test(authdomain): cover the role mapping echo and the spec/kind pairing

The enforcement toggle and the edit modal both PUT a full replacement, so a role mapping either one fails to echo back is dropped silently. Nothing caught that before: the fixtures these tests asserted against carried no role mapping at all. Also walks the pager when locating a list row, and checks a deleted domain against the list rather than the rendered page — the table paginates, and a shared stack holds domains the suite did not seed.
fix(authtypes): reject spec fields foreign to the declared kind
2026-08-11 15:30:47 +01:00 · 2026-08-11 01:59:54 +05:30 · 2026-08-11 01:41:28 +05:30 · 2026-08-11 01:03:56 +05:30 · 2026-08-10 18:54:04 +05:30 · 2026-08-10 18:26:45 +05:30
87 changed files with 13311 additions and 4152 deletions
--- a/docs/api/openapi.yml
+++ b/docs/api/openapi.yml
@@ -464,27 +464,50 @@ components:
          type: string
      type: object
    AuthtypesAuthDomainConfig:
+      discriminator:
+        mapping:
+          google: '#/components/schemas/AuthtypesAuthDomainConfigGoogle'
+          oidc: '#/components/schemas/AuthtypesAuthDomainConfigOIDC'
+          saml: '#/components/schemas/AuthtypesAuthDomainConfigSAML'
+        propertyName: kind
      oneOf:
-      - $ref: '#/components/schemas/AuthtypesSamlConfig'
-      - $ref: '#/components/schemas/AuthtypesGoogleConfig'
-      - $ref: '#/components/schemas/AuthtypesOIDCConfig'
+      - $ref: '#/components/schemas/AuthtypesAuthDomainConfigSAML'
+      - $ref: '#/components/schemas/AuthtypesAuthDomainConfigGoogle'
+      - $ref: '#/components/schemas/AuthtypesAuthDomainConfigOIDC'
+      type: object
+    AuthtypesAuthDomainConfigGoogle:
      properties:
-        googleAuthConfig:
-          $ref: '#/components/schemas/AuthtypesGoogleConfig'
-        oidcConfig:
-          $ref: '#/components/schemas/AuthtypesOIDCConfig'
-        roleMapping:
-          $ref: '#/components/schemas/AuthtypesRoleMapping'
-        samlConfig:
-          $ref: '#/components/schemas/AuthtypesSamlConfig'
-        ssoEnabled:
-          type: boolean
-        ssoType:
+        kind:
          $ref: '#/components/schemas/AuthtypesAuthNProvider'
+        spec:
+          $ref: '#/components/schemas/AuthtypesGoogleConfig'
+      required:
+      - kind
+      - spec
+      type: object
+    AuthtypesAuthDomainConfigOIDC:
+      properties:
+        kind:
+          $ref: '#/components/schemas/AuthtypesAuthNProvider'
+        spec:
+          $ref: '#/components/schemas/AuthtypesOIDCConfig'
+      required:
+      - kind
+      - spec
+      type: object
+    AuthtypesAuthDomainConfigSAML:
+      properties:
+        kind:
+          $ref: '#/components/schemas/AuthtypesAuthNProvider'
+        spec:
+          $ref: '#/components/schemas/AuthtypesSamlConfig'
+      required:
+      - kind
+      - spec
      type: object
    AuthtypesAuthNProvider:
      enum:
-      - google_auth
+      - google
      - saml
      - email_password
      - oidc
@@ -531,12 +554,16 @@ components:
        createdAt:
          format: date-time
          type: string
+        enabled:
+          type: boolean
        id:
          type: string
        name:
          type: string
        orgId:
          type: string
+        roleMapping:
+          $ref: '#/components/schemas/AuthtypesRoleMapping'
        updatedAt:
          format: date-time
          type: string
@@ -601,6 +628,7 @@ components:
        clientId:
          type: string
        clientSecret:
+          format: password
          type: string
        domainToAdminEmail:
          additionalProperties:
@@ -612,10 +640,12 @@ components:
          type: boolean
        insecureSkipEmailVerified:
          type: boolean
-        redirectURI:
-          type: string
        serviceAccountJson:
+          format: password
          type: string
+      required:
+      - clientId
+      - clientSecret
      type: object
    AuthtypesOIDCConfig:
      properties:
@@ -624,6 +654,7 @@ components:
        clientId:
          type: string
        clientSecret:
+          format: password
          type: string
        getUserInfo:
          type: boolean
@@ -633,6 +664,10 @@ components:
          type: string
        issuerAlias:
          type: string
+      required:
+      - issuer
+      - clientId
+      - clientSecret
      type: object
    AuthtypesOrgSessionContext:
      properties:
@@ -654,8 +689,15 @@ components:
      properties:
        config:
          $ref: '#/components/schemas/AuthtypesAuthDomainConfig'
+        enabled:
+          type: boolean
        name:
          type: string
+        roleMapping:
+          $ref: '#/components/schemas/AuthtypesRoleMapping'
+      required:
+      - name
+      - config
      type: object
    AuthtypesPostableEmailPasswordSession:
      properties:
@@ -762,14 +804,18 @@ components:
      properties:
        attributeMapping:
          $ref: '#/components/schemas/AuthtypesAttributeMapping'
+        certificate:
+          type: string
+        entityId:
+          type: string
        insecureSkipAuthNRequestsSigned:
          type: boolean
-        samlCert:
-          type: string
-        samlEntity:
-          type: string
-        samlIdp:
+        location:
          type: string
+      required:
+      - entityId
+      - location
+      - certificate
      type: object
    AuthtypesSessionContext:
      properties:
@@ -809,6 +855,12 @@ components:
      properties:
        config:
          $ref: '#/components/schemas/AuthtypesAuthDomainConfig'
+        enabled:
+          type: boolean
+        roleMapping:
+          $ref: '#/components/schemas/AuthtypesRoleMapping'
+      required:
+      - config
      type: object
    AuthtypesUpdatableRole:
      properties:
@@ -10602,275 +10654,6 @@ paths:
      summary: Update public dashboard
      tags:
      - dashboard
-  /api/v1/domains:
-    get:
-      deprecated: false
-      description: This endpoint lists all auth domains
-      operationId: ListAuthDomains
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    items:
-                      $ref: '#/components/schemas/AuthtypesGettableAuthDomain'
-                    type: array
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: List all auth domains
-      tags:
-      - authdomains
-    post:
-      deprecated: false
-      description: This endpoint creates an auth domain
-      operationId: CreateAuthDomain
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AuthtypesPostableAuthDomain'
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/TypesIdentifiable'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: Created
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "409":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Conflict
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Create auth domain
-      tags:
-      - authdomains
-  /api/v1/domains/{id}:
-    delete:
-      deprecated: false
-      description: This endpoint deletes an auth domain
-      operationId: DeleteAuthDomain
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "204":
-          description: No Content
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Delete auth domain
-      tags:
-      - authdomains
-    get:
-      deprecated: false
-      description: This endpoint returns an auth domain by ID
-      operationId: GetAuthDomain
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/AuthtypesGettableAuthDomain'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Get auth domain by ID
-      tags:
-      - authdomains
-    put:
-      deprecated: false
-      description: This endpoint updates an auth domain
-      operationId: UpdateAuthDomain
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AuthtypesUpdatableAuthDomain'
-      responses:
-        "204":
-          description: No Content
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "409":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Conflict
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Update auth domain
-      tags:
-      - authdomains
  /api/v1/downtime_schedules:
    get:
      deprecated: false
@@ -14673,6 +14456,275 @@ paths:
      summary: Update user preference
      tags:
      - preferences
+  /api/v2/auth_domains:
+    get:
+      deprecated: false
+      description: This endpoint lists all auth domains
+      operationId: ListAuthDomains
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    items:
+                      $ref: '#/components/schemas/AuthtypesGettableAuthDomain'
+                    type: array
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: List all auth domains
+      tags:
+      - authdomains
+    post:
+      deprecated: false
+      description: This endpoint creates an auth domain
+      operationId: CreateAuthDomain
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuthtypesPostableAuthDomain'
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/TypesIdentifiable'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: Created
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Conflict
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: Create auth domain
+      tags:
+      - authdomains
+  /api/v2/auth_domains/{id}:
+    delete:
+      deprecated: false
+      description: This endpoint deletes an auth domain
+      operationId: DeleteAuthDomain
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: Delete auth domain
+      tags:
+      - authdomains
+    get:
+      deprecated: false
+      description: This endpoint returns an auth domain by ID
+      operationId: GetAuthDomain
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/AuthtypesGettableAuthDomain'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: Get auth domain by ID
+      tags:
+      - authdomains
+    put:
+      deprecated: false
+      description: This endpoint updates an auth domain
+      operationId: UpdateAuthDomain
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuthtypesUpdatableAuthDomain'
+      responses:
+        "204":
+          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Conflict
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: Update auth domain
+      tags:
+      - authdomains
  /api/v2/dashboard_views:
    get:
      deprecated: false
--- a/docs/contributing/go/types.md
+++ b/docs/contributing/go/types.md
@@ -61,31 +61,37 @@ type Channel struct {

 ```go
 type AuthDomain struct {
-    storableAuthDomain *StorableAuthDomain
-    authDomainConfig   *AuthDomainConfig
+    storableAuthDomain       *StorableAuthDomain
+    storableAuthDomainConfig *StorableAuthDomainConfig
 }

 type StorableAuthDomain struct {
    bun.BaseModel `bun:"table:auth_domain"`
    types.Identifiable
    Name  string      `bun:"name"`
-    Data  string      `bun:"data"`  // AuthDomainConfig serialized as JSON
+    Data  string      `bun:"data"`  // StorableAuthDomainConfig serialized as JSON
    OrgID valuer.UUID `bun:"org_id"`
    types.TimeAuditable
 }

 type PostableAuthDomain struct {
-    Config AuthDomainConfig `json:"config"`
-    Name   string           `json:"name"`
+    Name        string           `json:"name" required:"true"`
+    Enabled     bool             `json:"enabled"`
+    Config      AuthDomainConfig `json:"config" required:"true"`
+    RoleMapping *RoleMapping     `json:"roleMapping"`
 }

-type UpdateableAuthDomain struct {
-    Config AuthDomainConfig `json:"config"` // Name intentionally absent
+type UpdatableAuthDomain struct {
+    Enabled     bool             `json:"enabled"` // Name intentionally absent
+    Config      AuthDomainConfig `json:"config" required:"true"`
+    RoleMapping *RoleMapping     `json:"roleMapping"`
 }

 type GettableAuthDomain struct {
-    *StorableAuthDomain
-    *AuthDomainConfig
+    StorableAuthDomain
+    Enabled           bool               `json:"enabled"`
+    Config            AuthDomainConfig   `json:"config"`
+    RoleMapping       *RoleMapping       `json:"roleMapping"`
    AuthNProviderInfo *AuthNProviderInfo `json:"authNProviderInfo"`
 }
 ```
@@ -93,11 +99,11 @@ type GettableAuthDomain struct {
 Each flavor exists for a concrete reason:

 - `StorableAuthDomain` stores the typed config as an opaque `Data string` column, so the schema does not need to migrate every time a config field is added.
- `PostableAuthDomain` carries the config as a structured object (not a string) for the request.
- `UpdateableAuthDomain` excludes `Name` because a domain's name cannot change after creation.
+- `PostableAuthDomain` carries the config as a structured object (not a string) for the request; `AuthDomainConfig` is a kind/spec envelope.
+- `UpdatableAuthDomain` excludes `Name` because a domain's name cannot change after creation.
 - `GettableAuthDomain` adds `AuthNProviderInfo`, which is derived at read time and never persisted.

-The core `AuthDomain` holds the two live halves — `storableAuthDomain` and `authDomainConfig` — and owns business methods such as `Update(config)`. Conversions use the `New<Output>From<Input>` form: `NewAuthDomainFromConfig`, `NewAuthDomainFromStorableAuthDomain`, `NewGettableAuthDomainFromAuthDomain`.
+The core `AuthDomain` holds the two live halves — `storableAuthDomain` and `storableAuthDomainConfig` — and owns business methods such as `Update(updatable)` and `Patch(patchable)`. Conversions use the `New<Output>From<Input>` form: `NewAuthDomainFromPostableAuthDomain`, `NewAuthDomainFromStorableAuthDomain`, `NewGettableAuthDomainFromAuthDomain`.

 ## Sum types: the kind/spec envelope

--- a/ee/authn/callbackauthn/oidccallbackauthn/authn.go
+++ b/ee/authn/callbackauthn/oidccallbackauthn/authn.go
@@ -53,10 +53,6 @@ func New(store authtypes.AuthNStore, licensing licensing.Licensing, providerSett
 }

 func (a *AuthN) LoginURL(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (string, error) {
-	if authDomain.AuthDomainConfig().AuthNProvider != authtypes.AuthNProviderOIDC {
-		return "", errors.Newf(errors.TypeInternal, authtypes.ErrCodeAuthDomainMismatch, "domain type is not oidc")
-	}
-
 	_, oauth2Config, err := a.oidcProviderAndoauth2Config(ctx, siteURL, authDomain)
 	if err != nil {
 		return "", err
@@ -85,6 +81,11 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}

+	oidcConfig, err := authDomain.Config().OIDCConfig()
+	if err != nil {
+		return nil, err
+	}
+
 	oidcProvider, oauth2Config, err := a.oidcProviderAndoauth2Config(ctx, state.URL, authDomain)
 	if err != nil {
 		return nil, err
@@ -106,14 +107,14 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, err
 	}

-	if claims == nil && authDomain.AuthDomainConfig().OIDC.GetUserInfo {
+	if claims == nil && oidcConfig.GetUserInfo {
 		claims, err = a.claimsFromUserInfo(ctx, oidcProvider, token)
 		if err != nil {
 			return nil, err
 		}
 	}

-	emailClaim, ok := claims[authDomain.AuthDomainConfig().OIDC.ClaimMapping.Email].(string)
+	emailClaim, ok := claims[oidcConfig.ClaimMapping.Email].(string)
 	if !ok {
 		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: missing email in claims")
 	}
@@ -123,7 +124,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: failed to parse email").WithAdditional(err.Error())
 	}

-	if !authDomain.AuthDomainConfig().OIDC.InsecureSkipEmailVerified {
+	if !oidcConfig.InsecureSkipEmailVerified {
 		emailVerifiedClaim, ok := claims["email_verified"].(bool)
 		if !ok {
 			return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: missing email_verified in claims")
@@ -135,14 +136,14 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 	}

 	name := ""
-	if nameClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Name; nameClaim != "" {
+	if nameClaim := oidcConfig.ClaimMapping.Name; nameClaim != "" {
 		if n, ok := claims[nameClaim].(string); ok {
 			name = n
 		}
 	}

 	var groups []string
-	if groupsClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Groups; groupsClaim != "" {
+	if groupsClaim := oidcConfig.ClaimMapping.Groups; groupsClaim != "" {
 		if claimValue, exists := claims[groupsClaim]; exists {
 			switch g := claimValue.(type) {
 			case []any:
@@ -161,7 +162,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 	}

 	role := ""
-	if roleClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Role; roleClaim != "" {
+	if roleClaim := oidcConfig.ClaimMapping.Role; roleClaim != "" {
 		if r, ok := claims[roleClaim].(string); ok {
 			role = r
 		}
@@ -177,11 +178,16 @@ func (a *AuthN) ProviderInfo(ctx context.Context, authDomain *authtypes.AuthDoma
 }

 func (a *AuthN) oidcProviderAndoauth2Config(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (*oidc.Provider, *oauth2.Config, error) {
-	if authDomain.AuthDomainConfig().OIDC.IssuerAlias != "" {
-		ctx = oidc.InsecureIssuerURLContext(ctx, authDomain.AuthDomainConfig().OIDC.IssuerAlias)
+	oidcConfig, err := authDomain.Config().OIDCConfig()
+	if err != nil {
+		return nil, nil, err
 	}

-	oidcProvider, err := oidc.NewProvider(ctx, authDomain.AuthDomainConfig().OIDC.Issuer)
+	if oidcConfig.IssuerAlias != "" {
+		ctx = oidc.InsecureIssuerURLContext(ctx, oidcConfig.IssuerAlias)
+	}
+
+	oidcProvider, err := oidc.NewProvider(ctx, oidcConfig.Issuer)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -189,13 +195,13 @@ func (a *AuthN) oidcProviderAndoauth2Config(ctx context.Context, siteURL *url.UR
 	scopes := make([]string, len(defaultScopes))
 	copy(scopes, defaultScopes)

-	if authDomain.AuthDomainConfig().RoleMapping != nil && len(authDomain.AuthDomainConfig().RoleMapping.GroupMappings) > 0 {
+	if authDomain.RoleMapping() != nil && len(authDomain.RoleMapping().GroupMappings) > 0 {
 		scopes = append(scopes, "groups")
 	}

 	return oidcProvider, &oauth2.Config{
-		ClientID:     authDomain.AuthDomainConfig().OIDC.ClientID,
-		ClientSecret: authDomain.AuthDomainConfig().OIDC.ClientSecret,
+		ClientID:     oidcConfig.ClientID,
+		ClientSecret: oidcConfig.ClientSecret,
 		Endpoint:     oidcProvider.Endpoint(),
 		Scopes:       scopes,
 		RedirectURL: (&url.URL{
@@ -212,7 +218,12 @@ func (a *AuthN) claimsFromIDToken(ctx context.Context, authDomain *authtypes.Aut
 		return nil, errors.New(errors.TypeNotFound, errors.CodeNotFound, "oidc: no id_token in token response")
 	}

-	verifier := provider.Verifier(&oidc.Config{ClientID: authDomain.AuthDomainConfig().OIDC.ClientID})
+	oidcConfig, err := authDomain.Config().OIDCConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	verifier := provider.Verifier(&oidc.Config{ClientID: oidcConfig.ClientID})
 	idToken, err := verifier.Verify(ctx, rawIDToken)
 	if err != nil {
 		return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "oidc: failed to verify token").WithAdditional(err.Error())
--- a/ee/authn/callbackauthn/samlcallbackauthn/authn.go
+++ b/ee/authn/callbackauthn/samlcallbackauthn/authn.go
@@ -40,10 +40,6 @@ func New(ctx context.Context, store authtypes.AuthNStore, licensing licensing.Li
 }

 func (a *AuthN) LoginURL(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (string, error) {
-	if authDomain.AuthDomainConfig().AuthNProvider != authtypes.AuthNProviderSAML {
-		return "", errors.Newf(errors.TypeInternal, authtypes.ErrCodeAuthDomainMismatch, "saml: domain type is not saml")
-	}
-
 	sp, err := a.serviceProvider(siteURL, authDomain)
 	if err != nil {
 		return "", err
@@ -73,6 +69,11 @@ func (a *AuthN) HandleCallback(ctx context.Context, formValues url.Values) (*aut
 		return nil, errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}

+	samlConfig, err := authDomain.Config().SamlConfig()
+	if err != nil {
+		return nil, err
+	}
+
 	sp, err := a.serviceProvider(state.URL, authDomain)
 	if err != nil {
 		return nil, err
@@ -101,19 +102,19 @@ func (a *AuthN) HandleCallback(ctx context.Context, formValues url.Values) (*aut
 	}

 	name := ""
-	if nameAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Name; nameAttribute != "" {
+	if nameAttribute := samlConfig.AttributeMapping.Name; nameAttribute != "" {
 		if val := assertionInfo.Values.Get(nameAttribute); val != "" {
 			name = val
 		}
 	}

 	var groups []string
-	if groupAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Groups; groupAttribute != "" {
+	if groupAttribute := samlConfig.AttributeMapping.Groups; groupAttribute != "" {
 		groups = assertionInfo.Values.GetAll(groupAttribute)
 	}

 	role := ""
-	if roleAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Role; roleAttribute != "" {
+	if roleAttribute := samlConfig.AttributeMapping.Role; roleAttribute != "" {
 		if val := assertionInfo.Values.Get(roleAttribute); val != "" {
 			role = val
 		}
@@ -131,7 +132,12 @@ func (a *AuthN) ProviderInfo(ctx context.Context, authDomain *authtypes.AuthDoma
 }

 func (a *AuthN) serviceProvider(siteURL *url.URL, authDomain *authtypes.AuthDomain) (*saml2.SAMLServiceProvider, error) {
-	certStore, err := a.getCertificateStore(authDomain)
+	samlConfig, err := authDomain.Config().SamlConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	certStore, err := a.getCertificateStore(samlConfig)
 	if err != nil {
 		return nil, err
 	}
@@ -142,32 +148,32 @@ func (a *AuthN) serviceProvider(siteURL *url.URL, authDomain *authtypes.AuthDoma
 	// The ServiceProviderIssuer is the client id in case of keycloak. Since we set it to the host here, we need to set the client id == host in keycloak.
 	// For AWSSSO, this is the value of Application SAML audience.
 	return &saml2.SAMLServiceProvider{
-		IdentityProviderSSOURL:      authDomain.AuthDomainConfig().SAML.SamlIdp,
-		IdentityProviderIssuer:      authDomain.AuthDomainConfig().SAML.SamlEntity,
+		IdentityProviderSSOURL:      samlConfig.Location,
+		IdentityProviderIssuer:      samlConfig.EntityID,
 		ServiceProviderIssuer:       siteURL.Host,
 		AssertionConsumerServiceURL: acsURL.String(),
-		SignAuthnRequests:           !authDomain.AuthDomainConfig().SAML.InsecureSkipAuthNRequestsSigned,
+		SignAuthnRequests:           !samlConfig.InsecureSkipAuthNRequestsSigned,
 		AllowMissingAttributes:      true,
 		IDPCertificateStore:         certStore,
 		SPKeyStore:                  dsig.RandomKeyStoreForTest(),
 	}, nil
 }

-func (a *AuthN) getCertificateStore(authDomain *authtypes.AuthDomain) (dsig.X509CertificateStore, error) {
+func (a *AuthN) getCertificateStore(samlConfig authtypes.SamlConfig) (dsig.X509CertificateStore, error) {
 	certStore := &dsig.MemoryX509CertificateStore{
 		Roots: []*x509.Certificate{},
 	}

 	var certBytes []byte
-	if strings.Contains(authDomain.AuthDomainConfig().SAML.SamlCert, "-----BEGIN CERTIFICATE-----") {
-		block, _ := pem.Decode([]byte(authDomain.AuthDomainConfig().SAML.SamlCert))
+	if strings.Contains(samlConfig.Certificate, "-----BEGIN CERTIFICATE-----") {
+		block, _ := pem.Decode([]byte(samlConfig.Certificate))
 		if block == nil {
 			return certStore, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "no valid pem cert found")
 		}

 		certBytes = block.Bytes
 	} else {
-		certData, err := base64.StdEncoding.DecodeString(authDomain.AuthDomainConfig().SAML.SamlCert)
+		certData, err := base64.StdEncoding.DecodeString(samlConfig.Certificate)
 		if err != nil {
 			return certStore, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to read certificate: %s", err.Error())
 		}
--- a/frontend/src/AppRoutes/index.tsx
+++ b/frontend/src/AppRoutes/index.tsx
@@ -376,19 +376,7 @@ function App(): JSX.Element {
 					tracesSampleRate: 0, // Ref: https://github.com/SigNoz/platform-pod/issues/2393#issuecomment-4603658055
 					replaysSessionSampleRate: 0.1, // This sets the sample rate at 10%. You may want to change it to 100% while in development and then sample at a lower rate in production.
 					replaysOnErrorSampleRate: 1.0, // If you're not already sampling the entire session, change the sample rate to 100% when sampling sessions where errors occur.
-					beforeSend(event, hint) {
-						const error = hint?.originalException as
-							| { name?: string; code?: string | number }
-							| undefined;
-
-						// Ignore benign aborted/cancelled requests (axios + fetch).
-						if (error?.code === 'ERR_CANCELED' || error?.code === 'ECONNABORTED') {
-							return null;
-						}
-						if (error?.name === 'AbortError') {
-							return null;
-						}
-
+					beforeSend(event) {
 						// Drop the event if its level is 'warning' or 'info'
 						if (event.level === 'warning' || event.level === 'info') {
 							return null;
--- a/frontend/src/api/generated/services/authdomains/index.ts
+++ b/frontend/src/api/generated/services/authdomains/index.ts
@@ -38,14 +38,14 @@ import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
 */
 export const listAuthDomains = (signal?: AbortSignal) => {
 	return GeneratedAPIInstance<ListAuthDomains200>({
-		url: `/api/v1/domains`,
+		url: `/api/v2/auth_domains`,
 		method: 'GET',
 		signal,
 	});
 };

 export const getListAuthDomainsQueryKey = () => {
-	return [`/api/v1/domains`] as const;
+	return [`/api/v2/auth_domains`] as const;
 };

 export const getListAuthDomainsQueryOptions = <
@@ -125,7 +125,7 @@ export const createAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<CreateAuthDomain201>({
-		url: `/api/v1/domains`,
+		url: `/api/v2/auth_domains`,
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
 		data: authtypesPostableAuthDomainDTO,
@@ -208,7 +208,7 @@ export const deleteAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<void>({
-		url: `/api/v1/domains/${id}`,
+		url: `/api/v2/auth_domains/${id}`,
 		method: 'DELETE',
 		signal,
 	});
@@ -287,7 +287,7 @@ export const getAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<GetAuthDomain200>({
-		url: `/api/v1/domains/${id}`,
+		url: `/api/v2/auth_domains/${id}`,
 		method: 'GET',
 		signal,
 	});
@@ -296,7 +296,7 @@ export const getAuthDomain = (
 export const getGetAuthDomainQueryKey = ({
 	id,
 }: GetAuthDomainPathParameters) => {
-	return [`/api/v1/domains/${id}`] as const;
+	return [`/api/v2/auth_domains/${id}`] as const;
 };

 export const getGetAuthDomainQueryOptions = <
@@ -389,7 +389,7 @@ export const updateAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<void>({
-		url: `/api/v1/domains/${id}`,
+		url: `/api/v2/auth_domains/${id}`,
 		method: 'PUT',
 		headers: { 'Content-Type': 'application/json' },
 		data: authtypesUpdatableAuthDomainDTO,
--- a/frontend/src/api/generated/services/sigNoz.schemas.ts
+++ b/frontend/src/api/generated/services/sigNoz.schemas.ts
@@ -1861,8 +1861,19 @@ export interface AuthtypesAttributeMappingDTO {
 	role?: string;
 }

+export enum AuthtypesAuthDomainConfigSAMLDTOKind {
+	saml = 'saml',
+}
 export interface AuthtypesSamlConfigDTO {
 	attributeMapping?: AuthtypesAttributeMappingDTO;
+	/**
+	 * @type string
+	 */
+	certificate: string;
+	/**
+	 * @type string
+	 */
+	entityId: string;
 	/**
 	 * @type boolean
 	 */
@@ -1870,17 +1881,21 @@ export interface AuthtypesSamlConfigDTO {
 	/**
 	 * @type string
 	 */
-	samlCert?: string;
-	/**
-	 * @type string
-	 */
-	samlEntity?: string;
-	/**
-	 * @type string
-	 */
-	samlIdp?: string;
+	location: string;
 }

+export interface AuthtypesAuthDomainConfigSAMLDTO {
+	/**
+	 * @type string
+	 * @enum saml
+	 */
+	kind: AuthtypesAuthDomainConfigSAMLDTOKind;
+	spec: AuthtypesSamlConfigDTO;
+}
+
+export enum AuthtypesAuthDomainConfigGoogleDTOKind {
+	google = 'google',
+}
 export type AuthtypesGoogleConfigDTODomainToAdminEmail = {
 	[key: string]: string;
 };
@@ -1893,11 +1908,12 @@ export interface AuthtypesGoogleConfigDTO {
 	/**
 	 * @type string
 	 */
-	clientId?: string;
+	clientId: string;
 	/**
 	 * @type string
+	 * @format password
 	 */
-	clientSecret?: string;
+	clientSecret: string;
 	/**
 	 * @type object
 	 */
@@ -1916,24 +1932,34 @@ export interface AuthtypesGoogleConfigDTO {
 	insecureSkipEmailVerified?: boolean;
 	/**
 	 * @type string
-	 */
-	redirectURI?: string;
-	/**
-	 * @type string
+	 * @format password
 	 */
 	serviceAccountJson?: string;
 }

+export interface AuthtypesAuthDomainConfigGoogleDTO {
+	/**
+	 * @type string
+	 * @enum google
+	 */
+	kind: AuthtypesAuthDomainConfigGoogleDTOKind;
+	spec: AuthtypesGoogleConfigDTO;
+}
+
+export enum AuthtypesAuthDomainConfigOIDCDTOKind {
+	oidc = 'oidc',
+}
 export interface AuthtypesOIDCConfigDTO {
 	claimMapping?: AuthtypesAttributeMappingDTO;
 	/**
 	 * @type string
 	 */
-	clientId?: string;
+	clientId: string;
 	/**
 	 * @type string
+	 * @format password
 	 */
-	clientSecret?: string;
+	clientSecret: string;
 	/**
 	 * @type boolean
 	 */
@@ -1945,79 +1971,33 @@ export interface AuthtypesOIDCConfigDTO {
 	/**
 	 * @type string
 	 */
-	issuer?: string;
+	issuer: string;
 	/**
 	 * @type string
 	 */
 	issuerAlias?: string;
 }

-export type AuthtypesRoleMappingDTOGroupMappingsAnyOf = {
-	[key: string]: string;
-};
-
-/**
- * @nullable
- */
-export type AuthtypesRoleMappingDTOGroupMappings =
-	AuthtypesRoleMappingDTOGroupMappingsAnyOf | null;
-
-export interface AuthtypesRoleMappingDTO {
+export interface AuthtypesAuthDomainConfigOIDCDTO {
 	/**
 	 * @type string
+	 * @enum oidc
 	 */
-	defaultRole?: string;
-	/**
-	 * @type object,null
-	 */
-	groupMappings?: AuthtypesRoleMappingDTOGroupMappings;
-	/**
-	 * @type boolean
-	 */
-	useRoleAttribute?: boolean;
+	kind: AuthtypesAuthDomainConfigOIDCDTOKind;
+	spec: AuthtypesOIDCConfigDTO;
 }

+export type AuthtypesAuthDomainConfigDTO =
+	| AuthtypesAuthDomainConfigSAMLDTO
+	| AuthtypesAuthDomainConfigGoogleDTO
+	| AuthtypesAuthDomainConfigOIDCDTO;
+
 export enum AuthtypesAuthNProviderDTO {
-	google_auth = 'google_auth',
+	google = 'google',
 	saml = 'saml',
 	email_password = 'email_password',
 	oidc = 'oidc',
 }
-export type AuthtypesAuthDomainConfigDTO =
-	| (AuthtypesSamlConfigDTO & {
-			googleAuthConfig?: AuthtypesGoogleConfigDTO;
-			oidcConfig?: AuthtypesOIDCConfigDTO;
-			roleMapping?: AuthtypesRoleMappingDTO;
-			samlConfig?: AuthtypesSamlConfigDTO;
-			/**
-			 * @type boolean
-			 */
-			ssoEnabled?: boolean;
-			ssoType?: AuthtypesAuthNProviderDTO;
-	  })
-	| (AuthtypesGoogleConfigDTO & {
-			googleAuthConfig?: AuthtypesGoogleConfigDTO;
-			oidcConfig?: AuthtypesOIDCConfigDTO;
-			roleMapping?: AuthtypesRoleMappingDTO;
-			samlConfig?: AuthtypesSamlConfigDTO;
-			/**
-			 * @type boolean
-			 */
-			ssoEnabled?: boolean;
-			ssoType?: AuthtypesAuthNProviderDTO;
-	  })
-	| (AuthtypesOIDCConfigDTO & {
-			googleAuthConfig?: AuthtypesGoogleConfigDTO;
-			oidcConfig?: AuthtypesOIDCConfigDTO;
-			roleMapping?: AuthtypesRoleMappingDTO;
-			samlConfig?: AuthtypesSamlConfigDTO;
-			/**
-			 * @type boolean
-			 */
-			ssoEnabled?: boolean;
-			ssoType?: AuthtypesAuthNProviderDTO;
-	  });
-
 export interface AuthtypesAuthNProviderInfoDTO {
 	/**
 	 * @type string,null
@@ -2055,6 +2035,31 @@ export interface AuthtypesDeprecatedPostableUserRoleDTO {
 	id: string;
 }

+export type AuthtypesRoleMappingDTOGroupMappingsAnyOf = {
+	[key: string]: string;
+};
+
+/**
+ * @nullable
+ */
+export type AuthtypesRoleMappingDTOGroupMappings =
+	AuthtypesRoleMappingDTOGroupMappingsAnyOf | null;
+
+export interface AuthtypesRoleMappingDTO {
+	/**
+	 * @type string
+	 */
+	defaultRole?: string;
+	/**
+	 * @type object,null
+	 */
+	groupMappings?: AuthtypesRoleMappingDTOGroupMappings;
+	/**
+	 * @type boolean
+	 */
+	useRoleAttribute?: boolean;
+}
+
 export interface AuthtypesGettableAuthDomainDTO {
 	authNProviderInfo?: AuthtypesAuthNProviderInfoDTO;
 	config?: AuthtypesAuthDomainConfigDTO;
@@ -2063,6 +2068,10 @@ export interface AuthtypesGettableAuthDomainDTO {
 	 * @format date-time
 	 */
 	createdAt?: string;
+	/**
+	 * @type boolean
+	 */
+	enabled?: boolean;
 	/**
 	 * @type string
 	 */
@@ -2075,6 +2084,7 @@ export interface AuthtypesGettableAuthDomainDTO {
 	 * @type string
 	 */
 	orgId?: string;
+	roleMapping?: AuthtypesRoleMappingDTO;
 	/**
 	 * @type string
 	 * @format date-time
@@ -2271,11 +2281,16 @@ export interface AuthtypesOrgSessionContextDTO {
 }

 export interface AuthtypesPostableAuthDomainDTO {
-	config?: AuthtypesAuthDomainConfigDTO;
+	config: AuthtypesAuthDomainConfigDTO;
+	/**
+	 * @type boolean
+	 */
+	enabled?: boolean;
 	/**
 	 * @type string
 	 */
-	name?: string;
+	name: string;
+	roleMapping?: AuthtypesRoleMappingDTO;
 }

 export interface AuthtypesPostableEmailPasswordSessionDTO {
@@ -2408,7 +2423,12 @@ export interface AuthtypesTransactionDTO {
 }

 export interface AuthtypesUpdatableAuthDomainDTO {
-	config?: AuthtypesAuthDomainConfigDTO;
+	config: AuthtypesAuthDomainConfigDTO;
+	/**
+	 * @type boolean
+	 */
+	enabled?: boolean;
+	roleMapping?: AuthtypesRoleMappingDTO;
 }

 export interface AuthtypesUpdatableRoleDTO {
@@ -10525,42 +10545,6 @@ export type CreatePublicDashboard201 = {
 export type UpdatePublicDashboardPathParameters = {
 	id: string;
 };
-export type ListAuthDomains200 = {
-	/**
-	 * @type array
-	 */
-	data: AuthtypesGettableAuthDomainDTO[];
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type CreateAuthDomain201 = {
-	data: TypesIdentifiableDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type DeleteAuthDomainPathParameters = {
-	id: string;
-};
-export type GetAuthDomainPathParameters = {
-	id: string;
-};
-export type GetAuthDomain200 = {
-	data: AuthtypesGettableAuthDomainDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type UpdateAuthDomainPathParameters = {
-	id: string;
-};
 export type ListDowntimeSchedulesParams = {
 	/**
 	 * @type boolean,null
@@ -11234,6 +11218,42 @@ export type GetUserPreference200 = {
 export type UpdateUserPreferencePathParameters = {
 	name: string;
 };
+export type ListAuthDomains200 = {
+	/**
+	 * @type array
+	 */
+	data: AuthtypesGettableAuthDomainDTO[];
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type CreateAuthDomain201 = {
+	data: TypesIdentifiableDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type DeleteAuthDomainPathParameters = {
+	id: string;
+};
+export type GetAuthDomainPathParameters = {
+	id: string;
+};
+export type GetAuthDomain200 = {
+	data: AuthtypesGettableAuthDomainDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type UpdateAuthDomainPathParameters = {
+	id: string;
+};
 export type ListDashboardViews200 = {
 	data: DashboardtypesListableDashboardViewDTO;
 	/**
--- a/frontend/src/api/v1/factor_password/resetPassword.ts
+++ b/frontend/src/api/v1/factor_password/resetPassword.ts
@@ -0,0 +1,31 @@
+import axios from 'api';
+import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
+import { AxiosError } from 'axios';
+import { ErrorV2Resp, SuccessResponseV2 } from 'types/api';
+import { PayloadProps, Props } from 'types/api/user/resetPassword';
+
+/**
+ * @deprecated Use the generated `useResetPassword` hook (or `resetPassword` fetcher) from
+ * `api/generated/services/users` instead. This hand-written client targets the
+ * same endpoint and will be removed once call sites migrate.
+ *
+ * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
+ */
+const resetPassword = async (
+	props: Props,
+): Promise<SuccessResponseV2<PayloadProps>> => {
+	try {
+		const response = await axios.post<PayloadProps>(`/resetPassword`, {
+			...props,
+		});
+
+		return {
+			httpStatusCode: response.status,
+			data: response.data,
+		};
+	} catch (error) {
+		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
+	}
+};
+
+export default resetPassword;
--- a/frontend/src/components/EditMemberDrawer/tests/EditMemberDrawer.test.tsx
+++ b/frontend/src/components/EditMemberDrawer/tests/EditMemberDrawer.test.tsx
@@ -5,9 +5,10 @@ import {
 	useCreateResetPasswordToken,
 	useDeleteUser,
 	useGetResetPasswordToken,
-	useCreateUserRole,
-	useDeleteUserRole,
+	useGetRolesByUserID,
 	useGetUser,
+	useRemoveUserRoleByUserIDAndRoleID,
+	useSetRoleByUserID,
 	useUpdateMyUserV2,
 	useUpdateUser,
 } from 'api/generated/services/users';
@@ -24,14 +25,15 @@ import EditMemberDrawer, { EditMemberDrawerProps } from '../EditMemberDrawer';
 jest.mock('api/generated/services/users', () => ({
 	useDeleteUser: jest.fn(),
 	useGetUser: jest.fn(),
-	useDeleteUserRole: jest.fn(),
+	useGetRolesByUserID: jest.fn(),
+	useRemoveUserRoleByUserIDAndRoleID: jest.fn(),
 	useUpdateUser: jest.fn(),
 	useUpdateMyUserV2: jest.fn(),
-	useCreateUserRole: jest.fn(),
+	useSetRoleByUserID: jest.fn(),
 	useGetResetPasswordToken: jest.fn(),
 	useCreateResetPasswordToken: jest.fn(),
-	getGetUserQueryKey: ({ id }: { id: string }): string[] => [
-		`/api/v2/users/${id}`,
+	getGetRolesByUserIDQueryKey: ({ id }: { id: string }): string[] => [
+		`/api/v2/users/${id}/roles`,
 	],
 }));

@@ -192,7 +194,11 @@ describe('EditMemberDrawer', () => {
 			isLoading: false,
 			refetch: jest.fn(),
 		});
-		(useDeleteUserRole as jest.Mock).mockReturnValue({
+		(useGetRolesByUserID as jest.Mock).mockReturnValue({
+			data: { data: [managedRoles[0]] },
+			isLoading: false,
+		});
+		(useRemoveUserRoleByUserIDAndRoleID as jest.Mock).mockReturnValue({
 			mutateAsync: mockRemoveMutateAsync.mockResolvedValue({}),
 			isLoading: false,
 		});
@@ -204,7 +210,7 @@ describe('EditMemberDrawer', () => {
 			mutateAsync: jest.fn().mockResolvedValue({}),
 			isLoading: false,
 		});
-		(useCreateUserRole as jest.Mock).mockReturnValue({
+		(useSetRoleByUserID as jest.Mock).mockReturnValue({
 			mutateAsync: jest.fn().mockResolvedValue({}),
 			isLoading: false,
 		});
@@ -306,12 +312,12 @@ describe('EditMemberDrawer', () => {
 		expect(onClose).not.toHaveBeenCalled();
 	});

-	it('adding a new role creates a user role without removing existing ones', async () => {
+	it('adding a new role calls setRole without removing existing ones', async () => {
 		const onComplete = jest.fn();
 		const user = userEvent.setup({ pointerEventsCheck: 0 });
 		const mockSet = jest.fn().mockResolvedValue({});

-		(useCreateUserRole as jest.Mock).mockReturnValue({
+		(useSetRoleByUserID as jest.Mock).mockReturnValue({
 			mutateAsync: mockSet,
 			isLoading: false,
 		});
@@ -328,14 +334,15 @@ describe('EditMemberDrawer', () => {

 		await waitFor(() => {
 			expect(mockSet).toHaveBeenCalledWith({
-				data: { userId: 'user-1', roleId: managedRoles[1].id },
+				pathParams: { id: 'user-1' },
+				data: { name: 'signoz-editor' },
 			});
 			expect(mockRemoveMutateAsync).not.toHaveBeenCalled();
 			expect(onComplete).toHaveBeenCalled();
 		});
 	});

-	it('deselecting a role deletes the user role by its assignment id', async () => {
+	it('deselecting a role calls removeRole with the role id', async () => {
 		const onComplete = jest.fn();
 		const user = userEvent.setup({ pointerEventsCheck: 0 });

@@ -354,7 +361,7 @@ describe('EditMemberDrawer', () => {

 		await waitFor(() => {
 			expect(mockRemoveMutateAsync).toHaveBeenCalledWith({
-				pathParams: { id: 'ur-1' },
+				pathParams: { id: 'user-1', roleId: managedRoles[0].id },
 			});
 			expect(onComplete).toHaveBeenCalled();
 		});
--- a/frontend/src/components/LogDetail/LogHighlights/LogHighlights.module.scss
+++ b/frontend/src/components/LogDetail/LogHighlights/LogHighlights.module.scss
@@ -1,46 +0,0 @@
-.highlights {
-	display: grid;
-	grid-template-columns: repeat(4, minmax(0, 1fr));
-	gap: 12px 16px;
-	padding: 12px 0;
-
-	// Constrain each KeyValueLabel (the grid items) to its cell.
-	:global(.key-value-label) {
-		width: auto;
-		min-width: 0;
-		overflow: hidden;
-	}
-}
-
-.valueBadge {
-	--badge-font-size: 13px;
-	box-sizing: border-box;
-	max-width: 100%;
-	min-width: 0;
-}
-
-// Truncating text inside a badge
-.badgeText {
-	min-width: 0;
-	overflow: hidden;
-	text-overflow: ellipsis;
-	white-space: nowrap;
-}
-
-.serviceDot {
-	width: 6px;
-	height: 6px;
-	border-radius: 50%;
-	background: var(--accent-forest);
-	flex-shrink: 0;
-	margin-right: 4px;
-}
-
-.traceLink {
-	display: inline-block;
-	max-width: 100%;
-	overflow: hidden;
-	text-overflow: ellipsis;
-	white-space: nowrap;
-	color: var(--accent-primary);
-}
--- a/frontend/src/components/LogDetail/LogHighlights/LogHighlights.tsx
+++ b/frontend/src/components/LogDetail/LogHighlights/LogHighlights.tsx
@@ -1,36 +0,0 @@
-import KeyValueLabel from 'periscope/components/KeyValueLabel';
-import { ILog } from 'types/api/logs/log';
-
-import { LOG_HIGHLIGHTS } from './config';
-import styles from './LogHighlights.module.scss';
-
-interface LogHighlightsProps {
-	log: ILog;
-}
-
-function LogHighlights({ log }: LogHighlightsProps): JSX.Element | null {
-	const fields = LOG_HIGHLIGHTS.map((field) => ({
-		key: field.key,
-		label: field.label,
-		value: field.render(log),
-	})).filter((field) => field.value != null);
-
-	if (fields.length === 0) {
-		return null;
-	}
-
-	return (
-		<div className={styles.highlights} data-testid="log-details-highlights">
-			{fields.map((field) => (
-				<KeyValueLabel
-					key={field.key}
-					badgeKey={field.label}
-					badgeValue={field.value}
-					direction="column"
-				/>
-			))}
-		</div>
-	);
-}
-
-export default LogHighlights;
--- a/frontend/src/components/LogDetail/LogHighlights/TraceIdField.tsx
+++ b/frontend/src/components/LogDetail/LogHighlights/TraceIdField.tsx
@@ -1,23 +0,0 @@
-import { Link } from 'react-router-dom';
-
-import styles from './LogHighlights.module.scss';
-
-interface TraceIdFieldProps {
-	traceId: string;
-}
-
-function TraceIdField({ traceId }: TraceIdFieldProps): JSX.Element {
-	return (
-		<Link
-			to={{ pathname: `/trace/${traceId}` }}
-			target="_blank"
-			rel="noreferrer"
-			className={styles.traceLink}
-			title={traceId}
-		>
-			{traceId}
-		</Link>
-	);
-}
-
-export default TraceIdField;
--- a/frontend/src/components/LogDetail/LogHighlights/config.tsx
+++ b/frontend/src/components/LogDetail/LogHighlights/config.tsx
@@ -1,102 +0,0 @@
-import { ReactNode } from 'react';
-import { Badge, BadgeColor } from '@signozhq/ui/badge';
-import { LogType } from 'components/Logs/LogStateIndicator/LogStateIndicator';
-import { getLogIndicatorType } from 'components/Logs/LogStateIndicator/utils';
-import { ILog } from 'types/api/logs/log';
-
-import styles from './LogHighlights.module.scss';
-import TraceIdField from './TraceIdField';
-
-// Severity badge color mirrors the LogStateIndicator bar
-const SEVERITY_COLOR: Record<string, BadgeColor> = {
-	[LogType.TRACE]: 'forest',
-	[LogType.DEBUG]: 'aqua',
-	[LogType.INFO]: 'robin',
-	[LogType.WARN]: 'amber',
-	[LogType.ERROR]: 'cherry',
-	[LogType.FATAL]: 'sakura',
-};
-
-export interface LogHighlightConfig {
-	key: string;
-	label: string;
-	render: (log: ILog) => ReactNode | null;
-}
-
-// Resource/attribute lookup (keys like `service.name` live in resources_string,
-// occasionally attributes_string). Typed loosely as these are string maps.
-const getAttr = (log: ILog, key: string): string =>
-	(log.resources_string as unknown as Record<string, string>)?.[key] ||
-	(log.attributes_string as unknown as Record<string, string>)?.[key] ||
-	'';
-
-const valueBadge = (
-	value: string,
-	options?: { prefix?: ReactNode; color?: BadgeColor },
-): ReactNode => (
-	<Badge color={options?.color ?? 'vanilla'} className={styles.valueBadge}>
-		{options?.prefix}
-		<span className={styles.badgeText} title={value}>
-			{value}
-		</span>
-	</Badge>
-);
-
-export const LOG_HIGHLIGHTS: LogHighlightConfig[] = [
-	{
-		key: 'service',
-		label: 'SERVICE',
-		render: (log): ReactNode | null => {
-			const value = getAttr(log, 'service.name');
-			return value
-				? valueBadge(value, {
-						prefix: <span className={styles.serviceDot} />,
-					})
-				: null;
-		},
-	},
-	{
-		key: 'severity',
-		label: 'SEVERITY',
-		render: (log): ReactNode | null => {
-			if (!log.severity_text) {
-				return null;
-			}
-			return valueBadge(log.severity_text, {
-				color: SEVERITY_COLOR[getLogIndicatorType(log)] ?? 'vanilla',
-			});
-		},
-	},
-	{
-		key: 'namespace',
-		label: 'NAMESPACE',
-		render: (log): ReactNode | null => {
-			const value = getAttr(log, 'service.namespace');
-			return value ? valueBadge(value) : null;
-		},
-	},
-	{
-		key: 'environment',
-		label: 'ENVIRONMENT',
-		render: (log): ReactNode | null => {
-			const value = getAttr(log, 'deployment.environment');
-			return value ? valueBadge(value) : null;
-		},
-	},
-	{
-		key: 'traceId',
-		label: 'TRACE ID',
-		render: (log): ReactNode | null => {
-			const traceId = log.trace_id || log.traceId;
-			return traceId ? <TraceIdField traceId={traceId} /> : null;
-		},
-	},
-	{
-		key: 'spanId',
-		label: 'SPAN ID',
-		render: (log): ReactNode | null => {
-			const spanId = log.span_id || log.spanID;
-			return spanId ? valueBadge(spanId) : null;
-		},
-	},
-];
--- a/frontend/src/components/LogDetail/tests/LogDetail.test.tsx
+++ b/frontend/src/components/LogDetail/tests/LogDetail.test.tsx
@@ -115,45 +115,6 @@ describe('LogDetail drawer — header (isLogDetailsV2)', () => {
 		expect(screen.queryByText('Open in Explorer')).not.toBeInTheDocument();
 	});

-	it('renders Highlights for fields present on the log, omitting absent ones', () => {
-		const logWithMeta = {
-			...mockLog,
-			severity_text: 'ERROR',
-			trace_id: 'trace-abc',
-			resources_string: {
-				'service.name': 'checkout',
-				'deployment.environment': 'production',
-			},
-		} as unknown as ILog;
-
-		renderDrawer({ log: logWithMeta });
-
-		const highlights = screen.getByTestId('log-details-highlights');
-		expect(highlights).toHaveTextContent('SEVERITY');
-		expect(highlights).toHaveTextContent('ERROR');
-		expect(highlights).toHaveTextContent('SERVICE');
-		expect(highlights).toHaveTextContent('checkout');
-		expect(highlights).toHaveTextContent('ENVIRONMENT');
-		expect(highlights).toHaveTextContent('production');
-		expect(highlights).toHaveTextContent('TRACE ID');
-		// Absent fields are omitted (no namespace / span id on this log).
-		expect(highlights).not.toHaveTextContent('NAMESPACE');
-		expect(highlights).not.toHaveTextContent('SPAN ID');
-	});
-
-	it('links the trace id highlight to the trace detail in a new tab', () => {
-		const logWithTrace = {
-			...mockLog,
-			trace_id: 'trace-abc',
-		} as unknown as ILog;
-
-		renderDrawer({ log: logWithTrace });
-
-		const link = screen.getByRole('link', { name: 'trace-abc' });
-		expect(link).toHaveAttribute('target', '_blank');
-		expect(link.getAttribute('href')).toContain('/trace/trace-abc');
-	});
-
 	it('navigates to the next / previous log with the Down / Up arrow keys', async () => {
 		const user = userEvent.setup({ pointerEventsCheck: 0 });
 		const logs = [makeLog('log-0'), makeLog('log-1'), makeLog('log-2')];
--- a/frontend/src/components/LogDetail/index.tsx
+++ b/frontend/src/components/LogDetail/index.tsx
@@ -55,7 +55,6 @@ import { isLogDetailsV2, RESOURCE_KEYS, VIEW_TYPES, VIEWS } from './constants';
 import { LogDetailInnerProps, LogDetailProps } from './LogDetail.interfaces';
 import LogDetailsHeader from './LogDetailsHeader/LogDetailsHeader';
 import { useLogNavigation } from './LogDetailsHeader/useLogNavigation';
-import LogHighlights from './LogHighlights/LogHighlights';

 import './LogDetails.styles.scss';

@@ -400,8 +399,6 @@ function LogDetailInner({
 					<div className="log-overflow-shadow">&nbsp;</div>
 				</div>

-				{isLogDetailsV2 && <LogHighlights log={log} />}
-
 				<div className="tabs-and-search">
 					<ToggleGroupSimple
 						type="single"
--- a/frontend/src/components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch.tsx
+++ b/frontend/src/components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch.tsx
@@ -183,14 +183,15 @@ function QuerySearch({
 				isProgrammaticChangeRef.current = true;
 			}

-			const changes = view.state.changes({
-				from: 0,
-				to: currentValue.length,
-				insert: value,
-			});
 			view.dispatch({
-				changes,
-				selection: { anchor: changes.newLength },
+				changes: {
+					from: 0,
+					to: currentValue.length,
+					insert: value,
+				},
+				selection: {
+					anchor: value.length,
+				},
 			});
 		},
 		[],
--- a/frontend/src/components/QueryBuilderV2/QueryV2/tests/QuerySearch.test.tsx
+++ b/frontend/src/components/QueryBuilderV2/QueryV2/tests/QuerySearch.test.tsx
@@ -301,66 +301,6 @@ describe('QuerySearch (Integration with Real CodeMirror)', () => {
 		dispatchSpy.mockRestore();
 	});

-	it('does not crash when the expression contains CRLF line breaks (issue #5869)', async () => {
-		const dispatchSpy = jest.spyOn(EditorView.prototype, 'dispatch');
-		const onChange = jest.fn() as jest.MockedFunction<(v: string) => void>;
-		const initialExpression = "service.name = 'frontend'";
-		// Filtering on a multi-line log value (CRLF) used to throw
-		// "RangeError: Selection points outside of document".
-		const crlfExpression = "body CONTAINS 'line1\r\nline2\r\nline3'";
-
-		const baseQueryData = {
-			...initialQueriesMap.logs.builder.queryData[0],
-			filter: { expression: initialExpression },
-		};
-
-		const { rerender } = render(
-			<QuerySearch
-				onChange={onChange}
-				queryData={baseQueryData}
-				dataSource={DataSource.LOGS}
-			/>,
-		);
-
-		await waitFor(
-			() => {
-				const editorContent = document.querySelector(
-					CM_EDITOR_SELECTOR,
-				) as HTMLElement;
-				expect(editorContent.textContent || '').toBe(initialExpression);
-			},
-			{ timeout: 3000 },
-		);
-
-		rerender(
-			<QuerySearch
-				onChange={onChange}
-				queryData={{ ...baseQueryData, filter: { expression: crlfExpression } }}
-				dataSource={DataSource.LOGS}
-			/>,
-		);
-
-		// The programmatic replace dispatched without throwing, and the selection anchor
-		// stayed within the CRLF-normalized document (the bug set it past the end).
-		await waitFor(() => {
-			const spec = dispatchSpy.mock.calls
-				.map(
-					(call) =>
-						call[0] as {
-							selection?: { anchor?: number };
-							changes?: { newLength?: number };
-						},
-				)
-				.find((s) => s?.selection?.anchor != null && s?.changes?.newLength != null);
-			expect(spec).toBeDefined();
-			expect(spec?.selection?.anchor).toBeLessThanOrEqual(
-				spec?.changes?.newLength as number,
-			);
-		});
-
-		dispatchSpy.mockRestore();
-	});
-
 	it('fetches key suggestions for metrics even without aggregateAttribute.key when showFilterSuggestionsWithoutMetric is true', async () => {
 		const mockedGetKeys = getKeySuggestions as jest.MockedFunction<
 			typeof getKeySuggestions
--- a/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityEvents/EntityEvents.tsx
+++ b/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityEvents/EntityEvents.tsx
@@ -22,7 +22,6 @@ import { InfraMonitoringEntity } from 'container/InfraMonitoringK8sV2/constants'
 import LoadingContainer from 'container/InfraMonitoringK8sV2/LoadingContainer';
 import RunQueryBtn from 'container/QueryBuilder/components/RunQueryBtn/RunQueryBtn';
 import { ChevronDown, ChevronRight } from '@signozhq/icons';
-import { saveRecentQueryByExpression } from 'lib/recentQueries/saveRecentQuery';
 import { useQueryState } from 'nuqs';
 import { DataSource } from 'types/common/queryBuilder';
 import { parseAsJsonNoValidate } from 'utils/nuqsParsers';
@@ -117,7 +116,6 @@ function EntityEventsContent({
 					: newUserExpression || '',
 			);
 			if (validation.isValid) {
-				saveRecentQueryByExpression(DataSource.LOGS, newUserExpression);
 				querySearchOnRun(newUserExpression || '');

 				void logEvent(InfraMonitoringEvents.FilterApplied, {
--- a/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityLogs/EntityLogs.tsx
+++ b/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityLogs/EntityLogs.tsx
@@ -29,7 +29,6 @@ import { getOldLogsOperatorFromNew } from 'hooks/logs/useActiveLog';
 import useLogDetailHandlers from 'hooks/logs/useLogDetailHandlers';
 import useScrollToLog from 'hooks/logs/useScrollToLog';
 import { generateFilterQuery } from 'lib/logs/generateFilterQuery';
-import { saveRecentQueryByExpression } from 'lib/recentQueries/saveRecentQuery';
 import { ILog } from 'types/api/logs/log';
 import { DataSource } from 'types/common/queryBuilder';
 import { validateQuery } from 'utils/queryValidationUtils';
@@ -133,7 +132,6 @@ function EntityLogsContent({
 			);

 			if (validation.isValid) {
-				saveRecentQueryByExpression(DataSource.LOGS, newUserExpression);
 				querySearchOnRun(newUserExpression);

 				void logEvent(InfraMonitoringEvents.FilterApplied, {
--- a/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityTraces/EntityTraces.tsx
+++ b/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityTraces/EntityTraces.tsx
@@ -22,7 +22,6 @@ import { InfraMonitoringEntity } from 'container/InfraMonitoringK8sV2/constants'
 import RunQueryBtn from 'container/QueryBuilder/components/RunQueryBtn/RunQueryBtn';
 import { PER_PAGE_OPTIONS } from 'container/TracesExplorer/ListView/configs';
 import { TracesLoading } from 'container/TracesExplorer/TraceLoading/TraceLoading';
-import { saveRecentQueryByExpression } from 'lib/recentQueries/saveRecentQuery';
 import { useQueryState } from 'nuqs';
 import { DataSource } from 'types/common/queryBuilder';
 import { parseAsJsonNoValidate } from 'utils/nuqsParsers';
@@ -99,7 +98,6 @@ function EntityTracesContent({
 					: newUserExpression || '',
 			);
 			if (validation.isValid) {
-				saveRecentQueryByExpression(DataSource.TRACES, newUserExpression);
 				querySearchOnRun(newUserExpression || '');

 				void logEvent(InfraMonitoringEvents.FilterApplied, {
--- a/frontend/src/container/MetricsExplorer/Summary/MetricsSearch.tsx
+++ b/frontend/src/container/MetricsExplorer/Summary/MetricsSearch.tsx
@@ -2,7 +2,6 @@ import { useCallback } from 'react';
 import QuerySearch from 'components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch';
 import RunQueryBtn from 'container/QueryBuilder/components/RunQueryBtn/RunQueryBtn';
 import DateTimeSelectionV2 from 'container/TopNav/DateTimeSelectionV2';
-import { saveRecentQueryByExpression } from 'lib/recentQueries/saveRecentQuery';
 import { DataSource } from 'types/common/queryBuilder';

 import { MetricsSearchProps } from './types';
@@ -24,14 +23,12 @@ function MetricsSearch({
 	);

 	const handleStageAndRunQuery = useCallback(() => {
-		saveRecentQueryByExpression(DataSource.METRICS, currentQueryFilterExpression);
 		onChange(currentQueryFilterExpression);
 		onRunQuery?.();
 	}, [currentQueryFilterExpression, onChange, onRunQuery]);

 	const handleRunQuery = useCallback(
 		(expression: string): void => {
-			saveRecentQueryByExpression(DataSource.METRICS, expression);
 			setCurrentQueryFilterExpression(expression);
 			onChange(expression);
 		},
--- a/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/AuthnProviderSelector.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/AuthnProviderSelector.tsx
@@ -16,7 +16,7 @@ interface AuthNProvider {
 function getAuthNProviders(samlEnabled: boolean): AuthNProvider[] {
 	return [
 		{
-			key: AuthtypesAuthNProviderDTO.google_auth,
+			key: AuthtypesAuthNProviderDTO.google,
 			title: 'Google Apps Authentication',
 			description: 'Let members sign-in with a Google workspace account',
 			icon: <SolidGoogle size={37} />,
@@ -78,6 +78,7 @@ function AuthnProviderSelector({
 								<Button
 									onClick={(): void => setAuthnProvider(provider.key)}
 									type="primary"
+									data-testid={`authn-provider-configure-${provider.key}`}
 								>
 									Configure
 								</Button>
--- a/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.tsx
@@ -10,8 +10,6 @@ import {
 import {
 	AuthtypesAuthNProviderDTO,
 	AuthtypesGettableAuthDomainDTO,
-	AuthtypesGoogleConfigDTO,
-	AuthtypesRoleMappingDTO,
 	RenderErrorResponseDTO,
 } from 'api/generated/services/sigNoz.schemas';
 import { AxiosError } from 'axios';
@@ -24,10 +22,11 @@ import APIError from 'types/api/error';

 import AuthnProviderSelector from './AuthnProviderSelector';
 import {
-	convertDomainMappingsToRecord,
-	convertGroupMappingsToRecord,
 	FormValues,
+	kindToProvider,
+	prepareConfig,
 	prepareInitialValues,
+	prepareRoleMapping,
 } from './CreateEdit.utils';
 import ConfigureGoogleAuthAuthnProvider from './Providers/AuthnGoogleAuth';
 import ConfigureOIDCAuthnProvider from './Providers/AuthnOIDC';
@@ -41,7 +40,7 @@ function configureAuthnProvider(
 	switch (authnProvider) {
 		case 'saml':
 			return <ConfigureSAMLAuthnProvider isCreate={isCreate} />;
-		case 'google_auth':
+		case 'google':
 			return <ConfigureGoogleAuthAuthnProvider isCreate={isCreate} />;
 		case 'oidc':
 			return <ConfigureOIDCAuthnProvider isCreate={isCreate} />;
@@ -61,7 +60,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 	const [form] = Form.useForm<FormValues>();
 	const [authnProvider, setAuthnProvider] = useState<
 		AuthtypesAuthNProviderDTO | ''
-	>(record?.config?.ssoType || '');
+	>(kindToProvider(record?.config?.kind));

 	const { showErrorModal } = useErrorModal();
 	const { featureFlags } = useAppContext();
@@ -85,68 +84,6 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 	const { mutate: updateAuthDomain, isLoading: isUpdating } =
 		useUpdateAuthDomain<AxiosError<RenderErrorResponseDTO>>();

-	/**
-	 * Prepares Google Auth config for API payload
-	 */
-	const getGoogleAuthConfig = useCallback(():
-		| AuthtypesGoogleConfigDTO
-		| undefined => {
-		const config = form.getFieldValue('googleAuthConfig');
-		if (!config) {
-			return undefined;
-		}
-
-		const {
-			domainToAdminEmailList,
-			allowedGroups,
-			serviceAccountJson,
-			domainToAdminEmail: _domainToAdminEmail,
-			fetchTransitiveGroupMembership,
-			...rest
-		} = config;
-		const domainToAdminEmail = convertDomainMappingsToRecord(
-			domainToAdminEmailList,
-		);
-
-		return {
-			...rest,
-			...(rest.fetchGroups
-				? {
-						allowedGroups,
-						serviceAccountJson,
-						domainToAdminEmail: domainToAdminEmail ?? {},
-						fetchTransitiveGroupMembership,
-					}
-				: { domainToAdminEmail: {} }),
-		};
-	}, [form]);
-
-	// Prepares role mapping for API payload
-	const getRoleMapping = useCallback((): AuthtypesRoleMappingDTO | undefined => {
-		const roleMapping = form.getFieldValue('roleMapping');
-		if (!roleMapping) {
-			return undefined;
-		}
-
-		const { groupMappingsList, ...rest } = roleMapping;
-		const groupMappings = convertGroupMappingsToRecord(groupMappingsList);
-
-		// Only return roleMapping if there's meaningful content
-		const hasDefaultRole = !!rest.defaultRole;
-		const hasUseRoleAttribute = rest.useRoleAttribute === true;
-		const hasGroupMappings =
-			groupMappings && Object.keys(groupMappings).length > 0;
-
-		if (!hasDefaultRole && !hasUseRoleAttribute && !hasGroupMappings) {
-			return undefined;
-		}
-
-		return {
-			...rest,
-			groupMappings: rest.useRoleAttribute ? undefined : (groupMappings ?? {}),
-		};
-	}, [form]);
-
 	const onSubmitHandler = useCallback(async (): Promise<void> => {
 		try {
 			await form.validateFields();
@@ -158,25 +95,23 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 			return;
 		}

-		const name = form.getFieldValue('name');
-		const googleAuthConfig = getGoogleAuthConfig();
-		const samlConfig = form.getFieldValue('samlConfig');
-		const oidcConfig = form.getFieldValue('oidcConfig');
-		const roleMapping = getRoleMapping();
+		const values = form.getFieldsValue(true) as FormValues;
+		const name = values.name ?? '';
+		const config = prepareConfig(values, authnProvider);
+		const roleMapping = prepareRoleMapping(values);
+
+		if (!config) {
+			return;
+		}

 		if (isCreate) {
 			createAuthDomain(
 				{
 					data: {
 						name,
-						config: {
-							ssoEnabled: true,
-							ssoType: authnProvider,
-							googleAuthConfig,
-							samlConfig,
-							oidcConfig,
-							roleMapping,
-						},
+						enabled: true,
+						config,
+						roleMapping,
 					},
 				},
 				{
@@ -196,14 +131,9 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 				{
 					pathParams: { id: record.id },
 					data: {
-						config: {
-							ssoEnabled: form.getFieldValue('ssoEnabled'),
-							ssoType: authnProvider,
-							googleAuthConfig,
-							samlConfig,
-							oidcConfig,
-							roleMapping,
-						},
+						enabled: values.enabled ?? false,
+						config,
+						roleMapping,
 					},
 				},
 				{
@@ -219,8 +149,6 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 		authnProvider,
 		createAuthDomain,
 		form,
-		getGoogleAuthConfig,
-		getRoleMapping,
 		handleError,
 		isCreate,

@@ -243,10 +171,10 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 		>
 			<Form
 				name="auth-domain"
+				data-testid="auth-domain-form"
 				initialValues={defaultTo(prepareInitialValues(record), {
 					name: '',
-					ssoEnabled: false,
-					ssoType: '',
+					enabled: false,
 				})}
 				form={form}
 				layout="vertical"
@@ -262,12 +190,22 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 						{configureAuthnProvider(authnProvider, isCreate)}
 						<section className="action-buttons">
 							{isCreate && (
-								<Button onClick={onBackHandler} variant="solid" color="secondary">
+								<Button
+									onClick={onBackHandler}
+									variant="solid"
+									color="secondary"
+									testId="auth-domain-back"
+								>
 									Back
 								</Button>
 							)}
 							{!isCreate && (
-								<Button onClick={onClose} variant="solid" color="secondary">
+								<Button
+									onClick={onClose}
+									variant="solid"
+									color="secondary"
+									testId="auth-domain-cancel"
+								>
 									Cancel
 								</Button>
 							)}
@@ -276,6 +214,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 								variant="solid"
 								color="primary"
 								loading={isCreating || isUpdating}
+								testId="auth-domain-save"
 							>
 								Save Changes
 							</Button>
--- a/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.utils.test.ts
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.utils.test.ts
@@ -1,4 +1,8 @@
-import { AuthtypesAuthNProviderDTO } from 'api/generated/services/sigNoz.schemas';
+import {
+	AuthtypesAuthDomainConfigGoogleDTOKind,
+	AuthtypesAuthDomainConfigOIDCDTOKind,
+	AuthtypesAuthDomainConfigSAMLDTOKind,
+} from 'api/generated/services/sigNoz.schemas';

 import {
 	convertDomainMappingsToList,
@@ -82,8 +86,7 @@ describe('prepareInitialValues', () => {
 	it('returns empty defaults when no record is provided', () => {
 		expect(prepareInitialValues(undefined)).toStrictEqual({
 			name: '',
-			ssoEnabled: false,
-			ssoType: '',
+			enabled: false,
 		});
 	});

@@ -91,15 +94,20 @@ describe('prepareInitialValues', () => {
 		const result = prepareInitialValues({
 			id: 'domain-1',
 			name: 'example.com',
+			enabled: true,
 			config: {
-				ssoEnabled: true,
-				ssoType: AuthtypesAuthNProviderDTO.saml,
-				roleMapping: {
-					defaultRole: 'VIEWER',
-					useRoleAttribute: false,
-					groupMappings: { admins: 'ADMIN', viewers: 'VIEWER' },
+				kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+				spec: {
+					location: 'https://idp.example.com/sso',
+					entityId: 'urn:example:idp',
+					certificate: 'CERT',
 				},
 			},
+			roleMapping: {
+				defaultRole: 'VIEWER',
+				useRoleAttribute: false,
+				groupMappings: { admins: 'ADMIN', viewers: 'VIEWER' },
+			},
 		});

 		expect(result.roleMapping?.groupMappingsList).toStrictEqual([
@@ -112,10 +120,10 @@ describe('prepareInitialValues', () => {
 		const result = prepareInitialValues({
 			id: 'domain-1',
 			name: 'example.com',
+			enabled: true,
 			config: {
-				ssoEnabled: true,
-				ssoType: AuthtypesAuthNProviderDTO.google_auth,
-				googleAuthConfig: {
+				kind: AuthtypesAuthDomainConfigGoogleDTOKind.google,
+				spec: {
 					clientId: 'id',
 					clientSecret: 'secret',
 					domainToAdminEmail: { 'example.com': 'admin@example.com' },
@@ -132,11 +140,16 @@ describe('prepareInitialValues', () => {
 		const result = prepareInitialValues({
 			id: 'domain-1',
 			name: 'example.com',
+			enabled: true,
 			config: {
-				ssoEnabled: true,
-				ssoType: AuthtypesAuthNProviderDTO.oidc,
-				roleMapping: { defaultRole: 'VIEWER', useRoleAttribute: true },
+				kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+				spec: {
+					issuer: 'https://oidc.example.com',
+					clientId: 'id',
+					clientSecret: 'secret',
+				},
 			},
+			roleMapping: { defaultRole: 'VIEWER', useRoleAttribute: true },
 		});

 		expect(result.roleMapping?.groupMappingsList).toStrictEqual([]);
--- a/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.utils.ts
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.utils.ts
@@ -1,4 +1,9 @@
 import {
+	AuthtypesAuthDomainConfigDTO,
+	AuthtypesAuthDomainConfigGoogleDTOKind,
+	AuthtypesAuthDomainConfigOIDCDTOKind,
+	AuthtypesAuthDomainConfigSAMLDTOKind,
+	AuthtypesAuthNProviderDTO,
 	AuthtypesGettableAuthDomainDTO,
 	AuthtypesGoogleConfigDTO,
 	AuthtypesOIDCConfigDTO,
@@ -6,11 +11,29 @@ import {
 	AuthtypesSamlConfigDTO,
 } from 'api/generated/services/sigNoz.schemas';

+/**
+ * Maps the config envelope's per-variant kind to the provider enum driving the
+ * create/edit UI.
+ */
+export function kindToProvider(
+	kind?: AuthtypesAuthDomainConfigDTO['kind'],
+): AuthtypesAuthNProviderDTO | '' {
+	switch (kind) {
+		case AuthtypesAuthDomainConfigSAMLDTOKind.saml:
+			return AuthtypesAuthNProviderDTO.saml;
+		case AuthtypesAuthDomainConfigGoogleDTOKind.google:
+			return AuthtypesAuthNProviderDTO.google;
+		case AuthtypesAuthDomainConfigOIDCDTOKind.oidc:
+			return AuthtypesAuthNProviderDTO.oidc;
+		default:
+			return '';
+	}
+}
+
 // Form values interface for internal use (includes array-based fields for UI)
 export interface FormValues {
 	name?: string;
-	ssoEnabled?: boolean;
-	ssoType?: string;
+	enabled?: boolean;
 	googleAuthConfig?: AuthtypesGoogleConfigDTO & {
 		domainToAdminEmailList?: Array<{ domain?: string; adminEmail?: string }>;
 	};
@@ -107,33 +130,141 @@ export function prepareInitialValues(
 	if (!record) {
 		return {
 			name: '',
-			ssoEnabled: false,
-			ssoType: '',
+			enabled: false,
 		};
 	}

-	const config = record.config ?? {};
+	const { config } = record;
 	return {
 		name: record.name,
-		ssoEnabled: config.ssoEnabled,
-		ssoType: config.ssoType,
-		samlConfig: config.samlConfig ?? undefined,
-		oidcConfig: config.oidcConfig ?? undefined,
-		googleAuthConfig: config.googleAuthConfig
+		enabled: record.enabled,
+		samlConfig:
+			config?.kind === AuthtypesAuthDomainConfigSAMLDTOKind.saml
+				? config.spec
+				: undefined,
+		oidcConfig:
+			config?.kind === AuthtypesAuthDomainConfigOIDCDTOKind.oidc
+				? config.spec
+				: undefined,
+		googleAuthConfig:
+			config?.kind === AuthtypesAuthDomainConfigGoogleDTOKind.google
+				? {
+						...config.spec,
+						domainToAdminEmailList: convertDomainMappingsToList(
+							config.spec.domainToAdminEmail,
+						),
+					}
+				: undefined,
+		roleMapping: record.roleMapping
 			? {
-					...config.googleAuthConfig,
-					domainToAdminEmailList: convertDomainMappingsToList(
-						config.googleAuthConfig.domainToAdminEmail,
-					),
-				}
-			: undefined,
-		roleMapping: config.roleMapping
-			? {
-					...config.roleMapping,
+					...record.roleMapping,
 					groupMappingsList: convertGroupMappingsToList(
-						config.roleMapping.groupMappings,
+						record.roleMapping.groupMappings,
 					),
 				}
 			: undefined,
 	};
 }
+
+/**
+ * Prepares Google Auth config for API payload
+ */
+export function prepareGoogleAuthConfig(
+	values: FormValues,
+): AuthtypesGoogleConfigDTO | undefined {
+	const config = values.googleAuthConfig;
+	if (!config) {
+		return undefined;
+	}
+
+	const {
+		domainToAdminEmailList,
+		allowedGroups,
+		serviceAccountJson,
+		domainToAdminEmail: _domainToAdminEmail,
+		fetchTransitiveGroupMembership,
+		...rest
+	} = config;
+	const domainToAdminEmail = convertDomainMappingsToRecord(
+		domainToAdminEmailList,
+	);
+
+	return {
+		...rest,
+		...(rest.fetchGroups
+			? {
+					allowedGroups,
+					serviceAccountJson,
+					domainToAdminEmail: domainToAdminEmail ?? {},
+					fetchTransitiveGroupMembership,
+				}
+			: { domainToAdminEmail: {} }),
+	};
+}
+
+/**
+ * Prepares role mapping for API payload; only returned when there is
+ * meaningful content.
+ */
+export function prepareRoleMapping(
+	values: FormValues,
+): AuthtypesRoleMappingDTO | undefined {
+	const roleMapping = values.roleMapping;
+	if (!roleMapping) {
+		return undefined;
+	}
+
+	const { groupMappingsList, ...rest } = roleMapping;
+	const groupMappings = convertGroupMappingsToRecord(groupMappingsList);
+
+	const hasDefaultRole = !!rest.defaultRole;
+	const hasUseRoleAttribute = rest.useRoleAttribute === true;
+	const hasGroupMappings =
+		groupMappings && Object.keys(groupMappings).length > 0;
+
+	if (!hasDefaultRole && !hasUseRoleAttribute && !hasGroupMappings) {
+		return undefined;
+	}
+
+	return {
+		...rest,
+		groupMappings: rest.useRoleAttribute ? undefined : (groupMappings ?? {}),
+	};
+}
+
+/**
+ * Prepares the kind/spec config envelope for API payload; the inverse of
+ * prepareInitialValues.
+ */
+export function prepareConfig(
+	values: FormValues,
+	provider: AuthtypesAuthNProviderDTO | '',
+): AuthtypesAuthDomainConfigDTO | undefined {
+	switch (provider) {
+		case AuthtypesAuthNProviderDTO.saml:
+			return values.samlConfig
+				? {
+						kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+						spec: values.samlConfig,
+					}
+				: undefined;
+		case AuthtypesAuthNProviderDTO.google: {
+			const spec = prepareGoogleAuthConfig(values);
+			return spec
+				? {
+						kind: AuthtypesAuthDomainConfigGoogleDTOKind.google,
+						spec,
+					}
+				: undefined;
+		}
+		case AuthtypesAuthNProviderDTO.oidc:
+			return values.oidcConfig
+				? {
+						kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+						spec: values.oidcConfig,
+					}
+				: undefined;
+		default:
+			return undefined;
+	}
+}
--- a/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/AuthnGoogleAuth.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/AuthnGoogleAuth.tsx
@@ -91,7 +91,11 @@ function ConfigureGoogleAuthAuthnProvider({
 								{ required: true, message: 'Domain is required', whitespace: true },
 							]}
 						>
-							<Input id="google-domain" disabled={!isCreate} />
+							<Input
+								id="google-domain"
+								disabled={!isCreate}
+								testId="google-auth-domain"
+							/>
 						</Form.Item>
 					</div>

@@ -109,7 +113,7 @@ function ConfigureGoogleAuthAuthnProvider({
 								{ required: true, message: 'Client ID is required', whitespace: true },
 							]}
 						>
-							<Input id="google-client-id" />
+							<Input id="google-client-id" testId="google-auth-client-id" />
 						</Form.Item>
 					</div>

@@ -131,7 +135,7 @@ function ConfigureGoogleAuthAuthnProvider({
 								},
 							]}
 						>
-							<Input id="google-client-secret" />
+							<Input id="google-client-secret" testId="google-auth-client-secret" />
 						</Form.Item>
 					</div>

@@ -143,6 +147,7 @@ function ConfigureGoogleAuthAuthnProvider({
 						>
 							<Checkbox
 								id="google-skip-email-verification"
+								testId="google-auth-skip-email-verified"
 								onChange={(checked: boolean): void => {
 									form.setFieldValue(
 										['googleAuthConfig', 'insecureSkipEmailVerified'],
@@ -180,7 +185,10 @@ function ConfigureGoogleAuthAuthnProvider({
 						<Collapse.Panel
 							key="workspace-groups"
 							header={
-								<div className="authn-provider__collapse-header">
+								<div
+									className="authn-provider__collapse-header"
+									data-testid="google-auth-workspace-groups-header"
+								>
 									{expandedSection !== 'workspace-groups' ? (
 										<ChevronRight size={16} />
 									) : (
@@ -221,6 +229,7 @@ function ConfigureGoogleAuthAuthnProvider({
 									>
 										<Checkbox
 											id="google-fetch-groups"
+											testId="google-auth-fetch-groups"
 											onChange={(checked: boolean): void => {
 												form.setFieldValue(['googleAuthConfig', 'fetchGroups'], checked);
 											}}
@@ -251,6 +260,7 @@ function ConfigureGoogleAuthAuthnProvider({
 											>
 												<AntdInput.TextArea
 													id="google-service-account-json"
+													data-testid="google-auth-service-account-json"
 													rows={3}
 													placeholder="Paste service account JSON"
 													className="authn-provider__textarea"
@@ -270,6 +280,7 @@ function ConfigureGoogleAuthAuthnProvider({
 											>
 												<Checkbox
 													id="google-transitive-membership"
+													testId="google-auth-transitive-membership"
 													onChange={(checked: boolean): void => {
 														form.setFieldValue(
 															['googleAuthConfig', 'fetchTransitiveGroupMembership'],
@@ -299,7 +310,10 @@ function ConfigureGoogleAuthAuthnProvider({
 												name={['googleAuthConfig', 'allowedGroups']}
 												className="authn-provider__form-item"
 											>
-												<EmailTagInput placeholder="Type a group email and press Enter" />
+												<EmailTagInput
+													placeholder="Type a group email and press Enter"
+													testId="google-auth-allowed-groups"
+												/>
 											</Form.Item>
 										</div>
 									</div>
--- a/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/AuthnSAML.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/AuthnSAML.tsx
@@ -76,7 +76,7 @@ function ConfigureSAMLAuthnProvider({
 							</Tooltip>
 						</label>
 						<Form.Item
-							name={['samlConfig', 'samlIdp']}
+							name={['samlConfig', 'location']}
 							className="authn-provider__form-item"
 							rules={[
 								{
@@ -98,7 +98,7 @@ function ConfigureSAMLAuthnProvider({
 							</Tooltip>
 						</label>
 						<Form.Item
-							name={['samlConfig', 'samlEntity']}
+							name={['samlConfig', 'entityId']}
 							className="authn-provider__form-item"
 							rules={[
 								{
@@ -120,7 +120,7 @@ function ConfigureSAMLAuthnProvider({
 							</Tooltip>
 						</label>
 						<Form.Item
-							name={['samlConfig', 'samlCert']}
+							name={['samlConfig', 'certificate']}
 							className="authn-provider__form-item"
 							rules={[
 								{
--- a/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/components/EmailTagInput.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/components/EmailTagInput.tsx
@@ -9,12 +9,14 @@ interface EmailTagInputProps {
 	value?: string[];
 	onChange?: (value: string[]) => void;
 	placeholder?: string;
+	testId?: string;
 }

 function EmailTagInput({
 	value = [],
 	onChange,
 	placeholder = 'Type an email and press Enter',
+	testId,
 }: EmailTagInputProps): JSX.Element {
 	const [validationError, setValidationError] = useState('');

@@ -34,7 +36,7 @@ function EmailTagInput({
 	);

 	return (
-		<div className="email-tag-input">
+		<div className="email-tag-input" data-testid={testId}>
 			<Tooltip
 				title={validationError}
 				open={!!validationError}
--- a/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/components/RoleMappingSection.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/components/RoleMappingSection.tsx
@@ -74,6 +74,7 @@ function RoleMappingSection({
 							role="button"
 							aria-expanded={expanded}
 							aria-controls="role-mapping-content"
+							data-testid="role-mapping-header"
 						>
 							{!expanded ? <ChevronRight size={16} /> : <ChevronDown size={16} />}
 							<div className="role-mapping-section__collapse-header-text">
@@ -138,6 +139,7 @@ function RoleMappingSection({
 							>
 								<Checkbox
 									id="use-role-attribute"
+									testId="role-mapping-use-role-attribute"
 									onChange={(checked: boolean): void => {
 										form.setFieldValue([...fieldNamePrefix, 'useRoleAttribute'], checked);
 									}}
@@ -166,13 +168,20 @@ function RoleMappingSection({
 									{(fields, { add, remove }): JSX.Element => (
 										<div className="role-mapping-section__items">
 											{fields.map((field) => (
-												<div key={field.key} className="role-mapping-section__row">
+												<div
+													key={field.key}
+													className="role-mapping-section__row"
+													data-testid="role-mapping-row"
+												>
 													<Form.Item
 														name={[field.name, 'groupName']}
 														className="role-mapping-section__field role-mapping-section__field--group"
 														rules={[{ required: true, message: 'Group name is required' }]}
 													>
-														<Input placeholder="IDP Group Name" />
+														<Input
+															placeholder="IDP Group Name"
+															testId="role-mapping-group-name"
+														/>
 													</Form.Item>

 													<Form.Item
@@ -199,6 +208,7 @@ function RoleMappingSection({
 														className="role-mapping-section__remove-btn"
 														onClick={(): void => remove(field.name)}
 														aria-label="Remove mapping"
+														testId="role-mapping-remove"
 													>
 														<Trash2 size={12} />
 													</Button>
@@ -212,6 +222,7 @@ function RoleMappingSection({
 													add({ groupName: '', role: SIGNOZ_VIEWER_ROLE })
 												}
 												prefix={<Plus size={14} />}
+												testId="role-mapping-add"
 											>
 												Add Group Mapping
 											</Button>
--- a/frontend/src/container/OrganizationSettings/AuthDomain/SSOEnforcementToggle.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/SSOEnforcementToggle.tsx
@@ -31,7 +31,7 @@ function SSOEnforcementToggle({
 		useUpdateAuthDomain<AxiosError<RenderErrorResponseDTO>>();

 	const onChangeHandler = (checked: boolean): void => {
-		if (!record.id) {
+		if (!record.id || !record.config) {
 			return;
 		}

@@ -41,14 +41,9 @@ function SSOEnforcementToggle({
 			{
 				pathParams: { id: record.id },
 				data: {
-					config: {
-						ssoEnabled: checked,
-						ssoType: record.config?.ssoType,
-						googleAuthConfig: record.config?.googleAuthConfig,
-						oidcConfig: record.config?.oidcConfig,
-						samlConfig: record.config?.samlConfig,
-						roleMapping: record.config?.roleMapping,
-					},
+					enabled: checked,
+					config: record.config,
+					roleMapping: record.roleMapping,
 				},
 			},
 			{
@@ -65,7 +60,12 @@ function SSOEnforcementToggle({
 	};

 	return (
-		<Switch disabled={isLoading} value={isChecked} onChange={onChangeHandler} />
+		<Switch
+			disabled={isLoading}
+			value={isChecked}
+			onChange={onChangeHandler}
+			testId="auth-domain-enforce-sso"
+		/>
 	);
 }

--- a/frontend/src/container/OrganizationSettings/AuthDomain/tests/AuthDomain.test.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/tests/AuthDomain.test.tsx
@@ -58,7 +58,7 @@ describe('AuthDomain', () => {
 			});
 		});

-		it('reflects ssoEnabled state from nested config in each row toggle', async () => {
+		it('reflects the enabled state in each row toggle', async () => {
 			server.use(
 				rest.get(AUTH_DOMAINS_LIST_ENDPOINT, (_, res, ctx) =>
 					res(ctx.status(200), ctx.json(mockDomainsListResponse)),
@@ -68,9 +68,9 @@ describe('AuthDomain', () => {
 			render(<AuthDomain />);

 			// mockDomainsListResponse rows:
-			//   [0] signoz.io   → config.ssoEnabled: true
-			//   [1] example.com → config.ssoEnabled: false
-			//   [2] corp.io     → config.ssoEnabled: true
+			//   [0] signoz.io   → enabled: true
+			//   [1] example.com → enabled: false
+			//   [2] corp.io     → enabled: true
 			const switches = await screen.findAllByRole('switch');
 			expect(switches).toHaveLength(3);
 			expect(switches[0]).toBeChecked();
--- a/frontend/src/container/OrganizationSettings/AuthDomain/tests/CreateEdit.payload.test.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/tests/CreateEdit.payload.test.tsx
@@ -112,9 +112,7 @@ describe('CreateEdit — save payload correctness', () => {
 		await waitFor(() => expect(capturedPayload).not.toBeNull());

 		expect(capturedPayload).toMatchObject({
-			config: expect.objectContaining({
-				roleMapping: expect.objectContaining({ groupMappings: {} }),
-			}),
+			roleMapping: expect.objectContaining({ groupMappings: {} }),
 		});
 	});

@@ -161,7 +159,7 @@ describe('CreateEdit — save payload correctness', () => {

 		expect(capturedPayload).toMatchObject({
 			config: expect.objectContaining({
-				googleAuthConfig: expect.objectContaining({
+				spec: expect.objectContaining({
 					domainToAdminEmail: {},
 				}),
 			}),
--- a/frontend/src/container/OrganizationSettings/AuthDomain/tests/CreateEdit.roleMapping.test.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/tests/CreateEdit.roleMapping.test.tsx
@@ -188,8 +188,8 @@ describe('CreateEdit — role mapping uses API roles', () => {

 		// SSO role mapping matches roles by name, so the payload carries the
 		// role *name*, not the opaque id.
-		expect(payload.get().config.roleMapping.defaultRole).toBe(editorRole.name);
-		expect(payload.get().config.roleMapping.defaultRole).not.toBe(editorRole.id);
+		expect(payload.get().roleMapping.defaultRole).toBe(editorRole.name);
+		expect(payload.get().roleMapping.defaultRole).not.toBe(editorRole.id);
 	});

 	it('defaults a fresh role mapping to the signoz-viewer role name', async () => {
@@ -221,8 +221,8 @@ describe('CreateEdit — role mapping uses API roles', () => {

 		await waitFor(() => expect(payload.get()).not.toBeNull());

-		expect(payload.get().config.roleMapping.defaultRole).toBe(viewerRole.name);
-		expect(payload.get().config.roleMapping.defaultRole).not.toBe(viewerRole.id);
+		expect(payload.get().roleMapping.defaultRole).toBe(viewerRole.name);
+		expect(payload.get().roleMapping.defaultRole).not.toBe(viewerRole.id);
 	});

 	it('still defaults to signoz-viewer when the roles fetch returns empty', async () => {
@@ -249,7 +249,7 @@ describe('CreateEdit — role mapping uses API roles', () => {
 		await waitFor(() => expect(payload.get()).not.toBeNull());

 		// The Form.Item initialValue (signoz-viewer) survives an empty roles list.
-		expect(payload.get().config.roleMapping.defaultRole).toBe(viewerRole.name);
+		expect(payload.get().roleMapping.defaultRole).toBe(viewerRole.name);
 	});

 	it('loads a stored role mapping by role name and round-trips it on save', async () => {
@@ -280,8 +280,8 @@ describe('CreateEdit — role mapping uses API roles', () => {

 		await waitFor(() => expect(payload.get()).not.toBeNull());

-		expect(payload.get().config.roleMapping.defaultRole).toBe(editorRole.name);
-		expect(payload.get().config.roleMapping.groupMappings).toStrictEqual({
+		expect(payload.get().roleMapping.defaultRole).toBe(editorRole.name);
+		expect(payload.get().roleMapping.groupMappings).toStrictEqual({
 			'admin-group': 'signoz-admin',
 			'dev-team': 'signoz-editor',
 			viewers: 'signoz-viewer',
--- a/frontend/src/container/OrganizationSettings/AuthDomain/tests/CreateEdit.sanitization.test.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/tests/CreateEdit.sanitization.test.tsx
@@ -1,6 +1,9 @@
 import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
 import { rest, server } from 'mocks-server/server';
-import { AuthtypesGettableAuthDomainDTO } from 'api/generated/services/sigNoz.schemas';
+import {
+	AuthtypesAuthDomainConfigGoogleDTO,
+	AuthtypesGettableAuthDomainDTO,
+} from 'api/generated/services/sigNoz.schemas';

 import CreateEdit from '../CreateEdit/CreateEdit';
 import {
@@ -48,11 +51,10 @@ jest.mock('@signozhq/ui/button', () => ({

 type SavedPayload = {
 	config: {
-		googleAuthConfig?: Record<string, unknown>;
-		samlConfig?: Record<string, unknown>;
-		oidcConfig?: Record<string, unknown>;
-		roleMapping?: Record<string, unknown>;
+		kind?: string;
+		spec?: Record<string, unknown>;
 	};
+	roleMapping?: Record<string, unknown>;
 };

 async function submitForm(
@@ -81,7 +83,7 @@ describe('CreateEdit — payload sanitization', () => {
 		it('sends core fields and omits workspace fields when fetchGroups is not set', async () => {
 			const payload = await submitForm(mockGoogleAuthDomain);

-			const g = payload.config.googleAuthConfig;
+			const g = payload.config.spec;
 			expect(g?.clientId).toBe('test-client-id');
 			expect(g?.clientSecret).toBe('test-client-secret');
 			expect(g?.allowedGroups).toBeUndefined();
@@ -91,18 +93,20 @@ describe('CreateEdit — payload sanitization', () => {
 		});

 		it('strips workspace fields when fetchGroups is false', async () => {
+			const googleConfig =
+				mockGoogleAuthWithWorkspaceGroups.config as AuthtypesAuthDomainConfigGoogleDTO;
 			const payload = await submitForm({
 				...mockGoogleAuthWithWorkspaceGroups,
 				config: {
-					...mockGoogleAuthWithWorkspaceGroups.config,
-					googleAuthConfig: {
-						...mockGoogleAuthWithWorkspaceGroups.config?.googleAuthConfig,
+					...googleConfig,
+					spec: {
+						...googleConfig.spec,
 						fetchGroups: false,
 					},
 				},
 			});

-			const g = payload.config.googleAuthConfig;
+			const g = payload.config.spec;
 			expect(g?.fetchGroups).toBe(false);
 			expect(g?.allowedGroups).toBeUndefined();
 			expect(g?.serviceAccountJson).toBeUndefined();
@@ -113,7 +117,7 @@ describe('CreateEdit — payload sanitization', () => {
 		it('includes all workspace fields when fetchGroups is true', async () => {
 			const payload = await submitForm(mockGoogleAuthWithWorkspaceGroups);

-			const g = payload.config.googleAuthConfig;
+			const g = payload.config.spec;
 			expect(g?.fetchGroups).toBe(true);
 			expect(g?.serviceAccountJson).toBe('{"type": "service_account"}');
 			expect(g?.fetchTransitiveGroupMembership).toBe(true);
@@ -131,10 +135,10 @@ describe('CreateEdit — payload sanitization', () => {
 		it('sends core and attributeMapping fields', async () => {
 			const payload = await submitForm(mockSamlWithAttributeMapping);

-			const s = payload.config.samlConfig;
-			expect(s?.samlIdp).toBe('https://idp.saml-attrs.com/sso');
-			expect(s?.samlEntity).toBe('urn:saml-attrs:idp');
-			expect(s?.samlCert).toBe('MOCK_CERTIFICATE_ATTRS');
+			const s = payload.config.spec;
+			expect(s?.location).toBe('https://idp.saml-attrs.com/sso');
+			expect(s?.entityId).toBe('urn:saml-attrs:idp');
+			expect(s?.certificate).toBe('MOCK_CERTIFICATE_ATTRS');
 			expect(s?.insecureSkipAuthNRequestsSigned).toBe(true);

 			const attr = s?.attributeMapping as Record<string, unknown>;
@@ -148,7 +152,7 @@ describe('CreateEdit — payload sanitization', () => {
 		it('sends all fields including claimMapping', async () => {
 			const payload = await submitForm(mockOidcWithClaimMapping);

-			const o = payload.config.oidcConfig;
+			const o = payload.config.spec;
 			expect(o?.issuer).toBe('https://oidc.claims.com');
 			expect(o?.issuerAlias).toBe('https://alias.claims.com');
 			expect(o?.clientId).toBe('claims-client-id');
@@ -168,24 +172,21 @@ describe('CreateEdit — payload sanitization', () => {
 		it('strips groupMappings when useRoleAttribute is true', async () => {
 			const payload = await submitForm({
 				...mockDomainWithRoleMapping,
-				config: {
-					...mockDomainWithRoleMapping.config,
-					roleMapping: {
-						...mockDomainWithRoleMapping.config?.roleMapping,
-						useRoleAttribute: true,
-					},
+				roleMapping: {
+					...mockDomainWithRoleMapping.roleMapping,
+					useRoleAttribute: true,
 				},
 			});

-			expect(payload.config.roleMapping?.useRoleAttribute).toBe(true);
-			expect(payload.config.roleMapping?.groupMappings).toBeUndefined();
+			expect(payload.roleMapping?.useRoleAttribute).toBe(true);
+			expect(payload.roleMapping?.groupMappings).toBeUndefined();
 		});

 		it('sends groupMappings when useRoleAttribute is false', async () => {
 			const payload = await submitForm(mockDomainWithRoleMapping);

-			expect(payload.config.roleMapping?.useRoleAttribute).toBe(false);
-			expect(payload.config.roleMapping?.groupMappings).toStrictEqual({
+			expect(payload.roleMapping?.useRoleAttribute).toBe(false);
+			expect(payload.roleMapping?.groupMappings).toStrictEqual({
 				'admin-group': 'signoz-admin',
 				'dev-team': 'signoz-editor',
 				viewers: 'signoz-viewer',
--- a/frontend/src/container/OrganizationSettings/AuthDomain/tests/SSOEnforcementToggle.test.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/tests/SSOEnforcementToggle.test.tsx
@@ -25,6 +25,7 @@ jest.mock('@signozhq/ui/switch', () => ({
 import SSOEnforcementToggle from '../SSOEnforcementToggle';
 import {
 	AUTH_DOMAINS_UPDATE_ENDPOINT,
+	mockDomainWithRoleMapping,
 	mockErrorResponse,
 	mockGoogleAuthDomain,
 	mockUpdateSuccessResponse,
@@ -57,7 +58,7 @@ describe('SSOEnforcementToggle', () => {
 				isDefaultChecked={false}
 				record={{
 					...mockGoogleAuthDomain,
-					config: { ...mockGoogleAuthDomain.config, ssoEnabled: false },
+					enabled: false,
 				}}
 			/>,
 		);
@@ -95,13 +96,42 @@ describe('SSOEnforcementToggle', () => {
 		expect(mockUpdateAPI).toHaveBeenCalledTimes(1);
 		expect(mockUpdateAPI).toHaveBeenCalledWith(
 			expect.objectContaining({
-				config: expect.objectContaining({
-					ssoEnabled: false,
-				}),
+				enabled: false,
+				config: mockGoogleAuthDomain.config,
 			}),
 		);
 	});

+	// The toggle sends a full replacement, so anything it fails to echo back is
+	// dropped from the domain — role mappings included.
+	it('echoes the existing role mapping when toggling enforcement', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+		const mockUpdateAPI = jest.fn();
+
+		server.use(
+			rest.put(AUTH_DOMAINS_UPDATE_ENDPOINT, async (req, res, ctx) => {
+				mockUpdateAPI(await req.json());
+				return res(ctx.status(200), ctx.json(mockUpdateSuccessResponse));
+			}),
+		);
+
+		render(
+			<SSOEnforcementToggle
+				isDefaultChecked={true}
+				record={mockDomainWithRoleMapping}
+			/>,
+		);
+
+		await user.click(screen.getByRole('switch'));
+
+		await waitFor(() => expect(mockUpdateAPI).toHaveBeenCalledTimes(1));
+		expect(mockUpdateAPI).toHaveBeenCalledWith({
+			enabled: false,
+			config: mockDomainWithRoleMapping.config,
+			roleMapping: mockDomainWithRoleMapping.roleMapping,
+		});
+	});
+
 	it('shows error modal when update fails', async () => {
 		const user = userEvent.setup({ pointerEventsCheck: 0 });

--- a/frontend/src/container/OrganizationSettings/AuthDomain/tests/mocks.ts
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/tests/mocks.ts
@@ -1,22 +1,24 @@
 import {
-	AuthtypesAuthNProviderDTO,
+	AuthtypesAuthDomainConfigGoogleDTOKind,
+	AuthtypesAuthDomainConfigOIDCDTOKind,
+	AuthtypesAuthDomainConfigSAMLDTOKind,
 	AuthtypesGettableAuthDomainDTO,
 } from 'api/generated/services/sigNoz.schemas';

 // API Endpoints
-export const AUTH_DOMAINS_LIST_ENDPOINT = '*/api/v1/domains';
-export const AUTH_DOMAINS_CREATE_ENDPOINT = '*/api/v1/domains';
-export const AUTH_DOMAINS_UPDATE_ENDPOINT = '*/api/v1/domains/:id';
-export const AUTH_DOMAINS_DELETE_ENDPOINT = '*/api/v1/domains/:id';
+export const AUTH_DOMAINS_LIST_ENDPOINT = '*/api/v2/auth_domains';
+export const AUTH_DOMAINS_CREATE_ENDPOINT = '*/api/v2/auth_domains';
+export const AUTH_DOMAINS_UPDATE_ENDPOINT = '*/api/v2/auth_domains/:id';
+export const AUTH_DOMAINS_DELETE_ENDPOINT = '*/api/v2/auth_domains/:id';

 // Mock Auth Domain with Google Auth
 export const mockGoogleAuthDomain: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-1',
 	name: 'signoz.io',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.google_auth,
-		googleAuthConfig: {
+		kind: AuthtypesAuthDomainConfigGoogleDTOKind.google,
+		spec: {
 			clientId: 'test-client-id',
 			clientSecret: 'test-client-secret',
 		},
@@ -30,13 +32,13 @@ export const mockGoogleAuthDomain: AuthtypesGettableAuthDomainDTO = {
 export const mockSamlAuthDomain: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-2',
 	name: 'example.com',
+	enabled: false,
 	config: {
-		ssoEnabled: false,
-		ssoType: AuthtypesAuthNProviderDTO.saml,
-		samlConfig: {
-			samlIdp: 'https://idp.example.com/sso',
-			samlEntity: 'urn:example:idp',
-			samlCert: 'MOCK_CERTIFICATE',
+		kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+		spec: {
+			location: 'https://idp.example.com/sso',
+			entityId: 'urn:example:idp',
+			certificate: 'MOCK_CERTIFICATE',
 		},
 	},
 	authNProviderInfo: {
@@ -48,10 +50,10 @@ export const mockSamlAuthDomain: AuthtypesGettableAuthDomainDTO = {
 export const mockOidcAuthDomain: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-3',
 	name: 'corp.io',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.oidc,
-		oidcConfig: {
+		kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+		spec: {
 			issuer: 'https://oidc.corp.io',
 			clientId: 'oidc-client-id',
 			clientSecret: 'oidc-client-secret',
@@ -66,22 +68,22 @@ export const mockOidcAuthDomain: AuthtypesGettableAuthDomainDTO = {
 export const mockDomainWithRoleMapping: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-4',
 	name: 'enterprise.com',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.saml,
-		samlConfig: {
-			samlIdp: 'https://idp.enterprise.com/sso',
-			samlEntity: 'urn:enterprise:idp',
-			samlCert: 'MOCK_CERTIFICATE',
+		kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+		spec: {
+			location: 'https://idp.enterprise.com/sso',
+			entityId: 'urn:enterprise:idp',
+			certificate: 'MOCK_CERTIFICATE',
 		},
-		roleMapping: {
-			defaultRole: 'signoz-editor',
-			useRoleAttribute: false,
-			groupMappings: {
-				'admin-group': 'signoz-admin',
-				'dev-team': 'signoz-editor',
-				viewers: 'signoz-viewer',
-			},
+	},
+	roleMapping: {
+		defaultRole: 'signoz-editor',
+		useRoleAttribute: false,
+		groupMappings: {
+			'admin-group': 'signoz-admin',
+			'dev-team': 'signoz-editor',
+			viewers: 'signoz-viewer',
 		},
 	},
 	authNProviderInfo: {
@@ -94,18 +96,18 @@ export const mockDomainWithDirectRoleAttribute: AuthtypesGettableAuthDomainDTO =
 	{
 		id: 'domain-5',
 		name: 'direct-role.com',
+		enabled: true,
 		config: {
-			ssoEnabled: true,
-			ssoType: AuthtypesAuthNProviderDTO.oidc,
-			oidcConfig: {
+			kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+			spec: {
 				issuer: 'https://oidc.direct-role.com',
 				clientId: 'direct-role-client-id',
 				clientSecret: 'direct-role-client-secret',
 			},
-			roleMapping: {
-				defaultRole: 'signoz-viewer',
-				useRoleAttribute: true,
-			},
+		},
+		roleMapping: {
+			defaultRole: 'signoz-viewer',
+			useRoleAttribute: true,
 		},
 		authNProviderInfo: {
 			relayStatePath: 'api/v1/sso/relay/domain-5',
@@ -116,10 +118,10 @@ export const mockDomainWithDirectRoleAttribute: AuthtypesGettableAuthDomainDTO =
 export const mockOidcWithClaimMapping: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-6',
 	name: 'oidc-claims.com',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.oidc,
-		oidcConfig: {
+		kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+		spec: {
 			issuer: 'https://oidc.claims.com',
 			issuerAlias: 'https://alias.claims.com',
 			clientId: 'claims-client-id',
@@ -143,13 +145,13 @@ export const mockOidcWithClaimMapping: AuthtypesGettableAuthDomainDTO = {
 export const mockSamlWithAttributeMapping: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-7',
 	name: 'saml-attrs.com',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.saml,
-		samlConfig: {
-			samlIdp: 'https://idp.saml-attrs.com/sso',
-			samlEntity: 'urn:saml-attrs:idp',
-			samlCert: 'MOCK_CERTIFICATE_ATTRS',
+		kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+		spec: {
+			location: 'https://idp.saml-attrs.com/sso',
+			entityId: 'urn:saml-attrs:idp',
+			certificate: 'MOCK_CERTIFICATE_ATTRS',
 			insecureSkipAuthNRequestsSigned: true,
 			attributeMapping: {
 				name: 'user_display_name',
@@ -168,10 +170,10 @@ export const mockGoogleAuthWithWorkspaceGroups: AuthtypesGettableAuthDomainDTO =
 	{
 		id: 'domain-8',
 		name: 'google-groups.com',
+		enabled: true,
 		config: {
-			ssoEnabled: true,
-			ssoType: AuthtypesAuthNProviderDTO.google_auth,
-			googleAuthConfig: {
+			kind: AuthtypesAuthDomainConfigGoogleDTOKind.google,
+			spec: {
 				clientId: 'google-groups-client-id',
 				clientSecret: 'google-groups-client-secret',
 				insecureSkipEmailVerified: false,
@@ -218,7 +220,7 @@ export const mockUpdateSuccessResponse = {
 	status: 'success',
 	data: {
 		...mockGoogleAuthDomain,
-		config: { ...mockGoogleAuthDomain.config, ssoEnabled: false },
+		enabled: false,
 	},
 };

--- a/frontend/src/container/OrganizationSettings/AuthDomain/index.tsx
+++ b/frontend/src/container/OrganizationSettings/AuthDomain/index.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useMemo, useState } from 'react';
+import { HTMLAttributes, useCallback, useMemo, useState } from 'react';
 import { Plus, Trash2, X } from '@signozhq/icons';
 import { Button } from '@signozhq/ui/button';
 import { toast } from '@signozhq/ui/sonner';
@@ -26,7 +26,7 @@ import './AuthDomain.styles.scss';
 import '../../IngestionSettings/IngestionSettings.styles.scss';

 export const SSOType = new Map<string, string>([
-	['google_auth', 'Google Auth'],
+	['google', 'Google Auth'],
 	['saml', 'SAML'],
 	['email_password', 'Email Password'],
 	['oidc', 'OIDC'],
@@ -121,8 +121,8 @@ function AuthDomain(): JSX.Element {
 			},
 			{
 				title: 'Enforce SSO',
-				dataIndex: ['config', 'ssoEnabled'],
-				key: 'ssoEnabled',
+				dataIndex: 'enabled',
+				key: 'enabled',
 				width: 80,
 				render: (
 					value: boolean,
@@ -157,13 +157,15 @@ function AuthDomain(): JSX.Element {
 							className="auth-domain-list-action-link"
 							onClick={(): void => setRecord(record)}
 							variant="link"
+							testId="auth-domain-configure"
 						>
-							Configure {SSOType.get(record.config?.ssoType || '')}
+							Configure {SSOType.get(record.config?.kind || '')}
 						</Button>
 						<Button
 							className="auth-domain-list-action-link delete"
 							onClick={(): void => showDeleteModal(record)}
 							variant="link"
+							testId="auth-domain-delete"
 						>
 							Delete
 						</Button>
@@ -177,7 +179,9 @@ function AuthDomain(): JSX.Element {
 	return (
 		<div className="auth-domain">
 			<section className="auth-domain-header">
-				<h3 className="auth-domain-title">Authenticated Domains</h3>
+				<h3 className="auth-domain-title" data-testid="auth-domain-title">
+					Authenticated Domains
+				</h3>
 				<Button
 					prefix={<Plus size="md" />}
 					onClick={(): void => {
@@ -186,6 +190,7 @@ function AuthDomain(): JSX.Element {
 					variant="solid"
 					size="sm"
 					color="primary"
+					testId="auth-domain-add"
 				>
 					Add Domain
 				</Button>
@@ -195,7 +200,14 @@ function AuthDomain(): JSX.Element {
 				<Table
 					columns={columns}
 					dataSource={authDomainListResponse?.data}
-					onRow={undefined}
+					onRow={(
+						record: AuthtypesGettableAuthDomainDTO,
+					): HTMLAttributes<HTMLElement> =>
+						// data-* attributes are valid row props but absent from the antd typing
+						({
+							'data-testid': `auth-domain-row-${record.name}`,
+						}) as unknown as HTMLAttributes<HTMLElement>
+					}
 					loading={
 						isLoadingAuthDomainListResponse || isFetchingAuthDomainListResponse
 					}
@@ -228,6 +240,7 @@ function AuthDomain(): JSX.Element {
 						onClick={hideDeleteModal}
 						className="cancel-btn"
 						prefix={<X size={16} />}
+						testId="auth-domain-delete-cancel"
 					>
 						Cancel
 					</Button>,
@@ -237,6 +250,7 @@ function AuthDomain(): JSX.Element {
 						onClick={handleDeleteDomain}
 						className="delete-btn"
 						loading={isLoading}
+						testId="auth-domain-delete-confirm"
 					>
 						Delete Domain
 					</Button>,
--- a/frontend/src/container/ResetPassword/tests/ResetPassword.test.tsx
+++ b/frontend/src/container/ResetPassword/tests/ResetPassword.test.tsx
@@ -33,7 +33,7 @@ jest.mock('hooks/useNotifications', () => ({
 	}),
 }));

-const RESET_PASSWORD_ENDPOINT = '*/api/v2/factor_password/reset';
+const RESET_PASSWORD_ENDPOINT = '*/resetPassword';

 const mockHistoryPush = history.push as jest.MockedFunction<
 	typeof history.push
--- a/frontend/src/container/ResetPassword/index.tsx
+++ b/frontend/src/container/ResetPassword/index.tsx
@@ -1,12 +1,11 @@
-import { useMemo, useState } from 'react';
+import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useLocation } from 'react-use';
 import { Button } from '@signozhq/ui/button';
 import { Callout } from '@signozhq/ui/callout';
 import { Form, Input as AntdInput } from 'antd';
 import { Typography } from '@signozhq/ui/typography';
-import { convertToApiError } from 'api/ErrorResponseHandlerForGeneratedAPIs';
-import { useResetPassword } from 'api/generated/services/users';
+import resetPasswordApi from 'api/v1/factor_password/resetPassword';
 import AuthError from 'components/AuthError/AuthError';
 import AuthPageContainer from 'components/AuthPageContainer';
 import ROUTES from 'constants/routes';
@@ -15,6 +14,7 @@ import { useNotifications } from 'hooks/useNotifications';
 import history from 'lib/history';
 import { ArrowRight, CircleAlert, KeyRound } from '@signozhq/icons';
 import { Label } from 'pages/SignUp/styles';
+import APIError from 'types/api/error';

 import { FormContainer } from './styles';

@@ -26,41 +26,40 @@ function ResetPassword({ version }: ResetPasswordProps): JSX.Element {
 	const [confirmPasswordError, setConfirmPasswordError] =
 		useState<boolean>(false);

+	const [errorMessage, setErrorMessage] = useState<APIError | null>();
+
 	const [isValidPassword, setIsValidPassword] = useState(false);
+	const [loading, setLoading] = useState(false);
 	const { t } = useTranslation(['common']);
 	const { search } = useLocation();
 	const params = new URLSearchParams(search);
 	const token = params.get('token');
 	const { notifications } = useNotifications();

-	const {
-		mutate: resetPassword,
-		isLoading,
-		error: mutationError,
-	} = useResetPassword();
-
-	const errorMessage = useMemo(
-		() => convertToApiError(mutationError),
-		[mutationError],
-	);
-
 	const [form] = Form.useForm<FormValues>();
-	const handleFormSubmit = (): void => {
-		const { password } = form.getFieldsValue();
+	const handleFormSubmit: () => Promise<void> = async () => {
+		try {
+			setLoading(true);
+			setErrorMessage(null);
+			const { password } = form.getFieldsValue();

-		resetPassword(
-			{ data: { password, token: token || '' } },
-			{
-				onSuccess: (): void => {
-					notifications.success({
-						message: t('success', {
-							ns: 'common',
-						}),
-					});
-					history.push(ROUTES.LOGIN);
-				},
-			},
-		);
+			await resetPasswordApi({
+				password,
+				token: token || '',
+			});
+
+			notifications.success({
+				message: t('success', {
+					ns: 'common',
+				}),
+			});
+			history.push(ROUTES.LOGIN);
+
+			setLoading(false);
+		} catch (error) {
+			setLoading(false);
+			setErrorMessage(error as APIError);
+		}
 	};

 	const validatePassword = (): boolean => {
@@ -223,7 +222,7 @@ function ResetPassword({ version }: ResetPasswordProps): JSX.Element {
 							color="primary"
 							type="submit"
 							data-attr="reset-password"
-							disabled={!isValidPassword || isLoading}
+							disabled={!isValidPassword || loading}
 							className="reset-password-submit-button"
 							suffix={<ArrowRight size={16} />}
 						>
--- a/frontend/src/hooks/member/useMemberRoleManager.ts
+++ b/frontend/src/hooks/member/useMemberRoleManager.ts
@@ -1,22 +1,19 @@
 import { useCallback, useMemo } from 'react';
-import type {
-	AuthtypesGettableRoleDTO,
-	AuthtypesUserRoleDTO,
-} from 'api/generated/services/sigNoz.schemas';
+import { useQueryClient } from 'react-query';
+import type { AuthtypesGettableRoleDTO } from 'api/generated/services/sigNoz.schemas';
 import {
-	useCreateUserRole,
-	useDeleteUserRole,
-	useGetUser,
+	getGetRolesByUserIDQueryKey,
+	useGetRolesByUserID,
+	useRemoveUserRoleByUserIDAndRoleID,
+	useSetRoleByUserID,
 } from 'api/generated/services/users';
 import { retryOn429 } from 'utils/errorUtils';

 const enum PromiseStatus {
+	Fulfilled = 'fulfilled',
 	Rejected = 'rejected',
 }

-// Stable identity so the memos below do not recompute on every render.
-const EMPTY_USER_ROLES: AuthtypesUserRoleDTO[] = [];
-
 export interface MemberRoleUpdateFailure {
 	roleName: string;
 	error: unknown;
@@ -36,30 +33,30 @@ export function useMemberRoleManager(
 	userId: string,
 	enabled: boolean,
 ): UseMemberRoleManagerResult {
-	const { data, isLoading } = useGetUser(
+	const queryClient = useQueryClient();
+
+	const { data, isLoading } = useGetRolesByUserID(
 		{ id: userId },
 		{ query: { enabled: !!userId && enabled } },
 	);

-	const userRoles = data?.data?.userRoles ?? EMPTY_USER_ROLES;
-
 	const currentRoles = useMemo<AuthtypesGettableRoleDTO[]>(
-		() => userRoles.map((userRole) => userRole.role),
-		[userRoles],
+		() => data?.data ?? [],
+		[data?.data],
 	);

-	// DELETE /api/v2/user_roles/{id} is keyed by the user_role join row, not the role.
-	const assignmentIdByRoleId = useMemo(
-		() => new Map(userRoles.map((userRole) => [userRole.roleId, userRole.id])),
-		[userRoles],
-	);
+	const { mutateAsync: setRole } = useSetRoleByUserID({
+		mutation: { retry: retryOn429 },
+	});
+	const { mutateAsync: removeRole } = useRemoveUserRoleByUserIDAndRoleID({
+		mutation: { retry: retryOn429 },
+	});

-	const { mutateAsync: createUserRole } = useCreateUserRole({
-		mutation: { retry: retryOn429 },
-	});
-	const { mutateAsync: deleteUserRole } = useDeleteUserRole({
-		mutation: { retry: retryOn429 },
-	});
+	const invalidateRoles = useCallback(
+		() =>
+			queryClient.invalidateQueries(getGetRolesByUserIDQueryKey({ id: userId })),
+		[userId, queryClient],
+	);

 	const applyDiff = useCallback(
 		async (
@@ -83,33 +80,30 @@ export function useMemberRoleManager(
 			const allOperations = [
 				...addedRoles.map((role) => ({
 					role,
-					run: (): ReturnType<typeof createUserRole> =>
-						createUserRole({ data: { userId, roleId: role.id ?? '' } }),
+					run: (): ReturnType<typeof setRole> =>
+						setRole({
+							pathParams: { id: userId },
+							data: { name: role.name ?? '' },
+						}),
+				})),
+				...removedRoles.map((role) => ({
+					role,
+					run: (): ReturnType<typeof removeRole> =>
+						removeRole({ pathParams: { id: userId, roleId: role.id ?? '' } }),
 				})),
-				...removedRoles
-					.map((role) => ({
-						role,
-						assignmentId: assignmentIdByRoleId.get(role.id ?? ''),
-					}))
-					.filter(
-						(
-							entry,
-						): entry is {
-							role: AuthtypesGettableRoleDTO;
-							assignmentId: string;
-						} => !!entry.assignmentId,
-					)
-					.map(({ role, assignmentId }) => ({
-						role,
-						run: (): ReturnType<typeof deleteUserRole> =>
-							deleteUserRole({ pathParams: { id: assignmentId } }),
-					})),
 			];

 			const results = await Promise.allSettled(
 				allOperations.map((op) => op.run()),
 			);

+			const successCount = results.filter(
+				(r) => r.status === PromiseStatus.Fulfilled,
+			).length;
+			if (successCount > 0) {
+				await invalidateRoles();
+			}
+
 			const failures: MemberRoleUpdateFailure[] = [];
 			results.forEach((result, index) => {
 				if (result.status === PromiseStatus.Rejected) {
@@ -119,6 +113,7 @@ export function useMemberRoleManager(
 						error: result.reason,
 						onRetry: async (): Promise<void> => {
 							await run();
+							await invalidateRoles();
 						},
 					});
 				}
@@ -126,7 +121,7 @@ export function useMemberRoleManager(

 			return failures;
 		},
-		[userId, currentRoles, assignmentIdByRoleId, createUserRole, deleteUserRole],
+		[userId, currentRoles, setRole, removeRole, invalidateRoles],
 	);

 	return { currentRoles, isLoading, applyDiff };
--- a/frontend/src/lib/recentQueries/saveRecentQuery.ts
+++ b/frontend/src/lib/recentQueries/saveRecentQuery.ts
@@ -19,30 +19,6 @@ type CompositeWithBuilder = {
 	builder?: { queryData?: IBuilderQuery[] };
 };

-export function saveRecentQueryByExpression(
-	dataSource: IBuilderQuery['dataSource'],
-	expression: string | null | undefined,
-	source = '',
-): void {
-	const trimmed = expression?.trim();
-	if (!trimmed) {
-		return;
-	}
-	const validation = validateQuery(trimmed);
-	if (!validation.isValid) {
-		return;
-	}
-	const signal = toSignal(dataSource);
-	if (!signal) {
-		return;
-	}
-	store.save({
-		signal,
-		source,
-		filter: { expression: trimmed },
-	});
-}
-
 // Persists each builder query in the composite as a recent entry. Call this
 // only from explicit user-driven Run triggers — reacting to stagedQuery or any
 // other derived state pollutes recents with navigation/refresh/go-to traffic.
@@ -55,10 +31,22 @@ export function saveRecentQuery(
 	}

 	queryData.forEach((q) => {
-		saveRecentQueryByExpression(
-			q.dataSource,
-			q.filter?.expression,
-			q.source ?? '',
-		);
+		const expression = q.filter?.expression?.trim();
+		if (!expression) {
+			return;
+		}
+		const validation = validateQuery(expression);
+		if (!validation.isValid) {
+			return;
+		}
+		const signal = toSignal(q.dataSource);
+		if (!signal) {
+			return;
+		}
+		store.save({
+			signal,
+			source: q.source ?? '',
+			filter: q.filter ?? { expression: '' },
+		});
 	});
 }
--- a/frontend/src/types/api/user/resetPassword.ts
+++ b/frontend/src/types/api/user/resetPassword.ts
@@ -0,0 +1,9 @@
+export interface Props {
+	token: string;
+	password: string;
+}
+
+export interface PayloadProps {
+	data: string;
+	status: string;
+}
--- a/pkg/apiserver/signozapiserver/authdomain.go
+++ b/pkg/apiserver/signozapiserver/authdomain.go
@@ -10,7 +10,7 @@ import (
 )

 func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v1/domains", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.List), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.List), handler.OpenAPIDef{
 		ID:                  "ListAuthDomains",
 		Tags:                []string{"authdomains"},
 		Summary:             "List all auth domains",
@@ -27,7 +27,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/domains", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Create), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Create), handler.OpenAPIDef{
 		ID:                  "CreateAuthDomain",
 		Tags:                []string{"authdomains"},
 		Summary:             "Create auth domain",
@@ -44,7 +44,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Get), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Get), handler.OpenAPIDef{
 		ID:                  "GetAuthDomain",
 		Tags:                []string{"authdomains"},
 		Summary:             "Get auth domain by ID",
@@ -61,7 +61,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Update), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Update), handler.OpenAPIDef{
 		ID:                  "UpdateAuthDomain",
 		Tags:                []string{"authdomains"},
 		Summary:             "Update auth domain",
@@ -78,7 +78,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Delete), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Delete), handler.OpenAPIDef{
 		ID:                  "DeleteAuthDomain",
 		Tags:                []string{"authdomains"},
 		Summary:             "Delete auth domain",
--- a/pkg/authn/callbackauthn/googlecallbackauthn/authn.go
+++ b/pkg/authn/callbackauthn/googlecallbackauthn/authn.go
@@ -59,12 +59,11 @@ func (a *AuthN) LoginURL(ctx context.Context, siteURL *url.URL, authDomain *auth
 		return "", err
 	}

-	if authDomain.AuthDomainConfig().AuthNProvider != authtypes.AuthNProviderGoogleAuth {
-		return "", errors.Newf(errors.TypeInternal, authtypes.ErrCodeAuthDomainMismatch, "domain type is not google")
+	oauth2Config, err := a.oauth2Config(siteURL, authDomain, oidcProvider)
+	if err != nil {
+		return "", err
 	}

-	oauth2Config := a.oauth2Config(siteURL, authDomain, oidcProvider)
-
 	return oauth2Config.AuthCodeURL(
 		authtypes.NewState(siteURL, authDomain.StorableAuthDomain().ID).URL.String(),
 		oauth2.SetAuthURLParam("hd", authDomain.StorableAuthDomain().Name),
@@ -93,7 +92,16 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, err
 	}

-	oauth2Config := a.oauth2Config(state.URL, authDomain, oidcProvider)
+	googleConfig, err := authDomain.Config().GoogleConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	oauth2Config, err := a.oauth2Config(state.URL, authDomain, oidcProvider)
+	if err != nil {
+		return nil, err
+	}
+
 	token, err := oauth2Config.Exchange(ctx, query.Get("code"))
 	if err != nil {
 		var retrieveError *oauth2.RetrieveError
@@ -111,7 +119,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "google: no id_token in token response")
 	}

-	verifier := oidcProvider.Verifier(&oidc.Config{ClientID: authDomain.AuthDomainConfig().Google.ClientID})
+	verifier := oidcProvider.Verifier(&oidc.Config{ClientID: googleConfig.ClientID})
 	idToken, err := verifier.Verify(ctx, rawIDToken)
 	if err != nil {
 		a.settings.Logger().ErrorContext(ctx, "google: failed to verify token", errors.Attr(err))
@@ -135,7 +143,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "google: unexpected hd claim")
 	}

-	if !authDomain.AuthDomainConfig().Google.InsecureSkipEmailVerified {
+	if !googleConfig.InsecureSkipEmailVerified {
 		if !claims.EmailVerified {
 			a.settings.Logger().ErrorContext(ctx, "google: email is not verified", slog.String("email", claims.Email))
 			return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "google: email is not verified")
@@ -148,14 +156,14 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 	}

 	var groups []string
-	if authDomain.AuthDomainConfig().Google.FetchGroups {
-		groups, err = a.fetchGoogleWorkspaceGroups(ctx, claims.Email, authDomain.AuthDomainConfig().Google)
+	if googleConfig.FetchGroups {
+		groups, err = a.fetchGoogleWorkspaceGroups(ctx, claims.Email, googleConfig)
 		if err != nil {
 			a.settings.Logger().ErrorContext(ctx, "google: could not fetch groups", errors.Attr(err))
 			return nil, errors.Newf(errors.TypeInternal, errors.CodeInternal, "google: could not fetch groups").WithAdditional(err.Error())
 		}

-		allowedGroups := authDomain.AuthDomainConfig().Google.AllowedGroups
+		allowedGroups := googleConfig.AllowedGroups
 		if len(allowedGroups) > 0 {
 			groups = filterGroups(groups, allowedGroups)
 			if len(groups) == 0 {
@@ -173,10 +181,15 @@ func (a *AuthN) ProviderInfo(ctx context.Context, authDomain *authtypes.AuthDoma
 	}
 }

-func (a *AuthN) oauth2Config(siteURL *url.URL, authDomain *authtypes.AuthDomain, provider *oidc.Provider) *oauth2.Config {
+func (a *AuthN) oauth2Config(siteURL *url.URL, authDomain *authtypes.AuthDomain, provider *oidc.Provider) (*oauth2.Config, error) {
+	googleConfig, err := authDomain.Config().GoogleConfig()
+	if err != nil {
+		return nil, err
+	}
+
 	return &oauth2.Config{
-		ClientID:     authDomain.AuthDomainConfig().Google.ClientID,
-		ClientSecret: authDomain.AuthDomainConfig().Google.ClientSecret,
+		ClientID:     googleConfig.ClientID,
+		ClientSecret: googleConfig.ClientSecret,
 		Endpoint:     provider.Endpoint(),
 		Scopes:       scopes,
 		RedirectURL: (&url.URL{
@@ -184,10 +197,10 @@ func (a *AuthN) oauth2Config(siteURL *url.URL, authDomain *authtypes.AuthDomain,
 			Host:   siteURL.Host,
 			Path:   path.Join(a.globalConfig.ExternalPath(), redirectPath),
 		}).String(),
-	}
+	}, nil
 }

-func (a *AuthN) fetchGoogleWorkspaceGroups(ctx context.Context, userEmail string, config *authtypes.GoogleConfig) ([]string, error) {
+func (a *AuthN) fetchGoogleWorkspaceGroups(ctx context.Context, userEmail string, config authtypes.GoogleConfig) ([]string, error) {
 	adminEmail := config.GetAdminEmailForDomain(userEmail)
 	if adminEmail == "" {
 		return nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "no admin email configured for domain of %s", userEmail)
--- a/pkg/modules/authdomain/implauthdomain/getter.go
+++ b/pkg/modules/authdomain/implauthdomain/getter.go
@@ -26,7 +26,7 @@ func (getter *getter) OnBeforeRoleDelete(ctx context.Context, orgID valuer.UUID,

 	referencedBy := make([]string, 0)
 	for _, domain := range domains {
-		for _, mappedRole := range domain.AuthDomainConfig().RoleMapping.RoleNames() {
+		for _, mappedRole := range domain.RoleMapping().RoleNames() {
 			if mappedRole == roleName {
 				referencedBy = append(referencedBy, domain.StorableAuthDomain().Name)
 				break
--- a/pkg/modules/authdomain/implauthdomain/handler.go
+++ b/pkg/modules/authdomain/implauthdomain/handler.go
@@ -38,7 +38,7 @@ func (handler *handler) Create(rw http.ResponseWriter, req *http.Request) {
 		return
 	}

-	authDomain, err := authtypes.NewAuthDomainFromConfig(body.Name, &body.Config, valuer.MustNewUUID(claims.OrgID))
+	authDomain, err := authtypes.NewAuthDomainFromPostableAuthDomain(body, valuer.MustNewUUID(claims.OrgID))
 	if err != nil {
 		render.Error(rw, err)
 		return
@@ -154,7 +154,7 @@ func (handler *handler) Update(rw http.ResponseWriter, r *http.Request) {
 		return
 	}

-	err = authDomain.Update(&body.Config)
+	err = authDomain.Update(body)
 	if err != nil {
 		render.Error(rw, err)
 		return
--- a/pkg/modules/authdomain/implauthdomain/module.go
+++ b/pkg/modules/authdomain/implauthdomain/module.go
@@ -33,7 +33,7 @@ func (module *module) Get(ctx context.Context, id valuer.UUID) (*authtypes.AuthD
 }

 func (module *module) GetAuthNProviderInfo(ctx context.Context, domain *authtypes.AuthDomain) *authtypes.AuthNProviderInfo {
-	if callbackAuthN, ok := module.authNs[domain.AuthDomainConfig().AuthNProvider].(authn.CallbackAuthN); ok {
+	if callbackAuthN, ok := module.authNs[domain.Kind()].(authn.CallbackAuthN); ok {
 		return callbackAuthN.ProviderInfo(ctx, domain)
 	}
 	return &authtypes.AuthNProviderInfo{}
@@ -72,7 +72,7 @@ func (module *module) Collect(ctx context.Context, orgID valuer.UUID) (map[strin
 	stats := make(map[string]any)

 	for _, domain := range domains {
-		key := "authdomain." + domain.AuthDomainConfig().AuthNProvider.StringValue() + ".count"
+		key := "authdomain." + domain.Kind().StringValue() + ".count"
 		if value, ok := stats[key]; ok {
 			stats[key] = value.(int64) + 1
 		} else {
@@ -86,7 +86,7 @@ func (module *module) Collect(ctx context.Context, orgID valuer.UUID) (map[strin
 }

 func (module *module) validateRoleMapping(ctx context.Context, domain *authtypes.AuthDomain) error {
-	roleNames := domain.AuthDomainConfig().RoleMapping.RoleNames()
+	roleNames := domain.RoleMapping().RoleNames()
 	if len(roleNames) == 0 {
 		return nil
 	}
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_mysql/assets/dashboards/overview.json
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_mysql/assets/dashboards/overview.json
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_mysql/icon.svg
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_mysql/icon.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24"><defs><style>.cls-1{fill:#aecbfa;}.cls-1,.cls-2,.cls-3{fill-rule:evenodd;}.cls-2{fill:#669df6;}.cls-3{fill:#4285f4;}</style></defs><title>Icon_24px_SQL_Color</title><g data-name="Product Icons"><g ><polygon class="cls-1" points="4.67 10.44 4.67 13.45 12 17.35 12 14.34 4.67 10.44"/><polygon class="cls-1" points="4.67 15.09 4.67 18.1 12 22 12 18.99 4.67 15.09"/><polygon class="cls-2" points="12 17.35 19.33 13.45 19.33 10.44 12 14.34 12 17.35"/><polygon class="cls-2" points="12 22 19.33 18.1 19.33 15.09 12 18.99 12 22"/><polygon class="cls-3" points="19.33 8.91 19.33 5.9 12 2 12 5.01 19.33 8.91"/><polygon class="cls-2" points="12 2 4.67 5.9 4.67 8.91 12 5.01 12 2"/><polygon class="cls-1" points="4.67 5.87 4.67 8.89 12 12.79 12 9.77 4.67 5.87"/><polygon class="cls-2" points="12 12.79 19.33 8.89 19.33 5.87 12 9.77 12 12.79"/></g></g></svg>
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_mysql/integration.json
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_mysql/integration.json
@@ -1,136 +0,0 @@
-{
-  "id": "cloudsql_mysql",
-  "title": "GCP Cloud SQL for MySQL",
-  "icon": "file://icon.svg",
-  "overview": "file://overview.md",
-  "supportedSignals": {
-    "metrics": true,
-    "logs": true
-  },
-  "dataCollected": {
-    "metrics": [
-      {
-        "name": "cloudsql.googleapis.com/database/up",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/instance_state",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/replication/replica_lag",
-        "unit": "Seconds",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/cpu/utilization",
-        "unit": "Percent",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/memory/utilization",
-        "unit": "Percent",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/disk/utilization",
-        "unit": "Percent",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/network/connections",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/queries",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/dml_operations_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/threads",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/innodb/buffer_pool_reads_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/innodb/buffer_pool_read_requests_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/slow_queries_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/aborted_connects_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/innodb/deadlocks_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/mysql/innodb/row_lock_waits_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/disk/read_ops_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      },
-      {
-        "name": "cloudsql.googleapis.com/database/disk/write_ops_count",
-        "unit": "Count",
-        "type": "Sum",
-        "description": ""
-      }
-    ],
-    "logs": []
-  },
-  "telemetryCollectionStrategy": {
-    "gcp": {}
-  },
-  "assets": {
-    "dashboards": [
-      {
-        "id": "overview",
-        "title": "GCP Cloud SQL for MySQL Overview",
-        "description": "Overview of GCP Cloud SQL for MySQL metrics",
-        "definition": "file://assets/dashboards/overview.json"
-      }
-    ]
-  }
-}
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_mysql/overview.md
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_mysql/overview.md
@@ -1,3 +0,0 @@
-### Monitor GCP Cloud SQL for MySQL with SigNoz
-
-Collect key GCP Cloud SQL for MySQL metrics and view them with an out of the box dashboard.
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_postgres/assets/dashboards/overview.json
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_postgres/assets/dashboards/overview.json
@@ -784,57 +784,40 @@
            {
              "kind": "time_series",
              "spec": {
+                "name": "A",
                "plugin": {
-                  "kind": "signoz/CompositeQuery",
+                  "kind": "signoz/BuilderQuery",
                  "spec": {
-                    "queries": [
+                    "name": "A",
+                    "signal": "metrics",
+                    "source": "",
+                    "aggregations": [
                      {
-                        "type": "builder_query",
-                        "spec": {
-                          "name": "A",
-                          "stepInterval": 0,
-                          "signal": "metrics",
-                          "source": "",
-                          "aggregations": [
-                            {
-                              "metricName": "cloudsql.googleapis.com/database/cpu/utilization",
-                              "temporality": "",
-                              "timeAggregation": "max",
-                              "spaceAggregation": "max",
-                              "reduceTo": ""
-                            }
-                          ],
-                          "disabled": false,
-                          "filter": {
-                            "expression": "project_id = $project_id AND database_id in $database_id AND gcp.resource_type = 'cloudsql_database' "
-                          },
-                          "groupBy": [
-                            {
-                              "name": "database_id",
-                              "signal": "",
-                              "fieldContext": "attribute",
-                              "fieldDataType": "string"
-                            }
-                          ],
-                          "order": null,
-                          "selectFields": null,
-                          "secondaryAggregations": null,
-                          "functions": null,
-                          "legend": "{{database_id}}"
-                        }
-                      },
-                      {
-                        "type": "builder_formula",
-                        "spec": {
-                          "name": "F1",
-                          "expression": "100 * A",
-                          "disabled": false,
-                          "order": null,
-                          "functions": null,
-                          "legend": "{{database_id}}"
-                        }
+                        "metricName": "cloudsql.googleapis.com/database/cpu/utilization",
+                        "temporality": "",
+                        "timeAggregation": "max",
+                        "spaceAggregation": "max",
+                        "reduceTo": "avg"
                      }
-                    ]
+                    ],
+                    "disabled": false,
+                    "filter": {
+                      "expression": "project_id = $project_id AND database_id in $database_id AND gcp.resource_type = 'cloudsql_database' "
+                    },
+                    "groupBy": [
+                      {
+                        "name": "database_id",
+                        "signal": "",
+                        "fieldContext": "attribute",
+                        "fieldDataType": "string"
+                      }
+                    ],
+                    "order": [],
+                    "having": {
+                      "expression": ""
+                    },
+                    "functions": [],
+                    "legend": "{{database_id}}"
                  }
                }
              }
@@ -1434,4 +1417,4 @@
    "refreshInterval": "",
    "links": []
  }
-}
+}
--- a/pkg/modules/dashboard/impldashboard/v2_module.go
+++ b/pkg/modules/dashboard/impldashboard/v2_module.go
@@ -245,13 +245,11 @@ func (module *module) PatchV2(ctx context.Context, orgID valuer.UUID, id valuer.
 }

 func (module *module) DeleteV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
-	// Read the storable, not the decoded v2 dashboard: deleting must work even
-	// when the stored data is corrupt or never migrated off the v1 schema.
-	storable, err := module.store.Get(ctx, orgID, id)
+	existing, err := module.GetV2(ctx, orgID, id)
 	if err != nil {
 		return err
 	}
-	if err := storable.ErrIfNotDeletable(); err != nil {
+	if err := existing.ErrIfNotDeletable(); err != nil {
 		return err
 	}

--- a/pkg/modules/session/implsession/handler.go
+++ b/pkg/modules/session/implsession/handler.go
@@ -75,7 +75,7 @@ func (handler *handler) CreateSessionByGoogleCallback(rw http.ResponseWriter, re

 	values := req.URL.Query()

-	redirectURL, err := handler.module.CreateCallbackAuthNSession(ctx, authtypes.AuthNProviderGoogleAuth, values)
+	redirectURL, err := handler.module.CreateCallbackAuthNSession(ctx, authtypes.AuthNProviderGoogle, values)
 	if err != nil {
 		http.Redirect(rw, req, handler.getRedirectURLFromErr(err), http.StatusSeeOther)
 		return
--- a/pkg/modules/session/implsession/module.go
+++ b/pkg/modules/session/implsession/module.go
@@ -152,7 +152,7 @@ func (module *module) CreateCallbackAuthNSession(ctx context.Context, authNProvi
 		return "", err
 	}

-	roleMapping := authDomain.AuthDomainConfig().RoleMapping
+	roleMapping := authDomain.RoleMapping()

 	roleAttributeExists := false
 	if roleMapping != nil && roleMapping.UseRoleAttribute && callbackIdentity.Role != "" {
@@ -215,11 +215,11 @@ func (module *module) getOrgSessionContext(ctx context.Context, org *types.Organ
 		return authtypes.NewOrgSessionContext(org.ID, org.Name).AddPasswordAuthNSupport(authtypes.AuthNProviderEmailPassword), nil
 	}

-	if !authDomain.AuthDomainConfig().SSOEnabled {
+	if !authDomain.Enabled() {
 		return authtypes.NewOrgSessionContext(org.ID, org.Name).AddPasswordAuthNSupport(authtypes.AuthNProviderEmailPassword), nil
 	}

-	provider, err := getProvider[authn.CallbackAuthN](authDomain.AuthDomainConfig().AuthNProvider, module.authNs)
+	provider, err := getProvider[authn.CallbackAuthN](authDomain.Kind(), module.authNs)
 	if err != nil {
 		return nil, err
 	}
@@ -233,7 +233,7 @@ func (module *module) getOrgSessionContext(ctx context.Context, org *types.Organ
 		return nil, err
 	}

-	return authtypes.NewOrgSessionContext(org.ID, org.Name).AddCallbackAuthNSupport(authDomain.AuthDomainConfig().AuthNProvider, loginURL), nil
+	return authtypes.NewOrgSessionContext(org.ID, org.Name).AddCallbackAuthNSupport(authDomain.Kind(), loginURL), nil
 }

 func getProvider[T authn.AuthN](authNProvider authtypes.AuthNProvider, authNs map[authtypes.AuthNProvider]authn.AuthN) (T, error) {
--- a/pkg/signoz/authn.go
+++ b/pkg/signoz/authn.go
@@ -22,6 +22,6 @@ func NewAuthNs(ctx context.Context, providerSettings factory.ProviderSettings, s

 	return map[authtypes.AuthNProvider]authn.AuthN{
 		authtypes.AuthNProviderEmailPassword: emailPasswordAuthN,
-		authtypes.AuthNProviderGoogleAuth:    googleCallbackAuthN,
+		authtypes.AuthNProviderGoogle:        googleCallbackAuthN,
 	}, nil
 }
--- a/pkg/signoz/provider.go
+++ b/pkg/signoz/provider.go
@@ -237,6 +237,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddDashboardTuplesFactory(sqlstore),
 		sqlmigration.NewRestructureSavedViewSpecFactory(sqlstore, sqlschema),
 		sqlmigration.NewAddSavedViewTuplesFactory(sqlstore),
+		sqlmigration.NewRestructureAuthDomainConfigFactory(sqlstore),
 	)
 }

--- a/pkg/sqlmigration/111_restructure_auth_domain_config.go
+++ b/pkg/sqlmigration/111_restructure_auth_domain_config.go
@@ -0,0 +1,189 @@
+package sqlmigration
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/migrate"
+)
+
+type restructureAuthDomainConfig struct {
+	sqlstore sqlstore.SQLStore
+	logger   *slog.Logger
+}
+
+type restructureAuthDomainRow struct {
+	bun.BaseModel `bun:"table:auth_domain"`
+
+	ID   string `bun:"id"`
+	Data string `bun:"data"`
+}
+
+// The legacy document keyed the discriminator as ssoType with the chosen
+// provider's config in a sibling field; the restructured document is
+// {enabled, config: {kind, spec}, roleMapping} with renamed saml spec keys.
+var legacySSOTypeToKind = map[string]string{
+	"google_auth": "google",
+	"saml":        "saml",
+	"oidc":        "oidc",
+}
+
+var legacySSOTypeToConfigKey = map[string]string{
+	"google_auth": "googleAuthConfig",
+	"saml":        "samlConfig",
+	"oidc":        "oidcConfig",
+}
+
+var legacySamlKeyToKey = map[string]string{
+	"samlEntity": "entityId",
+	"samlIdp":    "location",
+	"samlCert":   "certificate",
+}
+
+func NewRestructureAuthDomainConfigFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(
+		factory.MustNewName("restructure_auth_domain_config"),
+		func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+			return &restructureAuthDomainConfig{sqlstore: sqlstore, logger: ps.Logger}, nil
+		},
+	)
+}
+
+func (migration *restructureAuthDomainConfig) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *restructureAuthDomainConfig) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		_ = tx.Rollback()
+	}()
+
+	rows := make([]*restructureAuthDomainRow, 0)
+	if err := tx.NewSelect().Model(&rows).Scan(ctx); err != nil {
+		return err
+	}
+
+	for _, row := range rows {
+		legacy := make(map[string]json.RawMessage)
+		if err := json.Unmarshal([]byte(row.Data), &legacy); err != nil {
+			migration.logger.WarnContext(ctx, "skipping auth domain with unreadable data", slog.String("auth_domain_id", row.ID), errors.Attr(err))
+			continue
+		}
+
+		ssoTypeRaw, ok := legacy["ssoType"]
+		if !ok {
+			continue
+		}
+
+		var ssoType string
+		if err := json.Unmarshal(ssoTypeRaw, &ssoType); err != nil {
+			migration.logger.WarnContext(ctx, "skipping auth domain with unreadable ssoType", slog.String("auth_domain_id", row.ID), errors.Attr(err))
+			continue
+		}
+
+		// Documents written before the provider enum became a valuer.String spell
+		// the discriminator uppercase ("SAML", "GOOGLE_AUTH"); reads lowercase it
+		// through valuer.NewString, so those rows still carry the original casing
+		// on disk. Every lookup and spec rewrite below keys off this value.
+		ssoType = strings.ToLower(strings.TrimSpace(ssoType))
+
+		kind, ok := legacySSOTypeToKind[ssoType]
+		if !ok {
+			migration.logger.WarnContext(ctx, "skipping auth domain with unknown ssoType", slog.String("auth_domain_id", row.ID), slog.String("sso_type", ssoType))
+			continue
+		}
+
+		spec, ok := legacy[legacySSOTypeToConfigKey[ssoType]]
+		if !ok || string(spec) == "null" {
+			migration.logger.WarnContext(ctx, "skipping auth domain with missing provider config", slog.String("auth_domain_id", row.ID), slog.String("sso_type", ssoType))
+			continue
+		}
+
+		if ssoType == "saml" {
+			samlSpec := make(map[string]json.RawMessage)
+			if err := json.Unmarshal(spec, &samlSpec); err != nil {
+				migration.logger.WarnContext(ctx, "skipping auth domain with unreadable saml config", slog.String("auth_domain_id", row.ID), errors.Attr(err))
+				continue
+			}
+
+			for legacyKey, key := range legacySamlKeyToKey {
+				if value, ok := samlSpec[legacyKey]; ok {
+					samlSpec[key] = value
+					delete(samlSpec, legacyKey)
+				}
+			}
+
+			if spec, err = json.Marshal(samlSpec); err != nil {
+				return err
+			}
+		}
+
+		if ssoType == "google_auth" {
+			googleSpec := make(map[string]json.RawMessage)
+			if err := json.Unmarshal(spec, &googleSpec); err != nil {
+				migration.logger.WarnContext(ctx, "skipping auth domain with unreadable google config", slog.String("auth_domain_id", row.ID), errors.Attr(err))
+				continue
+			}
+
+			delete(googleSpec, "redirectURI")
+
+			if spec, err = json.Marshal(googleSpec); err != nil {
+				return err
+			}
+		}
+
+		kindRaw, err := json.Marshal(kind)
+		if err != nil {
+			return err
+		}
+
+		config, err := json.Marshal(map[string]json.RawMessage{
+			"kind": kindRaw,
+			"spec": spec,
+		})
+		if err != nil {
+			return err
+		}
+
+		restructured := map[string]json.RawMessage{
+			"enabled": json.RawMessage("false"),
+			"config":  config,
+		}
+		if enabled, ok := legacy["ssoEnabled"]; ok {
+			restructured["enabled"] = enabled
+		}
+		if roleMapping, ok := legacy["roleMapping"]; ok && string(roleMapping) != "null" {
+			restructured["roleMapping"] = roleMapping
+		}
+
+		newData, err := json.Marshal(restructured)
+		if err != nil {
+			return err
+		}
+
+		if _, err := tx.NewUpdate().
+			Model((*restructureAuthDomainRow)(nil)).
+			Set("data = ?", string(newData)).
+			Where("id = ?", row.ID).
+			Exec(ctx); err != nil {
+			return err
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *restructureAuthDomainConfig) Down(context.Context, *bun.DB) error {
+	return nil
+}
--- a/pkg/sqlmigration/111_restructure_auth_domain_config_test.go
+++ b/pkg/sqlmigration/111_restructure_auth_domain_config_test.go
@@ -0,0 +1,127 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"log/slog"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect/sqlitedialect"
+	_ "modernc.org/sqlite"
+)
+
+func TestRestructureAuthDomainConfig(t *testing.T) {
+	testCases := []struct {
+		name         string
+		data         string
+		expectedData string
+	}{
+		{
+			// Rows written before the provider enum became a valuer.String spell
+			// the discriminator uppercase and were never rewritten on disk.
+			name:         "UppercaseSAML",
+			data:         `{"ssoEnabled":true,"ssoType":"SAML","samlConfig":{"samlEntity":"entity","samlIdp":"https://idp.example.com/sso","samlCert":"cert"},"roleMapping":{"defaultRole":"signoz-admin"}}`,
+			expectedData: `{"enabled":true,"config":{"kind":"saml","spec":{"entityId":"entity","location":"https://idp.example.com/sso","certificate":"cert"}},"roleMapping":{"defaultRole":"signoz-admin"}}`,
+		},
+		{
+			name:         "UppercaseGoogleAuth",
+			data:         `{"ssoEnabled":true,"ssoType":"GOOGLE_AUTH","googleAuthConfig":{"clientId":"cid","clientSecret":"secret","redirectURI":"https://example.com/callback"}}`,
+			expectedData: `{"enabled":true,"config":{"kind":"google","spec":{"clientId":"cid","clientSecret":"secret"}}}`,
+		},
+		{
+			name:         "MixedCaseWithSurroundingWhitespace",
+			data:         `{"ssoEnabled":false,"ssoType":" Saml ","samlConfig":{"samlEntity":"entity","samlIdp":"location","samlCert":"cert"}}`,
+			expectedData: `{"enabled":false,"config":{"kind":"saml","spec":{"entityId":"entity","location":"location","certificate":"cert"}}}`,
+		},
+		{
+			name:         "LowercaseSAML",
+			data:         `{"ssoEnabled":true,"ssoType":"saml","samlConfig":{"samlEntity":"entity","samlIdp":"location","samlCert":"cert","samlSkipSigning":true}}`,
+			expectedData: `{"enabled":true,"config":{"kind":"saml","spec":{"entityId":"entity","location":"location","certificate":"cert","samlSkipSigning":true}}}`,
+		},
+		{
+			name:         "LowercaseGoogleAuthWithWorkspaceGroups",
+			data:         `{"ssoEnabled":true,"ssoType":"google_auth","googleAuthConfig":{"clientId":"cid","clientSecret":"secret","redirectURI":"https://example.com/callback","fetchGroups":true,"serviceAccountJson":"{}","domainToAdminEmail":{"*":"admin@example.com"},"allowedGroups":["eng@example.com"]},"roleMapping":{"defaultRole":"signoz-viewer","groupMappings":{"eng":"signoz-editor"}}}`,
+			expectedData: `{"enabled":true,"config":{"kind":"google","spec":{"clientId":"cid","clientSecret":"secret","fetchGroups":true,"serviceAccountJson":"{}","domainToAdminEmail":{"*":"admin@example.com"},"allowedGroups":["eng@example.com"]}},"roleMapping":{"defaultRole":"signoz-viewer","groupMappings":{"eng":"signoz-editor"}}}`,
+		},
+		{
+			name:         "LowercaseOIDC",
+			data:         `{"ssoEnabled":true,"ssoType":"oidc","oidcConfig":{"clientId":"cid","clientSecret":"secret","issuer":"https://issuer.example.com"}}`,
+			expectedData: `{"enabled":true,"config":{"kind":"oidc","spec":{"clientId":"cid","clientSecret":"secret","issuer":"https://issuer.example.com"}}}`,
+		},
+		{
+			name:         "MissingSSOEnabledDefaultsToDisabled",
+			data:         `{"ssoType":"saml","samlConfig":{"samlEntity":"entity","samlIdp":"location","samlCert":"cert"}}`,
+			expectedData: `{"enabled":false,"config":{"kind":"saml","spec":{"entityId":"entity","location":"location","certificate":"cert"}}}`,
+		},
+		{
+			name:         "NullRoleMappingIsDropped",
+			data:         `{"ssoEnabled":true,"ssoType":"saml","samlConfig":{"samlEntity":"entity","samlIdp":"location","samlCert":"cert"},"roleMapping":null}`,
+			expectedData: `{"enabled":true,"config":{"kind":"saml","spec":{"entityId":"entity","location":"location","certificate":"cert"}}}`,
+		},
+		{
+			name:         "AlreadyRestructured",
+			data:         `{"enabled":true,"config":{"kind":"saml","spec":{"entityId":"entity","location":"location","certificate":"cert"}}}`,
+			expectedData: `{"enabled":true,"config":{"kind":"saml","spec":{"entityId":"entity","location":"location","certificate":"cert"}}}`,
+		},
+		{
+			name:         "UnknownSSOType",
+			data:         `{"ssoEnabled":true,"ssoType":"ldap","samlConfig":{"samlEntity":"entity"}}`,
+			expectedData: `{"ssoEnabled":true,"ssoType":"ldap","samlConfig":{"samlEntity":"entity"}}`,
+		},
+		{
+			name:         "NullProviderConfig",
+			data:         `{"ssoEnabled":true,"ssoType":"saml","samlConfig":null}`,
+			expectedData: `{"ssoEnabled":true,"ssoType":"saml","samlConfig":null}`,
+		},
+		{
+			name:         "UnreadableData",
+			data:         `not json`,
+			expectedData: `not json`,
+		},
+	}
+
+	ctx := context.Background()
+
+	sqldb, err := sql.Open("sqlite", "file:"+filepath.Join(t.TempDir(), "test.db"))
+	require.NoError(t, err)
+	defer sqldb.Close()
+
+	db := bun.NewDB(sqldb, sqlitedialect.New())
+
+	// Only the two columns the migration reads and writes.
+	_, err = db.ExecContext(ctx, `CREATE TABLE auth_domain (id TEXT PRIMARY KEY, data TEXT NOT NULL)`)
+	require.NoError(t, err)
+
+	for _, testCase := range testCases {
+		_, err := db.NewInsert().
+			Model(&restructureAuthDomainRow{ID: testCase.name, Data: testCase.data}).
+			Exec(ctx)
+		require.NoError(t, err)
+	}
+
+	migration := &restructureAuthDomainConfig{logger: slog.New(slog.DiscardHandler)}
+
+	// Running twice pins idempotency: a restructured document carries no
+	// ssoType, so the second pass must leave every row untouched.
+	for range 2 {
+		require.NoError(t, migration.Up(ctx, db))
+
+		for _, testCase := range testCases {
+			t.Run(testCase.name, func(t *testing.T) {
+				row := new(restructureAuthDomainRow)
+				require.NoError(t, db.NewSelect().Model(row).Where("id = ?", testCase.name).Scan(ctx))
+
+				if testCase.name == "UnreadableData" {
+					assert.Equal(t, testCase.expectedData, row.Data)
+					return
+				}
+
+				assert.JSONEq(t, testCase.expectedData, row.Data)
+			})
+		}
+	}
+}
--- a/pkg/types/authtypes/authn.go
+++ b/pkg/types/authtypes/authn.go
@@ -16,7 +16,7 @@ var (
 )

 var (
-	AuthNProviderGoogleAuth    = AuthNProvider{valuer.NewString("google_auth")}
+	AuthNProviderGoogle        = AuthNProvider{valuer.NewString("google")}
 	AuthNProviderSAML          = AuthNProvider{valuer.NewString("saml")}
 	AuthNProviderEmailPassword = AuthNProvider{valuer.NewString("email_password")}
 	AuthNProviderOIDC          = AuthNProvider{valuer.NewString("oidc")}
@@ -158,7 +158,7 @@ func (typ *Identity) ToClaims() Claims {

 func (AuthNProvider) Enum() []any {
 	return []any{
-		AuthNProviderGoogleAuth,
+		AuthNProviderGoogle,
 		AuthNProviderSAML,
 		AuthNProviderEmailPassword,
 		AuthNProviderOIDC,
--- a/pkg/types/authtypes/domain.go
+++ b/pkg/types/authtypes/domain.go
@@ -1,6 +1,7 @@
 package authtypes

 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"regexp"
@@ -9,6 +10,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/swaggest/jsonschema-go"
 	"github.com/uptrace/bun"
 )

@@ -28,9 +30,81 @@ var (
 	ErrCodeAuthDomainAlreadyExists = errors.MustNewCode("auth_domain_already_exists")
 )

+// authDomainConfigVariants is the single registry of authn provider kinds:
+// UnmarshalJSON, JSONSchemaOneOf and the discriminator mapping all derive from
+// it, so a new provider is one entry here plus its authn registration.
+//
+// rejectUnknownSpecFields decodes into a method-less alias of the spec: a type
+// carrying its own UnmarshalJSON consumes the bytes itself, which would bypass
+// DisallowUnknownFields. It only sees the spec's own fields, not those of
+// nested objects that unmarshal themselves.
+var authDomainConfigVariants = []authDomainConfigVariant{
+	{
+		kind: AuthNProviderSAML,
+		decodeSpec: func(data []byte) (any, error) {
+			spec := SamlConfig{}
+			if err := json.Unmarshal(data, &spec); err != nil {
+				return nil, err
+			}
+			return spec, nil
+		},
+		rejectUnknownSpecFields: func(data []byte) error {
+			type alias SamlConfig
+			decoder := json.NewDecoder(bytes.NewReader(data))
+			decoder.DisallowUnknownFields()
+			return decoder.Decode(new(alias))
+		},
+		schema:    authDomainConfigSAML{},
+		schemaRef: "#/components/schemas/AuthtypesAuthDomainConfigSAML",
+	},
+	{
+		kind: AuthNProviderGoogle,
+		decodeSpec: func(data []byte) (any, error) {
+			spec := GoogleConfig{}
+			if err := json.Unmarshal(data, &spec); err != nil {
+				return nil, err
+			}
+			return spec, nil
+		},
+		rejectUnknownSpecFields: func(data []byte) error {
+			type alias GoogleConfig
+			decoder := json.NewDecoder(bytes.NewReader(data))
+			decoder.DisallowUnknownFields()
+			return decoder.Decode(new(alias))
+		},
+		schema:    authDomainConfigGoogle{},
+		schemaRef: "#/components/schemas/AuthtypesAuthDomainConfigGoogle",
+	},
+	{
+		kind: AuthNProviderOIDC,
+		decodeSpec: func(data []byte) (any, error) {
+			spec := OIDCConfig{}
+			if err := json.Unmarshal(data, &spec); err != nil {
+				return nil, err
+			}
+			return spec, nil
+		},
+		rejectUnknownSpecFields: func(data []byte) error {
+			type alias OIDCConfig
+			decoder := json.NewDecoder(bytes.NewReader(data))
+			decoder.DisallowUnknownFields()
+			return decoder.Decode(new(alias))
+		},
+		schema:    authDomainConfigOIDC{},
+		schemaRef: "#/components/schemas/AuthtypesAuthDomainConfigOIDC",
+	},
+}
+
+var (
+	_ jsonschema.OneOfExposer = AuthDomainConfig{}
+	_ jsonschema.Preparer     = AuthDomainConfig{}
+)
+
 type GettableAuthDomain struct {
 	StorableAuthDomain
+	Enabled           bool               `json:"enabled"`
 	Config            AuthDomainConfig   `json:"config"`
+	RoleMapping       *RoleMapping       `json:"roleMapping"`
 	AuthNProviderInfo *AuthNProviderInfo `json:"authNProviderInfo"`
 }

@@ -39,12 +113,16 @@ type AuthNProviderInfo struct {
 }

 type PostableAuthDomain struct {
-	Config AuthDomainConfig `json:"config"`
-	Name   string           `json:"name"`
+	Name        string           `json:"name" required:"true"`
+	Enabled     bool             `json:"enabled"`
+	Config      AuthDomainConfig `json:"config" required:"true"`
+	RoleMapping *RoleMapping     `json:"roleMapping"`
 }

 type UpdatableAuthDomain struct {
-	Config AuthDomainConfig `json:"config"`
+	Enabled     bool             `json:"enabled"`
+	Config      AuthDomainConfig `json:"config" required:"true"`
+	RoleMapping *RoleMapping     `json:"roleMapping"`
 }

 type StorableAuthDomain struct {
@@ -57,150 +135,47 @@ type StorableAuthDomain struct {
 	types.TimeAuditable
 }

-// TODO: the oneOf emitted by JSONSchemaOneOf is not the shape OpenAPI wants
-// for a discriminated union. OpenAPI's discriminator requires every oneOf
-// branch to be a $ref to a named component and a sibling property whose value
-// selects the variant. ssoType is already discriminator-shaped, but the
-// variant payload lives in a sibling field (samlConfig / googleAuthConfig /
-// oidcConfig) instead of being the payload itself, so no discriminator can
-// be attached. Refactor AuthDomainConfig into an envelope (see
-// ruletypes.RuleThresholdData for the pattern) where the chosen config is
-// the payload and ssoType is the discriminator.
+// StorableAuthDomainConfig is the JSON document persisted in StorableAuthDomain.Data.
+type StorableAuthDomainConfig struct {
+	Enabled     bool             `json:"enabled"`
+	Config      AuthDomainConfig `json:"config"`
+	RoleMapping *RoleMapping     `json:"roleMapping"`
+}
+
 type AuthDomainConfig struct {
-	SSOEnabled    bool          `json:"ssoEnabled"`
-	AuthNProvider AuthNProvider `json:"ssoType"`
-	SAML          *SamlConfig   `json:"samlConfig"`
-	Google        *GoogleConfig `json:"googleAuthConfig"`
-	OIDC          *OIDCConfig   `json:"oidcConfig"`
-	RoleMapping   *RoleMapping  `json:"roleMapping"`
+	Kind AuthNProvider `json:"kind" required:"true"`
+	Spec any           `json:"spec" required:"true"`
+}
+
+// authDomainConfigSAML is the OpenAPI schema for an AuthDomainConfig with kind=saml.
+type authDomainConfigSAML struct {
+	Kind AuthNProvider `json:"kind" description:"The kind of authn provider." required:"true"`
+	Spec SamlConfig    `json:"spec" description:"The saml configuration." required:"true"`
+}
+
+// authDomainConfigGoogle is the OpenAPI schema for an AuthDomainConfig with kind=google.
+type authDomainConfigGoogle struct {
+	Kind AuthNProvider `json:"kind" description:"The kind of authn provider." required:"true"`
+	Spec GoogleConfig  `json:"spec" description:"The google auth configuration." required:"true"`
+}
+
+// authDomainConfigOIDC is the OpenAPI schema for an AuthDomainConfig with kind=oidc.
+type authDomainConfigOIDC struct {
+	Kind AuthNProvider `json:"kind" description:"The kind of authn provider." required:"true"`
+	Spec OIDCConfig    `json:"spec" description:"The oidc configuration." required:"true"`
+}
+
+type authDomainConfigVariant struct {
+	kind                    AuthNProvider
+	decodeSpec              func(data []byte) (any, error)
+	rejectUnknownSpecFields func(data []byte) error
+	schema                  any
+	schemaRef               string
 }

 type AuthDomain struct {
-	storableAuthDomain *StorableAuthDomain
-	authDomainConfig   *AuthDomainConfig
-}
-
-func NewAuthDomainFromConfig(name string, config *AuthDomainConfig, orgID valuer.UUID) (*AuthDomain, error) {
-	data, err := json.Marshal(config)
-	if err != nil {
-		return nil, err
-	}
-
-	return NewAuthDomain(name, string(data), orgID)
-}
-
-func NewAuthDomain(name string, data string, orgID valuer.UUID) (*AuthDomain, error) {
-	storableAuthDomain := &StorableAuthDomain{
-		Identifiable: types.Identifiable{
-			ID: valuer.GenerateUUID(),
-		},
-		Name:  name,
-		Data:  data,
-		OrgID: orgID,
-		TimeAuditable: types.TimeAuditable{
-			CreatedAt: time.Now(),
-			UpdatedAt: time.Now(),
-		},
-	}
-
-	return NewAuthDomainFromStorableAuthDomain(storableAuthDomain)
-}
-
-func NewAuthDomainFromStorableAuthDomain(storableAuthDomain *StorableAuthDomain) (*AuthDomain, error) {
-	authDomainConfig := new(AuthDomainConfig)
-	if err := json.Unmarshal([]byte(storableAuthDomain.Data), authDomainConfig); err != nil {
-		return nil, err
-	}
-
-	return &AuthDomain{
-		storableAuthDomain: storableAuthDomain,
-		authDomainConfig:   authDomainConfig,
-	}, nil
-}
-
-func NewGettableAuthDomainFromAuthDomain(authDomain *AuthDomain, authNProviderInfo *AuthNProviderInfo) *GettableAuthDomain {
-	return &GettableAuthDomain{
-		StorableAuthDomain: *authDomain.StorableAuthDomain(),
-		Config:             *authDomain.AuthDomainConfig(),
-		AuthNProviderInfo:  authNProviderInfo,
-	}
-}
-
-func (typ *AuthDomain) StorableAuthDomain() *StorableAuthDomain {
-	return typ.storableAuthDomain
-}
-
-func (typ *AuthDomain) AuthDomainConfig() *AuthDomainConfig {
-	return typ.authDomainConfig
-}
-
-func (typ *AuthDomain) Update(config *AuthDomainConfig) error {
-	data, err := json.Marshal(config)
-	if err != nil {
-		return err
-	}
-
-	typ.authDomainConfig = config
-	typ.storableAuthDomain.Data = string(data)
-	typ.storableAuthDomain.UpdatedAt = time.Now()
-	return nil
-}
-
-func (typ *PostableAuthDomain) UnmarshalJSON(data []byte) error {
-	type Alias PostableAuthDomain
-
-	var temp Alias
-	if err := json.Unmarshal(data, &temp); err != nil {
-		return err
-	}
-
-	if !authDomainNameRegex.MatchString(temp.Name) {
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidName, "invalid domain name %s", temp.Name)
-	}
-
-	*typ = PostableAuthDomain(temp)
-	return nil
-}
-
-func (typ *AuthDomainConfig) UnmarshalJSON(data []byte) error {
-	type Alias AuthDomainConfig
-
-	var temp Alias
-	if err := json.Unmarshal(data, &temp); err != nil {
-		return err
-	}
-
-	switch temp.AuthNProvider {
-	case AuthNProviderGoogleAuth:
-		if temp.Google == nil {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "google auth config is required")
-		}
-
-	case AuthNProviderSAML:
-		if temp.SAML == nil {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "saml config is required")
-		}
-
-	case AuthNProviderOIDC:
-		if temp.OIDC == nil {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "oidc config is required")
-		}
-
-	default:
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "invalid authn provider %q", temp.AuthNProvider.StringValue())
-	}
-
-	*typ = AuthDomainConfig(temp)
-	return nil
-
-}
-
-func (AuthDomainConfig) JSONSchemaOneOf() []any {
-	return []any{
-		SamlConfig{},
-		GoogleConfig{},
-		OIDCConfig{},
-	}
+	storableAuthDomain       *StorableAuthDomain
+	storableAuthDomainConfig *StorableAuthDomainConfig
 }

 type AuthDomainStore interface {
@@ -228,3 +203,270 @@ type AuthDomainStore interface {
 	// Delete by orgID and id.
 	Delete(context.Context, valuer.UUID, valuer.UUID) error
 }
+
+func NewAuthDomainFromPostableAuthDomain(postableAuthDomain *PostableAuthDomain, orgID valuer.UUID) (*AuthDomain, error) {
+	storableAuthDomainConfig := &StorableAuthDomainConfig{
+		Enabled:     postableAuthDomain.Enabled,
+		Config:      postableAuthDomain.Config,
+		RoleMapping: postableAuthDomain.RoleMapping,
+	}
+
+	data, err := json.Marshal(storableAuthDomainConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	return &AuthDomain{
+		storableAuthDomain: &StorableAuthDomain{
+			Identifiable: types.Identifiable{
+				ID: valuer.GenerateUUID(),
+			},
+			Name:  postableAuthDomain.Name,
+			Data:  string(data),
+			OrgID: orgID,
+			TimeAuditable: types.TimeAuditable{
+				CreatedAt: time.Now(),
+				UpdatedAt: time.Now(),
+			},
+		},
+		storableAuthDomainConfig: storableAuthDomainConfig,
+	}, nil
+}
+
+func NewAuthDomainFromStorableAuthDomain(storableAuthDomain *StorableAuthDomain) (*AuthDomain, error) {
+	storableAuthDomainConfig := new(StorableAuthDomainConfig)
+	if err := json.Unmarshal([]byte(storableAuthDomain.Data), storableAuthDomainConfig); err != nil {
+		return nil, err
+	}
+
+	return &AuthDomain{
+		storableAuthDomain:       storableAuthDomain,
+		storableAuthDomainConfig: storableAuthDomainConfig,
+	}, nil
+}
+
+func NewGettableAuthDomainFromAuthDomain(authDomain *AuthDomain, authNProviderInfo *AuthNProviderInfo) *GettableAuthDomain {
+	return &GettableAuthDomain{
+		StorableAuthDomain: *authDomain.StorableAuthDomain(),
+		Enabled:            authDomain.Enabled(),
+		Config:             authDomain.Config(),
+		RoleMapping:        authDomain.RoleMapping(),
+		AuthNProviderInfo:  authNProviderInfo,
+	}
+}
+
+// JSONSchemaOneOf returns the oneOf variants for the AuthDomainConfig discriminated union.
+// Each variant represents a different authn provider kind with its corresponding spec schema.
+func (AuthDomainConfig) JSONSchemaOneOf() []any {
+	oneOf := make([]any, len(authDomainConfigVariants))
+	for i, variant := range authDomainConfigVariants {
+		oneOf[i] = variant.schema
+	}
+
+	return oneOf
+}
+
+// PrepareJSONSchema marks the schema with x-signoz-discriminator;
+// signoz.attachDiscriminators promotes it to a real OpenAPI 3
+// discriminator after reflection.
+func (AuthDomainConfig) PrepareJSONSchema(schema *jsonschema.Schema) error {
+	if schema.ExtraProperties == nil {
+		schema.ExtraProperties = map[string]any{}
+	}
+
+	mapping := make(map[string]string, len(authDomainConfigVariants))
+	for _, variant := range authDomainConfigVariants {
+		mapping[variant.kind.StringValue()] = variant.schemaRef
+	}
+
+	schema.ExtraProperties["x-signoz-discriminator"] = map[string]any{
+		"propertyName": "kind",
+		"mapping":      mapping,
+	}
+
+	return nil
+}
+
+func (typ *AuthDomainConfig) UnmarshalJSON(data []byte) error {
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "failed to unmarshal auth domain config")
+	}
+
+	kindData, ok := raw["kind"]
+	if !ok {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "kind is required")
+	}
+
+	var kind AuthNProvider
+	if err := json.Unmarshal(kindData, &kind); err != nil {
+		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "failed to unmarshal kind")
+	}
+
+	specData, ok := raw["spec"]
+	if !ok {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "spec is required")
+	}
+
+	for _, variant := range authDomainConfigVariants {
+		if variant.kind != kind {
+			continue
+		}
+
+		spec, err := variant.decodeSpec(specData)
+		if err != nil {
+			return err
+		}
+
+		typ.Kind = kind
+		typ.Spec = spec
+		return nil
+	}
+
+	return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "invalid authn provider %q", kind.StringValue())
+}
+
+func (config AuthDomainConfig) SamlConfig() (SamlConfig, error) {
+	spec, ok := config.Spec.(SamlConfig)
+	if !ok {
+		return SamlConfig{}, errors.Newf(errors.TypeInternal, ErrCodeAuthDomainMismatch, "auth domain config is not saml")
+	}
+
+	return spec, nil
+}
+
+func (config AuthDomainConfig) GoogleConfig() (GoogleConfig, error) {
+	spec, ok := config.Spec.(GoogleConfig)
+	if !ok {
+		return GoogleConfig{}, errors.Newf(errors.TypeInternal, ErrCodeAuthDomainMismatch, "auth domain config is not google")
+	}
+
+	return spec, nil
+}
+
+func (config AuthDomainConfig) OIDCConfig() (OIDCConfig, error) {
+	spec, ok := config.Spec.(OIDCConfig)
+	if !ok {
+		return OIDCConfig{}, errors.Newf(errors.TypeInternal, ErrCodeAuthDomainMismatch, "auth domain config is not oidc")
+	}
+
+	return spec, nil
+}
+
+func (typ *AuthDomain) StorableAuthDomain() *StorableAuthDomain {
+	return typ.storableAuthDomain
+}
+
+func (typ *AuthDomain) Enabled() bool {
+	return typ.storableAuthDomainConfig.Enabled
+}
+
+func (typ *AuthDomain) Kind() AuthNProvider {
+	return typ.storableAuthDomainConfig.Config.Kind
+}
+
+func (typ *AuthDomain) Config() AuthDomainConfig {
+	return typ.storableAuthDomainConfig.Config
+}
+
+func (typ *AuthDomain) RoleMapping() *RoleMapping {
+	return typ.storableAuthDomainConfig.RoleMapping
+}
+
+func (typ *AuthDomain) Update(updatableAuthDomain *UpdatableAuthDomain) error {
+	storableAuthDomainConfig := &StorableAuthDomainConfig{
+		Enabled:     updatableAuthDomain.Enabled,
+		Config:      updatableAuthDomain.Config,
+		RoleMapping: updatableAuthDomain.RoleMapping,
+	}
+
+	data, err := json.Marshal(storableAuthDomainConfig)
+	if err != nil {
+		return err
+	}
+
+	typ.storableAuthDomainConfig = storableAuthDomainConfig
+	typ.storableAuthDomain.Data = string(data)
+	typ.storableAuthDomain.UpdatedAt = time.Now()
+	return nil
+}
+
+// rejectForeignSpecFields rejects a request whose config.spec carries fields the
+// declared kind does not define. Without it a spec belonging to another provider
+// decodes as a partial config of the declared kind whenever their required
+// fields overlap — an oidc spec sent as kind google loses its issuer and points
+// the domain at Google instead of the intended provider.
+//
+// This is a request-shape check by design: stored documents keep decoding
+// leniently so a rollback can still read a document a newer binary wrote, and so
+// removing a field later does not need a migration.
+func rejectForeignSpecFields(body []byte, kind AuthNProvider) error {
+	var raw struct {
+		Config struct {
+			Spec json.RawMessage `json:"spec"`
+		} `json:"config"`
+	}
+	if err := json.Unmarshal(body, &raw); err != nil {
+		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "failed to unmarshal auth domain config")
+	}
+
+	for _, variant := range authDomainConfigVariants {
+		if variant.kind != kind {
+			continue
+		}
+
+		if err := variant.rejectUnknownSpecFields(raw.Config.Spec); err != nil {
+			return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "invalid %q spec", kind.StringValue())
+		}
+	}
+
+	return nil
+}
+
+func (typ *PostableAuthDomain) UnmarshalJSON(data []byte) error {
+	type Alias PostableAuthDomain
+
+	var temp Alias
+	if err := json.Unmarshal(data, &temp); err != nil {
+		return err
+	}
+
+	if !authDomainNameRegex.MatchString(temp.Name) {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidName, "invalid domain name %s", temp.Name)
+	}
+
+	// A present config always carries a kind (its UnmarshalJSON rejects
+	// anything else), so a zero kind means the key was absent.
+	if temp.Config.Kind.IsZero() {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "config is required")
+	}
+
+	if err := rejectForeignSpecFields(data, temp.Config.Kind); err != nil {
+		return err
+	}
+
+	*typ = PostableAuthDomain(temp)
+	return nil
+}
+
+func (typ *UpdatableAuthDomain) UnmarshalJSON(data []byte) error {
+	type Alias UpdatableAuthDomain
+
+	var temp Alias
+	if err := json.Unmarshal(data, &temp); err != nil {
+		return err
+	}
+
+	// A present config always carries a kind (its UnmarshalJSON rejects
+	// anything else), so a zero kind means the key was absent.
+	if temp.Config.Kind.IsZero() {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "config is required")
+	}
+
+	if err := rejectForeignSpecFields(data, temp.Config.Kind); err != nil {
+		return err
+	}
+
+	*typ = UpdatableAuthDomain(temp)
+	return nil
+}
--- a/pkg/types/authtypes/domain_test.go
+++ b/pkg/types/authtypes/domain_test.go
@@ -0,0 +1,109 @@
+package authtypes
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPostableAuthDomainSpecFields(t *testing.T) {
+	testCases := []struct {
+		name          string
+		body          string
+		expectedError bool
+	}{
+		{
+			name:          "SAMLSpec",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"saml","spec":{"entityId":"e","location":"l","certificate":"c"}}}`,
+			expectedError: false,
+		},
+		{
+			name:          "SAMLSpecWithAttributeMapping",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"saml","spec":{"entityId":"e","location":"l","certificate":"c","insecureSkipAuthNRequestsSigned":true,"attributeMapping":{"email":"mail"}}}}`,
+			expectedError: false,
+		},
+		{
+			name:          "GoogleSpec",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"google","spec":{"clientId":"c","clientSecret":"s","insecureSkipEmailVerified":false}}}`,
+			expectedError: false,
+		},
+		{
+			name:          "GoogleSpecWithWorkspaceGroups",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"google","spec":{"clientId":"c","clientSecret":"s","fetchGroups":true,"serviceAccountJson":"{}","domainToAdminEmail":{"*":"admin@a.test"},"fetchTransitiveGroupMembership":true,"allowedGroups":["g@a.test"]}}}`,
+			expectedError: false,
+		},
+		{
+			name:          "OIDCSpec",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"oidc","spec":{"issuer":"https://issuer.a.test","clientId":"c","clientSecret":"s"}}}`,
+			expectedError: false,
+		},
+		{
+			// clientId and clientSecret are google's only required fields, so an
+			// oidc spec satisfies them and would otherwise be accepted with its
+			// issuer silently dropped.
+			name:          "OIDCSpecUnderGoogleKind",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"google","spec":{"issuer":"https://issuer.a.test","clientId":"c","clientSecret":"s","claimMapping":{"email":"mail"}}}}`,
+			expectedError: true,
+		},
+		{
+			name:          "GoogleSpecUnderOIDCKind",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"oidc","spec":{"issuer":"https://issuer.a.test","clientId":"c","clientSecret":"s","fetchGroups":true}}}`,
+			expectedError: true,
+		},
+		{
+			name:          "SAMLSpecUnderGoogleKind",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"google","spec":{"clientId":"c","clientSecret":"s","entityId":"e"}}}`,
+			expectedError: true,
+		},
+		{
+			name:          "UnrecognizedFieldInGoogleSpec",
+			body:          `{"name":"a.test","enabled":true,"config":{"kind":"google","spec":{"clientId":"c","clientSecret":"s","redirectURI":"https://a.test/cb"}}}`,
+			expectedError: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			postable := new(PostableAuthDomain)
+			err := json.Unmarshal([]byte(testCase.body), postable)
+
+			if testCase.expectedError {
+				assert.Error(t, err)
+				return
+			}
+
+			assert.NoError(t, err)
+		})
+	}
+}
+
+// The enforcement toggle and the edit modal both PUT a full replacement, so the
+// update body needs the same check as the create body.
+func TestUpdatableAuthDomainSpecFields(t *testing.T) {
+	updatable := new(UpdatableAuthDomain)
+	err := json.Unmarshal([]byte(`{"enabled":true,"config":{"kind":"google","spec":{"issuer":"https://issuer.a.test","clientId":"c","clientSecret":"s"}}}`), updatable)
+	assert.Error(t, err)
+
+	updatable = new(UpdatableAuthDomain)
+	err = json.Unmarshal([]byte(`{"enabled":true,"config":{"kind":"google","spec":{"clientId":"c","clientSecret":"s"}}}`), updatable)
+	assert.NoError(t, err)
+}
+
+// Reads stay lenient on purpose: a document written by a newer binary has to keep
+// loading after a rollback, and dropping a field must not need a migration.
+func TestNewAuthDomainFromStorableAuthDomainKeepsUnknownSpecFields(t *testing.T) {
+	storable := &StorableAuthDomain{
+		Data: `{"enabled":true,"config":{"kind":"google","spec":{"clientId":"c","clientSecret":"s","fieldFromANewerVersion":"x"}}}`,
+	}
+
+	authDomain, err := NewAuthDomainFromStorableAuthDomain(storable)
+	require.NoError(t, err)
+
+	google, err := authDomain.Config().GoogleConfig()
+	require.NoError(t, err)
+
+	assert.Equal(t, AuthNProviderGoogle, authDomain.Kind())
+	assert.Equal(t, "c", google.ClientID)
+}
--- a/pkg/types/authtypes/google.go
+++ b/pkg/types/authtypes/google.go
@@ -12,13 +12,10 @@ const wildCardDomain = "*"

 type GoogleConfig struct {
 	// ClientID is the application's ID. For example, 292085223830.apps.googleusercontent.com.
-	ClientID string `json:"clientId"`
+	ClientID string `json:"clientId" required:"true"`

 	// It is the application's secret.
-	ClientSecret string `json:"clientSecret"`
-
-	// What is the meaning of this? Should we remove this?
-	RedirectURI string `json:"redirectURI"`
+	ClientSecret string `json:"clientSecret" required:"true" format:"password"`

 	// Whether to fetch the Google workspace groups (required additional API scopes)
 	FetchGroups bool `json:"fetchGroups"`
@@ -26,7 +23,7 @@ type GoogleConfig struct {
 	// Service Account creds JSON stored for Google Admin SDK access
 	// This is content of the JSON file stored directly into db as string
 	// Required if FetchGroups is true (unless running on GCE with default credentials)
-	ServiceAccountJSON string `json:"serviceAccountJson,omitempty"`
+	ServiceAccountJSON string `json:"serviceAccountJson,omitempty" format:"password"`

 	// Map of workspace domain to admin email for service account impersonation
 	// The service account will impersonate this admin to call the directory API
--- a/pkg/types/authtypes/oidc.go
+++ b/pkg/types/authtypes/oidc.go
@@ -8,7 +8,7 @@ import (

 type OIDCConfig struct {
 	// It is the URL identifier for the service. For example: "https://accounts.google.com" or "https://login.salesforce.com".
-	Issuer string `json:"issuer"`
+	Issuer string `json:"issuer" required:"true"`

 	// Some offspec providers like Azure, Oracle IDCS have oidc discovery url different from issuer url which causes issuerValidation to fail
 	// This provides a way to override the Issuer url from the .well-known/openid-configuration issuer
@@ -16,10 +16,10 @@ type OIDCConfig struct {
 	IssuerAlias string `json:"issuerAlias"`

 	// It is the application's ID.
-	ClientID string `json:"clientId"`
+	ClientID string `json:"clientId" required:"true"`

 	// It is the application's secret.
-	ClientSecret string `json:"clientSecret"`
+	ClientSecret string `json:"clientSecret" required:"true" format:"password"`

 	// Mapping of claims to the corresponding fields in the token.
 	ClaimMapping AttributeMapping `json:"claimMapping"`
--- a/pkg/types/authtypes/saml.go
+++ b/pkg/types/authtypes/saml.go
@@ -7,14 +7,14 @@ import (
 )

 type SamlConfig struct {
-	// The entityID of the SAML identity provider. It can typically be found in the EntityID attribute of the EntityDescriptor element in the SAML metadata of the identity provider. Example: <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{samlEntity}">
-	SamlEntity string `json:"samlEntity"`
+	// The entityID of the SAML identity provider. It can typically be found in the EntityID attribute of the EntityDescriptor element in the SAML metadata of the identity provider. Example: <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entityId}">
+	EntityID string `json:"entityId" required:"true"`

-	// The SSO endpoint of the SAML identity provider. It can typically be found in the SingleSignOnService element in the SAML metadata of the identity provider. Example: <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="{samlIdp}"/>
-	SamlIdp string `json:"samlIdp"`
+	// The SSO endpoint of the SAML identity provider. It can typically be found in the Location attribute of the SingleSignOnService element in the SAML metadata of the identity provider. Example: <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="{location}"/>
+	Location string `json:"location" required:"true"`

-	// The certificate of the SAML identity provider. It can typically be found in the X509Certificate element in the SAML metadata of the identity provider. Example: <ds:X509Certificate><ds:X509Certificate>{samlCert}</ds:X509Certificate></ds:X509Certificate>
-	SamlCert string `json:"samlCert"`
+	// The certificate of the SAML identity provider. It can typically be found in the X509Certificate element in the SAML metadata of the identity provider. Example: <ds:X509Certificate><ds:X509Certificate>{certificate}</ds:X509Certificate></ds:X509Certificate>
+	Certificate string `json:"certificate" required:"true"`

 	// Whether to skip signing the SAML requests. It can typically be found in the WantAuthnRequestsSigned attribute of the IDPSSODescriptor element in the SAML metadata of the identity provider. Example: <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 	// For providers like jumpcloud, this should be set to true.
@@ -33,24 +33,34 @@ func (config *SamlConfig) UnmarshalJSON(data []byte) error {
 		return err
 	}

-	if temp.SamlEntity == "" {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "samlEntity is required")
+	samlConfig := SamlConfig(temp)
+	if err := samlConfig.validate(); err != nil {
+		return err
 	}

-	if temp.SamlIdp == "" {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "samlIdp is required")
+	*config = samlConfig
+	return nil
+}
+
+// validate also assigns the default attribute mapping when none is present.
+func (config *SamlConfig) validate() error {
+	if config.EntityID == "" {
+		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "entityId is required")
 	}

-	if temp.SamlCert == "" {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "samlCert is required")
+	if config.Location == "" {
+		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "location is required")
 	}

-	if temp.AttributeMapping == (AttributeMapping{}) {
-		if err := json.Unmarshal([]byte("{}"), &temp.AttributeMapping); err != nil {
+	if config.Certificate == "" {
+		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "certificate is required")
+	}
+
+	if config.AttributeMapping == (AttributeMapping{}) {
+		if err := json.Unmarshal([]byte("{}"), &config.AttributeMapping); err != nil {
 			return err
 		}
 	}

-	*config = SamlConfig(temp)
 	return nil
 }
--- a/pkg/types/cloudintegrationtypes/serviceid.go
+++ b/pkg/types/cloudintegrationtypes/serviceid.go
@@ -46,7 +46,6 @@ var (
 	GCPServiceComputeEngine    = ServiceID{valuer.NewString("computeengine")}
 	GCPServiceGKE              = ServiceID{valuer.NewString("gke")}
 	GCPServiceCloudStorage     = ServiceID{valuer.NewString("cloudstorage")}
-	GCPServiceCloudSQLMySQL    = ServiceID{valuer.NewString("cloudsql_mysql")}
 )

 func (ServiceID) Enum() []any {
@@ -83,7 +82,6 @@ func (ServiceID) Enum() []any {
 		GCPServiceComputeEngine,
 		GCPServiceGKE,
 		GCPServiceCloudStorage,
-		GCPServiceCloudSQLMySQL,
 	}
 }

@@ -126,7 +124,6 @@ var SupportedServices = map[CloudProviderType][]ServiceID{
 		GCPServiceComputeEngine,
 		GCPServiceGKE,
 		GCPServiceCloudStorage,
-		GCPServiceCloudSQLMySQL,
 	},
 }

--- a/pkg/types/dashboardtypes/dashboard.go
+++ b/pkg/types/dashboardtypes/dashboard.go
@@ -201,18 +201,6 @@ func (storableDashboardData *StorableDashboardData) GetWidgetIds() []string {
 	return widgetIds
 }

-// ErrIfNotDeletable gates deletion on the columns alone, never on Data, so a
-// dashboard whose data is corrupt or stuck on the v1 schema stays deletable.
-func (storable StorableDashboard) ErrIfNotDeletable() error {
-	if storable.Locked {
-		return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "cannot delete a locked dashboard, please unlock the dashboard to delete")
-	}
-	if !storable.Source.isUserDeletable() {
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be deleted", storable.Source)
-	}
-	return nil
-}
-
 func (dashboard *Dashboard) ErrIfNotMutable() error {
 	if dashboard.Source == SourceIntegration {
 		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "integration dashboards cannot be modified")
--- a/pkg/types/dashboardtypes/dashboard_test.go
+++ b/pkg/types/dashboardtypes/dashboard_test.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"testing"

-	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/stretchr/testify/assert"
 )
@@ -82,64 +81,3 @@ func TestCanUpdate_MultipleDeletions_ByDiff(t *testing.T) {
 		})
 	}
 }
-
-func TestStorableDashboardErrIfNotDeletable(t *testing.T) {
-	testCases := []struct {
-		subtestName     string
-		locked          bool
-		source          Source
-		data            StorableDashboardData
-		expectDeletable bool
-	}{
-		{
-			subtestName:     "user dashboard on the v2 schema",
-			source:          SourceUser,
-			data:            StorableDashboardData{"metadata": map[string]any{"schemaVersion": SchemaVersion}},
-			expectDeletable: true,
-		},
-		{
-			subtestName:     "user dashboard still on the v1 schema",
-			source:          SourceUser,
-			data:            StorableDashboardData{"widgets": makeTestWidgets("a")},
-			expectDeletable: true,
-		},
-		{
-			subtestName:     "user dashboard with unreadable data",
-			source:          SourceUser,
-			data:            StorableDashboardData{"metadata": "not-an-object"},
-			expectDeletable: true,
-		},
-		{
-			subtestName:     "locked user dashboard",
-			locked:          true,
-			source:          SourceUser,
-			data:            StorableDashboardData{"widgets": makeTestWidgets("a")},
-			expectDeletable: false,
-		},
-		{
-			subtestName:     "system dashboard",
-			source:          SourceSystem,
-			data:            StorableDashboardData{"widgets": makeTestWidgets("a")},
-			expectDeletable: false,
-		},
-		{
-			subtestName:     "integration dashboard",
-			source:          SourceIntegration,
-			data:            StorableDashboardData{"widgets": makeTestWidgets("a")},
-			expectDeletable: false,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.subtestName, func(t *testing.T) {
-			storable := StorableDashboard{
-				Identifiable: types.Identifiable{ID: valuer.GenerateUUID()},
-				OrgID:        valuer.GenerateUUID(),
-				Locked:       tc.locked,
-				Source:       tc.source,
-				Data:         tc.data,
-			}
-			assert.Equal(t, tc.expectDeletable, storable.ErrIfNotDeletable() == nil)
-		})
-	}
-}
--- a/pkg/types/dashboardtypes/perses_dashboard.go
+++ b/pkg/types/dashboardtypes/perses_dashboard.go
@@ -129,6 +129,16 @@ func (d *DashboardV2) LockUnlock(lock bool, isAdmin bool, updatedBy string) erro
 	return nil
 }

+func (d *DashboardV2) ErrIfNotDeletable() error {
+	if d.Locked {
+		return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "cannot delete a locked dashboard, please unlock the dashboard to delete")
+	}
+	if !d.Source.isUserDeletable() {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be deleted", d.Source)
+	}
+	return nil
+}
+
 func (d *DashboardV2) ErrIfNotClonable() error {
 	if !d.Source.isClonable() {
 		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be cloned", d.Source)
--- a/pkg/types/telemetrytypes/logical_field.go
+++ b/pkg/types/telemetrytypes/logical_field.go
@@ -1,78 +0,0 @@
-package telemetrytypes
-
-import "strings"
-
-// LogicalField is one queryable field. Its Name is the spelling that the
-// request used. Its Members are the physical keys that store the field.
-// LogicalField is the output type of name resolution: resolution changes a
-// referenced name into logical fields, and compilers make SQL from them.
-//
-// A []*LogicalField shows ambiguity. Ambiguity means that possibly different
-// fields have the same name. Each logical field in the slice gets its own
-// condition. The operator tells the compiler how to connect the conditions.
-//
-// One LogicalField with more than one member shows a semantic-convention
-// family. A family is one field that has more than one spelling. The members
-// are in current-first order. The compiler merges the members into one
-// expression, and the current name wins.
-//
-// Members always has one entry or more. A field that is not a family has
-// exactly one member. The members point to the metadata map entries. Do not
-// change the members.
-type LogicalField struct {
-	// Name is the spelling that the request used. Aliases, series labels,
-	// and warnings use this spelling. Because of this, the response shows
-	// the same spelling as the request.
-	Name string
-
-	// Signal, FieldContext, and FieldDataType are the identity that all
-	// members share. Members with a different signal, field context, or
-	// data type are parts of different logical fields.
-	Signal        Signal
-	FieldContext  FieldContext
-	FieldDataType FieldDataType
-
-	// Members are the physical keys that store this field, in current-first
-	// order. Each member has its own physical data (Materialized,
-	// Evolutions, JSONPlan, ...). A per-member accessor does not need data
-	// from the other members.
-	Members []*TelemetryFieldKey
-}
-
-// SingleLogicalField makes a logical field that has one physical key.
-func SingleLogicalField(name string, key *TelemetryFieldKey) *LogicalField {
-	return &LogicalField{
-		Name:          name,
-		Signal:        key.Signal,
-		FieldContext:  key.FieldContext,
-		FieldDataType: key.FieldDataType,
-		Members:       []*TelemetryFieldKey{key},
-	}
-}
-
-// Single returns the only member of a single-member field. A decision that
-// uses only the shared identity can also use Single on a family. This is
-// safe because all members have the same signal, context, and data type.
-func (l *LogicalField) Single() *TelemetryFieldKey {
-	return l.Members[0]
-}
-
-// IsFamily returns true when the field has more than one physical member.
-func (l *LogicalField) IsFamily() bool {
-	return len(l.Members) > 1
-}
-
-// String implements fmt.Stringer. A single-member field prints as its
-// member. Because of this, a message made from the field and a message made
-// from the key are the same. A family prints its shared identity and its
-// member spellings.
-func (l *LogicalField) String() string {
-	if len(l.Members) == 1 {
-		return l.Members[0].String()
-	}
-	names := make([]string, 0, len(l.Members))
-	for _, member := range l.Members {
-		names = append(names, member.Name)
-	}
-	return l.Name + "(" + l.FieldContext.StringValue() + ", " + l.FieldDataType.StringValue() + ", members: " + strings.Join(names, ", ") + ")"
-}
--- a/pkg/types/telemetrytypes/logical_field_test.go
+++ b/pkg/types/telemetrytypes/logical_field_test.go
@@ -1,50 +0,0 @@
-package telemetrytypes
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestSingleLogicalFieldSharesIdentityAndAliasesKey(t *testing.T) {
-	key := &TelemetryFieldKey{
-		Name:          "service.name",
-		Signal:        SignalTraces,
-		FieldContext:  FieldContextResource,
-		FieldDataType: FieldDataTypeString,
-	}
-
-	logical := SingleLogicalField("resource.service.name", key)
-
-	assert.Equal(t, "resource.service.name", logical.Name, "the identity is the spelling that the request used, not the stored spelling")
-	assert.Equal(t, key.Signal, logical.Signal)
-	assert.Equal(t, key.FieldContext, logical.FieldContext)
-	assert.Equal(t, key.FieldDataType, logical.FieldDataType)
-	assert.False(t, logical.IsFamily())
-	assert.Same(t, key, logical.Single(), "the member points to the key; there is no copy")
-}
-
-func TestStringDelegatesForSingleMember(t *testing.T) {
-	key := &TelemetryFieldKey{
-		Name:          "service.name",
-		FieldContext:  FieldContextResource,
-		FieldDataType: FieldDataTypeString,
-	}
-	assert.Equal(t, key.String(), SingleLogicalField(key.Name, key).String(),
-		"a message made from a single-member field must be the same as a message made from the key")
-}
-
-func TestStringListsFamilyMembers(t *testing.T) {
-	logical := &LogicalField{
-		Name:          "deployment.environment.name",
-		Signal:        SignalTraces,
-		FieldContext:  FieldContextResource,
-		FieldDataType: FieldDataTypeString,
-		Members: []*TelemetryFieldKey{
-			{Name: "deployment.environment.name"},
-			{Name: "deployment.environment"},
-		},
-	}
-	assert.True(t, logical.IsFamily())
-	assert.Equal(t, "deployment.environment.name(resource, string, members: deployment.environment.name, deployment.environment)", logical.String())
-}
--- a/tests/e2e/helpers/sso.ts
+++ b/tests/e2e/helpers/sso.ts
@@ -0,0 +1,188 @@
+import { expect, type Locator, type Page } from '@playwright/test';
+
+import { authToken } from './common';
+
+// ─── Constants ───────────────────────────────────────────────────────────
+
+export const ORG_SETTINGS_PATH = '/settings/org-settings';
+
+// ─── Types ─────────────────────────────────────────────────────────────────
+
+export interface GoogleAuthDomainSeed {
+	/** Domain name (e.g. `sso-edit.example.com`). Keep unique per test. */
+	name: string;
+	/** Enforce-SSO flag. Defaults to false. */
+	enabled?: boolean;
+	clientId?: string;
+	clientSecret?: string;
+	/**
+	 * Enables Google Workspace group fetching. The backend then requires
+	 * `serviceAccountJson` and `domainToAdminEmail`, and only with it may
+	 * `allowedGroups` be set.
+	 */
+	fetchGroups?: boolean;
+	serviceAccountJson?: string;
+	domainToAdminEmail?: Record<string, string>;
+	allowedGroups?: string[];
+	roleMapping?: {
+		defaultRole?: string;
+		groupMappings?: Record<string, string>;
+		useRoleAttribute?: boolean;
+	};
+}
+
+// ─── API helpers ─────────────────────────────────────────────────────────
+
+/**
+ * Seed a Google auth domain via POST /api/v2/auth_domains. Returns the new
+ * domain ID. Pair with {@link deleteAuthDomainByNameViaApi} for cleanup.
+ */
+export async function createGoogleAuthDomainViaApi(
+	page: Page,
+	seed: GoogleAuthDomainSeed,
+): Promise<string> {
+	const token = await authToken(page);
+
+	const spec: Record<string, unknown> = {
+		clientId: seed.clientId ?? 'e2e-client-id.apps.googleusercontent.com',
+		clientSecret: seed.clientSecret ?? 'e2e-client-secret',
+		fetchGroups: seed.fetchGroups ?? false,
+		insecureSkipEmailVerified: false,
+	};
+	if (seed.serviceAccountJson) {
+		spec.serviceAccountJson = seed.serviceAccountJson;
+	}
+	if (seed.domainToAdminEmail) {
+		spec.domainToAdminEmail = seed.domainToAdminEmail;
+	}
+	if (seed.allowedGroups) {
+		spec.allowedGroups = seed.allowedGroups;
+	}
+
+	const res = await page.request.post('/api/v2/auth_domains', {
+		data: {
+			name: seed.name,
+			enabled: seed.enabled ?? false,
+			config: { kind: 'google', spec },
+			roleMapping: seed.roleMapping,
+		},
+		headers: { Authorization: `Bearer ${token}` },
+	});
+	if (!res.ok()) {
+		throw new Error(
+			`POST /api/v2/auth_domains ${res.status()}: ${await res.text()}`,
+		);
+	}
+	const json = (await res.json()) as { data: { id: string } };
+	return json.data.id;
+}
+
+/** Names of every auth domain in the org, across all list pages. */
+export async function listAuthDomainNamesViaApi(page: Page): Promise<string[]> {
+	const token = await authToken(page);
+	const res = await page.request.get('/api/v2/auth_domains', {
+		headers: { Authorization: `Bearer ${token}` },
+	});
+	if (!res.ok()) {
+		throw new Error(
+			`GET /api/v2/auth_domains ${res.status()}: ${await res.text()}`,
+		);
+	}
+	const json = (await res.json()) as {
+		data: Array<{ name: string }> | null;
+	};
+	return (json.data ?? []).map((domain) => domain.name);
+}
+
+/** Delete an auth domain by ID (best-effort cleanup). */
+export async function deleteAuthDomainViaApi(
+	page: Page,
+	id: string,
+): Promise<void> {
+	const token = await authToken(page);
+	await page.request.delete(`/api/v2/auth_domains/${id}`, {
+		headers: { Authorization: `Bearer ${token}` },
+	});
+}
+
+/**
+ * Delete any auth domain named `name`; a no-op when absent. Doubles as the
+ * leftover guard before seeding (domain names are unique per org, so a
+ * crashed earlier run would otherwise make the seed conflict).
+ */
+export async function deleteAuthDomainByNameViaApi(
+	page: Page,
+	name: string,
+): Promise<void> {
+	const token = await authToken(page);
+	const res = await page.request.get('/api/v2/auth_domains', {
+		headers: { Authorization: `Bearer ${token}` },
+	});
+	if (!res.ok()) {
+		throw new Error(
+			`GET /api/v2/auth_domains ${res.status()}: ${await res.text()}`,
+		);
+	}
+	const json = (await res.json()) as {
+		data: Array<{ id: string; name: string }> | null;
+	};
+	const match = (json.data ?? []).find((domain) => domain.name === name);
+	if (match) {
+		await deleteAuthDomainViaApi(page, match.id);
+	}
+}
+
+// ─── Navigation ────────────────────────────────────────────────────────────
+
+/** Open org settings and wait for the Authenticated Domains section. */
+export async function gotoAuthDomains(page: Page): Promise<void> {
+	await page.goto(ORG_SETTINGS_PATH);
+	await expect(page.getByTestId('auth-domain-title')).toBeVisible();
+}
+
+/**
+ * Locate the list row for `name`, advancing through the pager when needed. The
+ * table paginates, and a shared stack holds domains this suite did not seed, so
+ * a freshly created row is not necessarily on the page currently shown.
+ */
+export async function findAuthDomainRow(
+	page: Page,
+	name: string,
+): Promise<Locator> {
+	const row = page.getByTestId(`auth-domain-row-${name}`);
+	const nextPage = page.locator('.auth-domain-list .ant-pagination-next');
+
+	// Bounded: a pager that never reports itself disabled must not spin forever.
+	for (let visited = 0; visited < 25; visited += 1) {
+		try {
+			await row.waitFor({ state: 'attached', timeout: 2_000 });
+			return row;
+		} catch {
+			// Not on the page currently shown; fall through to the pager.
+		}
+
+		if (
+			(await nextPage.count()) === 0 ||
+			(await nextPage.getAttribute('aria-disabled')) === 'true' ||
+			(await nextPage.evaluate((node) =>
+				node.classList.contains('ant-pagination-disabled'),
+			))
+		) {
+			break;
+		}
+
+		await nextPage.click();
+	}
+
+	throw new Error(`auth domain row not found in the list: ${name}`);
+}
+
+/** Open the Configure (edit) modal for the domain row named `name`. */
+export async function openConfigureAuthDomain(
+	page: Page,
+	name: string,
+): Promise<void> {
+	const row = await findAuthDomainRow(page, name);
+	await row.getByTestId('auth-domain-configure').click();
+	await expect(page.getByTestId('auth-domain-form')).toBeVisible();
+}
--- a/tests/e2e/tests/sso/auth-domains.spec.ts
+++ b/tests/e2e/tests/sso/auth-domains.spec.ts
@@ -0,0 +1,275 @@
+import { expect, test } from '../../fixtures/auth';
+import {
+	createGoogleAuthDomainViaApi,
+	deleteAuthDomainByNameViaApi,
+	findAuthDomainRow,
+	gotoAuthDomains,
+	listAuthDomainNamesViaApi,
+	openConfigureAuthDomain,
+	ORG_SETTINGS_PATH,
+} from '../../helpers/sso';
+
+// Every test seeds its own uniquely-named domain so the file can run fully
+// parallel. Names are registered here and removed by the afterEach guard;
+// the delete-by-name call before each seed clears leftovers of crashed runs.
+const cleanupNames: string[] = [];
+
+test.afterEach(async ({ authedPage: page }) => {
+	for (const name of cleanupNames.splice(0)) {
+		await deleteAuthDomainByNameViaApi(page, name);
+	}
+});
+
+test('TC-01 org settings shows the authenticated domains section', async ({
+	authedPage: page,
+}) => {
+	await page.goto(ORG_SETTINGS_PATH);
+	await expect(page.getByTestId('auth-domain-title')).toBeVisible();
+	await expect(page.getByTestId('auth-domain-add')).toBeVisible();
+});
+
+test('TC-02 create a google auth domain via the UI', async ({
+	authedPage: page,
+}) => {
+	const domain = 'sso-create.example.com';
+	cleanupNames.push(domain);
+	await deleteAuthDomainByNameViaApi(page, domain);
+
+	await gotoAuthDomains(page);
+	await page.getByTestId('auth-domain-add').click();
+	await page.getByTestId('authn-provider-configure-google').click();
+
+	await page.getByTestId('google-auth-domain').fill(domain);
+	await page
+		.getByTestId('google-auth-client-id')
+		.fill('e2e-client-id.apps.googleusercontent.com');
+	await page.getByTestId('google-auth-client-secret').fill('e2e-client-secret');
+	await page.getByTestId('auth-domain-save').click();
+
+	await expect(page.getByText('Domain created successfully')).toBeVisible();
+	const row = await findAuthDomainRow(page, domain);
+	await expect(row.getByTestId('auth-domain-configure')).toHaveText(
+		'Configure Google Auth',
+	);
+});
+
+test('TC-03 editing the client id persists across reopen', async ({
+	authedPage: page,
+}) => {
+	const domain = 'sso-edit.example.com';
+	cleanupNames.push(domain);
+	await deleteAuthDomainByNameViaApi(page, domain);
+	await createGoogleAuthDomainViaApi(page, { name: domain });
+
+	await gotoAuthDomains(page);
+	await openConfigureAuthDomain(page, domain);
+	await expect(page.getByTestId('google-auth-client-id')).toHaveValue(
+		'e2e-client-id.apps.googleusercontent.com',
+	);
+	await page
+		.getByTestId('google-auth-client-id')
+		.fill('rotated-client-id.apps.googleusercontent.com');
+	await page.getByTestId('auth-domain-save').click();
+	await expect(page.getByText('Domain updated successfully')).toBeVisible();
+	await expect(page.getByTestId('auth-domain-form')).toBeHidden();
+
+	await openConfigureAuthDomain(page, domain);
+	await expect(page.getByTestId('google-auth-client-id')).toHaveValue(
+		'rotated-client-id.apps.googleusercontent.com',
+	);
+});
+
+test('TC-04 removing a group mapping persists after save', async ({
+	authedPage: page,
+}) => {
+	const domain = 'sso-rolemap.example.com';
+	cleanupNames.push(domain);
+	await deleteAuthDomainByNameViaApi(page, domain);
+	await createGoogleAuthDomainViaApi(page, {
+		name: domain,
+		roleMapping: {
+			defaultRole: 'signoz-viewer',
+			groupMappings: {
+				engineers: 'signoz-editor',
+				support: 'signoz-viewer',
+			},
+		},
+	});
+
+	await gotoAuthDomains(page);
+	await openConfigureAuthDomain(page, domain);
+	await page.getByTestId('role-mapping-header').click();
+
+	const rows = page.getByTestId('role-mapping-row');
+	await expect(rows).toHaveCount(2);
+	// Go marshals map keys sorted, so "engineers" is always the first row.
+	await expect(rows.nth(0).getByTestId('role-mapping-group-name')).toHaveValue(
+		'engineers',
+	);
+	await rows.nth(0).getByTestId('role-mapping-remove').click();
+	await expect(rows).toHaveCount(1);
+
+	// The PUT body is the #2402 contract: the removed mapping must be gone
+	// from the payload, not just from the form state.
+	const putRequest = page.waitForRequest(
+		(req) =>
+			req.method() === 'PUT' && req.url().includes('/api/v2/auth_domains/'),
+	);
+	await page.getByTestId('auth-domain-save').click();
+	const body = JSON.parse((await putRequest).postData() ?? '{}');
+	expect(body.roleMapping?.groupMappings).toEqual({
+		support: 'signoz-viewer',
+	});
+	await expect(page.getByText('Domain updated successfully')).toBeVisible();
+	await expect(page.getByTestId('auth-domain-form')).toBeHidden();
+
+	await openConfigureAuthDomain(page, domain);
+	await page.getByTestId('role-mapping-header').click();
+	await expect(rows).toHaveCount(1);
+	await expect(rows.getByTestId('role-mapping-group-name')).toHaveValue(
+		'support',
+	);
+});
+
+test('TC-05 disabling fetch groups clears the allowed groups', async ({
+	authedPage: page,
+}) => {
+	const domain = 'sso-groups.example.com';
+	cleanupNames.push(domain);
+	await deleteAuthDomainByNameViaApi(page, domain);
+	await createGoogleAuthDomainViaApi(page, {
+		name: domain,
+		fetchGroups: true,
+		serviceAccountJson: '{"type":"service_account","project_id":"e2e"}',
+		domainToAdminEmail: { '*': 'admin@sso-groups.example.com' },
+		allowedGroups: ['engineering@sso-groups.example.com'],
+	});
+
+	await gotoAuthDomains(page);
+	await openConfigureAuthDomain(page, domain);
+	await page.getByTestId('google-auth-workspace-groups-header').click();
+
+	const fetchGroups = page
+		.getByTestId('google-auth-fetch-groups')
+		.getByRole('checkbox');
+	await expect(fetchGroups).toBeChecked();
+	await expect(
+		page
+			.getByTestId('google-auth-allowed-groups')
+			.locator('.ant-select-selection-item'),
+	).toHaveCount(1);
+	await fetchGroups.click();
+	await expect(fetchGroups).not.toBeChecked();
+
+	// The PUT body is the #2402 contract: with fetchGroups off, the payload
+	// must drop allowedGroups instead of resending the stale list.
+	const putRequest = page.waitForRequest(
+		(req) =>
+			req.method() === 'PUT' && req.url().includes('/api/v2/auth_domains/'),
+	);
+	await page.getByTestId('auth-domain-save').click();
+	const spec = JSON.parse((await putRequest).postData() ?? '{}').config?.spec;
+	expect(spec?.fetchGroups).toBeFalsy();
+	expect(spec?.allowedGroups).toBeUndefined();
+	expect(spec?.domainToAdminEmail).toEqual({});
+	await expect(page.getByText('Domain updated successfully')).toBeVisible();
+	await expect(page.getByTestId('auth-domain-form')).toBeHidden();
+
+	await openConfigureAuthDomain(page, domain);
+	await page.getByTestId('google-auth-workspace-groups-header').click();
+	await expect(fetchGroups).not.toBeChecked();
+	// Re-enable to reveal the group fields: the allowed-groups list must be
+	// empty, not repopulated from the pre-disable state.
+	await fetchGroups.click();
+	await expect(
+		page
+			.getByTestId('google-auth-allowed-groups')
+			.locator('.ant-select-selection-item'),
+	).toHaveCount(0);
+});
+
+test('TC-06 enforce sso toggle persists across reload', async ({
+	authedPage: page,
+}) => {
+	const domain = 'sso-toggle.example.com';
+	cleanupNames.push(domain);
+	await deleteAuthDomainByNameViaApi(page, domain);
+	await createGoogleAuthDomainViaApi(page, { name: domain, enabled: false });
+
+	await gotoAuthDomains(page);
+	const toggle = (await findAuthDomainRow(page, domain)).getByTestId(
+		'auth-domain-enforce-sso',
+	);
+	await expect(toggle).not.toBeChecked();
+
+	const putResponse = page.waitForResponse(
+		(res) =>
+			res.request().method() === 'PUT' &&
+			res.url().includes('/api/v2/auth_domains/'),
+	);
+	await toggle.click();
+	expect((await putResponse).status()).toBe(204);
+
+	await page.reload();
+	const reloadedRow = await findAuthDomainRow(page, domain);
+	await expect(reloadedRow.getByTestId('auth-domain-enforce-sso')).toBeChecked();
+});
+
+test('TC-07 delete a domain via the UI', async ({ authedPage: page }) => {
+	const domain = 'sso-delete.example.com';
+	cleanupNames.push(domain);
+	await deleteAuthDomainByNameViaApi(page, domain);
+	await createGoogleAuthDomainViaApi(page, { name: domain });
+
+	await gotoAuthDomains(page);
+	const row = await findAuthDomainRow(page, domain);
+	await row.getByTestId('auth-domain-delete').click();
+	await page.getByTestId('auth-domain-delete-confirm').click();
+
+	await expect(page.getByText('Domain deleted successfully')).toBeVisible();
+	// Asserted against the list rather than the rendered page: an absent row
+	// proves nothing while the table paginates.
+	expect(await listAuthDomainNamesViaApi(page)).not.toContain(domain);
+});
+
+test('TC-08 enforce sso toggle preserves the role mapping', async ({
+	authedPage: page,
+}) => {
+	const domain = 'sso-toggle-rolemap.example.com';
+	cleanupNames.push(domain);
+	await deleteAuthDomainByNameViaApi(page, domain);
+	await createGoogleAuthDomainViaApi(page, {
+		name: domain,
+		enabled: false,
+		roleMapping: {
+			defaultRole: 'signoz-editor',
+			groupMappings: { engineers: 'signoz-editor', support: 'signoz-viewer' },
+		},
+	});
+
+	await gotoAuthDomains(page);
+
+	// The toggle PUTs a full replacement, so a role mapping it fails to echo
+	// back is silently dropped.
+	const putResponse = page.waitForResponse(
+		(res) =>
+			res.request().method() === 'PUT' &&
+			res.url().includes('/api/v2/auth_domains/'),
+	);
+	const row = await findAuthDomainRow(page, domain);
+	await row.getByTestId('auth-domain-enforce-sso').click();
+	expect((await putResponse).status()).toBe(204);
+
+	await page.reload();
+	await openConfigureAuthDomain(page, domain);
+	await page.getByTestId('role-mapping-header').click();
+
+	const rows = page.getByTestId('role-mapping-row');
+	await expect(rows).toHaveCount(2);
+	await expect(rows.nth(0).getByTestId('role-mapping-group-name')).toHaveValue(
+		'engineers',
+	);
+	await expect(rows.nth(1).getByTestId('role-mapping-group-name')).toHaveValue(
+		'support',
+	);
+});
--- a/tests/fixtures/cloudintegrations.py
+++ b/tests/fixtures/cloudintegrations.py
@@ -26,14 +26,14 @@ class ProviderAccountSpec:
    provider: str
    # params for the account created by default.
    initial_params: dict
+    # params for the config an update (PUT) test sends.
+    updated_params: dict
    # params -> the provider-keyed `config` block for a POST/PUT body.
    build_config: Callable[[dict], dict]
    # params -> the full config block the API is expected to return under
    # config[provider] on GET/list. This may differ from what build_config sends:
    # e.g. AWS accepts deploymentRegion on POST but the API does not echo it back.
    expected_config: Callable[[dict], dict]
-    # only the suites that exercise updates need to supply it.
-    updated_params: dict = field(default_factory=dict)
    # id shown in parametrized test names; defaults to the provider slug.
    id: str = field(default="")

@@ -42,29 +42,6 @@ class ProviderAccountSpec:
            object.__setattr__(self, "id", self.provider)


-# Per-provider service shape.
-@dataclass(frozen=True)
-class ProviderServiceSpec:
-    provider: str
-    service_id: str
-    # GCP ships every service with supportedSignals.logs false, so a logs block
-    # is neither required on write nor persisted.
-    supports_logs: bool
-    account_config: dict
-    # id shown in parametrized test names; defaults to the provider slug.
-    id: str = field(default="")
-
-    def __post_init__(self) -> None:
-        if not self.id:
-            object.__setattr__(self, "id", self.provider)
-
-    def build_service_config(self, metrics_enabled: bool, logs_enabled: bool | None = None) -> dict:
-        config: dict = {"metrics": {"enabled": metrics_enabled}}
-        if self.supports_logs:
-            config["logs"] = {"enabled": metrics_enabled if logs_enabled is None else logs_enabled}
-        return {self.provider: config}
-
-
@pytest.fixture(scope="function")
 def deprecated_create_cloud_integration_account(
    request: pytest.FixtureRequest,
--- a/tests/fixtures/googleidp.py
+++ b/tests/fixtures/googleidp.py
@@ -74,7 +74,7 @@ def perform_google_login(

 def get_google_domain(signoz: types.SigNoz, admin_token: str) -> dict:
    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=2,
    )
--- a/tests/fixtures/idp.py
+++ b/tests/fixtures/idp.py
@@ -624,7 +624,7 @@ def _ensure_groups_client_scope(client: KeycloakAdmin) -> None:

 def get_oidc_domain(signoz: types.SigNoz, admin_token: str) -> dict:
    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=2,
    )
@@ -665,7 +665,7 @@ def perform_oidc_login(

 def get_saml_domain(signoz: types.SigNoz, admin_token: str) -> dict:
    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=2,
    )
--- a/tests/integration/testdata/filter_expressions_10000.txt
+++ b/tests/integration/testdata/filter_expressions_10000.txt
--- a/tests/integration/tests/basepath/01_oidc.py
+++ b/tests/integration/tests/basepath/01_oidc.py
@@ -50,13 +50,13 @@ def test_create_auth_domain(
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

    response = requests.post(
-        signoz.self.host_configs["8080"].get("/signoz/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/signoz/api/v2/auth_domains"),
        json={
            "name": "oidc.basepath.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "oidc",
-                "oidcConfig": {
+                "kind": "oidc",
+                "spec": {
                    "clientId": settings["client_id"],
                    "clientSecret": settings["client_secret"],
                    # Change the hostname of the issuer to the internal resolvable hostname of the idp
--- a/tests/integration/tests/basepath/02_saml.py
+++ b/tests/integration/tests/basepath/02_saml.py
@@ -48,16 +48,16 @@ def test_create_auth_domain(
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

    response = requests.post(
-        signoz.self.host_configs["8080"].get("/signoz/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/signoz/api/v2/auth_domains"),
        json={
            "name": "saml.basepath.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": settings["entityID"],
-                    "samlIdp": settings["singleSignOnServiceLocation"],
-                    "samlCert": settings["certificate"],
+                "kind": "saml",
+                "spec": {
+                    "entityId": settings["entityID"],
+                    "location": settings["singleSignOnServiceLocation"],
+                    "certificate": settings["certificate"],
                },
            },
        },
--- a/tests/integration/tests/callbackauthn/01_domain.py
+++ b/tests/integration/tests/callbackauthn/01_domain.py
@@ -1,6 +1,7 @@
 from collections.abc import Callable
 from http import HTTPStatus

+import pytest
 import requests

 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
@@ -14,30 +15,35 @@ def test_create_and_get_domain(
 ):
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    # Get domains which should be an empty list
+    # Reruns against a reused stack find domains from previous runs; drop them
+    # all so the suite starts from a clean slate.
    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=2,
    )

    assert response.status_code == HTTPStatus.OK
    assert response.json()["status"] == "success"
-    data = response.json()["data"]
-    assert len(data) == 0
+    for domain in response.json()["data"]:
+        response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=2,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT

    # Create a domain with google auth config
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "domain-google.integration.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "google_auth",
-                "googleAuthConfig": {
+                "kind": "google",
+                "spec": {
                    "clientId": "client-id",
                    "clientSecret": "client-secret",
-                    "redirectURI": "redirect-uri",
                },
            },
        },
@@ -49,16 +55,16 @@ def test_create_and_get_domain(

    # Create a domain with saml config
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "domain-saml.integration.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                },
            },
        },
@@ -70,7 +76,7 @@ def test_create_and_get_domain(

    # List the domains
    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=2,
    )
@@ -86,7 +92,7 @@ def test_create_and_get_domain(
            "domain-google.integration.test",
            "domain-saml.integration.test",
        ]
-        assert domain["config"]["ssoType"] in ["google_auth", "saml"]
+        assert domain["config"]["kind"] in ["google", "saml"]


 def test_create_invalid(
@@ -96,15 +102,15 @@ def test_create_invalid(
 ):
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    # Create a domain with type saml and body for oidc, this should fail because oidcConfig is not allowed for saml
+    # Create a domain with kind saml and a spec for oidc, this should fail because the spec does not match the kind
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "domain.integration.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "oidcConfig": {
+                "kind": "saml",
+                "spec": {
                    "clientId": "client-id",
                    "clientSecret": "client-secret",
                    "issuer": "issuer",
@@ -117,18 +123,58 @@ def test_create_invalid(

    assert response.status_code == HTTPStatus.BAD_REQUEST

+    # The reverse direction: an oidc spec under kind google satisfies google's
+    # required clientId and clientSecret, so only the foreign issuer and
+    # claimMapping fields distinguish it.
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": "domain.integration.test",
+            "enabled": True,
+            "config": {
+                "kind": "google",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "claimMapping": {"email": "mail"},
+                },
+            },
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+
+    # Create a domain with a kind but no spec
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": "domain.integration.test",
+            "enabled": True,
+            "config": {
+                "kind": "saml",
+            },
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+
    # Create a domain with invalid name
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "$%^invalid",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                },
            },
        },
@@ -140,17 +186,17 @@ def test_create_invalid(

    # Create a domain with no name
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                },
-            }
+            },
        },
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=2,
@@ -160,7 +206,7 @@ def test_create_invalid(

    # Create a domain with no config
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "domain.integration.test",
        },
@@ -180,21 +226,21 @@ def test_create_invalid_role_mapping(

    # Create domain with invalid defaultRole
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "invalid-role-test.integration.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
-                },
-                "roleMapping": {
-                    "defaultRole": "SUPERADMIN",  # Invalid role
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                },
            },
+            "roleMapping": {
+                "defaultRole": "SUPERADMIN",  # Invalid role
+            },
        },
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=2,
@@ -204,22 +250,22 @@ def test_create_invalid_role_mapping(

    # Create domain with invalid role in groupMappings
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "invalid-group-role.integration.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "admins": "SUPERUSER",  # Invalid role
-                    },
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "admins": "SUPERUSER",  # Invalid role
                },
            },
        },
@@ -231,23 +277,23 @@ def test_create_invalid_role_mapping(

    # Valid role mapping should succeed
    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "valid-role-mapping.integration.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                    },
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
                },
            },
        },
@@ -256,3 +302,386 @@ def test_create_invalid_role_mapping(
    )

    assert response.status_code == HTTPStatus.CREATED
+
+
+@pytest.mark.parametrize(
+    ("config", "role_mapping", "expected_config", "expected_role_mapping"),
+    [
+        pytest.param(
+            {
+                "kind": "google",
+                "spec": {"clientId": "client-id", "clientSecret": "client-secret"},
+            },
+            None,
+            {
+                "kind": "google",
+                "spec": {
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "fetchGroups": False,
+                    "insecureSkipEmailVerified": False,
+                },
+            },
+            None,
+            id="google_minimal",
+        ),
+        pytest.param(
+            {
+                "kind": "google",
+                "spec": {
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "fetchGroups": True,
+                    "serviceAccountJson": '{"type": "service_account"}',
+                    "domainToAdminEmail": {
+                        "roundtrip.integration.test": "admin@roundtrip.integration.test",
+                        "*": "fallback@roundtrip.integration.test",
+                    },
+                    "fetchTransitiveGroupMembership": True,
+                    "allowedGroups": ["group-one", "group-two"],
+                    "insecureSkipEmailVerified": True,
+                },
+            },
+            None,
+            {
+                "kind": "google",
+                "spec": {
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "fetchGroups": True,
+                    "serviceAccountJson": '{"type": "service_account"}',
+                    "domainToAdminEmail": {
+                        "roundtrip.integration.test": "admin@roundtrip.integration.test",
+                        "*": "fallback@roundtrip.integration.test",
+                    },
+                    "fetchTransitiveGroupMembership": True,
+                    "allowedGroups": ["group-one", "group-two"],
+                    "insecureSkipEmailVerified": True,
+                },
+            },
+            None,
+            id="google_full",
+        ),
+        pytest.param(
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                },
+            },
+            None,
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": False,
+                    "attributeMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+                },
+            },
+            None,
+            id="saml_minimal",
+        ),
+        pytest.param(
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": True,
+                    "attributeMapping": {"email": "mail"},
+                },
+            },
+            None,
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": True,
+                    "attributeMapping": {"email": "mail", "name": "name", "groups": "groups", "role": "role"},
+                },
+            },
+            None,
+            id="saml_partial_attribute_mapping",
+        ),
+        pytest.param(
+            {
+                "kind": "oidc",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                },
+            },
+            None,
+            {
+                "kind": "oidc",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "issuerAlias": "",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "claimMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+                    "insecureSkipEmailVerified": False,
+                    "getUserInfo": False,
+                },
+            },
+            None,
+            id="oidc_minimal",
+        ),
+        pytest.param(
+            {
+                "kind": "oidc",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "issuerAlias": "https://alias.integration.test",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "claimMapping": {"email": "eml", "name": "nm", "groups": "grps", "role": "rl"},
+                    "insecureSkipEmailVerified": True,
+                    "getUserInfo": True,
+                },
+            },
+            None,
+            {
+                "kind": "oidc",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "issuerAlias": "https://alias.integration.test",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "claimMapping": {"email": "eml", "name": "nm", "groups": "grps", "role": "rl"},
+                    "insecureSkipEmailVerified": True,
+                    "getUserInfo": True,
+                },
+            },
+            None,
+            id="oidc_full",
+        ),
+        pytest.param(
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                },
+            },
+            {
+                "defaultRole": "EDITOR",
+                "groupMappings": {"platform-team": "ADMIN"},
+                "useRoleAttribute": False,
+            },
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": False,
+                    "attributeMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+                },
+            },
+            {
+                "defaultRole": "signoz-editor",
+                "groupMappings": {"platform-team": "signoz-admin"},
+                "useRoleAttribute": False,
+            },
+            id="role_mapping_names_normalized",
+        ),
+        pytest.param(
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                },
+            },
+            {"defaultRole": "VIEWER", "useRoleAttribute": True},
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": False,
+                    "attributeMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+                },
+            },
+            {"defaultRole": "signoz-viewer", "groupMappings": None, "useRoleAttribute": True},
+            id="role_mapping_null_group_mappings",
+        ),
+    ],
+)
+def test_domain_roundtrip(  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    config: dict,
+    role_mapping: dict | None,
+    expected_config: dict,
+    expected_role_mapping: dict | None,
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Drop a same-named leftover so reruns against a reused stack stay green.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    for domain in response.json()["data"]:
+        if domain["name"] == "roundtrip.integration.test":
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=2,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": "roundtrip.integration.test",
+            "enabled": True,
+            "config": config,
+            "roleMapping": role_mapping,
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.CREATED
+    domain_id = response.json()["data"]["id"]
+
+    # Clients (e.g. the terraform provider) read state back with a follow-up
+    # GET after every write, so posted values must round-trip exactly; the
+    # server-side defaulting and role-name normalization pinned here are part
+    # of that contract.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()["data"]
+
+    assert data["name"] == "roundtrip.integration.test"
+    assert data["enabled"] is True
+    assert data["config"] == expected_config
+    assert data["roleMapping"] == expected_role_mapping
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+
+def test_update_enabled(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Drop a same-named leftover so reruns against a reused stack stay green.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    for domain in response.json()["data"]:
+        if domain["name"] == "update-enabled.integration.test":
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=2,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT
+
+    role_mapping = {
+        "defaultRole": "signoz-editor",
+        "groupMappings": {"admin-group": "signoz-admin", "dev-team": "signoz-editor"},
+        "useRoleAttribute": False,
+    }
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": "update-enabled.integration.test",
+            "enabled": True,
+            "config": {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
+                },
+            },
+            "roleMapping": role_mapping,
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.CREATED
+    domain_id = response.json()["data"]["id"]
+
+    # Flipping enforcement goes through the same full update as any other
+    # change; the echoed provider config and role mapping must both survive the
+    # round trip, since the UI resends them verbatim on every toggle.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        json={
+            "enabled": False,
+            "config": {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
+                },
+            },
+            "roleMapping": role_mapping,
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()["data"]
+
+    assert data["enabled"] is False
+    assert data["config"] == {
+        "kind": "saml",
+        "spec": {
+            "entityId": "saml-entity",
+            "location": "saml-idp",
+            "certificate": "saml-cert",
+            "insecureSkipAuthNRequestsSigned": False,
+            "attributeMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+        },
+    }
+    assert data["roleMapping"] == role_mapping
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
--- a/tests/integration/tests/callbackauthn/02_saml.py
+++ b/tests/integration/tests/callbackauthn/02_saml.py
@@ -50,16 +50,16 @@ def test_create_auth_domain(
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "saml.integration.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": settings["entityID"],
-                    "samlIdp": settings["singleSignOnServiceLocation"],
-                    "samlCert": settings["certificate"],
+                "kind": "saml",
+                "spec": {
+                    "entityId": settings["entityID"],
+                    "location": settings["singleSignOnServiceLocation"],
+                    "certificate": settings["certificate"],
                },
            },
        },
@@ -71,7 +71,7 @@ def test_create_auth_domain(

    # Get the domains from signoz
    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=2,
    )
@@ -174,30 +174,30 @@ def test_saml_update_domain_with_group_mappings(

    # update the existing saml domain to have role mappings also
    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
        json={
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": settings["entityID"],
-                    "samlIdp": settings["singleSignOnServiceLocation"],
-                    "samlCert": settings["certificate"],
+                "kind": "saml",
+                "spec": {
+                    "entityId": settings["entityID"],
+                    "location": settings["singleSignOnServiceLocation"],
+                    "certificate": settings["certificate"],
                    "attributeMapping": {
                        "name": "givenName",
                        "groups": "groups",
                        "role": "signoz_role",
                    },
                },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                        "signoz-viewers": "VIEWER",
-                    },
-                    "useRoleAttribute": False,
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
+                    "signoz-viewers": "VIEWER",
                },
+                "useRoleAttribute": False,
            },
        },
        headers={"Authorization": f"Bearer {admin_token}"},
@@ -329,29 +329,29 @@ def test_saml_update_domain_with_use_role_claim(
    settings = get_saml_settings()

    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
        json={
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": settings["entityID"],
-                    "samlIdp": settings["singleSignOnServiceLocation"],
-                    "samlCert": settings["certificate"],
+                "kind": "saml",
+                "spec": {
+                    "entityId": settings["entityID"],
+                    "location": settings["singleSignOnServiceLocation"],
+                    "certificate": settings["certificate"],
                    "attributeMapping": {
                        "name": "displayName",
                        "groups": "groups",
                        "role": "signoz_role",
                    },
                },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                    },
-                    "useRoleAttribute": True,
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
                },
+                "useRoleAttribute": True,
            },
        },
        headers={"Authorization": f"Bearer {admin_token}"},
--- a/tests/integration/tests/callbackauthn/03_oidc.py
+++ b/tests/integration/tests/callbackauthn/03_oidc.py
@@ -48,13 +48,13 @@ def test_create_auth_domain(
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": "oidc.integration.test",
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "oidc",
-                "oidcConfig": {
+                "kind": "oidc",
+                "spec": {
                    "clientId": settings["client_id"],
                    "clientSecret": settings["client_secret"],
                    # Change the hostname of the issuer to the internal resolvable hostname of the idp
@@ -121,12 +121,12 @@ def test_oidc_update_domain_with_group_mappings(
    settings = get_oidc_settings(client_id)

    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
        json={
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "oidc",
-                "oidcConfig": {
+                "kind": "oidc",
+                "spec": {
                    "clientId": settings["client_id"],
                    "clientSecret": settings["client_secret"],
                    "issuer": f"{idp.container.container_configs['6060'].get(urlparse(settings['issuer']).path)}",
@@ -139,15 +139,15 @@ def test_oidc_update_domain_with_group_mappings(
                        "role": "signoz_role",
                    },
                },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                        "signoz-viewers": "VIEWER",
-                    },
-                    "useRoleAttribute": False,
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
+                    "signoz-viewers": "VIEWER",
                },
+                "useRoleAttribute": False,
            },
        },
        headers={"Authorization": f"Bearer {admin_token}"},
@@ -278,12 +278,12 @@ def test_oidc_update_domain_with_use_role_claim(
    settings = get_oidc_settings(client_id)

    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
        json={
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "oidc",
-                "oidcConfig": {
+                "kind": "oidc",
+                "spec": {
                    "clientId": settings["client_id"],
                    "clientSecret": settings["client_secret"],
                    "issuer": f"{idp.container.container_configs['6060'].get(urlparse(settings['issuer']).path)}",
@@ -296,14 +296,14 @@ def test_oidc_update_domain_with_use_role_claim(
                        "role": "signoz_role",
                    },
                },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                    },
-                    "useRoleAttribute": True,
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
                },
+                "useRoleAttribute": True,
            },
        },
        headers={"Authorization": f"Bearer {admin_token}"},
--- a/tests/integration/tests/callbackauthn/04_google.py
+++ b/tests/integration/tests/callbackauthn/04_google.py
@@ -30,20 +30,20 @@ def test_create_auth_domain(
    domain = get_google_domain(signoz, admin_token)
    if domain:
        response = requests.delete(
-            signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+            signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
            headers={"Authorization": f"Bearer {admin_token}"},
            timeout=2,
        )
        assert response.status_code == HTTPStatus.NO_CONTENT

    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
        json={
            "name": GOOGLE_DOMAIN,
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "google_auth",
-                "googleAuthConfig": {
+                "kind": "google",
+                "spec": {
                    "clientId": GOOGLE_CLIENT_ID,
                    "clientSecret": GOOGLE_CLIENT_SECRET,
                },
@@ -121,12 +121,12 @@ def test_google_authn_unverified_email(
    domain = get_google_domain(signoz, admin_token)

    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
        json={
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "google_auth",
-                "googleAuthConfig": {
+                "kind": "google",
+                "spec": {
                    "clientId": GOOGLE_CLIENT_ID,
                    "clientSecret": GOOGLE_CLIENT_SECRET,
                    "insecureSkipEmailVerified": True,
@@ -156,18 +156,18 @@ def test_google_role_mapping_default_role(
    domain = get_google_domain(signoz, admin_token)

    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
        json={
+            "enabled": True,
            "config": {
-                "ssoEnabled": True,
-                "ssoType": "google_auth",
-                "googleAuthConfig": {
+                "kind": "google",
+                "spec": {
                    "clientId": GOOGLE_CLIENT_ID,
                    "clientSecret": GOOGLE_CLIENT_SECRET,
                },
-                "roleMapping": {
-                    "defaultRole": "EDITOR",
-                },
+            },
+            "roleMapping": {
+                "defaultRole": "EDITOR",
            },
        },
        headers={"Authorization": f"Bearer {admin_token}"},
--- a/tests/integration/tests/cloudintegrations/02_create_account.py
+++ b/tests/integration/tests/cloudintegrations/02_create_account.py
@@ -1,52 +1,14 @@
 from collections.abc import Callable
 from http import HTTPStatus

-import pytest
 import requests

 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, add_license
-from fixtures.cloudintegrations import ProviderAccountSpec
 from fixtures.logger import setup_logger

 logger = setup_logger(__name__)

-AWS_ACCOUNT_SPEC = ProviderAccountSpec(
-    provider="aws",
-    initial_params={"deployment_region": "us-east-1", "regions": ["us-east-1", "us-west-2"]},
-    build_config=lambda p: {"aws": {"deploymentRegion": p["deployment_region"], "regions": p["regions"]}},
-    expected_config=lambda p: {"regions": p["regions"]},
-)
-
-GCP_ACCOUNT_SPEC = ProviderAccountSpec(
-    provider="gcp",
-    initial_params={
-        "deployment_project_id": "signoz-test-project",
-        "deployment_region": "us-central1",
-        "project_ids": ["signoz-test-project"],
-    },
-    build_config=lambda p: {
-        "gcp": {
-            "deploymentProjectId": p["deployment_project_id"],
-            "deploymentRegion": p["deployment_region"],
-            "projectIds": p["project_ids"],
-        }
-    },
-    expected_config=lambda p: {
-        "deploymentProjectId": p["deployment_project_id"],
-        "deploymentRegion": p["deployment_region"],
-        "projectIds": p["project_ids"],
-    },
-)
-
-PROVIDER_ACCOUNT_SPECS = [AWS_ACCOUNT_SPEC, GCP_ACCOUNT_SPEC]
-
-provider_spec = pytest.mark.parametrize(
-    "spec",
-    PROVIDER_ACCOUNT_SPECS,
-    ids=[s.id for s in PROVIDER_ACCOUNT_SPECS],
-)
-

 def test_apply_license(
    signoz: types.SigNoz,
@@ -58,19 +20,19 @@ def test_apply_license(
    add_license(signoz, make_http_mocks, get_token)


-@provider_spec
 def test_create_account(
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderAccountSpec,
 ) -> None:
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    cloud_provider = "aws"

    data = create_cloud_integration_account(
        admin_token,
-        spec.provider,
-        config=spec.build_config(spec.initial_params),
+        cloud_provider,
+        deployment_region="us-east-1",
+        regions=["us-east-1", "us-west-2"],
    )

    assert "id" in data, "Response data should contain 'id' field"
@@ -78,17 +40,12 @@ def test_create_account(

    assert "connectionArtifact" in data, "Response data should contain 'connectionArtifact' field"
    artifact = data["connectionArtifact"]
+    assert "aws" in artifact, "connectionArtifact should contain 'aws' field"
+    assert "connectionUrl" in artifact["aws"], "connectionArtifact.aws should contain 'connectionUrl'"

-    if spec.provider == "aws":
-        assert "aws" in artifact, "connectionArtifact should contain 'aws' field"
-        assert "connectionUrl" in artifact["aws"], "connectionArtifact.aws should contain 'connectionUrl'"
-
-        connection_url = artifact["aws"]["connectionUrl"]
-        assert "console.aws.amazon.com/cloudformation" in connection_url, "connectionUrl should be an AWS CloudFormation URL"
-        assert f"region={spec.initial_params['deployment_region']}" in connection_url, "connectionUrl should contain the deployment region"
-    else:
-        # GCP is a manual flow: no one-click install artifact.
-        assert artifact.get("gcp") is None, f"GCP should not return a connection artifact, got: {artifact}"
+    connection_url = artifact["aws"]["connectionUrl"]
+    assert "console.aws.amazon.com/cloudformation" in connection_url, "connectionUrl should be an AWS CloudFormation URL"
+    assert "region=us-east-1" in connection_url, "connectionUrl should contain the deployment region"


 def test_create_account_unsupported_provider(
@@ -119,36 +76,3 @@ def test_create_account_unsupported_provider(

    response_data = response.json()
    assert "error" in response_data, "Response should contain 'error' field"
-
-
-def test_create_gcp_account_without_project_ids(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-) -> None:
-    """GCP account config requires at least one project ID to monitor."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/cloud_integrations/gcp/accounts"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        json={
-            "config": {
-                "gcp": {
-                    "deploymentProjectId": "signoz-test-project",
-                    "deploymentRegion": "us-central1",
-                    "projectIds": [],
-                }
-            },
-            "credentials": {
-                "sigNozApiURL": "https://test.signoz.cloud",
-                "sigNozApiKey": "test-key",
-                "ingestionUrl": "https://ingest.test.signoz.cloud",
-                "ingestionKey": "test-ingestion-key",
-            },
-        },
-        timeout=10,
-    )
-
-    assert response.status_code == HTTPStatus.BAD_REQUEST, f"Expected 400 for empty projectIds, got {response.status_code}: {response.text}"
-    assert "error" in response.json(), "Response should contain 'error' field"
--- a/tests/integration/tests/cloudintegrations/03_agent_check_in.py
+++ b/tests/integration/tests/cloudintegrations/03_agent_check_in.py
@@ -2,53 +2,14 @@ import uuid
 from collections.abc import Callable
 from http import HTTPStatus

-import pytest
-
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, add_license
-from fixtures.cloudintegrations import (
-    ProviderAccountSpec,
-    simulate_agent_checkin,
-)
+from fixtures.cloudintegrations import simulate_agent_checkin
 from fixtures.logger import setup_logger

 logger = setup_logger(__name__)

-AWS_ACCOUNT_SPEC = ProviderAccountSpec(
-    provider="aws",
-    initial_params={"deployment_region": "us-east-1", "regions": ["us-east-1"]},
-    build_config=lambda p: {"aws": {"deploymentRegion": p["deployment_region"], "regions": p["regions"]}},
-    expected_config=lambda p: {"regions": p["regions"]},
-)
-
-GCP_ACCOUNT_SPEC = ProviderAccountSpec(
-    provider="gcp",
-    initial_params={
-        "deployment_project_id": "signoz-test-project",
-        "deployment_region": "us-central1",
-        "project_ids": ["signoz-test-project"],
-    },
-    build_config=lambda p: {
-        "gcp": {
-            "deploymentProjectId": p["deployment_project_id"],
-            "deploymentRegion": p["deployment_region"],
-            "projectIds": p["project_ids"],
-        }
-    },
-    expected_config=lambda p: {
-        "deploymentProjectId": p["deployment_project_id"],
-        "deploymentRegion": p["deployment_region"],
-        "projectIds": p["project_ids"],
-    },
-)
-
-PROVIDER_ACCOUNT_SPECS = [AWS_ACCOUNT_SPEC, GCP_ACCOUNT_SPEC]
-
-provider_spec = pytest.mark.parametrize(
-    "spec",
-    PROVIDER_ACCOUNT_SPECS,
-    ids=[s.id for s in PROVIDER_ACCOUNT_SPECS],
-)
+CLOUD_PROVIDER = "aws"


 def test_apply_license(
@@ -61,28 +22,22 @@ def test_apply_license(
    add_license(signoz, make_http_mocks, get_token)


-@provider_spec
 def test_agent_check_in(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderAccountSpec,
 ) -> None:
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(
-        admin_token,
-        spec.provider,
-        config=spec.build_config(spec.initial_params),
-    )
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER, regions=["us-east-1"])
    account_id = account["id"]
    provider_account_id = str(uuid.uuid4())

    response = simulate_agent_checkin(
        signoz,
        admin_token,
-        spec.provider,
+        CLOUD_PROVIDER,
        account_id,
        provider_account_id,
        data={"version": "v0.0.8"},
@@ -92,63 +47,57 @@ def test_agent_check_in(

    data = response.json()["data"]

+    # New camelCase fields
    assert data["cloudIntegrationId"] == account_id, "cloudIntegrationId should match"
    assert data["providerAccountId"] == provider_account_id, "providerAccountId should match"
    assert "integrationConfig" in data, "Response should contain 'integrationConfig'"
    assert data["removedAt"] is None, "removedAt should be null for a live account"

-    if spec.provider == "aws":
-        # Backward compat for agents deployed before the camelCase response; AWS only.
-        assert data["account_id"] == account_id, "account_id (compat) should match"
-        assert data["cloud_account_id"] == provider_account_id, "cloud_account_id (compat) should match"
-        assert "integration_config" in data, "Response should contain 'integration_config' (compat)"
-        assert "removed_at" in data, "Response should contain 'removed_at' (compat)"
+    # Backward-compat snake_case fields
+    assert data["account_id"] == account_id, "account_id (compat) should match"
+    assert data["cloud_account_id"] == provider_account_id, "cloud_account_id (compat) should match"
+    assert "integration_config" in data, "Response should contain 'integration_config' (compat)"
+    assert "removed_at" in data, "Response should contain 'removed_at' (compat)"

-        integration_config = data["integrationConfig"]
-        assert "aws" in integration_config, "integrationConfig should contain 'aws' block"
-        assert integration_config["aws"]["enabledRegions"] == spec.initial_params["regions"], "enabledRegions should match account config"
-    else:
-        # GCP is a manual flow: the agent carries its own configuration.
-        assert data["integrationConfig"].get("gcp") is None, f"GCP should not return an integration config, got: {data['integrationConfig']}"
+    # integrationConfig should reflect the configured regions
+    integration_config = data["integrationConfig"]
+    assert "aws" in integration_config, "integrationConfig should contain 'aws' block"
+    assert integration_config["aws"]["enabledRegions"] == ["us-east-1"], "enabledRegions should match account config"


-@provider_spec
 def test_agent_check_in_account_not_found(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
-    spec: ProviderAccountSpec,
 ) -> None:
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
    fake_id = str(uuid.uuid4())

-    response = simulate_agent_checkin(signoz, admin_token, spec.provider, fake_id, str(uuid.uuid4()))
+    response = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, fake_id, str(uuid.uuid4()))

    assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}: {response.text}"


-@provider_spec
 def test_duplicate_cloud_account_checkins(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderAccountSpec,
 ) -> None:
    """Test that two different accounts cannot check in with the same providerAccountId."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account1 = create_cloud_integration_account(admin_token, spec.provider, config=spec.build_config(spec.initial_params))
-    account2 = create_cloud_integration_account(admin_token, spec.provider, config=spec.build_config(spec.initial_params))
+    account1 = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
+    account2 = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)

    assert account1["id"] != account2["id"], "Two accounts should have different IDs"

    same_provider_account_id = str(uuid.uuid4())

    # First check-in: account1 claims the provider account ID
-    response = simulate_agent_checkin(signoz, admin_token, spec.provider, account1["id"], same_provider_account_id)
+    response = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account1["id"], same_provider_account_id)
    assert response.status_code == HTTPStatus.OK, f"Expected 200 for first check-in, got {response.status_code}: {response.text}"

    # Second check-in: account2 tries to claim the same provider account ID → 409
-    response = simulate_agent_checkin(signoz, admin_token, spec.provider, account2["id"], same_provider_account_id)
+    response = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account2["id"], same_provider_account_id)
    assert response.status_code == HTTPStatus.CONFLICT, f"Expected 409 for duplicate providerAccountId, got {response.status_code}: {response.text}"
--- a/tests/integration/tests/cloudintegrations/05_services.py
+++ b/tests/integration/tests/cloudintegrations/05_services.py
@@ -2,47 +2,18 @@ import uuid
 from collections.abc import Callable
 from http import HTTPStatus

-import pytest
 import requests
 from sqlalchemy import bindparam, sql

 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, add_license
-from fixtures.cloudintegrations import (
-    ProviderServiceSpec,
-    simulate_agent_checkin,
-)
+from fixtures.cloudintegrations import simulate_agent_checkin
 from fixtures.logger import setup_logger

 logger = setup_logger(__name__)

-AWS_SERVICE_SPEC = ProviderServiceSpec(
-    provider="aws",
-    service_id="rds",
-    supports_logs=True,
-    account_config={"aws": {"deploymentRegion": "us-east-1", "regions": ["us-east-1"]}},
-)
-
-GCP_SERVICE_SPEC = ProviderServiceSpec(
-    provider="gcp",
-    service_id="cloudsql_postgres",
-    supports_logs=False,
-    account_config={
-        "gcp": {
-            "deploymentProjectId": "signoz-test-project",
-            "deploymentRegion": "us-central1",
-            "projectIds": ["signoz-test-project"],
-        }
-    },
-)
-
-PROVIDER_SERVICE_SPECS = [AWS_SERVICE_SPEC, GCP_SERVICE_SPEC]
-
-provider_spec = pytest.mark.parametrize(
-    "spec",
-    PROVIDER_SERVICE_SPECS,
-    ids=[s.id for s in PROVIDER_SERVICE_SPECS],
-)
+CLOUD_PROVIDER = "aws"
+SERVICE_ID = "rds"


 def test_apply_license(
@@ -55,18 +26,16 @@ def test_apply_license(
    add_license(signoz, make_http_mocks, get_token)


-@provider_spec
 def test_list_services_without_account(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
-    spec: ProviderServiceSpec,
 ) -> None:
    """List the cloud provider's supported services"""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/services"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/services"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -84,37 +53,35 @@ def test_list_services_without_account(
    assert "icon" in service, "Service should have 'icon' field"
    assert "enabled" in service, "Service should have 'enabled' field"

-    listed_ids = {s["id"] for s in data["services"]}
-    assert spec.service_id in listed_ids, f"'{spec.service_id}' should be listed for {spec.provider}"
+
+EC2_SERVICE_ID = "ec2"


-@provider_spec
 def test_list_account_services(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
-    """ListAccountServicesMetadata reflects enabled state per service."""
+    """ListAccountServicesMetadata reflects enabled state after enabling a service."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

    put_response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{EC2_SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": True}}}},
        timeout=10,
    )
-    assert put_response.status_code == HTTPStatus.NO_CONTENT, f"Enable {spec.service_id} failed: {put_response.status_code}: {put_response.text}"
+    assert put_response.status_code == HTTPStatus.NO_CONTENT, f"Enable ec2 failed: {put_response.status_code}: {put_response.text}"

    list_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -125,28 +92,21 @@ def test_list_account_services(
    assert isinstance(data["services"], list), "services should be a list"
    assert len(data["services"]) > 0, "services list should be non-empty"

-    enabled_service = next((s for s in data["services"] if s["id"] == spec.service_id), None)
-    assert enabled_service is not None, f"Service '{spec.service_id}' not found in services list"
-    assert enabled_service["enabled"] is True, f"Service should be enabled, got: {enabled_service['enabled']}"
-
-    # The listing must report state per service, not blanket-enable or echo the write.
-    untouched_service = next((s for s in data["services"] if s["id"] != spec.service_id), None)
-    assert untouched_service is not None, "Expected more than one service in the listing"
-    assert untouched_service["enabled"] is False, f"Service '{untouched_service['id']}' was never enabled, got: {untouched_service['enabled']}"
+    ec2_service = next((s for s in data["services"] if s["id"] == EC2_SERVICE_ID), None)
+    assert ec2_service is not None, f"EC2 service '{EC2_SERVICE_ID}' not found in services list"
+    assert ec2_service["enabled"] is True, f"EC2 service should be enabled, got: {ec2_service['enabled']}"


-@provider_spec
 def test_get_service_details_without_account(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
-    spec: ProviderServiceSpec,
 ) -> None:
    """Get full service definition without specifying an account."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -154,36 +114,31 @@ def test_get_service_details_without_account(
    assert response.status_code == HTTPStatus.OK, f"Expected 200, got {response.status_code}"

    data = response.json()["data"]
-    assert data["id"] == spec.service_id, f"id should be '{spec.service_id}'"
+    assert data["id"] == SERVICE_ID, f"id should be '{SERVICE_ID}'"
    assert "title" in data, "Service should have 'title'"
    assert "overview" in data, "Service should have 'overview' (markdown)"
    assert "assets" in data, "Service should have 'assets'"
    assert isinstance(data["assets"]["dashboards"], list), "assets.dashboards should be a list"
    assert data["cloudIntegrationService"] is None, "cloudIntegrationService should be null without account context"

-    assert data["supportedSignals"]["metrics"] is True, "metrics should be a supported signal"
-    assert data["supportedSignals"]["logs"] is spec.supports_logs, f"logs support should be {spec.supports_logs} for {spec.provider}"

-
-@provider_spec
 def test_get_account_service(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
    """Get service for a specific account — all disabled by default."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -191,22 +146,20 @@ def test_get_account_service(
    assert response.status_code == HTTPStatus.OK, f"Expected 200, got {response.status_code}"

    data = response.json()["data"]
-    assert data["id"] == spec.service_id, f"id should be '{spec.service_id}'"
+    assert data["id"] == SERVICE_ID, f"id should be '{SERVICE_ID}'"
    assert data["cloudIntegrationService"] is None, "cloudIntegrationService should be null before any config is set"


-@provider_spec
 def test_get_service_not_found(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
-    spec: ProviderServiceSpec,
 ) -> None:
    """Get a non-existent service ID returns 400 (invalid service ID is a bad request)."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/services/non-existent-service"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/services/non-existent-service"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -214,34 +167,32 @@ def test_get_service_not_found(
    assert response.status_code == HTTPStatus.BAD_REQUEST, f"Expected 400, got {response.status_code}"


-@provider_spec
 def test_update_service_config(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
    """Enable a service and verify the config is persisted via GET."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

    put_response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": True}}}},
        timeout=10,
    )

    assert put_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204, got {put_response.status_code}: {put_response.text}"

    get_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -250,39 +201,33 @@ def test_update_service_config(
    data = get_response.json()["data"]
    svc = data["cloudIntegrationService"]
    assert svc is not None, "cloudIntegrationService should be non-null after UpdateService"
-    assert svc["config"][spec.provider]["metrics"]["enabled"] is True, "metrics should be enabled"
+    assert svc["config"]["aws"]["metrics"]["enabled"] is True, "metrics should be enabled"
+    assert svc["config"]["aws"]["logs"]["enabled"] is True, "logs should be enabled"
    assert svc["cloudIntegrationId"] == account_id, "cloudIntegrationId should match the account"

-    if spec.supports_logs:
-        assert svc["config"][spec.provider]["logs"]["enabled"] is True, "logs should be enabled"
-    else:
-        assert svc["config"][spec.provider].get("logs") is None, f"logs should not be stored for {spec.provider}, got: {svc['config'][spec.provider]}"

-
-@provider_spec
 def test_update_service_config_disable(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
    """Enable then disable a service — config change is persisted."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

-    endpoint = signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}")
+    endpoint = signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}")

    # Enable
    r = requests.put(
        endpoint,
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": True}}}},
        timeout=10,
    )
    assert r.status_code == HTTPStatus.NO_CONTENT, f"Enable failed: {r.status_code}: {r.text}"
@@ -291,13 +236,13 @@ def test_update_service_config_disable(
    r = requests.put(
        endpoint,
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(False)},
+        json={"config": {"aws": {"metrics": {"enabled": False}, "logs": {"enabled": False}}}},
        timeout=10,
    )
    assert r.status_code == HTTPStatus.NO_CONTENT, f"Disable failed: {r.status_code}: {r.text}"

    get_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -305,57 +250,28 @@ def test_update_service_config_disable(
    assert get_response.status_code == HTTPStatus.OK
    svc = get_response.json()["data"]["cloudIntegrationService"]
    assert svc is not None, "cloudIntegrationService should still be present after disable"
-    assert svc["config"][spec.provider]["metrics"]["enabled"] is False, "metrics should be disabled"
-
-    if spec.supports_logs:
-        assert svc["config"][spec.provider]["logs"]["enabled"] is False, "logs should be disabled"
+    assert svc["config"]["aws"]["metrics"]["enabled"] is False, "metrics should be disabled"
+    assert svc["config"]["aws"]["logs"]["enabled"] is False, "logs should be disabled"


-@provider_spec
 def test_update_service_account_not_found(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
-    spec: ProviderServiceSpec,
 ) -> None:
    """PUT with a non-existent account UUID returns 404."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{uuid.uuid4()}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{uuid.uuid4()}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}}}},
        timeout=10,
    )

    assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}"


-def test_update_gcp_service_without_metrics_config(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    create_cloud_integration_account: Callable,
-) -> None:
-    """GCP services support metrics only, so a config omitting metrics is rejected."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    account = create_cloud_integration_account(admin_token, "gcp", config=GCP_SERVICE_SPEC.account_config)
-    account_id = account["id"]
-
-    checkin = simulate_agent_checkin(signoz, admin_token, "gcp", account_id, str(uuid.uuid4()))
-    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/gcp/accounts/{account_id}/services/{GCP_SERVICE_SPEC.service_id}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": {"gcp": {"logs": {"enabled": True}}}},
-        timeout=10,
-    )
-
-    assert response.status_code == HTTPStatus.BAD_REQUEST, f"Expected 400 when metrics config is missing, got {response.status_code}: {response.text}"
-
-
 def test_list_services_unsupported_provider(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -373,32 +289,30 @@ def test_list_services_unsupported_provider(
    assert response.status_code == HTTPStatus.BAD_REQUEST, f"Expected 400, got {response.status_code}"


-@provider_spec
 def test_list_services_account_removed(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
    """List services for a deleted account returns 404."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

    delete_response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
    assert delete_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204 on delete, got {delete_response.status_code}"

    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -406,32 +320,30 @@ def test_list_services_account_removed(
    assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}"


-@provider_spec
 def test_get_service_details_account_removed(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
    """Get service details for a deleted account returns 404."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

    delete_response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
    assert delete_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204 on delete, got {delete_response.status_code}"

    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -439,68 +351,64 @@ def test_get_service_details_account_removed(
    assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}"


-@provider_spec
 def test_update_service_account_removed(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
    """PUT service config for a deleted account returns 404."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

    delete_response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
    assert delete_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204 on delete, got {delete_response.status_code}"

    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}}}},
        timeout=10,
    )

    assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}"


-@provider_spec
 def test_enable_metrics_provisions_dashboards(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
    """Enabling metrics provisions dashboards visible in GetService and present in the DB."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

    put_response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True, logs_enabled=False)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": False}}}},
        timeout=10,
    )
    assert put_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204, got {put_response.status_code}: {put_response.text}"

    # Assertion 1: GetService returns provisioned dashboard UUIDs
    get_svc_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -509,7 +417,7 @@ def test_enable_metrics_provisions_dashboards(
    data = get_svc_response.json()["data"]
    svc = data["cloudIntegrationService"]
    assert svc is not None, "cloudIntegrationService should be non-null after enabling metrics"
-    assert svc["config"][spec.provider]["metrics"]["enabled"] is True
+    assert svc["config"]["aws"]["metrics"]["enabled"] is True

    dashboards_in_service = data["assets"]["dashboards"]
    assert isinstance(dashboards_in_service, list) and len(dashboards_in_service) > 0, "assets.dashboards should be non-empty after enabling metrics"
@@ -537,37 +445,35 @@ def test_enable_metrics_provisions_dashboards(
    assert provisioned_ids == db_ids, f"Dashboards {provisioned_ids - db_ids} are missing from the DB"


-@provider_spec
 def test_disable_metrics_deprovisions_dashboards(
    signoz: types.SigNoz,
    create_user_admin: types.Operation,  # pylint: disable=unused-argument
    get_token: Callable[[str, str], str],
    create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
    """Disabling metrics removes provisioned dashboards from both GetService and the dashboards list."""
    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
    account_id = account["id"]

-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"

-    endpoint = signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}")
+    endpoint = signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}")

    # Enable metrics to provision dashboards first
    enable_response = requests.put(
        endpoint,
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True, logs_enabled=False)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": False}}}},
        timeout=10,
    )
    assert enable_response.status_code == HTTPStatus.NO_CONTENT, f"Enable failed: {enable_response.status_code}: {enable_response.text}"

    # Capture the provisioned dashboard IDs before disabling
    get_svc_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
@@ -579,14 +485,14 @@ def test_disable_metrics_deprovisions_dashboards(
    disable_response = requests.put(
        endpoint,
        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(False)},
+        json={"config": {"aws": {"metrics": {"enabled": False}, "logs": {"enabled": False}}}},
        timeout=10,
    )
    assert disable_response.status_code == HTTPStatus.NO_CONTENT, f"Disable failed: {disable_response.status_code}: {disable_response.text}"

    # Assertion 1: GetService no longer returns UUID dashboard IDs
    get_svc_after = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
        headers={"Authorization": f"Bearer {admin_token}"},
        timeout=10,
    )
--- a/tests/integration/tests/queriercommon/01_filter_expression.py
+++ b/tests/integration/tests/queriercommon/01_filter_expression.py
@@ -1,14 +1,20 @@
+import os
 from collections.abc import Callable
+from concurrent.futures import ThreadPoolExecutor, as_completed
 from datetime import UTC, datetime, timedelta
 from http import HTTPStatus

 import pytest
+import requests

 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.logs import Logs
 from fixtures.querier import get_column_data_from_response, make_query_request

+TESTDATA_DIR = os.path.join(os.path.dirname(__file__), "..", "..", "testdata")
+FILTER_EXPRESSIONS_FILE = os.path.join(TESTDATA_DIR, "filter_expressions_10000.txt")
+

@pytest.mark.parametrize(
    "expression,expected_logs",
@@ -174,3 +180,101 @@ def test_not_filter_expression(
    assert response.status_code == HTTPStatus.OK
    assert response.json()["status"] == "success"
    assert set(get_column_data_from_response(response.json(), "body")) == expected_logs
+
+
+def test_filter_expressions_no_server_error(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    insert_logs,
+    get_token: Callable[[str, str], str],
+) -> None:
+    """
+    Reads every line from filter_expressions_10000.txt and fires it as a filter
+    expression against the logs query endpoint.
+
+    Expressions may be valid (200) or invalid (400) — both are acceptable.
+    A 500 means the server crashed on the input and is a test failure.
+    All failing expressions are collected before asserting so the full list is
+    visible in one run.
+    """
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    now = datetime.now(tz=UTC)
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=5),
+                body="alpha-log",
+                resources={
+                    "f1": "v10",
+                    "f2": "v20",
+                    "f3": "v30",
+                },
+                attributes={
+                    "f4": 40,
+                    "f5": 50,
+                    "f6": 60,
+                },
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=3),
+                body="beta-log",
+                resources={
+                    "f4": "v41",
+                    "f5": "v51",
+                    "f6": "v61",
+                },
+                attributes={
+                    "f1": 11,
+                    "f2": 21,
+                    "f3": 31,
+                },
+            ),
+        ]
+    )
+
+    def _make_raw_logs_query(
+        signoz: types.SigNoz,
+        token: str,
+        filter_expression: str,
+    ) -> requests.Response:
+        """Helper to query raw logs with a filter expression over the last 30 seconds."""
+        now = datetime.now(tz=UTC)
+        return make_query_request(
+            signoz,
+            token,
+            start_ms=int((now - timedelta(seconds=30)).timestamp() * 1000),
+            end_ms=int(now.timestamp() * 1000),
+            request_type="raw",
+            queries=[
+                {
+                    "type": "builder_query",
+                    "spec": {
+                        "name": "A",
+                        "signal": "logs",
+                        "disabled": False,
+                        "limit": 100,
+                        "offset": 0,
+                        "filter": {"expression": filter_expression},
+                        "order": [
+                            {"key": {"name": "timestamp"}, "direction": "desc"},
+                            {"key": {"name": "id"}, "direction": "desc"},
+                        ],
+                        "having": {"expression": ""},
+                        "aggregations": [{"expression": "count()"}],
+                    },
+                }
+            ],
+        )
+
+    failures: list[str] = []
+    with ThreadPoolExecutor(max_workers=40) as executor:
+        with open(FILTER_EXPRESSIONS_FILE, encoding="utf-8") as f:
+            futures = {executor.submit(_make_raw_logs_query, signoz, token, expr.rstrip("\n")): expr.rstrip("\n") for expr in f}
+            for future in as_completed(futures):
+                expr = futures[future]
+                if future.result().status_code == HTTPStatus.INTERNAL_SERVER_ERROR:
+                    failures.append(expr)
+
+    assert len(failures) <= 0, f"{len(failures)} expression(s) caused HTTP 500:\n" + "\n".join(f"  {expr!r}" for expr in failures)
Author	SHA1	Message	Date
grandwizard28	1d849df949	test(authdomain): cover the role mapping echo and the spec/kind pairing The enforcement toggle and the edit modal both PUT a full replacement, so a role mapping either one fails to echo back is dropped silently. Nothing caught that before: the fixtures these tests asserted against carried no role mapping at all. Also walks the pager when locating a list row, and checks a deleted domain against the list rather than the rendered page — the table paginates, and a shared stack holds domains the suite did not seed.	2026-08-11 01:59:54 +05:30
grandwizard28	fecf3b0805	fix(authtypes): reject spec fields foreign to the declared kind An oidc spec sent as kind google satisfies google's required clientId and clientSecret, so it decoded as a partial google config with the issuer dropped, pointing the domain at Google rather than the intended provider. The check runs on the request types only: stored documents keep decoding leniently so a rollback can read what a newer binary wrote, and so dropping a field later needs no migration.	2026-08-11 01:41:28 +05:30
grandwizard28	ea0b887e44	fix(sqlmigration): case-fold the legacy ssoType before restructuring Auth domains configured before the provider enum moved to valuer.String persist the discriminator uppercase, and nothing has rewritten them since because reads lowercase it on the way in. The exact-match lookup skipped those rows, leaving them in the legacy shape where the new types read an empty config, silently dropping SSO enforcement back to password auth.	2026-08-11 01:03:56 +05:30
grandwizard28	21069bc652	test(e2e): locate the sso auth domain elements by data-testid	2026-08-10 18:54:04 +05:30
grandwizard28	5b8785480a	test(e2e): cover the sso auth domain config flows	2026-08-10 18:26:45 +05:30
grandwizard28	fee8eb9a29	fix(authdomain): drop the patch endpoint and the unused redirectURI Flipping SSO enforcement goes through the standard update like every other resource, so the patch endpoint and PatchableAuthDomain go away. GoogleConfig loses redirectURI, which nothing reads; the migration strips it from persisted documents. domain.go declarations are ordered const, var, structs, exported functions, methods.	2026-08-10 18:02:57 +05:30
grandwizard28	90d884c113	chore: merge main	2026-08-10 17:06:38 +05:30
grandwizard28	07eb864447	docs(contributing): keep only the auth domain worked-example sync The kind/spec pattern documentation moves to its own PR with generic examples; this branch only keeps the existing worked example in step with the refactored types.	2026-08-10 16:34:53 +05:30
grandwizard28	df2658de38	test(callbackauthn): port the google authn tests to /api/v2/auth_domains	2026-08-10 16:13:41 +05:30
grandwizard28	125b5b3ab8	chore: merge main # Conflicts: # tests/fixtures/googleidp.py # tests/fixtures/signoz.py # tests/fixtures/tls.py # tests/integration/tests/callbackauthn/04_google.py	2026-08-10 16:11:36 +05:30
grandwizard28	e25bb31f28	chore: merge the reusable tls fixture from the stacked test PR	2026-08-10 11:54:06 +05:30
grandwizard28	3a6c54a47a	test(fixtures): make the integration CA a reusable tls fixture The CA becomes a reuse-wrapped tls fixture with issue_server_keystore issuing per-hostname keystores into tmpfs directories, so other mocks that must serve TLS under a real hostname (e.g. chat.googleapis.com) can chain to the same CA. The CA itself lives in the pytest cache directory because basetemp is wiped every session while reused containers must keep chaining to it; create_signoz takes the CA as an optional argument.	2026-08-10 11:53:51 +05:30
grandwizard28	015689f587	test(callbackauthn): cover the patch endpoint and document the migration path	2026-08-10 11:48:35 +05:30
grandwizard28	3aacca0d52	fix(frontend): patch SSO enforcement and co-locate the config conversion The enforcement toggle uses the new PATCH endpoint instead of echoing the whole provider config through PUT, and both directions of the envelope<->form translation now live in CreateEdit.utils.ts, replacing the cross-enum cast with an explicit kind-to-provider mapping.	2026-08-10 11:48:31 +05:30
grandwizard28	f4d428cbee	fix(authtypes): migrate the persisted auth domain config to the envelope shape A new sqlmigration rewrites auth_domain.data from the flat legacy document into {enabled, config: {kind, spec}, roleMapping} with the renamed saml keys, so all legacy-shape code goes away: the storable twins, the google_auth translation and the four per-kind conversion switches collapse into a single variant registry that UnmarshalJSON, JSONSchemaOneOf and the discriminator mapping derive from. AuthDomain now exposes the domain shape (Enabled, Kind, Config, RoleMapping and typed spec accessors) instead of the persisted document, creates build the row directly instead of re-parsing their own marshal output, and config presence is enforced explicitly on Postable and Updatable — the old PUT path never enforced it at all. A new PATCH endpoint flips SSO enforcement without rewriting the provider configuration, and secret fields are marked format password in the schema.	2026-08-10 11:48:29 +05:30
grandwizard28	60cb50af25	chore: merge google authn test infrastructure from the stacked test PR # Conflicts: # tests/fixtures/googleidp.py # tests/integration/tests/callbackauthn/04_google.py	2026-08-10 11:26:27 +05:30
grandwizard28	609a9c9bf9	test(callbackauthn): cover the google authn flow end to end A wiremock container impersonates Google's OIDC provider: it joins the test network as accounts.google.com and serves HTTPS with a certificate issued by a new integration CA, which every signoz container now trusts via SSL_CERT_FILE, since the google callback authn hardcodes Google's issuer and fully verifies the RS256 id_token against the served JWKS. Stubs are installed per test with a pre-signed token for the identity under test, all signed by one session-scoped key.	2026-08-10 11:25:24 +05:30
grandwizard28	b955f1eee1	chore(frontend): remove the loginPrecheck mock for an endpoint that no longer exists	2026-08-10 11:21:40 +05:30
grandwizard28	4f400da770	test(callbackauthn): pin the auth domain POST/GET roundtrip contract Clients like the terraform provider land state via a follow-up GET after every write, so the responses must round-trip posted values exactly. The parametrized cases pin that contract per kind, including the server-side defaulting (attribute/claim mappings, zero-value scalars) and role-name normalization (EDITOR -> signoz-editor, null groupMappings).	2026-08-08 17:58:32 +05:30
grandwizard28	de3ba9d20c	test(callbackauthn): cover the google authn flow end to end A wiremock container impersonates Google's OIDC provider: it joins the test network as accounts.google.com and serves HTTPS with a certificate issued by a new integration CA, which every signoz container now trusts via SSL_CERT_FILE, since the google callback authn hardcodes Google's issuer and fully verifies the RS256 id_token against the served JWKS. Stubs are installed per test with a pre-signed token for the identity under test. The domain tests also sweep leftover domains so reruns against a reused stack stay green.	2026-08-08 17:45:22 +05:30
grandwizard28	fe447e7f35	fix(authtypes): mark validator-required config fields as required in the schema	2026-08-08 17:12:19 +05:30
grandwizard28	94ce3e51f1	fix(apiserver): move auth domain endpoints to /api/v2/auth_domains The request and response shapes changed, so the endpoints move to a new version instead of breaking /api/v1/domains in place; the v1 routes are removed.	2026-08-08 17:02:21 +05:30
grandwizard28	a5ddafc5db	fix(authtypes): rename google_auth kind to google and saml ssoUrl to location The kind follows the provider name; the SAML field follows the Location attribute of the SingleSignOnService element, consistent with entityId and certificate. Persisted rows are untouched: StorableAuthDomainConfig translates the legacy google_auth value on read and keeps writing it.	2026-08-08 16:52:28 +05:30
grandwizard28	54e2caaac2	docs(contributing): explain envelope placement and tagging-style rationale	2026-08-08 16:21:18 +05:30
grandwizard28	9313e7bea5	docs(contributing): document the kind/spec envelope for sum types	2026-08-08 16:12:35 +05:30
grandwizard28	6b58b6fcae	fix(tests): update auth domain payloads to kind/spec envelope	2026-08-08 16:11:22 +05:30
grandwizard28	cc5d3574a4	fix(frontend): adopt kind/spec auth domain payload in org settings Regenerates the orval client (AuthtypesAuthDomainConfigDTO is now a discriminated union) and updates the AuthDomain container, toggle, list and tests to the new enabled/config/roleMapping root shape and the renamed SAML spec keys.	2026-08-08 16:07:58 +05:30
grandwizard28	6175ff3fc2	chore(openapi): regenerate spec for auth domain kind/spec envelope	2026-08-08 16:00:21 +05:30
grandwizard28	db7ec08969	fix(authtypes): restructure auth domain payload into a kind/spec envelope The auth domain config previously carried the discriminator (ssoType) and the per-provider payloads as sibling fields, which cannot be expressed as an OpenAPI discriminated union. AuthDomainConfig is now a kind/spec envelope; ssoEnabled and roleMapping move to the root as enabled and roleMapping. The persisted shape is unchanged: StorableAuthDomainConfig keeps the legacy keys and conversions happen at the type boundary.	2026-08-08 15:59:32 +05:30
				`@@ -1 +0,0 @@`
				<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24"><defs><style>.cls-1{fill:#aecbfa;}.cls-1,.cls-2,.cls-3{fill-rule:evenodd;}.cls-2{fill:#669df6;}.cls-3{fill:#4285f4;}</style></defs><title>Icon_24px_SQL_Color</title><g data-name="Product Icons"><g ><polygon class="cls-1" points="4.67 10.44 4.67 13.45 12 17.35 12 14.34 4.67 10.44"/><polygon class="cls-1" points="4.67 15.09 4.67 18.1 12 22 12 18.99 4.67 15.09"/><polygon class="cls-2" points="12 17.35 19.33 13.45 19.33 10.44 12 14.34 12 17.35"/><polygon class="cls-2" points="12 22 19.33 18.1 19.33 15.09 12 18.99 12 22"/><polygon class="cls-3" points="19.33 8.91 19.33 5.9 12 2 12 5.01 19.33 8.91"/><polygon class="cls-2" points="12 2 4.67 5.9 4.67 8.91 12 5.01 12 2"/><polygon class="cls-1" points="4.67 5.87 4.67 8.89 12 12.79 12 9.77 4.67 5.87"/><polygon class="cls-2" points="12 12.79 19.33 8.89 19.33 5.87 12 9.77 12 12.79"/></g></g></svg>