyBRACGIAEIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIo8BChlUb2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Eh0KBHVzZXIYASABKAlCCrpIB3IFEAIYgARIAIgBARJKChR0b2tlbl9jcmVhdGVfcmVxdWVzdBgCIAEoCzIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3RCBwoFX3VzZXIiVQoaVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbhIOCgZzZWNyZXQYAiABKAky6wIKDFRva2VuU2VydmljZRJvCgRMaXN0EiwubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBotLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgBEnQKBlJldm9rZRIuLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBovLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiCdLzGAEB4PMYARJ0CgZDcmVhdGUSLi5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QaLy5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgnS8xgBAeDzGAFCzgEKF2NvbS5tZXRhbHN0YWNrLmFkbWluLnYyQgpUb2tlblByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_token]);
+  fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL3Rva2VuLnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIkcKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0EiwKBXF1ZXJ5GAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5RdWVyeSJEChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USKAoGdG9rZW5zGAEgAygLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iTgoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARIZCgR1c2VyGAIgASgJQgu6SAhyBvizrrECASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSKQAQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIeCgR1c2VyGAEgASgJQgu6SAhyBvizrrECAUgAiAEBEkoKFHRva2VuX2NyZWF0ZV9yZXF1ZXN0GAIgASgLMiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdEIHCgVfdXNlciJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCTLrAgoMVG9rZW5TZXJ2aWNlEm8KBExpc3QSLC5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUxpc3RSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCtLzGAIBAuDzGAESdAoGUmV2b2tlEi4ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi8ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSIJ0vMYAQHg8xgBEnQKBkNyZWF0ZRIuLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBovLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiCdLzGAEB4PMYAULOAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCClRva2VuUHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_token]);
 
 /**
  * TokenServiceListRequest is the request payload for listing tokens.
@@ -23,11 +24,11 @@ export const file_metalstack_admin_v2_token: GenFile = /*@__PURE__*/
  */
 export type TokenServiceListRequest = Message<"metalstack.admin.v2.TokenServiceListRequest"> & {
   /**
-   * User is the id of the user for which the tokens should be listed
+   * Query for tokens
    *
-   * @generated from field: optional string user = 1;
+   * @generated from field: metalstack.api.v2.TokenQuery query = 1;
    */
-  user?: string | undefined;
+  query?: TokenQuery | undefined;
 };
 
 /**
diff --git a/js/metalstack/api/v2/predefined_rules_pb.d.ts b/js/metalstack/api/v2/predefined_rules_pb.d.ts
index 300fcc40..61a5a589 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.d.ts
+++ b/js/metalstack/api/v2/predefined_rules_pb.d.ts
@@ -52,6 +52,12 @@ export declare const is_ip_or_hostname: GenExtension<StringRules, boolean>;
  * @generated from extension: optional bool trimmed = 80048958;
  */
 export declare const trimmed: GenExtension<StringRules, boolean>;
+/**
+ * IsUser returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_user = 80048959;
+ */
+export declare const is_user: GenExtension<StringRules, boolean>;
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
diff --git a/js/metalstack/api/v2/predefined_rules_pb.js b/js/metalstack/api/v2/predefined_rules_pb.js
index 2b526429..e7ef7e2a 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.js
+++ b/js/metalstack/api/v2/predefined_rules_pb.js
@@ -6,7 +6,7 @@ import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 /**
  * Describes the file metalstack/api/v2/predefined_rules.proto.
  */
-export const file_metalstack_api_v2_predefined_rules = /*@__PURE__*/ fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
+export const file_metalstack_api_v2_predefined_rules = /*@__PURE__*/ fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqZAQoHaXNfdXNlchIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi/5pUmIAEoCEJiwkhfCl0KDnN0cmluZy5pc191c2VyEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCA1MTIgY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSA1MTJSBmlzVXNlcjqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
 /**
  * Macaddress returns true if the given string is a valid macaddress
  *
@@ -55,39 +55,45 @@ export const is_ip_or_hostname = /*@__PURE__*/ extDesc(file_metalstack_api_v2_pr
  * @generated from extension: optional bool trimmed = 80048958;
  */
 export const trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 7);
+/**
+ * IsUser returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_user = 80048959;
+ */
+export const is_user = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 8);
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
  * @generated from extension: optional bool prefixes = 80058951;
  */
-export const prefixes = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 8);
+export const prefixes = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 9);
 /**
  * Ips validates if a slice of ips in string form are valid
  *
  * @generated from extension: optional bool ips = 80058952;
  */
-export const ips = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 9);
+export const ips = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 10);
 /**
  * AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
  *
  * @generated from extension: optional bool are_host_and_port = 80058953;
  */
-export const are_host_and_port = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 10);
+export const are_host_and_port = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 11);
 /**
  * All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool all_trimmed = 80058954;
  */
-export const all_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 11);
+export const all_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 12);
 /**
  * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
  */
-export const keys_and_values_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 12);
+export const keys_and_values_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 13);
 /**
  * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool keys_trimmed = 80068952;
  */
-export const keys_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 13);
+export const keys_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 14);
diff --git a/js/metalstack/api/v2/predefined_rules_pb.ts b/js/metalstack/api/v2/predefined_rules_pb.ts
index ae5fbbc8..897dc6b5 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.ts
+++ b/js/metalstack/api/v2/predefined_rules_pb.ts
@@ -11,7 +11,7 @@ import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
  * Describes the file metalstack/api/v2/predefined_rules.proto.
  */
 export const file_metalstack_api_v2_predefined_rules: GenFile = /*@__PURE__*/
-  fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
+  fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqZAQoHaXNfdXNlchIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi/5pUmIAEoCEJiwkhfCl0KDnN0cmluZy5pc191c2VyEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCA1MTIgY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSA1MTJSBmlzVXNlcjqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
 
 /**
  * Macaddress returns true if the given string is a valid macaddress
@@ -77,13 +77,21 @@ export const is_ip_or_hostname: GenExtension<StringRules, boolean> = /*@__PURE__
 export const trimmed: GenExtension<StringRules, boolean> = /*@__PURE__*/
   extDesc(file_metalstack_api_v2_predefined_rules, 7);
 
+/**
+ * IsUser returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_user = 80048959;
+ */
+export const is_user: GenExtension<StringRules, boolean> = /*@__PURE__*/
+  extDesc(file_metalstack_api_v2_predefined_rules, 8);
+
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
  * @generated from extension: optional bool prefixes = 80058951;
  */
 export const prefixes: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 8);
+  extDesc(file_metalstack_api_v2_predefined_rules, 9);
 
 /**
  * Ips validates if a slice of ips in string form are valid
@@ -91,7 +99,7 @@ export const prefixes: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool ips = 80058952;
  */
 export const ips: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 9);
+  extDesc(file_metalstack_api_v2_predefined_rules, 10);
 
 /**
  * AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
@@ -99,7 +107,7 @@ export const ips: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool are_host_and_port = 80058953;
  */
 export const are_host_and_port: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 10);
+  extDesc(file_metalstack_api_v2_predefined_rules, 11);
 
 /**
  * All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
@@ -107,7 +115,7 @@ export const are_host_and_port: GenExtension<RepeatedRules, boolean> = /*@__PURE
  * @generated from extension: optional bool all_trimmed = 80058954;
  */
 export const all_trimmed: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 11);
+  extDesc(file_metalstack_api_v2_predefined_rules, 12);
 
 /**
  * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
@@ -115,7 +123,7 @@ export const all_trimmed: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
  */
 export const keys_and_values_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 12);
+  extDesc(file_metalstack_api_v2_predefined_rules, 13);
 
 /**
  * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
@@ -123,5 +131,5 @@ export const keys_and_values_trimmed: GenExtension<MapRules, boolean> = /*@__PUR
  * @generated from extension: optional bool keys_trimmed = 80068952;
  */
 export const keys_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 13);
+  extDesc(file_metalstack_api_v2_predefined_rules, 14);
 
diff --git a/js/metalstack/api/v2/token_pb.d.ts b/js/metalstack/api/v2/token_pb.d.ts
index e4befca8..3a461424 100644
--- a/js/metalstack/api/v2/token_pb.d.ts
+++ b/js/metalstack/api/v2/token_pb.d.ts
@@ -244,7 +244,14 @@ export declare const TokenServiceCreateResponseSchema: GenMessage<TokenServiceCr
  *
  * @generated from message metalstack.api.v2.TokenServiceListRequest
  */
-export type TokenServiceListRequest = Message<"metalstack.api.v2.TokenServiceListRequest"> & {};
+export type TokenServiceListRequest = Message<"metalstack.api.v2.TokenServiceListRequest"> & {
+    /**
+     * Query for tokens
+     *
+     * @generated from field: metalstack.api.v2.TokenQuery query = 1;
+     */
+    query?: TokenQuery | undefined;
+};
 /**
  * Describes the message metalstack.api.v2.TokenServiceListRequest.
  * Use `create(TokenServiceListRequestSchema)` to create a new message.
@@ -467,6 +474,49 @@ export type TokenServiceRefreshResponse = Message<"metalstack.api.v2.TokenServic
  * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
  */
 export declare const TokenServiceRefreshResponseSchema: GenMessage<TokenServiceRefreshResponse>;
+/**
+ * TokenQuery is used to search tokens
+ *
+ * @generated from message metalstack.api.v2.TokenQuery
+ */
+export type TokenQuery = Message<"metalstack.api.v2.TokenQuery"> & {
+    /**
+     * UUID of the token to get
+     *
+     * @generated from field: optional string uuid = 1;
+     */
+    uuid?: string | undefined;
+    /**
+     * Name of the token user to query
+     * Only useful for admins.
+     *
+     * @generated from field: optional string user = 2;
+     */
+    user?: string | undefined;
+    /**
+     * Description of the token to query
+     *
+     * @generated from field: optional string description = 3;
+     */
+    description?: string | undefined;
+    /**
+     * Labels lists only tokens containing the given labels
+     *
+     * @generated from field: optional metalstack.api.v2.Labels labels = 4;
+     */
+    labels?: Labels | undefined;
+    /**
+     * Token type of the token to query
+     *
+     * @generated from field: optional metalstack.api.v2.TokenType token_type = 5;
+     */
+    tokenType?: TokenType | undefined;
+};
+/**
+ * Describes the message metalstack.api.v2.TokenQuery.
+ * Use `create(TokenQuerySchema)` to create a new message.
+ */
+export declare const TokenQuerySchema: GenMessage<TokenQuery>;
 /**
  * TokenType specifies different use cases of tokens
  *
diff --git a/js/metalstack/api/v2/token_pb.js b/js/metalstack/api/v2/token_pb.js
index e95dfaf3..d87aba32 100644
--- a/js/metalstack/api/v2/token_pb.js
+++ b/js/metalstack/api/v2/token_pb.js
@@ -9,7 +9,7 @@ import { file_metalstack_api_v2_predefined_rules } from "./predefined_rules_pb";
 /**
  * Describes the file metalstack/api/v2/token.proto.
  */
-export const file_metalstack_api_v2_token = /*@__PURE__*/ fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIi5QgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSJQoEbWV0YRgDIAEoCzIXLm1ldGFsc3RhY2suYXBpLnYyLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEkMKC3Blcm1pc3Npb25zGAUgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASOgoKdG9rZW5fdHlwZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAESQQoNcHJvamVjdF9yb2xlcxgJIAMoCzIqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlByb2plY3RSb2xlc0VudHJ5Ej8KDHRlbmFudF9yb2xlcxgKIAMoCzIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlRlbmFudFJvbGVzRW50cnkSPwoKYWRtaW5fcm9sZRgLIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAwgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBEkEKDW1hY2hpbmVfcm9sZXMYDSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5NYWNoaW5lUm9sZXNFbnRyeRpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAE6nwG6SJsBGpgBCht0b2tlbi5wZXJtaXNzaW9ucy51c2VydG9rZW4SKXRva2VuIHR5cGUgdXNlciBtdXN0IG5vdCBoYXZlIHBlcm1pc3Npb25zGk4odGhpcy50b2tlbl90eXBlID09IDIgJiYgdGhpcy5wZXJtaXNzaW9ucy5zaXplKCkgPT0gMCkgfHwgdGhpcy50b2tlbl90eXBlICE9IDJCDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUipQkKGVRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QSIAoLZGVzY3JpcHRpb24YASABKAlCC7pICHIGyLOusQIBEkIKC3Blcm1pc3Npb25zGAIgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIIukgFkgECEGQSPgoHZXhwaXJlcxgDIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkISukgPqgEMGgUIgeeEDzIDCNgEEnEKDXByb2plY3Rfcm9sZXMYBCADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5Qhq6SBeaARTAlbixAgEiBXIDsAEBKgWCAQIQARJxCgx0ZW5hbnRfcm9sZXMYBSADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCHLpIGZoBFsCVuLECASIHcgUQAxiAASoFggECEAESPwoKYWRtaW5fcm9sZRgGIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAcgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBErMCCg1tYWNoaW5lX3JvbGVzGAggAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeULbAbpI1wG6AckBChJtYWNoaW5lX3JvbGVzX2tleXMSM21hcCBrZXlzIG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBp+dGhpcy5hbGwoaywgayA9PSAnJyB8fCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpmgEHKgWCAQIQARIpCgZsYWJlbHMYCSABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIlUKGlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0IkQKGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIoCgZ0b2tlbnMYASADKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIsoJChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjoKC3VwZGF0ZV9tZXRhGAIgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjgKC3Blcm1pc3Npb25zGAQgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbhJxCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIaukgXmgEUwJW4sQIBIgVyA7ABASoFggECEAEScQoMdGVuYW50X3JvbGVzGAYgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhy6SBmaARbAlbixAgEiB3IFEAMYgAEqBYIBAhABEj8KCmFkbWluX3JvbGUYByABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSAGIAQESPwoKaW5mcmFfcm9sZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAogBARKzAgoNbWFjaGluZV9yb2xlcxgJIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuTWFjaGluZVJvbGVzRW50cnlC2wG6SNcBugHJAQoSbWFjaGluZV9yb2xlc19rZXlzEjNtYXAga2V5cyBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKZoBByoFggECEAESLwoGbGFiZWxzGAogASgLMh8ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTGFiZWxzGlMKEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RSb2xlOgI4ARpRChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlRlbmFudFJvbGU6AjgBGlMKEU1hY2hpbmVSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUiRQoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIkIKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiVgobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjKoBQoMVG9rZW5TZXJ2aWNlEmYKA0dldBIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUdldFJlcXVlc3QaKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSII2PMYAuDzGAESbwoGQ3JlYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgjY8xgC4PMYARJvCgZVcGRhdGUSLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2UiCNjzGALg8xgBEmkKBExpc3QSKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBorLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSII2PMYAuDzGAESbwoGUmV2b2tlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIgjY8xgC4PMYARJyCgdSZWZyZXNoEi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QaLi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2UiCNjzGALg8xgBQsABChVjb20ubWV0YWxzdGFjay5hcGkudjJCClRva2VuUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
+export const file_metalstack_api_v2_token = /*@__PURE__*/ fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIi5ggKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhkKBHVzZXIYAiABKAlCC7pICHIG+LOusQIBEiUKBG1ldGEYAyABKAsyFy5tZXRhbHN0YWNrLmFwaS52Mi5NZXRhEiAKC2Rlc2NyaXB0aW9uGAQgASgJQgu6SAhyBsizrrECARJDCgtwZXJtaXNzaW9ucxgFIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCbpIBpIBAxD0AxIrCgdleHBpcmVzGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBItCglpc3N1ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjoKCnRva2VuX3R5cGUYCCABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblR5cGVCCLpIBYIBAhABEkEKDXByb2plY3Rfcm9sZXMYCSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5Qcm9qZWN0Um9sZXNFbnRyeRI/Cgx0ZW5hbnRfcm9sZXMYCiADKAsyKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5UZW5hbnRSb2xlc0VudHJ5Ej8KCmFkbWluX3JvbGUYCyABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgMIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARJBCg1tYWNoaW5lX3JvbGVzGA0gAygLMioubWV0YWxzdGFjay5hcGkudjIuVG9rZW4uTWFjaGluZVJvbGVzRW50cnkaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBOp8BukibARqYAQobdG9rZW4ucGVybWlzc2lvbnMudXNlcnRva2VuEil0b2tlbiB0eXBlIHVzZXIgbXVzdCBub3QgaGF2ZSBwZXJtaXNzaW9ucxpOKHRoaXMudG9rZW5fdHlwZSA9PSAyICYmIHRoaXMucGVybWlzc2lvbnMuc2l6ZSgpID09IDApIHx8IHRoaXMudG9rZW5fdHlwZSAhPSAyQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIqUJChlUb2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0EiAKC2Rlc2NyaXB0aW9uGAEgASgJQgu6SAhyBsizrrECARJCCgtwZXJtaXNzaW9ucxgCIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCLpIBZIBAhBkEj4KB2V4cGlyZXMYAyABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CErpID6oBDBoFCIHnhA8yAwjYBBJxCg1wcm9qZWN0X3JvbGVzGAQgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIaukgXmgEUwJW4sQIBIgVyA7ABASoFggECEAEScQoMdGVuYW50X3JvbGVzGAUgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhy6SBmaARbAlbixAgEiB3IFEAMYgAEqBYIBAhABEj8KCmFkbWluX3JvbGUYBiABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARKzAgoNbWFjaGluZV9yb2xlcxgIIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuTWFjaGluZVJvbGVzRW50cnlC2wG6SNcBugHJAQoSbWFjaGluZV9yb2xlc19rZXlzEjNtYXAga2V5cyBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKZoBByoFggECEAESKQoGbGFiZWxzGAkgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzGlMKEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RSb2xlOgI4ARpRChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlRlbmFudFJvbGU6AjgBGlMKEU1hY2hpbmVSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlOgI4AUINCgtfYWRtaW5fcm9sZUINCgtfaW5mcmFfcm9sZSJJChBNZXRob2RQZXJtaXNzaW9uEhkKB3N1YmplY3QYASABKAlCCLpIBXIDGIACEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSJHChdUb2tlblNlcnZpY2VMaXN0UmVxdWVzdBIsCgVxdWVyeRgBIAEoCzIdLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuUXVlcnkiRAoYVG9rZW5TZXJ2aWNlTGlzdFJlc3BvbnNlEigKBnRva2VucxgBIAMoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIjMKGVRva2VuU2VydmljZVJldm9rZVJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQEiHAoaVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiygkKGVRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQESOgoLdXBkYXRlX21ldGEYAiABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5VcGRhdGVNZXRhQga6SAPIAQASJQoLZGVzY3JpcHRpb24YAyABKAlCC7pICHIGyLOusQIBSACIAQESOAoLcGVybWlzc2lvbnMYBCADKAsyIy5tZXRhbHN0YWNrLmFwaS52Mi5NZXRob2RQZXJtaXNzaW9uEnEKDXByb2plY3Rfcm9sZXMYBSADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5Qhq6SBeaARTAlbixAgEiBXIDsAEBKgWCAQIQARJxCgx0ZW5hbnRfcm9sZXMYBiADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCHLpIGZoBFsCVuLECASIHcgUQAxiAASoFggECEAESPwoKYWRtaW5fcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAYgBARI/CgppbmZyYV9yb2xlGAggASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgCiAEBErMCCg1tYWNoaW5lX3JvbGVzGAkgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeULbAbpI1wG6AckBChJtYWNoaW5lX3JvbGVzX2tleXMSM21hcCBrZXlzIG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBp+dGhpcy5hbGwoaywgayA9PSAnJyB8fCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpmgEHKgWCAQIQARIvCgZsYWJlbHMYCiABKAsyHy5tZXRhbHN0YWNrLmFwaS52Mi5VcGRhdGVMYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg4KDF9kZXNjcmlwdGlvbkINCgtfYWRtaW5fcm9sZUINCgtfaW5mcmFfcm9sZSJFChpUb2tlblNlcnZpY2VVcGRhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIjAKFlRva2VuU2VydmljZUdldFJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQEiQgoXVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIcChpUb2tlblNlcnZpY2VSZWZyZXNoUmVxdWVzdCJWChtUb2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbhIOCgZzZWNyZXQYAiABKAkinQIKClRva2VuUXVlcnkSGwoEdXVpZBgBIAEoCUIIukgFcgOwAQFIAIgBARIeCgR1c2VyGAIgASgJQgu6SAhyBvizrrECAUgBiAEBEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgCiAEBEi4KBmxhYmVscxgEIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0gDiAEBEj8KCnRva2VuX3R5cGUYBSABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblR5cGVCCLpIBYIBAhABSASIAQFCBwoFX3V1aWRCBwoFX3VzZXJCDgoMX2Rlc2NyaXB0aW9uQgkKB19sYWJlbHNCDQoLX3Rva2VuX3R5cGUqUAoJVG9rZW5UeXBlEhoKFlRPS0VOX1RZUEVfVU5TUEVDSUZJRUQQABISCg5UT0tFTl9UWVBFX0FQSRABEhMKD1RPS0VOX1RZUEVfVVNFUhACMqgFCgxUb2tlblNlcnZpY2USZgoDR2V0EikubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlR2V0UmVxdWVzdBoqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUdldFJlc3BvbnNlIgjY8xgC4PMYARJvCgZDcmVhdGUSLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiCNjzGALg8xgBEm8KBlVwZGF0ZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXNwb25zZSII2PMYAuDzGAESaQoETGlzdBIqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUxpc3RSZXF1ZXN0GisubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlTGlzdFJlc3BvbnNlIgjY8xgC4PMYARJvCgZSZXZva2USLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiCNjzGALg8xgBEnIKB1JlZnJlc2gSLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZWZyZXNoUmVxdWVzdBouLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXNwb25zZSII2PMYAuDzGAFCwAEKFWNvbS5tZXRhbHN0YWNrLmFwaS52MkIKVG9rZW5Qcm90b1ABWjVnaXRodWIuY29tL21ldGFsLXN0YWNrL2FwaS9nby9tZXRhbHN0YWNrL2FwaS92MjthcGl2MqICA01BWKoCEU1ldGFsc3RhY2suQXBpLlYyygIRTWV0YWxzdGFja1xBcGlcVjLiAh1NZXRhbHN0YWNrXEFwaVxWMlxHUEJNZXRhZGF0YeoCE01ldGFsc3RhY2s6OkFwaTo6VjJiBnByb3RvMw", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
 /**
  * Describes the message metalstack.api.v2.Token.
  * Use `create(TokenSchema)` to create a new message.
@@ -80,6 +80,11 @@ export const TokenServiceRefreshRequestSchema = /*@__PURE__*/ messageDesc(file_m
  * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
  */
 export const TokenServiceRefreshResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 13);
+/**
+ * Describes the message metalstack.api.v2.TokenQuery.
+ * Use `create(TokenQuerySchema)` to create a new message.
+ */
+export const TokenQuerySchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 14);
 /**
  * TokenType specifies different use cases of tokens
  *
diff --git a/js/metalstack/api/v2/token_pb.ts b/js/metalstack/api/v2/token_pb.ts
index c0900c38..879dddea 100644
--- a/js/metalstack/api/v2/token_pb.ts
+++ b/js/metalstack/api/v2/token_pb.ts
@@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/api/v2/token.proto.
  */
 export const file_metalstack_api_v2_token: GenFile = /*@__PURE__*/
-  fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIi5QgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSJQoEbWV0YRgDIAEoCzIXLm1ldGFsc3RhY2suYXBpLnYyLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEkMKC3Blcm1pc3Npb25zGAUgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASOgoKdG9rZW5fdHlwZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAESQQoNcHJvamVjdF9yb2xlcxgJIAMoCzIqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlByb2plY3RSb2xlc0VudHJ5Ej8KDHRlbmFudF9yb2xlcxgKIAMoCzIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlRlbmFudFJvbGVzRW50cnkSPwoKYWRtaW5fcm9sZRgLIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAwgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBEkEKDW1hY2hpbmVfcm9sZXMYDSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5NYWNoaW5lUm9sZXNFbnRyeRpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAE6nwG6SJsBGpgBCht0b2tlbi5wZXJtaXNzaW9ucy51c2VydG9rZW4SKXRva2VuIHR5cGUgdXNlciBtdXN0IG5vdCBoYXZlIHBlcm1pc3Npb25zGk4odGhpcy50b2tlbl90eXBlID09IDIgJiYgdGhpcy5wZXJtaXNzaW9ucy5zaXplKCkgPT0gMCkgfHwgdGhpcy50b2tlbl90eXBlICE9IDJCDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUipQkKGVRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QSIAoLZGVzY3JpcHRpb24YASABKAlCC7pICHIGyLOusQIBEkIKC3Blcm1pc3Npb25zGAIgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIIukgFkgECEGQSPgoHZXhwaXJlcxgDIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkISukgPqgEMGgUIgeeEDzIDCNgEEnEKDXByb2plY3Rfcm9sZXMYBCADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5Qhq6SBeaARTAlbixAgEiBXIDsAEBKgWCAQIQARJxCgx0ZW5hbnRfcm9sZXMYBSADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCHLpIGZoBFsCVuLECASIHcgUQAxiAASoFggECEAESPwoKYWRtaW5fcm9sZRgGIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAcgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBErMCCg1tYWNoaW5lX3JvbGVzGAggAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeULbAbpI1wG6AckBChJtYWNoaW5lX3JvbGVzX2tleXMSM21hcCBrZXlzIG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBp+dGhpcy5hbGwoaywgayA9PSAnJyB8fCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpmgEHKgWCAQIQARIpCgZsYWJlbHMYCSABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIlUKGlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0IkQKGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIoCgZ0b2tlbnMYASADKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIsoJChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjoKC3VwZGF0ZV9tZXRhGAIgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjgKC3Blcm1pc3Npb25zGAQgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbhJxCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIaukgXmgEUwJW4sQIBIgVyA7ABASoFggECEAEScQoMdGVuYW50X3JvbGVzGAYgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhy6SBmaARbAlbixAgEiB3IFEAMYgAEqBYIBAhABEj8KCmFkbWluX3JvbGUYByABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSAGIAQESPwoKaW5mcmFfcm9sZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAogBARKzAgoNbWFjaGluZV9yb2xlcxgJIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuTWFjaGluZVJvbGVzRW50cnlC2wG6SNcBugHJAQoSbWFjaGluZV9yb2xlc19rZXlzEjNtYXAga2V5cyBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKZoBByoFggECEAESLwoGbGFiZWxzGAogASgLMh8ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTGFiZWxzGlMKEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RSb2xlOgI4ARpRChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlRlbmFudFJvbGU6AjgBGlMKEU1hY2hpbmVSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUiRQoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIkIKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiVgobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjKoBQoMVG9rZW5TZXJ2aWNlEmYKA0dldBIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUdldFJlcXVlc3QaKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSII2PMYAuDzGAESbwoGQ3JlYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgjY8xgC4PMYARJvCgZVcGRhdGUSLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2UiCNjzGALg8xgBEmkKBExpc3QSKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBorLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSII2PMYAuDzGAESbwoGUmV2b2tlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIgjY8xgC4PMYARJyCgdSZWZyZXNoEi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QaLi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2UiCNjzGALg8xgBQsABChVjb20ubWV0YWxzdGFjay5hcGkudjJCClRva2VuUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
+  fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIi5ggKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhkKBHVzZXIYAiABKAlCC7pICHIG+LOusQIBEiUKBG1ldGEYAyABKAsyFy5tZXRhbHN0YWNrLmFwaS52Mi5NZXRhEiAKC2Rlc2NyaXB0aW9uGAQgASgJQgu6SAhyBsizrrECARJDCgtwZXJtaXNzaW9ucxgFIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCbpIBpIBAxD0AxIrCgdleHBpcmVzGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBItCglpc3N1ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjoKCnRva2VuX3R5cGUYCCABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblR5cGVCCLpIBYIBAhABEkEKDXByb2plY3Rfcm9sZXMYCSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5Qcm9qZWN0Um9sZXNFbnRyeRI/Cgx0ZW5hbnRfcm9sZXMYCiADKAsyKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5UZW5hbnRSb2xlc0VudHJ5Ej8KCmFkbWluX3JvbGUYCyABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgMIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARJBCg1tYWNoaW5lX3JvbGVzGA0gAygLMioubWV0YWxzdGFjay5hcGkudjIuVG9rZW4uTWFjaGluZVJvbGVzRW50cnkaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBOp8BukibARqYAQobdG9rZW4ucGVybWlzc2lvbnMudXNlcnRva2VuEil0b2tlbiB0eXBlIHVzZXIgbXVzdCBub3QgaGF2ZSBwZXJtaXNzaW9ucxpOKHRoaXMudG9rZW5fdHlwZSA9PSAyICYmIHRoaXMucGVybWlzc2lvbnMuc2l6ZSgpID09IDApIHx8IHRoaXMudG9rZW5fdHlwZSAhPSAyQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIqUJChlUb2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0EiAKC2Rlc2NyaXB0aW9uGAEgASgJQgu6SAhyBsizrrECARJCCgtwZXJtaXNzaW9ucxgCIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCLpIBZIBAhBkEj4KB2V4cGlyZXMYAyABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CErpID6oBDBoFCIHnhA8yAwjYBBJxCg1wcm9qZWN0X3JvbGVzGAQgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIaukgXmgEUwJW4sQIBIgVyA7ABASoFggECEAEScQoMdGVuYW50X3JvbGVzGAUgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhy6SBmaARbAlbixAgEiB3IFEAMYgAEqBYIBAhABEj8KCmFkbWluX3JvbGUYBiABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARKzAgoNbWFjaGluZV9yb2xlcxgIIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuTWFjaGluZVJvbGVzRW50cnlC2wG6SNcBugHJAQoSbWFjaGluZV9yb2xlc19rZXlzEjNtYXAga2V5cyBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKZoBByoFggECEAESKQoGbGFiZWxzGAkgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzGlMKEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RSb2xlOgI4ARpRChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlRlbmFudFJvbGU6AjgBGlMKEU1hY2hpbmVSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlOgI4AUINCgtfYWRtaW5fcm9sZUINCgtfaW5mcmFfcm9sZSJJChBNZXRob2RQZXJtaXNzaW9uEhkKB3N1YmplY3QYASABKAlCCLpIBXIDGIACEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSJHChdUb2tlblNlcnZpY2VMaXN0UmVxdWVzdBIsCgVxdWVyeRgBIAEoCzIdLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuUXVlcnkiRAoYVG9rZW5TZXJ2aWNlTGlzdFJlc3BvbnNlEigKBnRva2VucxgBIAMoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIjMKGVRva2VuU2VydmljZVJldm9rZVJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQEiHAoaVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiygkKGVRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQESOgoLdXBkYXRlX21ldGEYAiABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5VcGRhdGVNZXRhQga6SAPIAQASJQoLZGVzY3JpcHRpb24YAyABKAlCC7pICHIGyLOusQIBSACIAQESOAoLcGVybWlzc2lvbnMYBCADKAsyIy5tZXRhbHN0YWNrLmFwaS52Mi5NZXRob2RQZXJtaXNzaW9uEnEKDXByb2plY3Rfcm9sZXMYBSADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5Qhq6SBeaARTAlbixAgEiBXIDsAEBKgWCAQIQARJxCgx0ZW5hbnRfcm9sZXMYBiADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCHLpIGZoBFsCVuLECASIHcgUQAxiAASoFggECEAESPwoKYWRtaW5fcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAYgBARI/CgppbmZyYV9yb2xlGAggASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgCiAEBErMCCg1tYWNoaW5lX3JvbGVzGAkgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeULbAbpI1wG6AckBChJtYWNoaW5lX3JvbGVzX2tleXMSM21hcCBrZXlzIG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBp+dGhpcy5hbGwoaywgayA9PSAnJyB8fCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpmgEHKgWCAQIQARIvCgZsYWJlbHMYCiABKAsyHy5tZXRhbHN0YWNrLmFwaS52Mi5VcGRhdGVMYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg4KDF9kZXNjcmlwdGlvbkINCgtfYWRtaW5fcm9sZUINCgtfaW5mcmFfcm9sZSJFChpUb2tlblNlcnZpY2VVcGRhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIjAKFlRva2VuU2VydmljZUdldFJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQEiQgoXVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIcChpUb2tlblNlcnZpY2VSZWZyZXNoUmVxdWVzdCJWChtUb2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbhIOCgZzZWNyZXQYAiABKAkinQIKClRva2VuUXVlcnkSGwoEdXVpZBgBIAEoCUIIukgFcgOwAQFIAIgBARIeCgR1c2VyGAIgASgJQgu6SAhyBvizrrECAUgBiAEBEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgCiAEBEi4KBmxhYmVscxgEIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0gDiAEBEj8KCnRva2VuX3R5cGUYBSABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblR5cGVCCLpIBYIBAhABSASIAQFCBwoFX3V1aWRCBwoFX3VzZXJCDgoMX2Rlc2NyaXB0aW9uQgkKB19sYWJlbHNCDQoLX3Rva2VuX3R5cGUqUAoJVG9rZW5UeXBlEhoKFlRPS0VOX1RZUEVfVU5TUEVDSUZJRUQQABISCg5UT0tFTl9UWVBFX0FQSRABEhMKD1RPS0VOX1RZUEVfVVNFUhACMqgFCgxUb2tlblNlcnZpY2USZgoDR2V0EikubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlR2V0UmVxdWVzdBoqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUdldFJlc3BvbnNlIgjY8xgC4PMYARJvCgZDcmVhdGUSLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiCNjzGALg8xgBEm8KBlVwZGF0ZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXNwb25zZSII2PMYAuDzGAESaQoETGlzdBIqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUxpc3RSZXF1ZXN0GisubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlTGlzdFJlc3BvbnNlIgjY8xgC4PMYARJvCgZSZXZva2USLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiCNjzGALg8xgBEnIKB1JlZnJlc2gSLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZWZyZXNoUmVxdWVzdBouLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXNwb25zZSII2PMYAuDzGAFCwAEKFWNvbS5tZXRhbHN0YWNrLmFwaS52MkIKVG9rZW5Qcm90b1ABWjVnaXRodWIuY29tL21ldGFsLXN0YWNrL2FwaS9nby9tZXRhbHN0YWNrL2FwaS92MjthcGl2MqICA01BWKoCEU1ldGFsc3RhY2suQXBpLlYyygIRTWV0YWxzdGFja1xBcGlcVjLiAh1NZXRhbHN0YWNrXEFwaVxWMlxHUEJNZXRhZGF0YeoCE01ldGFsc3RhY2s6OkFwaTo6VjJiBnByb3RvMw", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
 
 /**
  * Token generates a jwt authentication token to access the api
@@ -279,6 +279,12 @@ export const TokenServiceCreateResponseSchema: GenMessage<TokenServiceCreateResp
  * @generated from message metalstack.api.v2.TokenServiceListRequest
  */
 export type TokenServiceListRequest = Message<"metalstack.api.v2.TokenServiceListRequest"> & {
+  /**
+   * Query for tokens
+   *
+   * @generated from field: metalstack.api.v2.TokenQuery query = 1;
+   */
+  query?: TokenQuery | undefined;
 };
 
 /**
@@ -538,6 +544,56 @@ export type TokenServiceRefreshResponse = Message<"metalstack.api.v2.TokenServic
 export const TokenServiceRefreshResponseSchema: GenMessage<TokenServiceRefreshResponse> = /*@__PURE__*/
   messageDesc(file_metalstack_api_v2_token, 13);
 
+/**
+ * TokenQuery is used to search tokens
+ *
+ * @generated from message metalstack.api.v2.TokenQuery
+ */
+export type TokenQuery = Message<"metalstack.api.v2.TokenQuery"> & {
+  /**
+   * UUID of the token to get
+   *
+   * @generated from field: optional string uuid = 1;
+   */
+  uuid?: string | undefined;
+
+  /**
+   * Name of the token user to query
+   * Only useful for admins.
+   *
+   * @generated from field: optional string user = 2;
+   */
+  user?: string | undefined;
+
+  /**
+   * Description of the token to query
+   *
+   * @generated from field: optional string description = 3;
+   */
+  description?: string | undefined;
+
+  /**
+   * Labels lists only tokens containing the given labels
+   *
+   * @generated from field: optional metalstack.api.v2.Labels labels = 4;
+   */
+  labels?: Labels | undefined;
+
+  /**
+   * Token type of the token to query
+   *
+   * @generated from field: optional metalstack.api.v2.TokenType token_type = 5;
+   */
+  tokenType?: TokenType | undefined;
+};
+
+/**
+ * Describes the message metalstack.api.v2.TokenQuery.
+ * Use `create(TokenQuerySchema)` to create a new message.
+ */
+export const TokenQuerySchema: GenMessage<TokenQuery> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 14);
+
 /**
  * TokenType specifies different use cases of tokens
  *
diff --git a/proto/metalstack/admin/v2/token.proto b/proto/metalstack/admin/v2/token.proto
index f7ba680f..6538d99a 100644
--- a/proto/metalstack/admin/v2/token.proto
+++ b/proto/metalstack/admin/v2/token.proto
@@ -4,6 +4,7 @@ package metalstack.admin.v2;
 
 import "buf/validate/validate.proto";
 import "metalstack/api/v2/common.proto";
+import "metalstack/api/v2/predefined_rules.proto";
 import "metalstack/api/v2/token.proto";
 
 // TokenService provides token management operations.
@@ -29,8 +30,8 @@ service TokenService {
 
 // TokenServiceListRequest is the request payload for listing tokens.
 message TokenServiceListRequest {
-  // User is the id of the user for which the tokens should be listed
-  optional string user = 1;
+  // Query for tokens
+  metalstack.api.v2.TokenQuery query = 1;
 }
 
 // TokenServiceListResponse is the response payload for listing tokens.
@@ -44,10 +45,7 @@ message TokenServiceRevokeRequest {
   // Uuid is the uuid of the token which should be revoked
   string uuid = 1 [(buf.validate.field).string.uuid = true];
   // User is the id of the user for which the token should be revoked
-  string user = 2 [(buf.validate.field).string = {
-    min_len: 2
-    max_len: 512
-  }];
+  string user = 2 [(buf.validate.field).string.(metalstack.api.v2.is_user) = true];
 }
 
 // TokenServiceRevokeResponse is the response payload for revoking a token.
@@ -56,10 +54,7 @@ message TokenServiceRevokeResponse {}
 // TokenServiceCreateRequest is the request payload for creating a token.
 message TokenServiceCreateRequest {
   // User this token should be created for, if omitted, user is derived from caller
-  optional string user = 1 [(buf.validate.field).string = {
-    min_len: 2
-    max_len: 512
-  }];
+  optional string user = 1 [(buf.validate.field).string.(metalstack.api.v2.is_user) = true];
   // TokenCreateRequest which should be created
   metalstack.api.v2.TokenServiceCreateRequest token_create_request = 2;
 }
diff --git a/proto/metalstack/api/v2/predefined_rules.proto b/proto/metalstack/api/v2/predefined_rules.proto
index 10e4f167..3d321b63 100644
--- a/proto/metalstack/api/v2/predefined_rules.proto
+++ b/proto/metalstack/api/v2/predefined_rules.proto
@@ -56,6 +56,12 @@ extend buf.validate.StringRules {
     message: "value must not start or end with whitespace"
     expression: "this.trim().size() == this.size()"
   }];
+  // IsUser returns true if name field satisfies our requirements
+  optional bool is_user = 80048959 [(buf.validate.predefined).cel = {
+    id: "string.is_user"
+    message: "must be within 2 and 512 characters"
+    expression: "this.size() >= 2 && this.size() <= 512"
+  }];
 }
 
 extend buf.validate.RepeatedRules {
diff --git a/proto/metalstack/api/v2/token.proto b/proto/metalstack/api/v2/token.proto
index c6b9ab2e..e088c266 100644
--- a/proto/metalstack/api/v2/token.proto
+++ b/proto/metalstack/api/v2/token.proto
@@ -64,10 +64,7 @@ message Token {
   // Uuid of the jwt token, used to reference it by revoke
   string uuid = 1 [(buf.validate.field).string.uuid = true];
   // User who created this token
-  string user = 2 [(buf.validate.field).string = {
-    min_len: 2
-    max_len: 512
-  }];
+  string user = 2 [(buf.validate.field).string.(metalstack.api.v2.is_user) = true];
   // Meta for this token
   Meta meta = 3;
   // Description is a user given description of this token.
@@ -183,7 +180,10 @@ message TokenServiceCreateResponse {
 }
 
 // TokenServiceListRequest is the request payload to list tokens
-message TokenServiceListRequest {}
+message TokenServiceListRequest {
+  // Query for tokens
+  TokenQuery query = 1;
+}
 
 // TokenServiceListResponse is the response payload of a token list request
 message TokenServiceListResponse {
@@ -288,3 +288,18 @@ message TokenServiceRefreshResponse {
   // Secret is the body if the jwt token, should be used in api requests as bearer token
   string secret = 2;
 }
+
+// TokenQuery is used to search tokens
+message TokenQuery {
+  // UUID of the token to get
+  optional string uuid = 1 [(buf.validate.field).string.uuid = true];
+  // Name of the token user to query
+  // Only useful for admins.
+  optional string user = 2 [(buf.validate.field).string.(metalstack.api.v2.is_user) = true];
+  // Description of the token to query
+  optional string description = 3 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // Labels lists only tokens containing the given labels
+  optional Labels labels = 4;
+  // Token type of the token to query
+  optional TokenType token_type = 5 [(buf.validate.field).enum.defined_only = true];
+}
diff --git a/python/metalstack/admin/v2/token_pb2.py b/python/metalstack/admin/v2/token_pb2.py
index 78f120f7..15a5d32e 100644
--- a/python/metalstack/admin/v2/token_pb2.py
+++ b/python/metalstack/admin/v2/token_pb2.py
@@ -24,10 +24,11 @@
 
 from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 from metalstack.api.v2 import common_pb2 as metalstack_dot_api_dot_v2_dot_common__pb2
+from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 from metalstack.api.v2 import token_pb2 as metalstack_dot_api_dot_v2_dot_token__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/admin/v2/token.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1dmetalstack/api/v2/token.proto\";\n\x17TokenServiceListRequest\x12\x17\n\x04user\x18\x01 \x01(\tH\x00R\x04user\x88\x01\x01\x42\x07\n\x05_user\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"Y\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\"\x1c\n\x1aTokenServiceRevokeResponse\"\xa9\x01\n\x19TokenServiceCreateRequest\x12#\n\x04user\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04H\x00R\x04user\x88\x01\x01\x12^\n\x14token_create_request\x18\x02 \x01(\x0b\x32,.metalstack.api.v2.TokenServiceCreateRequestR\x12tokenCreateRequestB\x07\n\x05_user\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret2\xeb\x02\n\x0cTokenService\x12o\n\x04List\x12,.metalstack.admin.v2.TokenServiceListRequest\x1a-.metalstack.admin.v2.TokenServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12t\n\x06Revoke\x12..metalstack.admin.v2.TokenServiceRevokeRequest\x1a/.metalstack.admin.v2.TokenServiceRevokeResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12t\n\x06\x43reate\x12..metalstack.admin.v2.TokenServiceCreateRequest\x1a/.metalstack.admin.v2.TokenServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x42\xce\x01\n\x17\x63om.metalstack.admin.v2B\nTokenProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/admin/v2/token.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1dmetalstack/api/v2/token.proto\"N\n\x17TokenServiceListRequest\x12\x33\n\x05query\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.TokenQueryR\x05query\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"Z\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01R\x04user\"\x1c\n\x1aTokenServiceRevokeResponse\"\xaa\x01\n\x19TokenServiceCreateRequest\x12$\n\x04user\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01H\x00R\x04user\x88\x01\x01\x12^\n\x14token_create_request\x18\x02 \x01(\x0b\x32,.metalstack.api.v2.TokenServiceCreateRequestR\x12tokenCreateRequestB\x07\n\x05_user\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret2\xeb\x02\n\x0cTokenService\x12o\n\x04List\x12,.metalstack.admin.v2.TokenServiceListRequest\x1a-.metalstack.admin.v2.TokenServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12t\n\x06Revoke\x12..metalstack.admin.v2.TokenServiceRevokeRequest\x1a/.metalstack.admin.v2.TokenServiceRevokeResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12t\n\x06\x43reate\x12..metalstack.admin.v2.TokenServiceCreateRequest\x1a/.metalstack.admin.v2.TokenServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x42\xce\x01\n\x17\x63om.metalstack.admin.v2B\nTokenProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -38,27 +39,27 @@
   _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['user']._loaded_options = None
-  _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['user']._serialized_options = b'\272H\007r\005\020\002\030\200\004'
+  _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['user']._serialized_options = b'\272H\010r\006\370\263\256\261\002\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['user']._loaded_options = None
-  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['user']._serialized_options = b'\272H\007r\005\020\002\030\200\004'
+  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['user']._serialized_options = b'\272H\010r\006\370\263\256\261\002\001'
   _globals['_TOKENSERVICE'].methods_by_name['List']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['List']._serialized_options = b'\322\363\030\002\001\002\340\363\030\001'
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._serialized_options = b'\322\363\030\001\001\340\363\030\001'
   _globals['_TOKENSERVICE'].methods_by_name['Create']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Create']._serialized_options = b'\322\363\030\001\001\340\363\030\001'
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=148
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=207
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=209
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=285
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=287
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=376
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=378
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=406
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=409
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=578
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=580
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=680
-  _globals['_TOKENSERVICE']._serialized_start=683
-  _globals['_TOKENSERVICE']._serialized_end=1046
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=190
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=268
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=270
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=346
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=348
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=438
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=440
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=468
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=471
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=641
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=643
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=743
+  _globals['_TOKENSERVICE']._serialized_start=746
+  _globals['_TOKENSERVICE']._serialized_end=1109
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/admin/v2/token_pb2.pyi b/python/metalstack/admin/v2/token_pb2.pyi
index 8c07777a..5902b33a 100644
--- a/python/metalstack/admin/v2/token_pb2.pyi
+++ b/python/metalstack/admin/v2/token_pb2.pyi
@@ -1,5 +1,6 @@
 from buf.validate import validate_pb2 as _validate_pb2
 from metalstack.api.v2 import common_pb2 as _common_pb2
+from metalstack.api.v2 import predefined_rules_pb2 as _predefined_rules_pb2
 from metalstack.api.v2 import token_pb2 as _token_pb2
 from google.protobuf.internal import containers as _containers
 from google.protobuf import descriptor as _descriptor
@@ -10,10 +11,10 @@ from typing import ClassVar as _ClassVar, Optional as _Optional, Union as _Union
 DESCRIPTOR: _descriptor.FileDescriptor
 
 class TokenServiceListRequest(_message.Message):
-    __slots__ = ("user",)
-    USER_FIELD_NUMBER: _ClassVar[int]
-    user: str
-    def __init__(self, user: _Optional[str] = ...) -> None: ...
+    __slots__ = ("query",)
+    QUERY_FIELD_NUMBER: _ClassVar[int]
+    query: _token_pb2.TokenQuery
+    def __init__(self, query: _Optional[_Union[_token_pb2.TokenQuery, _Mapping]] = ...) -> None: ...
 
 class TokenServiceListResponse(_message.Message):
     __slots__ = ("tokens",)
diff --git a/python/metalstack/api/v2/predefined_rules_pb2.py b/python/metalstack/api/v2/predefined_rules_pb2.py
index e30eb41e..deb704da 100644
--- a/python/metalstack/api/v2/predefined_rules_pb2.py
+++ b/python/metalstack/api/v2/predefined_rules_pb2.py
@@ -25,7 +25,7 @@
 from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(metalstack/api/v2/predefined_rules.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\xa7\x01\n\x11is_ip_or_hostname\x12\x19.buf.validate.StringRules\x18\xbd\xe6\x95& \x01(\x08\x42^\xc2H[\nY\n\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n\x07trimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\x08\x42\x65\xc2Hb\n`\n\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\x07trimmed:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ips:\xe6\x01\n\x11\x61re_host_and_port\x12\x1b.buf.validate.RepeatedRules\x18\xc9\xb4\x96& \x01(\x08\x42\x9a\x01\xc2H\x96\x01\n\x93\x01\n\x1arepeated.are_host_and_port\x12Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\x1a#this.all(m, m.isHostAndPort(false))R\x0e\x61reHostAndPort:\xba\x01\n\x0b\x61ll_trimmed\x12\x1b.buf.validate.RepeatedRules\x18\xca\xb4\x96& \x01(\x08\x42y\xc2Hv\nt\n\x14repeated.all_trimmed\x12\x32given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\nallTrimmed:\x84\x02\n\x17keys_and_values_trimmed\x12\x16.buf.validate.MapRules\x18\xd7\x82\x97& \x01(\x08\x42\xb1\x01\xc2H\xad\x01\n\xaa\x01\n\x1bmap.keys_and_values_trimmed\x12\x35keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n\x0ckeys_trimmed\x12\x16.buf.validate.MapRules\x18\xd8\x82\x97& \x01(\x08\x42m\xc2Hj\nh\n\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\x0bkeysTrimmedB\xca\x01\n\x15\x63om.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(metalstack/api/v2/predefined_rules.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\xa7\x01\n\x11is_ip_or_hostname\x12\x19.buf.validate.StringRules\x18\xbd\xe6\x95& \x01(\x08\x42^\xc2H[\nY\n\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n\x07trimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\x08\x42\x65\xc2Hb\n`\n\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\x07trimmed:\x99\x01\n\x07is_user\x12\x19.buf.validate.StringRules\x18\xbf\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_user\x12#must be within 2 and 512 characters\x1a&this.size() >= 2 && this.size() <= 512R\x06isUser:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ips:\xe6\x01\n\x11\x61re_host_and_port\x12\x1b.buf.validate.RepeatedRules\x18\xc9\xb4\x96& \x01(\x08\x42\x9a\x01\xc2H\x96\x01\n\x93\x01\n\x1arepeated.are_host_and_port\x12Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\x1a#this.all(m, m.isHostAndPort(false))R\x0e\x61reHostAndPort:\xba\x01\n\x0b\x61ll_trimmed\x12\x1b.buf.validate.RepeatedRules\x18\xca\xb4\x96& \x01(\x08\x42y\xc2Hv\nt\n\x14repeated.all_trimmed\x12\x32given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\nallTrimmed:\x84\x02\n\x17keys_and_values_trimmed\x12\x16.buf.validate.MapRules\x18\xd7\x82\x97& \x01(\x08\x42\xb1\x01\xc2H\xad\x01\n\xaa\x01\n\x1bmap.keys_and_values_trimmed\x12\x35keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n\x0ckeys_trimmed\x12\x16.buf.validate.MapRules\x18\xd8\x82\x97& \x01(\x08\x42m\xc2Hj\nh\n\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\x0bkeysTrimmedB\xca\x01\n\x15\x63om.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -49,6 +49,8 @@
   _globals['is_ip_or_hostname']._serialized_options = b'\302H[\nY\n\rvalid_address\022&must be a valid IP address or hostname\032 this.isIp() || this.isHostname()'
   _globals['trimmed']._loaded_options = None
   _globals['trimmed']._serialized_options = b'\302Hb\n`\n\016string.trimmed\022+value must not start or end with whitespace\032!this.trim().size() == this.size()'
+  _globals['is_user']._loaded_options = None
+  _globals['is_user']._serialized_options = b'\302H_\n]\n\016string.is_user\022#must be within 2 and 512 characters\032&this.size() >= 2 && this.size() <= 512'
   _globals['prefixes']._loaded_options = None
   _globals['prefixes']._serialized_options = b'\302HP\nN\n\021repeated.prefixes\022\034given prefixes must be valid\032\033this.all(m, m.isIpPrefix())'
   _globals['ips']._loaded_options = None
diff --git a/python/metalstack/api/v2/predefined_rules_pb2.pyi b/python/metalstack/api/v2/predefined_rules_pb2.pyi
index 6290e37c..7246b292 100644
--- a/python/metalstack/api/v2/predefined_rules_pb2.pyi
+++ b/python/metalstack/api/v2/predefined_rules_pb2.pyi
@@ -19,6 +19,8 @@ IS_IP_OR_HOSTNAME_FIELD_NUMBER: _ClassVar[int]
 is_ip_or_hostname: _descriptor.FieldDescriptor
 TRIMMED_FIELD_NUMBER: _ClassVar[int]
 trimmed: _descriptor.FieldDescriptor
+IS_USER_FIELD_NUMBER: _ClassVar[int]
+is_user: _descriptor.FieldDescriptor
 PREFIXES_FIELD_NUMBER: _ClassVar[int]
 prefixes: _descriptor.FieldDescriptor
 IPS_FIELD_NUMBER: _ClassVar[int]
diff --git a/python/metalstack/api/v2/token_pb2.py b/python/metalstack/api/v2/token_pb2.py
index 57d7ff04..3aef4266 100644
--- a/python/metalstack/api/v2/token_pb2.py
+++ b/python/metalstack/api/v2/token_pb2.py
@@ -29,7 +29,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x92\n\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12O\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryR\x0cprojectRoles\x12L\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12O\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryR\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xb3\n\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12\x7f\n\rproject_roles\x18\x04 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12~\n\x0ctenant_roles\x18\x05 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x06 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\x08 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x31\n\x06labels\x18\t \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xe1\n\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12\x7f\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12~\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\xa8\x05\n\x0cTokenService\x12\x66\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12i\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12r\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x93\n\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12O\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryR\x0cprojectRoles\x12L\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12O\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryR\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xb3\n\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12\x7f\n\rproject_roles\x18\x04 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12~\n\x0ctenant_roles\x18\x05 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x06 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\x08 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x31\n\x06labels\x18\t \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"N\n\x17TokenServiceListRequest\x12\x33\n\x05query\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.TokenQueryR\x05query\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xe1\n\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12\x7f\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12~\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\xc9\x02\n\nTokenQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01H\x01R\x04user\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x0b\x64\x65scription\x88\x01\x01\x12\x36\n\x06labels\x18\x04 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x03R\x06labels\x88\x01\x01\x12J\n\ntoken_type\x18\x05 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x04R\ttokenType\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_userB\x0e\n\x0c_descriptionB\t\n\x07_labelsB\r\n\x0b_token_type*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\xa8\x05\n\x0cTokenService\x12\x66\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12i\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12r\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -46,7 +46,7 @@
   _globals['_TOKEN'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKEN'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_TOKEN'].fields_by_name['user']._loaded_options = None
-  _globals['_TOKEN'].fields_by_name['user']._serialized_options = b'\272H\007r\005\020\002\030\200\004'
+  _globals['_TOKEN'].fields_by_name['user']._serialized_options = b'\272H\010r\006\370\263\256\261\002\001'
   _globals['_TOKEN'].fields_by_name['description']._loaded_options = None
   _globals['_TOKEN'].fields_by_name['description']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_TOKEN'].fields_by_name['permissions']._loaded_options = None
@@ -111,6 +111,14 @@
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['machine_roles']._serialized_options = b'\272H\327\001\232\001\007*\005\202\001\002\020\001\272\001\311\001\n\022machine_roles_keys\0223map keys must be empty string, \'*\', or a valid UUID\032~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))'
   _globals['_TOKENSERVICEGETREQUEST'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKENSERVICEGETREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_TOKENQUERY'].fields_by_name['uuid']._loaded_options = None
+  _globals['_TOKENQUERY'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_TOKENQUERY'].fields_by_name['user']._loaded_options = None
+  _globals['_TOKENQUERY'].fields_by_name['user']._serialized_options = b'\272H\010r\006\370\263\256\261\002\001'
+  _globals['_TOKENQUERY'].fields_by_name['description']._loaded_options = None
+  _globals['_TOKENQUERY'].fields_by_name['description']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_TOKENQUERY'].fields_by_name['token_type']._loaded_options = None
+  _globals['_TOKENQUERY'].fields_by_name['token_type']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_TOKENSERVICE'].methods_by_name['Get']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Get']._serialized_options = b'\330\363\030\002\340\363\030\001'
   _globals['_TOKENSERVICE'].methods_by_name['Create']._loaded_options = None
@@ -123,54 +131,56 @@
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._serialized_options = b'\330\363\030\002\340\363\030\001'
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._serialized_options = b'\330\363\030\002\340\363\030\001'
-  _globals['_TOKENTYPE']._serialized_start=4966
-  _globals['_TOKENTYPE']._serialized_end=5046
+  _globals['_TOKENTYPE']._serialized_start=5352
+  _globals['_TOKENTYPE']._serialized_end=5432
   _globals['_TOKEN']._serialized_start=221
-  _globals['_TOKEN']._serialized_end=1519
-  _globals['_TOKEN_PROJECTROLESENTRY']._serialized_start=1040
-  _globals['_TOKEN_PROJECTROLESENTRY']._serialized_end=1135
-  _globals['_TOKEN_TENANTROLESENTRY']._serialized_start=1137
-  _globals['_TOKEN_TENANTROLESENTRY']._serialized_end=1230
-  _globals['_TOKEN_MACHINEROLESENTRY']._serialized_start=1232
-  _globals['_TOKEN_MACHINEROLESENTRY']._serialized_end=1327
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=1522
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2853
-  _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_start=1040
-  _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_end=1135
-  _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_start=1137
-  _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_end=1230
-  _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_start=1232
-  _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_end=1327
-  _globals['_METHODPERMISSION']._serialized_start=2855
-  _globals['_METHODPERMISSION']._serialized_end=2946
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2948
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=3048
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=3050
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=3075
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=3077
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=3153
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=3155
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=3212
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3214
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3242
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3245
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=4622
-  _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_start=1040
-  _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_end=1135
-  _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_start=1137
-  _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_end=1230
-  _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_start=1232
-  _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_end=1327
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=4624
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=4700
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=4702
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=4756
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=4758
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4831
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4833
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4861
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4863
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=4964
-  _globals['_TOKENSERVICE']._serialized_start=5049
-  _globals['_TOKENSERVICE']._serialized_end=5729
+  _globals['_TOKEN']._serialized_end=1520
+  _globals['_TOKEN_PROJECTROLESENTRY']._serialized_start=1041
+  _globals['_TOKEN_PROJECTROLESENTRY']._serialized_end=1136
+  _globals['_TOKEN_TENANTROLESENTRY']._serialized_start=1138
+  _globals['_TOKEN_TENANTROLESENTRY']._serialized_end=1231
+  _globals['_TOKEN_MACHINEROLESENTRY']._serialized_start=1233
+  _globals['_TOKEN_MACHINEROLESENTRY']._serialized_end=1328
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=1523
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2854
+  _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_start=1041
+  _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_end=1136
+  _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_start=1138
+  _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_end=1231
+  _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_start=1233
+  _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_end=1328
+  _globals['_METHODPERMISSION']._serialized_start=2856
+  _globals['_METHODPERMISSION']._serialized_end=2947
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2949
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=3049
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=3051
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=3129
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=3131
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=3207
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=3209
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=3266
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3268
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3296
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3299
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=4676
+  _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_start=1041
+  _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_end=1136
+  _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_start=1138
+  _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_end=1231
+  _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_start=1233
+  _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_end=1328
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=4678
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=4754
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=4756
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=4810
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=4812
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4885
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4887
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4915
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4917
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=5018
+  _globals['_TOKENQUERY']._serialized_start=5021
+  _globals['_TOKENQUERY']._serialized_end=5350
+  _globals['_TOKENSERVICE']._serialized_start=5435
+  _globals['_TOKENSERVICE']._serialized_end=6115
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/token_pb2.pyi b/python/metalstack/api/v2/token_pb2.pyi
index f50e2fba..40ad85d6 100644
--- a/python/metalstack/api/v2/token_pb2.pyi
+++ b/python/metalstack/api/v2/token_pb2.pyi
@@ -134,8 +134,10 @@ class TokenServiceCreateResponse(_message.Message):
     def __init__(self, token: _Optional[_Union[Token, _Mapping]] = ..., secret: _Optional[str] = ...) -> None: ...
 
 class TokenServiceListRequest(_message.Message):
-    __slots__ = ()
-    def __init__(self) -> None: ...
+    __slots__ = ("query",)
+    QUERY_FIELD_NUMBER: _ClassVar[int]
+    query: TokenQuery
+    def __init__(self, query: _Optional[_Union[TokenQuery, _Mapping]] = ...) -> None: ...
 
 class TokenServiceListResponse(_message.Message):
     __slots__ = ("tokens",)
@@ -227,3 +229,17 @@ class TokenServiceRefreshResponse(_message.Message):
     token: Token
     secret: str
     def __init__(self, token: _Optional[_Union[Token, _Mapping]] = ..., secret: _Optional[str] = ...) -> None: ...
+
+class TokenQuery(_message.Message):
+    __slots__ = ("uuid", "user", "description", "labels", "token_type")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    USER_FIELD_NUMBER: _ClassVar[int]
+    DESCRIPTION_FIELD_NUMBER: _ClassVar[int]
+    LABELS_FIELD_NUMBER: _ClassVar[int]
+    TOKEN_TYPE_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    user: str
+    description: str
+    labels: _common_pb2.Labels
+    token_type: TokenType
+    def __init__(self, uuid: _Optional[str] = ..., user: _Optional[str] = ..., description: _Optional[str] = ..., labels: _Optional[_Union[_common_pb2.Labels, _Mapping]] = ..., token_type: _Optional[_Union[TokenType, str]] = ...) -> None: ...