fix(savedview): drop attach/detach from saved-view's allowed verbs

saved-view has no attach/detach semantics -- nothing links to it the
way roles attach to service accounts. Restrict
ResourceMetaResourceSavedView to the 5 CRUD verbs it actually
supports, matching ResourceMetaResourceFactorAPIKey's pattern, so a
custom role can no longer be granted attach/detach on saved-view and
those verbs don't surface as options wherever saved-view's
permissions get exposed.

Verified: a custom role transactionGroup granting "attach" on
metaresource:saved-view now gets rejected with 400 ("verb attach is
not valid for resource metaresource:saved-view") instead of being
silently accepted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xb5R7Eo19HUukBMVCgKPjS

docs/api/openapi.yml

@@ -7759,6 +7759,98 @@ components:
       enum:
       - basic
       type: string
+    SavedviewtypesDisplay:
+      properties:
+        color:
+          type: string
+        fontSize:
+          type: string
+        format:
+          type: string
+        maxLines:
+          type: integer
+      type: object
+    SavedviewtypesPanelType:
+      enum:
+      - value
+      - graph
+      - table
+      - list
+      - trace
+      type: string
+    SavedviewtypesPostableSavedView:
+      properties:
+        data:
+          $ref: '#/components/schemas/SavedviewtypesSavedViewData'
+        name:
+          type: string
+        sourcePage:
+          $ref: '#/components/schemas/SavedviewtypesSourcePage'
+      required:
+      - name
+      - sourcePage
+      - data
+      type: object
+    SavedviewtypesSavedView:
+      properties:
+        createdAt:
+          format: date-time
+          type: string
+        createdBy:
+          type: string
+        data:
+          $ref: '#/components/schemas/SavedviewtypesSavedViewData'
+        id:
+          type: string
+        name:
+          type: string
+        sourcePage:
+          $ref: '#/components/schemas/SavedviewtypesSourcePage'
+        updatedAt:
+          format: date-time
+          type: string
+        updatedBy:
+          type: string
+      required:
+      - id
+      type: object
+    SavedviewtypesSavedViewData:
+      properties:
+        schemaVersion:
+          type: string
+        spec:
+          $ref: '#/components/schemas/SavedviewtypesSavedViewSpec'
+      required:
+      - schemaVersion
+      - spec
+      type: object
+    SavedviewtypesSavedViewSpec:
+      properties:
+        display:
+          $ref: '#/components/schemas/SavedviewtypesDisplay'
+        panelType:
+          $ref: '#/components/schemas/SavedviewtypesPanelType'
+        queries:
+          items:
+            $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelope'
+          type: array
+        selectedFields:
+          items:
+            $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey'
+          type: array
+      required:
+      - panelType
+      - queries
+      - selectedFields
+      - display
+      type: object
+    SavedviewtypesSourcePage:
+      enum:
+      - traces
+      - logs
+      - metrics
+      - meter
+      type: string
     ServiceaccounttypesDeprecatedPostableServiceAccountRole:
       properties:
         id:
@@ -10247,9 +10339,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - dashboard:update
       - tokenizer:
-        - ADMIN
+        - dashboard:update
       summary: Delete public dashboard
       tags:
       - dashboard
@@ -10298,9 +10390,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - dashboard:read
       - tokenizer:
-        - ADMIN
+        - dashboard:read
       summary: Get public dashboard
       tags:
       - dashboard
@@ -10355,9 +10447,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - dashboard:update
       - tokenizer:
-        - ADMIN
+        - dashboard:update
       summary: Create public dashboard
       tags:
       - dashboard
@@ -10399,9 +10491,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - dashboard:update
       - tokenizer:
-        - ADMIN
+        - dashboard:update
       summary: Update public dashboard
       tags:
       - dashboard
@@ -14739,9 +14831,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - dashboard:list
       - tokenizer:
-        - VIEWER
+        - dashboard:list
       summary: List dashboard saved views
       tags:
       - dashboard
@@ -14796,9 +14888,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:list
       - tokenizer:
-        - EDITOR
+        - dashboard:list
       summary: Create dashboard saved view
       tags:
       - dashboard
@@ -14849,9 +14941,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:list
       - tokenizer:
-        - EDITOR
+        - dashboard:list
       summary: Delete dashboard saved view
       tags:
       - dashboard
@@ -14917,9 +15009,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:list
       - tokenizer:
-        - EDITOR
+        - dashboard:list
       summary: Update dashboard saved view
       tags:
       - dashboard
@@ -14994,9 +15086,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - dashboard:list
       - tokenizer:
-        - VIEWER
+        - dashboard:list
       summary: List dashboards (v2)
       tags:
       - dashboard
@@ -15051,9 +15143,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:create
       - tokenizer:
-        - EDITOR
+        - dashboard:create
       summary: Create dashboard (v2)
       tags:
       - dashboard
@@ -15104,9 +15196,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:delete
       - tokenizer:
-        - EDITOR
+        - dashboard:delete
       summary: Delete dashboard (v2)
       tags:
       - dashboard
@@ -15167,9 +15259,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - dashboard:read
       - tokenizer:
-        - VIEWER
+        - dashboard:read
       summary: Get dashboard (v2)
       tags:
       - dashboard
@@ -15241,9 +15333,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:update
       - tokenizer:
-        - EDITOR
+        - dashboard:update
       summary: Patch dashboard (v2)
       tags:
       - dashboard
@@ -15310,9 +15402,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:update
       - tokenizer:
-        - EDITOR
+        - dashboard:update
       summary: Update dashboard (v2)
       tags:
       - dashboard
@@ -15378,9 +15470,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:read
+        - dashboard:create
       - tokenizer:
-        - EDITOR
+        - dashboard:read
+        - dashboard:create
       summary: Clone dashboard (v2)
       tags:
       - dashboard
@@ -15431,9 +15525,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:update
       - tokenizer:
-        - EDITOR
+        - dashboard:update
       summary: Unlock dashboard (v2)
       tags:
       - dashboard
@@ -15483,9 +15577,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:update
       - tokenizer:
-        - EDITOR
+        - dashboard:update
       summary: Lock dashboard (v2)
       tags:
       - dashboard
@@ -15549,9 +15643,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - dashboard:update
       - tokenizer:
-        - EDITOR
+        - dashboard:update
       summary: Migrate dashboard to v2
       tags:
       - dashboard
@@ -22657,6 +22751,298 @@ paths:
       summary: Test alert rule
       tags:
       - rules
+  /api/v2/saved_views:
+    get:
+      deprecated: false
+      description: Returns saved views, optionally filtered by source page and name.
+      operationId: ListSavedViews
+      parameters:
+      - in: query
+        name: sourcePage
+        schema:
+          $ref: '#/components/schemas/SavedviewtypesSourcePage'
+      - in: query
+        name: name
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    items:
+                      $ref: '#/components/schemas/SavedviewtypesSavedView'
+                    nullable: true
+                    type: array
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - saved-view:list
+      - tokenizer:
+        - saved-view:list
+      summary: List saved views
+      tags:
+      - saved_view
+    post:
+      deprecated: false
+      description: Persists a saved view for the explore page. Returns the id of the
+        created view.
+      operationId: CreateSavedView
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SavedviewtypesPostableSavedView'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/TypesIdentifiable'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - saved-view:create
+      - tokenizer:
+        - saved-view:create
+      summary: Create saved view
+      tags:
+      - saved_view
+  /api/v2/saved_views/{id}:
+    delete:
+      deprecated: false
+      description: Deletes a saved view by id.
+      operationId: DeleteSavedView
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - saved-view:delete
+      - tokenizer:
+        - saved-view:delete
+      summary: Delete saved view
+      tags:
+      - saved_view
+    get:
+      deprecated: false
+      description: Returns a saved view by id.
+      operationId: GetSavedView
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/SavedviewtypesSavedView'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - saved-view:read
+      - tokenizer:
+        - saved-view:read
+      summary: Get saved view
+      tags:
+      - saved_view
+    put:
+      deprecated: false
+      description: Replaces a saved view's name and query.
+      operationId: UpdateSavedView
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SavedviewtypesPostableSavedView'
+      responses:
+        "200":
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - saved-view:update
+      - tokenizer:
+        - saved-view:update
+      summary: Update saved view
+      tags:
+      - saved_view
   /api/v2/sessions:
     delete:
       deprecated: false
@@ -23695,9 +24081,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - dashboard:list
       - tokenizer:
-        - VIEWER
+        - dashboard:list
       summary: List dashboards for the current user (v2)
       tags:
       - dashboard
@@ -23742,9 +24128,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - dashboard:list
       - tokenizer:
-        - VIEWER
+        - dashboard:list
       summary: Unpin a dashboard for the current user (v2)
       tags:
       - dashboard
@@ -23801,9 +24187,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - dashboard:list
       - tokenizer:
-        - VIEWER
+        - dashboard:list
       summary: Pin a dashboard for the current user (v2)
       tags:
       - dashboard

frontend/src/api/generated/services/saved-view/index.ts

@@ -0,0 +1,489 @@
+/**
+ * ! Do not edit manually
+ * * The file has been auto-generated using Orval for SigNoz
+ * * regenerate with 'pnpm generate:api'
+ * SigNoz
+ */
+import { useMutation, useQuery } from 'react-query';
+import type {
+	InvalidateOptions,
+	MutationFunction,
+	QueryClient,
+	QueryFunction,
+	QueryKey,
+	UseMutationOptions,
+	UseMutationResult,
+	UseQueryOptions,
+	UseQueryResult,
+} from 'react-query';
+
+import type {
+	CreateSavedView200,
+	DeleteSavedViewPathParameters,
+	GetSavedView200,
+	GetSavedViewPathParameters,
+	ListSavedViews200,
+	ListSavedViewsParams,
+	RenderErrorResponseDTO,
+	SavedviewtypesPostableSavedViewDTO,
+	UpdateSavedViewPathParameters,
+} from '../sigNoz.schemas';
+
+import { GeneratedAPIInstance } from '../../../generatedAPIInstance';
+import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
+
+/**
+ * Returns saved views, optionally filtered by source page and name.
+ * @summary List saved views
+ */
+export const listSavedViews = (
+	params?: ListSavedViewsParams,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<ListSavedViews200>({
+		url: `/api/v2/saved_views`,
+		method: 'GET',
+		params,
+		signal,
+	});
+};
+
+export const getListSavedViewsQueryKey = (params?: ListSavedViewsParams) => {
+	return [`/api/v2/saved_views`, ...(params ? [params] : [])] as const;
+};
+
+export const getListSavedViewsQueryOptions = <
+	TData = Awaited<ReturnType<typeof listSavedViews>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(
+	params?: ListSavedViewsParams,
+	options?: {
+		query?: UseQueryOptions<
+			Awaited<ReturnType<typeof listSavedViews>>,
+			TError,
+			TData
+		>;
+	},
+) => {
+	const { query: queryOptions } = options ?? {};
+
+	const queryKey = queryOptions?.queryKey ?? getListSavedViewsQueryKey(params);
+
+	const queryFn: QueryFunction<Awaited<ReturnType<typeof listSavedViews>>> = ({
+		signal,
+	}) => listSavedViews(params, signal);
+
+	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
+		Awaited<ReturnType<typeof listSavedViews>>,
+		TError,
+		TData
+	> & { queryKey: QueryKey };
+};
+
+export type ListSavedViewsQueryResult = NonNullable<
+	Awaited<ReturnType<typeof listSavedViews>>
+>;
+export type ListSavedViewsQueryError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary List saved views
+ */
+
+export function useListSavedViews<
+	TData = Awaited<ReturnType<typeof listSavedViews>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(
+	params?: ListSavedViewsParams,
+	options?: {
+		query?: UseQueryOptions<
+			Awaited<ReturnType<typeof listSavedViews>>,
+			TError,
+			TData
+		>;
+	},
+): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
+	const queryOptions = getListSavedViewsQueryOptions(params, options);
+
+	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
+		queryKey: QueryKey;
+	};
+
+	return { ...query, queryKey: queryOptions.queryKey };
+}
+
+/**
+ * @summary List saved views
+ */
+export const invalidateListSavedViews = async (
+	queryClient: QueryClient,
+	params?: ListSavedViewsParams,
+	options?: InvalidateOptions,
+): Promise<QueryClient> => {
+	await queryClient.invalidateQueries(
+		{ queryKey: getListSavedViewsQueryKey(params) },
+		options,
+	);
+
+	return queryClient;
+};
+
+/**
+ * Persists a saved view for the explore page. Returns the id of the created view.
+ * @summary Create saved view
+ */
+export const createSavedView = (
+	savedviewtypesPostableSavedViewDTO?: BodyType<SavedviewtypesPostableSavedViewDTO>,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<CreateSavedView200>({
+		url: `/api/v2/saved_views`,
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		data: savedviewtypesPostableSavedViewDTO,
+		signal,
+	});
+};
+
+export const getCreateSavedViewMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof createSavedView>>,
+		TError,
+		{ data?: BodyType<SavedviewtypesPostableSavedViewDTO> },
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof createSavedView>>,
+	TError,
+	{ data?: BodyType<SavedviewtypesPostableSavedViewDTO> },
+	TContext
+> => {
+	const mutationKey = ['createSavedView'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof createSavedView>>,
+		{ data?: BodyType<SavedviewtypesPostableSavedViewDTO> }
+	> = (props) => {
+		const { data } = props ?? {};
+
+		return createSavedView(data);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type CreateSavedViewMutationResult = NonNullable<
+	Awaited<ReturnType<typeof createSavedView>>
+>;
+export type CreateSavedViewMutationBody =
+	| BodyType<SavedviewtypesPostableSavedViewDTO>
+	| undefined;
+export type CreateSavedViewMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Create saved view
+ */
+export const useCreateSavedView = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof createSavedView>>,
+		TError,
+		{ data?: BodyType<SavedviewtypesPostableSavedViewDTO> },
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof createSavedView>>,
+	TError,
+	{ data?: BodyType<SavedviewtypesPostableSavedViewDTO> },
+	TContext
+> => {
+	return useMutation(getCreateSavedViewMutationOptions(options));
+};
+/**
+ * Deletes a saved view by id.
+ * @summary Delete saved view
+ */
+export const deleteSavedView = (
+	{ id }: DeleteSavedViewPathParameters,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<void>({
+		url: `/api/v2/saved_views/${id}`,
+		method: 'DELETE',
+		signal,
+	});
+};
+
+export const getDeleteSavedViewMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof deleteSavedView>>,
+		TError,
+		{ pathParams: DeleteSavedViewPathParameters },
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof deleteSavedView>>,
+	TError,
+	{ pathParams: DeleteSavedViewPathParameters },
+	TContext
+> => {
+	const mutationKey = ['deleteSavedView'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof deleteSavedView>>,
+		{ pathParams: DeleteSavedViewPathParameters }
+	> = (props) => {
+		const { pathParams } = props ?? {};
+
+		return deleteSavedView(pathParams);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type DeleteSavedViewMutationResult = NonNullable<
+	Awaited<ReturnType<typeof deleteSavedView>>
+>;
+
+export type DeleteSavedViewMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Delete saved view
+ */
+export const useDeleteSavedView = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof deleteSavedView>>,
+		TError,
+		{ pathParams: DeleteSavedViewPathParameters },
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof deleteSavedView>>,
+	TError,
+	{ pathParams: DeleteSavedViewPathParameters },
+	TContext
+> => {
+	return useMutation(getDeleteSavedViewMutationOptions(options));
+};
+/**
+ * Returns a saved view by id.
+ * @summary Get saved view
+ */
+export const getSavedView = (
+	{ id }: GetSavedViewPathParameters,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<GetSavedView200>({
+		url: `/api/v2/saved_views/${id}`,
+		method: 'GET',
+		signal,
+	});
+};
+
+export const getGetSavedViewQueryKey = ({ id }: GetSavedViewPathParameters) => {
+	return [`/api/v2/saved_views/${id}`] as const;
+};
+
+export const getGetSavedViewQueryOptions = <
+	TData = Awaited<ReturnType<typeof getSavedView>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(
+	{ id }: GetSavedViewPathParameters,
+	options?: {
+		query?: UseQueryOptions<
+			Awaited<ReturnType<typeof getSavedView>>,
+			TError,
+			TData
+		>;
+	},
+) => {
+	const { query: queryOptions } = options ?? {};
+
+	const queryKey = queryOptions?.queryKey ?? getGetSavedViewQueryKey({ id });
+
+	const queryFn: QueryFunction<Awaited<ReturnType<typeof getSavedView>>> = ({
+		signal,
+	}) => getSavedView({ id }, signal);
+
+	return {
+		queryKey,
+		queryFn,
+		enabled: !!id,
+		...queryOptions,
+	} as UseQueryOptions<
+		Awaited<ReturnType<typeof getSavedView>>,
+		TError,
+		TData
+	> & { queryKey: QueryKey };
+};
+
+export type GetSavedViewQueryResult = NonNullable<
+	Awaited<ReturnType<typeof getSavedView>>
+>;
+export type GetSavedViewQueryError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Get saved view
+ */
+
+export function useGetSavedView<
+	TData = Awaited<ReturnType<typeof getSavedView>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(
+	{ id }: GetSavedViewPathParameters,
+	options?: {
+		query?: UseQueryOptions<
+			Awaited<ReturnType<typeof getSavedView>>,
+			TError,
+			TData
+		>;
+	},
+): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
+	const queryOptions = getGetSavedViewQueryOptions({ id }, options);
+
+	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
+		queryKey: QueryKey;
+	};
+
+	return { ...query, queryKey: queryOptions.queryKey };
+}
+
+/**
+ * @summary Get saved view
+ */
+export const invalidateGetSavedView = async (
+	queryClient: QueryClient,
+	{ id }: GetSavedViewPathParameters,
+	options?: InvalidateOptions,
+): Promise<QueryClient> => {
+	await queryClient.invalidateQueries(
+		{ queryKey: getGetSavedViewQueryKey({ id }) },
+		options,
+	);
+
+	return queryClient;
+};
+
+/**
+ * Replaces a saved view's name and query.
+ * @summary Update saved view
+ */
+export const updateSavedView = (
+	{ id }: UpdateSavedViewPathParameters,
+	savedviewtypesPostableSavedViewDTO?: BodyType<SavedviewtypesPostableSavedViewDTO>,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<void>({
+		url: `/api/v2/saved_views/${id}`,
+		method: 'PUT',
+		headers: { 'Content-Type': 'application/json' },
+		data: savedviewtypesPostableSavedViewDTO,
+		signal,
+	});
+};
+
+export const getUpdateSavedViewMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof updateSavedView>>,
+		TError,
+		{
+			pathParams: UpdateSavedViewPathParameters;
+			data?: BodyType<SavedviewtypesPostableSavedViewDTO>;
+		},
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof updateSavedView>>,
+	TError,
+	{
+		pathParams: UpdateSavedViewPathParameters;
+		data?: BodyType<SavedviewtypesPostableSavedViewDTO>;
+	},
+	TContext
+> => {
+	const mutationKey = ['updateSavedView'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof updateSavedView>>,
+		{
+			pathParams: UpdateSavedViewPathParameters;
+			data?: BodyType<SavedviewtypesPostableSavedViewDTO>;
+		}
+	> = (props) => {
+		const { pathParams, data } = props ?? {};
+
+		return updateSavedView(pathParams, data);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type UpdateSavedViewMutationResult = NonNullable<
+	Awaited<ReturnType<typeof updateSavedView>>
+>;
+export type UpdateSavedViewMutationBody =
+	| BodyType<SavedviewtypesPostableSavedViewDTO>
+	| undefined;
+export type UpdateSavedViewMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Update saved view
+ */
+export const useUpdateSavedView = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof updateSavedView>>,
+		TError,
+		{
+			pathParams: UpdateSavedViewPathParameters;
+			data?: BodyType<SavedviewtypesPostableSavedViewDTO>;
+		},
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof updateSavedView>>,
+	TError,
+	{
+		pathParams: UpdateSavedViewPathParameters;
+		data?: BodyType<SavedviewtypesPostableSavedViewDTO>;
+	},
+	TContext
+> => {
+	return useMutation(getUpdateSavedViewMutationOptions(options));
+};

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -8858,6 +8858,99 @@ export interface RuletypesRuleDTO {
 export enum RuletypesThresholdKindDTO {
 	basic = 'basic',
 }
+export interface SavedviewtypesDisplayDTO {
+	/**
+	 * @type string
+	 */
+	color?: string;
+	/**
+	 * @type string
+	 */
+	fontSize?: string;
+	/**
+	 * @type string
+	 */
+	format?: string;
+	/**
+	 * @type integer
+	 */
+	maxLines?: number;
+}
+
+export enum SavedviewtypesPanelTypeDTO {
+	value = 'value',
+	graph = 'graph',
+	table = 'table',
+	list = 'list',
+	trace = 'trace',
+}
+export interface SavedviewtypesSavedViewSpecDTO {
+	display: SavedviewtypesDisplayDTO;
+	panelType: SavedviewtypesPanelTypeDTO;
+	/**
+	 * @type array
+	 */
+	queries: Querybuildertypesv5QueryEnvelopeDTO[];
+	/**
+	 * @type array
+	 */
+	selectedFields: TelemetrytypesTelemetryFieldKeyDTO[];
+}
+
+export interface SavedviewtypesSavedViewDataDTO {
+	/**
+	 * @type string
+	 */
+	schemaVersion: string;
+	spec: SavedviewtypesSavedViewSpecDTO;
+}
+
+export enum SavedviewtypesSourcePageDTO {
+	traces = 'traces',
+	logs = 'logs',
+	metrics = 'metrics',
+	meter = 'meter',
+}
+export interface SavedviewtypesPostableSavedViewDTO {
+	data: SavedviewtypesSavedViewDataDTO;
+	/**
+	 * @type string
+	 */
+	name: string;
+	sourcePage: SavedviewtypesSourcePageDTO;
+}
+
+export interface SavedviewtypesSavedViewDTO {
+	/**
+	 * @type string
+	 * @format date-time
+	 */
+	createdAt?: string;
+	/**
+	 * @type string
+	 */
+	createdBy?: string;
+	data?: SavedviewtypesSavedViewDataDTO;
+	/**
+	 * @type string
+	 */
+	id: string;
+	/**
+	 * @type string
+	 */
+	name?: string;
+	sourcePage?: SavedviewtypesSourcePageDTO;
+	/**
+	 * @type string
+	 * @format date-time
+	 */
+	updatedAt?: string;
+	/**
+	 * @type string
+	 */
+	updatedBy?: string;
+}
+
 export interface ServiceaccounttypesDeprecatedPostableServiceAccountRoleDTO {
 	/**
 	 * @type string
@@ -12056,6 +12149,54 @@ export type TestRule200 = {
 	status: string;
 };
 
+export type ListSavedViewsParams = {
+	/**
+	 * @description undefined
+	 */
+	sourcePage?: SavedviewtypesSourcePageDTO;
+	/**
+	 * @type string
+	 * @description undefined
+	 */
+	name?: string;
+};
+
+export type ListSavedViews200 = {
+	/**
+	 * @type array,null
+	 */
+	data: SavedviewtypesSavedViewDTO[] | null;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type CreateSavedView200 = {
+	data: TypesIdentifiableDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type DeleteSavedViewPathParameters = {
+	id: string;
+};
+export type GetSavedViewPathParameters = {
+	id: string;
+};
+export type GetSavedView200 = {
+	data: SavedviewtypesSavedViewDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type UpdateSavedViewPathParameters = {
+	id: string;
+};
 export type GetSessionContext200 = {
 	data: AuthtypesSessionContextDTO;
 	/**

frontend/src/container/DashboardContainer/visualization/charts/ChartWrapper/ChartWrapper.tsx

@@ -37,6 +37,7 @@ export default function ChartWrapper({
 	groupByPerQuery,
 	customTooltip,
 	pinnedTooltipElement,
+	tooltipPortalRoot,
 	'data-testid': testId,
 }: ChartProps): JSX.Element {
 	const plotInstanceRef = useRef<uPlot | null>(null);
@@ -118,6 +119,7 @@ export default function ChartWrapper({
 								syncMetadata={syncMetadata}
 								render={renderTooltipCallback}
 								pinnedTooltipElement={pinnedTooltipElement}
+								portalRoot={tooltipPortalRoot}
 							/>
 						)}
 					</UPlotChart>

frontend/src/container/DashboardContainer/visualization/charts/types.ts

@@ -30,6 +30,7 @@ interface BaseChartProps {
 	pinnedTooltipElement?: (clickData: ChartClickData) => React.ReactNode;
 	renderTooltipFooter?: (args: IRenderTooltipFooterArgs) => React.ReactNode;
 	customTooltip?: (props: TooltipRenderArgs) => React.ReactNode;
+	tooltipPortalRoot?: HTMLElement | null;
 	'data-testid'?: string;
 }
 interface UPlotBasedChartProps {

frontend/src/container/InfraMonitoringK8sV2/Base/K8sBaseDetails.tsx

@@ -40,6 +40,9 @@ export type {
 
 // TODO(H4ad): Improve this on component level
 const DRAWER_TRANSITION = { duration: 0.3, ease: [0.25, 0.1, 0.25, 1] };
+// Be careful when changing these props, this must be animated with transform but later
+// replaced with none, otherwise, the tooltip of the chart will be not positioned correctly
+// due to how the tooltip positioning calculation works
 const DRAWER_MOTION_PROPS = {
 	onOpenAutoFocus: (e: Event): void => e.preventDefault(),
 	initial: { opacity: 0, transform: 'translateX(100%)' },
@@ -47,6 +50,7 @@ const DRAWER_MOTION_PROPS = {
 		opacity: 1,
 		transform: 'translateX(0%)',
 		transition: DRAWER_TRANSITION,
+		transitionEnd: { transform: 'none' },
 	},
 	exit: {
 		opacity: 0,

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/ChartTooltipFooter.module.scss

@@ -0,0 +1,38 @@
+.footer {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	gap: var(--spacing-5);
+	padding: var(--spacing-4) var(--spacing-6);
+	border-top: 1px dashed var(--l2-border);
+	background: var(--l1-background);
+	border-radius: 0 0 6px 6px;
+}
+
+.hintList {
+	display: flex;
+	flex-direction: column;
+	gap: var(--spacing-4);
+	padding: var(--spacing-2) var(--spacing-8);
+	margin: 0;
+}
+
+.hint {
+	--typography-text-display: flex;
+	align-items: center;
+	gap: var(--spacing-3);
+	position: relative;
+
+	&[data-active='false']::before {
+		content: '';
+		position: absolute;
+		top: 50%;
+		left: -12px;
+		transform: translateY(-50%);
+		width: 4px;
+		height: 4px;
+		border-radius: 50%;
+		background: var(--l2-foreground);
+		opacity: 0.5;
+	}
+}

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/ChartTooltipFooter.tsx

@@ -0,0 +1,82 @@
+import { MousePointerClick, X } from '@signozhq/icons';
+import { Button } from '@signozhq/ui/button';
+import { Kbd } from '@signozhq/ui/kbd';
+import logEvent from 'api/common/logEvent';
+import { Events } from 'constants/events';
+import { DEFAULT_PIN_TOOLTIP_KEY } from 'lib/uPlotV2/plugins/TooltipPlugin/types';
+
+import styles from './ChartTooltipFooter.module.scss';
+import { Typography } from '@signozhq/ui/typography';
+
+interface ChartTooltipFooterProps {
+	id: string;
+	pinKey?: string;
+	isPinned: boolean;
+	canSelectTimeRange?: boolean;
+	dismiss: () => void;
+}
+
+export default function ChartTooltipFooter({
+	id,
+	pinKey = DEFAULT_PIN_TOOLTIP_KEY,
+	isPinned,
+	canSelectTimeRange = true,
+	dismiss,
+}: ChartTooltipFooterProps): JSX.Element {
+	const handleUnpinClick = (): void => {
+		void logEvent(Events.TOOLTIP_UNPINNED, {
+			id,
+		});
+		dismiss();
+	};
+
+	return (
+		<output className={styles.footer} data-testid="entity-chart-tooltip-footer">
+			<div>
+				{isPinned ? (
+					<Typography.Text className={styles.hint} size="small">
+						<span>Press</span>
+						<Kbd active>{pinKey.toUpperCase()}</Kbd>
+						<span>or</span>
+						<Kbd active>Esc</Kbd>
+						<span>to unpin</span>
+					</Typography.Text>
+				) : (
+					<div className={styles.hintList}>
+						{canSelectTimeRange && (
+							<Typography.Text
+								className={styles.hint}
+								size="small"
+								data-active="false"
+							>
+								<Kbd>
+									<MousePointerClick size={12} />
+								</Kbd>
+								<span>Click and drag to zoom into a time range</span>
+							</Typography.Text>
+						)}
+						<Typography.Text className={styles.hint} size="small" data-active="false">
+							<span>Press</span>
+							<Kbd>{pinKey.toUpperCase()}</Kbd>
+							<span>to pin the tooltip</span>
+						</Typography.Text>
+					</div>
+				)}
+			</div>
+
+			{isPinned && (
+				<Button
+					variant="outlined"
+					color="secondary"
+					size="sm"
+					onClick={handleUnpinClick}
+					aria-label="Unpin tooltip"
+					data-testid="entity-chart-tooltip-unpin"
+				>
+					<X size={10} />
+					<span>Unpin</span>
+				</Button>
+			)}
+		</output>
+	);
+}

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/EntityMetrics.tsx

@@ -1,11 +1,14 @@
-import { useCallback, useMemo, useRef } from 'react';
+import { useCallback, useMemo, useRef, useState } from 'react';
 import { UseQueryResult } from 'react-query';
 import { Skeleton } from 'antd';
 import cx from 'classnames';
 import { InfraMonitoringEvents } from 'constants/events';
 import { PANEL_TYPES } from 'constants/queryBuilder';
 import TimeSeries from 'container/DashboardContainer/visualization/charts/TimeSeries/TimeSeries';
-import { LegendPosition } from 'lib/uPlotV2/components/types';
+import {
+	IRenderTooltipFooterArgs,
+	LegendPosition,
+} from 'lib/uPlotV2/components/types';
 import {
 	InfraMonitoringEntity,
 	VIEW_TYPES,
@@ -33,6 +36,7 @@ import { isKeyNotFoundError } from '../utils';
 import styles from './EntityMetrics.module.scss';
 import { MetricsTable } from './MetricsTable';
 import { logInfraExplorerNavigatedEvent } from 'container/InfraMonitoringK8sV2/Base/events';
+import ChartTooltipFooter from './ChartTooltipFooter';
 
 interface EntityMetricsProps<T> {
 	entity: T;
@@ -78,6 +82,10 @@ function EntityMetrics<T>({
 		category,
 	});
 
+	const [tooltipPortalEl, setTooltipPortalEl] = useState<HTMLDivElement | null>(
+		null,
+	);
+
 	const isDarkMode = useIsDarkMode();
 	const { timezone } = useTimezone();
 	const graphRef = useRef<HTMLDivElement>(null);
@@ -171,6 +179,18 @@ function EntityMetrics<T>({
 							height={dimensions.height}
 							timezone={timezone}
 							yAxisUnit={entityWidgetInfo[idx].yAxisUnit}
+							canPinTooltip
+							tooltipPortalRoot={tooltipPortalEl ?? undefined}
+							renderTooltipFooter={({
+								isPinned,
+								dismiss,
+							}: IRenderTooltipFooterArgs) => (
+								<ChartTooltipFooter
+									id={configs[idx]?.getId() || idx.toString()}
+									isPinned={isPinned}
+									dismiss={dismiss}
+								/>
+							)}
 						/>
 					)
 				)}
@@ -180,6 +200,8 @@ function EntityMetrics<T>({
 
 	return (
 		<>
+			<div ref={setTooltipPortalEl} style={{ display: 'contents' }} />
+
 			<div className={styles.metricsHeader}>
 				<EntityDateTimeSelector
 					eventEntity={eventEntity}

frontend/src/lib/uPlotV2/plugins/TooltipPlugin/TooltipPlugin.tsx

@@ -51,6 +51,7 @@ export default function TooltipPlugin({
 	canPinTooltip = false,
 	pinKey = DEFAULT_PIN_TOOLTIP_KEY,
 	onClick,
+	portalRoot: portalRootProp,
 }: TooltipPluginProps): JSX.Element | null {
 	const containerRef = useRef<HTMLDivElement>(null);
 	const rafId = useRef<number | null>(null);
@@ -59,7 +60,9 @@ export default function TooltipPlugin({
 	const renderRef = useRef(render);
 	renderRef.current = render;
 	const [portalRoot, setPortalRoot] = useState<HTMLElement>(
-		(document.fullscreenElement as HTMLElement) ?? document.body,
+		portalRootProp ??
+			(document.fullscreenElement as HTMLElement) ??
+			document.body,
 	);
 
 	// React-managed snapshot of what should be rendered. The controller
@@ -464,8 +467,12 @@ export default function TooltipPlugin({
 	}, [config]);
 
 	const resolvePortalRoot = useCallback((): void => {
-		setPortalRoot((document.fullscreenElement as HTMLElement) ?? document.body);
-	}, []);
+		setPortalRoot(
+			portalRootProp ??
+				(document.fullscreenElement as HTMLElement) ??
+				document.body,
+		);
+	}, [portalRootProp]);
 
 	useLayoutEffect((): (() => void) => {
 		resolvePortalRoot();

frontend/src/lib/uPlotV2/plugins/TooltipPlugin/types.ts

@@ -67,6 +67,7 @@ export interface TooltipPluginProps {
 	pinnedTooltipElement?: (clickData: ChartClickData) => ReactNode;
 	maxWidth?: number;
 	maxHeight?: number;
+	portalRoot?: HTMLElement | null;
 }
 
 export interface ChartClickData {

go.mod

@@ -223,7 +223,7 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/cel-go v0.28.0 // indirect
+	github.com/google/cel-go v0.29.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
 	github.com/googleapis/gax-go/v2 v2.18.0 // indirect
@@ -392,9 +392,9 @@ require (
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.44.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d
-	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478
+	google.golang.org/grpc v1.82.1 // indirect
 	gopkg.in/telebot.v3 v3.3.8 // indirect
 	k8s.io/client-go v0.35.3 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect

go.sum

@@ -247,8 +247,8 @@ github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/coder/quartz v0.3.0 h1:bUoSEJ77NBfKtUqv6CPSC0AS8dsjqAqqAv7bN02m1mg=
 github.com/coder/quartz v0.3.0/go.mod h1:BgE7DOj/8NfvRgvKw0jPLDQH/2Lya2kxcTaNJ8X0rZk=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -507,8 +507,8 @@ github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Z
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.28.0 h1:KjSWstCpz/MN5t4a8gnGJNIYUsJRpdi/r97xWDphIQc=
-github.com/google/cel-go v0.28.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
+github.com/google/cel-go v0.29.0 h1:fEG+Ja3YRwNOqnQxTyJwoByAUAvTuxUGiro/jhrm4F4=
+github.com/google/cel-go v0.29.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
 github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
 github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -1856,10 +1856,10 @@ google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP
 google.golang.org/genproto v0.0.0-20220519153652-3a47de7e79bd/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20260217215200-42d3e9bedb6d h1:vsOm753cOAMkt76efriTCDKjpCbK18XGHMJHo0JUKhc=
 google.golang.org/genproto v0.0.0-20260217215200-42d3e9bedb6d/go.mod h1:0oz9d7g9QLSdv9/lgbIjowW1JoxMbxmBVNe8i6tORJI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -1892,8 +1892,8 @@ google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ5
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
 google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

pkg/apiserver/signozapiserver/dashboard.go

@@ -14,371 +14,592 @@ import (
 )
 
 func (provider *provider) addDashboardRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/dashboards", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.ListV2), handler.OpenAPIDef{
-		ID:                  "ListDashboardsV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "List dashboards (v2)",
-		Description:         "Returns a page of v2-shape dashboards for the org. This is the pure, user-independent list — it carries no pin state. Use ListDashboardsForUserV2 for the personalized, pin-aware list. Supports a filter DSL (`query`), sort (`updated_at`/`created_at`/`name`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`).",
-		Request:             nil,
-		RequestQuery:        new(dashboardtypes.ListDashboardsV2Params),
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.ListableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.ListV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDashboardsV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "List dashboards (v2)",
+			Description:         "Returns a page of v2-shape dashboards for the org. This is the pure, user-independent list — it carries no pin state. Use ListDashboardsForUserV2 for the personalized, pin-aware list. Supports a filter DSL (`query`), sort (`updated_at`/`created_at`/`name`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`).",
+			Request:             nil,
+			RequestQuery:        new(dashboardtypes.ListDashboardsV2Params),
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.ListableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/me/dashboards", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.ListForUserV2), handler.OpenAPIDef{
-		ID:                  "ListDashboardsForUserV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "List dashboards for the current user (v2)",
-		Description:         "Same as ListDashboardsV2 but personalized for the calling user: each dashboard carries the caller's `pinned` state, and pinned dashboards float to the top of the requested ordering. Supports the same filter DSL, sort, order, and pagination.",
-		Request:             nil,
-		RequestQuery:        new(dashboardtypes.ListDashboardsV2Params),
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.ListableDashboardForUserV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/me/dashboards", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.ListForUserV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDashboardsForUserV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "List dashboards for the current user (v2)",
+			Description:         "Same as ListDashboardsV2 but personalized for the calling user: each dashboard carries the caller's `pinned` state, and pinned dashboards float to the top of the requested ordering. Supports the same filter DSL, sort, order, and pagination.",
+			Request:             nil,
+			RequestQuery:        new(dashboardtypes.ListDashboardsV2Params),
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.ListableDashboardForUserV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.CreateV2), handler.OpenAPIDef{
-		ID:                  "CreateDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Create dashboard (v2)",
-		Description:         "This endpoint creates a dashboard in the v2 format that follows Perses spec.",
-		Request:             new(dashboardtypes.PostableDashboardV2),
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		// TODO: add http.StatusConflict once the dashboard name unique index is added.
-		ErrorStatusCodes: []int{http.StatusBadRequest},
-		Deprecated:       false,
-		SecuritySchemes:  newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.CreateV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Create dashboard (v2)",
+			Description:         "This endpoint creates a dashboard in the v2 format that follows Perses spec.",
+			Request:             new(dashboardtypes.PostableDashboardV2),
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			// TODO: add http.StatusConflict once the dashboard name unique index is added.
+			ErrorStatusCodes: []int{http.StatusBadRequest},
+			Deprecated:       false,
+			SecuritySchemes:  newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbCreate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards/{id}/clone", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.CloneV2), handler.OpenAPIDef{
-		ID:                  "CloneDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Clone dashboard (v2)",
-		Description:         "This endpoint clones an existing v2-shape dashboard. User and integration dashboards can be cloned; system dashboards are rejected. The clone keeps the source's display name, panels, and tags, but gets a freshly generated unique internal name and is always created as an unlocked user dashboard owned by the caller.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	// Two defs: the clone reads the source dashboard and creates a new one, so
+	// both read on the source id and create on the collection are checked.
+	if err := router.Handle("/api/v2/dashboards/{id}/clone", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.CloneV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CloneDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Clone dashboard (v2)",
+			Description:         "This endpoint clones an existing v2-shape dashboard. User and integration dashboards can be cloned; system dashboards are rejected. The clone keeps the source's display name, panels, and tags, but gets a freshly generated unique internal name and is always created as an unlocked user dashboard owned by the caller.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbRead),
+				coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbCreate),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceDashboard,
+				Verb:     coretypes.VerbRead,
+				Category: coretypes.ActionCategoryDataAccess,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceDashboard,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards/{id}/migrate", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.MigrateV2), handler.OpenAPIDef{
-		ID:                  "MigrateDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Migrate dashboard to v2",
-		Description:         "This endpoint retries the v1→v2 (Perses) migration on a dashboard still stored in the v1 schema and returns the v2-shape result. It is idempotent: a dashboard already in the v2 schema is returned unchanged.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}/migrate", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.MigrateV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "MigrateDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Migrate dashboard to v2",
+			Description:         "This endpoint retries the v1→v2 (Perses) migration on a dashboard still stored in the v1 schema and returns the v2-shape result. It is idempotent: a dashboard already in the v2 schema is returned unchanged.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.GetV2), handler.OpenAPIDef{
-		ID:                  "GetDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Get dashboard (v2)",
-		Description:         "This endpoint returns a v2-shape dashboard.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.GetV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Get dashboard (v2)",
+			Description:         "This endpoint returns a v2-shape dashboard.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.UpdateV2), handler.OpenAPIDef{
-		ID:                  "UpdateDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Update dashboard (v2)",
-		Description:         "This endpoint updates a v2-shape dashboard's metadata, data, and tag set. Locked dashboards are rejected.",
-		Request:             new(dashboardtypes.UpdatableDashboardV2),
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UpdateV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Update dashboard (v2)",
+			Description:         "This endpoint updates a v2-shape dashboard's metadata, data, and tag set. Locked dashboards are rejected.",
+			Request:             new(dashboardtypes.UpdatableDashboardV2),
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.PatchV2), handler.OpenAPIDef{
-		ID:          "PatchDashboardV2",
-		Tags:        []string{"dashboard"},
-		Summary:     "Patch dashboard (v2)",
-		Description: "This endpoint applies an RFC 6902 JSON Patch to a v2-shape dashboard. The patch is applied against the postable view of the dashboard (metadata, data, tags), so individual panels, queries, variables, layouts, or tags can be updated without re-sending the rest of the dashboard. Apply is lenient: `remove` on a missing path is a no-op (idempotent) and `add` creates any missing parent objects, rather than failing as strict RFC 6902 would. The resulting dashboard is still validated. Locked dashboards are rejected.",
-		Request:     new(dashboardtypes.PatchableDashboardV2),
-		// Strictly per RFC 6902 the content type is `application/json-patch+json`,
-		// but our OpenAPI generator only reflects schemas for content types it
-		// understands (application/json, form-urlencoded, multipart) — anything
-		// else degrades to `type: string`. Declaring application/json here keeps
-		// the array-of-ops schema visible to spec consumers; the runtime decoder
-		// parses JSON regardless of the request's actual Content-Type header.
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPatch).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.PatchV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:          "PatchDashboardV2",
+			Tags:        []string{"dashboard"},
+			Summary:     "Patch dashboard (v2)",
+			Description: "This endpoint applies an RFC 6902 JSON Patch to a v2-shape dashboard. The patch is applied against the postable view of the dashboard (metadata, data, tags), so individual panels, queries, variables, layouts, or tags can be updated without re-sending the rest of the dashboard. Apply is lenient: `remove` on a missing path is a no-op (idempotent) and `add` creates any missing parent objects, rather than failing as strict RFC 6902 would. The resulting dashboard is still validated. Locked dashboards are rejected.",
+			Request:     new(dashboardtypes.PatchableDashboardV2),
+			// Strictly per RFC 6902 the content type is `application/json-patch+json`,
+			// but our OpenAPI generator only reflects schemas for content types it
+			// understands (application/json, form-urlencoded, multipart) — anything
+			// else degrades to `type: string`. Declaring application/json here keeps
+			// the array-of-ops schema visible to spec consumers; the runtime decoder
+			// parses JSON regardless of the request's actual Content-Type header.
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.DeleteV2), handler.OpenAPIDef{
-		ID:                  "DeleteDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Delete dashboard (v2)",
-		Description:         "This endpoint deletes a v2-shape dashboard along with its tag relations. Locked dashboards are rejected.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.DeleteV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Delete dashboard (v2)",
+			Description:         "This endpoint deletes a v2-shape dashboard along with its tag relations. Locked dashboards are rejected.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards/{id}/lock", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.LockV2), handler.OpenAPIDef{
-		ID:                  "LockDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Lock dashboard (v2)",
-		Description:         "This endpoint locks a v2-shape dashboard. Only the dashboard's creator or an org admin may lock or unlock.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}/lock", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.LockV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "LockDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Lock dashboard (v2)",
+			Description:         "This endpoint locks a v2-shape dashboard. Only the dashboard's creator or an org admin may lock or unlock.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboards/{id}/lock", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.UnlockV2), handler.OpenAPIDef{
-		ID:                  "UnlockDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Unlock dashboard (v2)",
-		Description:         "This endpoint unlocks a v2-shape dashboard. Only the dashboard's creator or an org admin may lock or unlock.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}/lock", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UnlockV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UnlockDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Unlock dashboard (v2)",
+			Description:         "This endpoint unlocks a v2-shape dashboard. Only the dashboard's creator or an org admin may lock or unlock.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	// ViewAccess: pinning only mutates the calling user's pin list, not the
-	// dashboard itself — anyone who can view a dashboard can bookmark it.
-	if err := router.Handle("/api/v2/users/me/dashboards/{id}/pins", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.PinV2), handler.OpenAPIDef{
-		ID:                  "PinDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Pin a dashboard for the current user (v2)",
-		Description:         "Pins the dashboard for the calling user. A user can pin at most 10 dashboards; pinning when at the limit returns 409. Re-pinning an already-pinned dashboard is a no-op success.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound, http.StatusConflict},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	// Pinning mutates the calling user's pin list, not the dashboard, so it rides
+	// on the collection-level list permission rather than a per-dashboard check.
+	// The id is still extracted, for audit.
+	if err := router.Handle("/api/v2/users/me/dashboards/{id}/pins", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.PinV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "PinDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Pin a dashboard for the current user (v2)",
+			Description:         "Pins the dashboard for the calling user. A user can pin at most 10 dashboards; pinning when at the limit returns 409. Re-pinning an already-pinned dashboard is a no-op success.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound, http.StatusConflict},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/me/dashboards/{id}/pins", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.UnpinV2), handler.OpenAPIDef{
-		ID:                  "UnpinDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Unpin a dashboard for the current user (v2)",
-		Description:         "Removes the pin for the calling user. Idempotent — unpinning a dashboard that wasn't pinned still returns 204.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/me/dashboards/{id}/pins", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UnpinV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UnpinDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Unpin a dashboard for the current user (v2)",
+			Description:         "Removes the pin for the calling user. Idempotent — unpinning a dashboard that wasn't pinned still returns 204.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboard_views", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.ListViews), handler.OpenAPIDef{
-		ID:                  "ListDashboardViews",
-		Tags:                []string{"dashboard"},
-		Summary:             "List dashboard saved views",
-		Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.ListableDashboardView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	// Saved views hold dashboard listing state (query, sort, order) rather than any
+	// one dashboard, so all four ride on the collection-level list permission.
+	if err := router.Handle("/api/v2/dashboard_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.ListViews, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDashboardViews",
+			Tags:                []string{"dashboard"},
+			Summary:             "List dashboard saved views",
+			Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.ListableDashboardView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboard_views", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.CreateView), handler.OpenAPIDef{
-		ID:                  "CreateDashboardView",
-		Tags:                []string{"dashboard"},
-		Summary:             "Create dashboard saved view",
-		Description:         "Persists the calling user's dashboard listing state (query, sort, order) as a named, reusable view shared across the org.",
-		Request:             new(dashboardtypes.PostableDashboardView),
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.DashboardView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboard_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.CreateView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateDashboardView",
+			Tags:                []string{"dashboard"},
+			Summary:             "Create dashboard saved view",
+			Description:         "Persists the calling user's dashboard listing state (query, sort, order) as a named, reusable view shared across the org.",
+			Request:             new(dashboardtypes.PostableDashboardView),
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.DashboardView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboard_views/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.UpdateView), handler.OpenAPIDef{
-		ID:                  "UpdateDashboardView",
-		Tags:                []string{"dashboard"},
-		Summary:             "Update dashboard saved view",
-		Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
-		Request:             new(dashboardtypes.UpdatableDashboardView),
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.DashboardView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboard_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UpdateView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateDashboardView",
+			Tags:                []string{"dashboard"},
+			Summary:             "Update dashboard saved view",
+			Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
+			Request:             new(dashboardtypes.UpdatableDashboardView),
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.DashboardView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/dashboard_views/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.DeleteView), handler.OpenAPIDef{
-		ID:                  "DeleteDashboardView",
-		Tags:                []string{"dashboard"},
-		Summary:             "Delete dashboard saved view",
-		Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboard_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.DeleteView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteDashboardView",
+			Tags:                []string{"dashboard"},
+			Summary:             "Delete dashboard saved view",
+			Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(provider.authzMiddleware.AdminAccess(provider.dashboardHandler.CreatePublic), handler.OpenAPIDef{
-		ID:                  "CreatePublicDashboard",
-		Tags:                []string{"dashboard"},
-		Summary:             "Create public dashboard",
-		Description:         "This endpoint creates public sharing config and enables public sharing of the dashboard",
-		Request:             new(dashboardtypes.PostablePublicDashboard),
-		RequestContentType:  "",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.CreatePublic, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreatePublicDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Create public dashboard",
+			Description:         "This endpoint creates public sharing config and enables public sharing of the dashboard",
+			Request:             new(dashboardtypes.PostablePublicDashboard),
+			RequestContentType:  "",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(provider.authzMiddleware.AdminAccess(provider.dashboardHandler.GetPublic), handler.OpenAPIDef{
-		ID:                  "GetPublicDashboard",
-		Tags:                []string{"dashboard"},
-		Summary:             "Get public dashboard",
-		Description:         "This endpoint returns public sharing config for a dashboard",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.GettablePublicDasbhboard),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.GetPublic, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetPublicDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Get public dashboard",
+			Description:         "This endpoint returns public sharing config for a dashboard",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettablePublicDasbhboard),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(provider.authzMiddleware.AdminAccess(provider.dashboardHandler.UpdatePublic), handler.OpenAPIDef{
-		ID:                  "UpdatePublicDashboard",
-		Tags:                []string{"dashboard"},
-		Summary:             "Update public dashboard",
-		Description:         "This endpoint updates the public sharing config for a dashboard",
-		Request:             new(dashboardtypes.UpdatablePublicDashboard),
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UpdatePublic, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdatePublicDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Update public dashboard",
+			Description:         "This endpoint updates the public sharing config for a dashboard",
+			Request:             new(dashboardtypes.UpdatablePublicDashboard),
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(provider.authzMiddleware.AdminAccess(provider.dashboardHandler.DeletePublic), handler.OpenAPIDef{
-		ID:                  "DeletePublicDashboard",
-		Tags:                []string{"dashboard"},
-		Summary:             "Delete public dashboard",
-		Description:         "This endpoint deletes the public sharing config and disables the public sharing of a dashboard",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.DeletePublic, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeletePublicDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Delete public dashboard",
+			Description:         "This endpoint deletes the public sharing config and disables the public sharing of a dashboard",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 

pkg/apiserver/signozapiserver/provider.go

@@ -25,6 +25,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/promote"
 	"github.com/SigNoz/signoz/pkg/modules/rawdataexport"
 	"github.com/SigNoz/signoz/pkg/modules/rulestatehistory"
+	"github.com/SigNoz/signoz/pkg/modules/savedview"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/session"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
@@ -75,6 +76,7 @@ type provider struct {
 	rulerHandler               ruler.Handler
 	llmPricingRuleHandler      llmpricingrule.Handler
 	statsHandler               statsreporter.Handler
+	savedViewHandler           savedview.Handler
 }
 
 func NewFactory(
@@ -110,6 +112,7 @@ func NewFactory(
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
+	savedViewHandler savedview.Handler,
 ) factory.ProviderFactory[apiserver.APIServer, apiserver.Config] {
 	return factory.NewProviderFactory(factory.MustNewName("signoz"), func(ctx context.Context, providerSettings factory.ProviderSettings, config apiserver.Config) (apiserver.APIServer, error) {
 		return newProvider(
@@ -148,6 +151,7 @@ func NewFactory(
 			traceDetailHandler,
 			rulerHandler,
 			statsHandler,
+			savedViewHandler,
 		)
 	})
 }
@@ -188,6 +192,7 @@ func newProvider(
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
+	savedViewHandler savedview.Handler,
 ) (apiserver.APIServer, error) {
 	settings := factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/apiserver/signozapiserver")
 	router := mux.NewRouter().UseEncodedPath()
@@ -227,6 +232,7 @@ func newProvider(
 		rulerHandler:               rulerHandler,
 		llmPricingRuleHandler:      llmPricingRuleHandler,
 		statsHandler:               statsHandler,
+		savedViewHandler:           savedViewHandler,
 	}
 
 	provider.authzMiddleware = middleware.NewAuthZ(settings.Logger(), orgGetter, authzService)
@@ -359,6 +365,10 @@ func (provider *provider) AddToRouter(router *mux.Router) error {
 		return err
 	}
 
+	if err := provider.addSavedViewRoutes(router); err != nil {
+		return err
+	}
+
 	return nil
 }
 

pkg/apiserver/signozapiserver/savedview.go

@@ -0,0 +1,151 @@
+package signozapiserver
+
+import (
+	"net/http"
+
+	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
+	"github.com/gorilla/mux"
+)
+
+func (provider *provider) addSavedViewRoutes(router *mux.Router) error {
+	if err := router.Handle("/api/v2/saved_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.savedViewHandler.ListV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListSavedViews",
+			Tags:                []string{"saved_view"},
+			Summary:             "List saved views",
+			Description:         "Returns saved views, optionally filtered by source page and name.",
+			Request:             nil,
+			RequestQuery:        new(savedviewtypes.ListSavedViewsParams),
+			RequestContentType:  "",
+			Response:            new([]*savedviewtypes.SavedView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSavedView.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSavedView,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v2/saved_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.savedViewHandler.CreateV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateSavedView",
+			Tags:                []string{"saved_view"},
+			Summary:             "Create saved view",
+			Description:         "Persists a saved view for the explore page. Returns the id of the created view.",
+			Request:             new(savedviewtypes.PostableSavedView),
+			RequestContentType:  "application/json",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSavedView.Scope(coretypes.VerbCreate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSavedView,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v2/saved_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.savedViewHandler.GetV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetSavedView",
+			Tags:                []string{"saved_view"},
+			Summary:             "Get saved view",
+			Description:         "Returns a saved view by id.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(savedviewtypes.SavedView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSavedView.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSavedView,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v2/saved_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.savedViewHandler.UpdateV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateSavedView",
+			Tags:                []string{"saved_view"},
+			Summary:             "Update saved view",
+			Description:         "Replaces a saved view's name and query.",
+			Request:             new(savedviewtypes.UpdatableSavedView),
+			RequestContentType:  "application/json",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSavedView.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSavedView,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v2/saved_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.savedViewHandler.Delete, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteSavedView",
+			Tags:                []string{"saved_view"},
+			Summary:             "Delete saved view",
+			Description:         "Deletes a saved view by id.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSavedView.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSavedView,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
+		return err
+	}
+
+	return nil
+}

pkg/modules/savedview/implsavedview/handler.go

@@ -11,6 +11,8 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/savedview"
 	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
@@ -23,6 +25,85 @@ func NewHandler(module savedview.Module) savedview.Handler {
 	return &handler{module: module}
 }
 
+// legacyExtraData mirrors the frontend's extraData JSON shape so /api/v1
+// responses can synthesize the same shape back for the legacy frontend.
+type legacyExtraData struct {
+	Color         string                             `json:"color,omitempty"`
+	SelectColumns []telemetrytypes.TelemetryFieldKey `json:"selectColumns,omitempty"`
+	Format        string                             `json:"format,omitempty"`
+	MaxLines      int                                `json:"maxLines,omitempty"`
+	FontSize      string                             `json:"fontSize,omitempty"`
+}
+
+func newPostableSavedViewFromLegacyView(v *v3.SavedView) savedviewtypes.PostableSavedView {
+	var legacy legacyExtraData
+	if v.ExtraData != "" {
+		// Best-effort: malformed/older extraData shapes never fail the request
+		_ = json.Unmarshal([]byte(v.ExtraData), &legacy)
+	}
+
+	return savedviewtypes.PostableSavedView{
+		Name:       v.Name,
+		SourcePage: savedviewtypes.SourcePage{String: valuer.NewString(v.SourcePage)},
+		Data: savedviewtypes.SavedViewData{
+			SchemaVersion: savedviewtypes.SavedViewSchemaVersion,
+			Spec: savedviewtypes.SavedViewSpec{
+				PanelType:      savedviewtypes.PanelType{String: valuer.NewString(string(v.CompositeQuery.PanelType))},
+				Queries:        v.CompositeQuery.Queries,
+				SelectedFields: legacy.SelectColumns,
+				Display: savedviewtypes.Display{
+					MaxLines: legacy.MaxLines,
+					FontSize: legacy.FontSize,
+					Format:   legacy.Format,
+					Color:    legacy.Color,
+				},
+			},
+		},
+	}
+}
+
+func newLegacyViewFromSavedView(v *savedviewtypes.SavedView) (*v3.SavedView, error) {
+	extraData, err := json.Marshal(legacyExtraData{
+		Color:         v.Data.Spec.Display.Color,
+		SelectColumns: v.Data.Spec.SelectedFields,
+		Format:        v.Data.Spec.Display.Format,
+		MaxLines:      v.Data.Spec.Display.MaxLines,
+		FontSize:      v.Data.Spec.Display.FontSize,
+	})
+	if err != nil {
+		return nil, errors.WrapInternalf(err, errors.CodeInternal, "error in marshalling extra data")
+	}
+
+	return &v3.SavedView{
+		ID:         v.ID,
+		Name:       v.Name,
+		CreatedAt:  v.CreatedAt,
+		CreatedBy:  v.CreatedBy,
+		UpdatedAt:  v.UpdatedAt,
+		UpdatedBy:  v.UpdatedBy,
+		SourcePage: v.SourcePage.StringValue(),
+		CompositeQuery: &v3.CompositeQuery{
+			PanelType: v3.PanelType(v.Data.Spec.PanelType.StringValue()),
+			// Saved views are only ever created from the explorer's builder mode.
+			QueryType: v3.QueryTypeBuilder,
+			Queries:   v.Data.Spec.Queries,
+		},
+		ExtraData: string(extraData),
+	}, nil
+}
+
+func newLegacyViewsFromSavedViews(views []*savedviewtypes.SavedView) ([]*v3.SavedView, error) {
+	out := make([]*v3.SavedView, 0, len(views))
+	for _, view := range views {
+		legacyView, err := newLegacyViewFromSavedView(view)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, legacyView)
+	}
+	return out, nil
+}
+
 func (handler *handler) Create(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
@@ -44,7 +125,7 @@ func (handler *handler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	uuid, err := handler.module.CreateView(ctx, claims.OrgID, view)
+	uuid, err := handler.module.CreateView(ctx, claims.OrgID, newPostableSavedViewFromLegacyView(&view))
 	if err != nil {
 		render.Error(w, err)
 		return
@@ -63,7 +144,7 @@ func (handler *handler) Get(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	viewID := mux.Vars(r)["viewId"]
+	viewID := mux.Vars(r)["id"]
 	viewUUID, err := valuer.NewUUID(viewID)
 	if err != nil {
 		render.Error(w, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to parse view id"))
@@ -76,7 +157,13 @@ func (handler *handler) Get(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	render.Success(w, http.StatusOK, view)
+	legacyView, err := newLegacyViewFromSavedView(view)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	render.Success(w, http.StatusOK, legacyView)
 }
 
 func (handler *handler) Update(w http.ResponseWriter, r *http.Request) {
@@ -89,7 +176,7 @@ func (handler *handler) Update(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	viewID := mux.Vars(r)["viewId"]
+	viewID := mux.Vars(r)["id"]
 	viewUUID, err := valuer.NewUUID(viewID)
 	if err != nil {
 		render.Error(w, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to parse view id"))
@@ -106,7 +193,7 @@ func (handler *handler) Update(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = handler.module.UpdateView(ctx, claims.OrgID, viewUUID, view)
+	err = handler.module.UpdateView(ctx, claims.OrgID, viewUUID, newPostableSavedViewFromLegacyView(&view))
 	if err != nil {
 		render.Error(w, err)
 		return
@@ -125,7 +212,7 @@ func (handler *handler) Delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	viewID := mux.Vars(r)["viewId"]
+	viewID := mux.Vars(r)["id"]
 	viewUUID, err := valuer.NewUUID(viewID)
 	if err != nil {
 		render.Error(w, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to parse view id"))
@@ -153,13 +240,18 @@ func (handler *handler) List(w http.ResponseWriter, r *http.Request) {
 
 	sourcePage := r.URL.Query().Get("sourcePage")
 	name := r.URL.Query().Get("name")
-	category := r.URL.Query().Get("category")
 
-	queries, err := handler.module.GetViewsForFilters(r.Context(), claims.OrgID, sourcePage, name, category)
+	views, err := handler.module.GetViewsForFilters(r.Context(), claims.OrgID, savedviewtypes.SourcePage{String: valuer.NewString(sourcePage)}, name)
 	if err != nil {
 		render.Error(w, err)
 		return
 	}
 
-	render.Success(w, http.StatusOK, queries)
+	legacyViews, err := newLegacyViewsFromSavedViews(views)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	render.Success(w, http.StatusOK, legacyViews)
 }

pkg/modules/savedview/implsavedview/handler_test.go

@@ -0,0 +1,173 @@
+package implsavedview
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func testQueries() []qbtypes.QueryEnvelope {
+	return []qbtypes.QueryEnvelope{
+		{
+			Type: qbtypes.QueryTypeBuilder,
+			Spec: qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]{
+				Signal:       telemetrytypes.SignalLogs,
+				Aggregations: []qbtypes.LogAggregation{{Expression: "count()"}},
+			},
+		},
+	}
+}
+
+func TestNewPostableSavedViewFromLegacyView(t *testing.T) {
+	t.Run("all fields carried over", func(t *testing.T) {
+		legacy := &v3.SavedView{
+			Name:       "my view",
+			SourcePage: "logs",
+			CompositeQuery: &v3.CompositeQuery{
+				PanelType: v3.PanelTypeGraph,
+				Queries:   testQueries(),
+			},
+			ExtraData: `{"color":"blue","selectColumns":[{"name":"service.name"}],"format":"table","maxLines":10,"fontSize":"large"}`,
+		}
+
+		postable := newPostableSavedViewFromLegacyView(legacy)
+
+		assert.Equal(t, "my view", postable.Name)
+		assert.Equal(t, savedviewtypes.SourcePageLogs, postable.SourcePage)
+		assert.Equal(t, savedviewtypes.SavedViewSchemaVersion, postable.Data.SchemaVersion)
+		assert.Equal(t, savedviewtypes.PanelTypeGraph, postable.Data.Spec.PanelType)
+		assert.Equal(t, legacy.CompositeQuery.Queries, postable.Data.Spec.Queries)
+		assert.Equal(t, []telemetrytypes.TelemetryFieldKey{{Name: "service.name"}}, postable.Data.Spec.SelectedFields)
+		assert.Equal(t, savedviewtypes.Display{MaxLines: 10, FontSize: "large", Format: "table", Color: "blue"}, postable.Data.Spec.Display)
+	})
+
+	t.Run("empty extra data leaves display and selected fields zero-valued", func(t *testing.T) {
+		legacy := &v3.SavedView{
+			Name:       "no extra data",
+			SourcePage: "traces",
+			CompositeQuery: &v3.CompositeQuery{
+				PanelType: v3.PanelTypeTable,
+				Queries:   testQueries(),
+			},
+			ExtraData: "",
+		}
+
+		postable := newPostableSavedViewFromLegacyView(legacy)
+
+		assert.Equal(t, savedviewtypes.Display{}, postable.Data.Spec.Display)
+		assert.Nil(t, postable.Data.Spec.SelectedFields)
+	})
+
+	t.Run("malformed extra data is ignored, not an error", func(t *testing.T) {
+		legacy := &v3.SavedView{
+			Name:       "malformed extra data",
+			SourcePage: "metrics",
+			CompositeQuery: &v3.CompositeQuery{
+				PanelType: v3.PanelTypeList,
+				Queries:   testQueries(),
+			},
+			ExtraData: `{not valid json`,
+		}
+
+		postable := newPostableSavedViewFromLegacyView(legacy)
+
+		assert.Equal(t, "malformed extra data", postable.Name)
+		assert.Equal(t, savedviewtypes.Display{}, postable.Data.Spec.Display)
+	})
+}
+
+func TestNewLegacyViewFromSavedView(t *testing.T) {
+	now := time.Now()
+	savedView := &savedviewtypes.SavedView{
+		Name:       "my view",
+		SourcePage: savedviewtypes.SourcePageLogs,
+		Data: savedviewtypes.SavedViewData{
+			SchemaVersion: savedviewtypes.SavedViewSchemaVersion,
+			Spec: savedviewtypes.SavedViewSpec{
+				PanelType:      savedviewtypes.PanelTypeGraph,
+				Queries:        testQueries(),
+				SelectedFields: []telemetrytypes.TelemetryFieldKey{{Name: "service.name"}},
+				Display:        savedviewtypes.Display{MaxLines: 10, FontSize: "large", Format: "table", Color: "blue"},
+			},
+		},
+	}
+	savedView.ID = valuer.GenerateUUID()
+	savedView.CreatedAt = now
+	savedView.UpdatedAt = now
+	savedView.CreatedBy = "creator@signoz.io"
+	savedView.UpdatedBy = "updater@signoz.io"
+
+	legacy, err := newLegacyViewFromSavedView(savedView)
+	require.NoError(t, err)
+
+	assert.Equal(t, savedView.ID, legacy.ID)
+	assert.Equal(t, savedView.Name, legacy.Name)
+	assert.Equal(t, savedView.CreatedAt, legacy.CreatedAt)
+	assert.Equal(t, savedView.CreatedBy, legacy.CreatedBy)
+	assert.Equal(t, savedView.UpdatedAt, legacy.UpdatedAt)
+	assert.Equal(t, savedView.UpdatedBy, legacy.UpdatedBy)
+	assert.Equal(t, "logs", legacy.SourcePage)
+	assert.Equal(t, v3.PanelTypeGraph, legacy.CompositeQuery.PanelType)
+	assert.Equal(t, v3.QueryTypeBuilder, legacy.CompositeQuery.QueryType)
+	assert.Equal(t, savedView.Data.Spec.Queries, legacy.CompositeQuery.Queries)
+
+	var extra legacyExtraData
+	require.NoError(t, json.Unmarshal([]byte(legacy.ExtraData), &extra))
+	assert.Equal(t, "blue", extra.Color)
+	assert.Equal(t, savedView.Data.Spec.SelectedFields, extra.SelectColumns)
+	assert.Equal(t, "table", extra.Format)
+	assert.Equal(t, 10, extra.MaxLines)
+	assert.Equal(t, "large", extra.FontSize)
+}
+
+func TestNewLegacyViewsFromSavedViews(t *testing.T) {
+	a := &savedviewtypes.SavedView{Name: "a", SourcePage: savedviewtypes.SourcePageLogs, Data: savedviewtypes.SavedViewData{Spec: savedviewtypes.SavedViewSpec{PanelType: savedviewtypes.PanelTypeGraph, Queries: testQueries()}}}
+	b := &savedviewtypes.SavedView{Name: "b", SourcePage: savedviewtypes.SourcePageTraces, Data: savedviewtypes.SavedViewData{Spec: savedviewtypes.SavedViewSpec{PanelType: savedviewtypes.PanelTypeTable, Queries: testQueries()}}}
+
+	legacyViews, err := newLegacyViewsFromSavedViews([]*savedviewtypes.SavedView{a, b})
+	require.NoError(t, err)
+	require.Len(t, legacyViews, 2)
+	assert.Equal(t, "a", legacyViews[0].Name)
+	assert.Equal(t, "b", legacyViews[1].Name)
+}
+
+// TestLegacyViewRoundTrip guards the whole v1<->v2 bridge: converting a
+// SavedView to its legacy shape and back must recover the fields the legacy
+// frontend round-trips through (name, sourcePage, panelType, queries,
+// selectedFields, display) -- these two functions are each other's inverse
+// on the API surface, so a regression in either should fail this.
+func TestLegacyViewRoundTrip(t *testing.T) {
+	original := &savedviewtypes.SavedView{
+		Name:       "round trip",
+		SourcePage: savedviewtypes.SourcePageMetrics,
+		Data: savedviewtypes.SavedViewData{
+			SchemaVersion: savedviewtypes.SavedViewSchemaVersion,
+			Spec: savedviewtypes.SavedViewSpec{
+				PanelType:      savedviewtypes.PanelTypeTable,
+				Queries:        testQueries(),
+				SelectedFields: []telemetrytypes.TelemetryFieldKey{{Name: "service.name"}},
+				Display:        savedviewtypes.Display{MaxLines: 5, FontSize: "small", Format: "list", Color: "red"},
+			},
+		},
+	}
+
+	legacy, err := newLegacyViewFromSavedView(original)
+	require.NoError(t, err)
+
+	roundTripped := newPostableSavedViewFromLegacyView(legacy)
+
+	assert.Equal(t, original.Name, roundTripped.Name)
+	assert.Equal(t, original.SourcePage, roundTripped.SourcePage)
+	assert.Equal(t, original.Data.Spec.PanelType, roundTripped.Data.Spec.PanelType)
+	assert.Equal(t, original.Data.Spec.Queries, roundTripped.Data.Spec.Queries)
+	assert.Equal(t, original.Data.Spec.SelectedFields, roundTripped.Data.Spec.SelectedFields)
+	assert.Equal(t, original.Data.Spec.Display, roundTripped.Data.Spec.Display)
+}

pkg/modules/savedview/implsavedview/handler_v2.go

@@ -0,0 +1,135 @@
+package implsavedview
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/http/binding"
+	"github.com/SigNoz/signoz/pkg/http/render"
+	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/gorilla/mux"
+)
+
+func (handler *handler) CreateV2(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	var view savedviewtypes.PostableSavedView
+	if err := binding.JSON.BindBody(r.Body, &view, binding.WithDisallowUnknownFields(true)); err != nil {
+		render.Error(w, err)
+		return
+	}
+	if err := view.Validate(); err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	uuid, err := handler.module.CreateView(ctx, claims.OrgID, view)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	render.Success(w, http.StatusOK, types.Identifiable{ID: uuid})
+}
+
+func (handler *handler) GetV2(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	viewID := mux.Vars(r)["id"]
+	viewUUID, err := valuer.NewUUID(viewID)
+	if err != nil {
+		render.Error(w, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to parse view id"))
+		return
+	}
+
+	view, err := handler.module.GetView(ctx, claims.OrgID, viewUUID)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	render.Success(w, http.StatusOK, view)
+}
+
+func (handler *handler) UpdateV2(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	viewID := mux.Vars(r)["id"]
+	viewUUID, err := valuer.NewUUID(viewID)
+	if err != nil {
+		render.Error(w, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to parse view id"))
+		return
+	}
+	var view savedviewtypes.UpdatableSavedView
+	if err := binding.JSON.BindBody(r.Body, &view, binding.WithDisallowUnknownFields(true)); err != nil {
+		render.Error(w, err)
+		return
+	}
+	if err := view.Validate(); err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	err = handler.module.UpdateView(ctx, claims.OrgID, viewUUID, view)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	render.Success(w, http.StatusOK, nil)
+}
+
+func (handler *handler) ListV2(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	params := new(savedviewtypes.ListSavedViewsParams)
+	if err := binding.Query.BindQuery(r.URL.Query(), params); err != nil {
+		render.Error(w, err)
+		return
+	}
+	if err := params.Validate(); err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	queries, err := handler.module.GetViewsForFilters(r.Context(), claims.OrgID, params.SourcePage, params.Name)
+	if err != nil {
+		render.Error(w, err)
+		return
+	}
+
+	render.Success(w, http.StatusOK, queries)
+}

pkg/modules/savedview/implsavedview/module.go

@@ -2,185 +2,62 @@ package implsavedview
 
 import (
 	"context"
-	"encoding/json"
-	"strings"
-	"time"
 
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/modules/savedview"
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 type module struct {
-	sqlstore sqlstore.SQLStore
+	store savedviewtypes.Store
 }
 
-func NewModule(sqlstore sqlstore.SQLStore) savedview.Module {
-	return &module{sqlstore: sqlstore}
+func NewModule(store savedviewtypes.Store) savedview.Module {
+	return &module{store: store}
 }
 
-func (module *module) GetViewsForFilters(ctx context.Context, orgID string, sourcePage string, name string, category string) ([]*v3.SavedView, error) {
-	var views []savedviewtypes.SavedView
-	var err error
-	if len(category) == 0 {
-		err = module.sqlstore.BunDB().NewSelect().Model(&views).Where("org_id = ? AND source_page = ? AND name LIKE ?", orgID, sourcePage, "%"+name+"%").Scan(ctx)
-	} else {
-		err = module.sqlstore.BunDB().NewSelect().Model(&views).Where("org_id = ? AND source_page = ? AND category LIKE ? AND name LIKE ?", orgID, sourcePage, "%"+category+"%", "%"+name+"%").Scan(ctx)
-	}
+func (module *module) GetViewsForFilters(ctx context.Context, orgID string, sourcePage savedviewtypes.SourcePage, name string) ([]*savedviewtypes.SavedView, error) {
+	return module.store.List(ctx, orgID, sourcePage, name)
+}
+
+func (module *module) CreateView(ctx context.Context, orgID string, view savedviewtypes.PostableSavedView) (valuer.UUID, error) {
+	claims, err := authtypes.ClaimsFromContext(ctx)
 	if err != nil {
-		return nil, errors.WrapInternalf(err, errors.CodeInternal, "error in getting saved views")
-	}
-
-	var savedViews []*v3.SavedView
-	for _, view := range views {
-		var compositeQuery v3.CompositeQuery
-		err = json.Unmarshal([]byte(view.Data), &compositeQuery)
-		if err != nil {
-			return nil, errors.WrapInternalf(err, errors.CodeInternal, "error in unmarshalling explorer query data: %s", err.Error())
-		}
-		savedViews = append(savedViews, &v3.SavedView{
-			ID:             view.ID,
-			Name:           view.Name,
-			CreatedAt:      view.CreatedAt,
-			CreatedBy:      view.CreatedBy,
-			UpdatedAt:      view.UpdatedAt,
-			UpdatedBy:      view.UpdatedBy,
-			Tags:           strings.Split(view.Tags, ","),
-			SourcePage:     view.SourcePage,
-			CompositeQuery: &compositeQuery,
-			ExtraData:      view.ExtraData,
-		})
-	}
-	return savedViews, nil
-}
-
-func (module *module) CreateView(ctx context.Context, orgID string, view v3.SavedView) (valuer.UUID, error) {
-	data, err := json.Marshal(view.CompositeQuery)
-	if err != nil {
-		return valuer.UUID{}, errors.WrapInternalf(err, errors.CodeInternal, "error in marshalling explorer query data")
-	}
-
-	uuid := valuer.GenerateUUID()
-	createdAt := time.Now()
-	updatedAt := time.Now()
-
-	claims, errv2 := authtypes.ClaimsFromContext(ctx)
-	if errv2 != nil {
 		return valuer.UUID{}, errors.NewInternalf(errors.CodeInternal, "error in getting email from context")
 	}
 
-	createBy := claims.Email
-	updatedBy := claims.Email
+	dbView := savedviewtypes.NewSavedView(orgID, claims.Email, claims.Email, view)
 
-	dbView := savedviewtypes.SavedView{
-		TimeAuditable: types.TimeAuditable{
-			CreatedAt: createdAt,
-			UpdatedAt: updatedAt,
-		},
-		UserAuditable: types.UserAuditable{
-			CreatedBy: createBy,
-			UpdatedBy: updatedBy,
-		},
-		OrgID: orgID,
-		Identifiable: types.Identifiable{
-			ID: uuid,
-		},
-		Name:       view.Name,
-		Category:   view.Category,
-		SourcePage: view.SourcePage,
-		Tags:       strings.Join(view.Tags, ","),
-		Data:       string(data),
-		ExtraData:  view.ExtraData,
+	if err := module.store.Create(ctx, dbView); err != nil {
+		return valuer.UUID{}, err
 	}
-
-	_, err = module.sqlstore.BunDB().NewInsert().Model(&dbView).Exec(ctx)
-	if err != nil {
-		return valuer.UUID{}, errors.WrapInternalf(err, errors.CodeInternal, "error in creating saved view")
-	}
-	return uuid, nil
+	return dbView.ID, nil
 }
 
-func (module *module) GetView(ctx context.Context, orgID string, uuid valuer.UUID) (*v3.SavedView, error) {
-	var view savedviewtypes.SavedView
-	err := module.sqlstore.BunDB().NewSelect().Model(&view).Where("org_id = ? AND id = ?", orgID, uuid.StringValue()).Scan(ctx)
-	if err != nil {
-		return nil, errors.WrapInternalf(err, errors.CodeInternal, "error in getting saved view")
-	}
-
-	var compositeQuery v3.CompositeQuery
-	err = json.Unmarshal([]byte(view.Data), &compositeQuery)
-	if err != nil {
-		return nil, errors.WrapInternalf(err, errors.CodeInternal, "error in unmarshalling explorer query data")
-	}
-	return &v3.SavedView{
-		ID:             view.ID,
-		Name:           view.Name,
-		Category:       view.Category,
-		CreatedAt:      view.CreatedAt,
-		CreatedBy:      view.CreatedBy,
-		UpdatedAt:      view.UpdatedAt,
-		UpdatedBy:      view.UpdatedBy,
-		SourcePage:     view.SourcePage,
-		Tags:           strings.Split(view.Tags, ","),
-		CompositeQuery: &compositeQuery,
-		ExtraData:      view.ExtraData,
-	}, nil
+func (module *module) GetView(ctx context.Context, orgID string, uuid valuer.UUID) (*savedviewtypes.SavedView, error) {
+	return module.store.Get(ctx, orgID, uuid)
 }
 
-func (module *module) UpdateView(ctx context.Context, orgID string, uuid valuer.UUID, view v3.SavedView) error {
-	data, err := json.Marshal(view.CompositeQuery)
+func (module *module) UpdateView(ctx context.Context, orgID string, uuid valuer.UUID, view savedviewtypes.UpdatableSavedView) error {
+	claims, err := authtypes.ClaimsFromContext(ctx)
 	if err != nil {
-		return errors.WrapInternalf(err, errors.CodeInternal, "error in marshalling explorer query data")
-	}
-
-	claims, errv2 := authtypes.ClaimsFromContext(ctx)
-	if errv2 != nil {
 		return errors.NewInternalf(errors.CodeInternal, "error in getting email from context")
 	}
 
-	updatedAt := time.Now()
-	updatedBy := claims.Email
+	dbView := savedviewtypes.NewSavedView(orgID, claims.Email, claims.Email, view)
+	dbView.ID = uuid
 
-	_, err = module.sqlstore.BunDB().NewUpdate().
-		Model(&savedviewtypes.SavedView{}).
-		Set("updated_at = ?, updated_by = ?, name = ?, category = ?, source_page = ?, tags = ?, data = ?, extra_data = ?",
-			updatedAt, updatedBy, view.Name, view.Category, view.SourcePage, strings.Join(view.Tags, ","), data, view.ExtraData).
-		Where("id = ?", uuid.StringValue()).
-		Where("org_id = ?", orgID).
-		Exec(ctx)
-	if err != nil {
-		return errors.WrapInternalf(err, errors.CodeInternal, "error in updating saved view")
-	}
-	return nil
+	return module.store.Update(ctx, dbView)
 }
 
 func (module *module) DeleteView(ctx context.Context, orgID string, uuid valuer.UUID) error {
-	_, err := module.sqlstore.BunDB().NewDelete().
-		Model(&savedviewtypes.SavedView{}).
-		Where("id = ?", uuid.StringValue()).
-		Where("org_id = ?", orgID).
-		Exec(ctx)
-	if err != nil {
-		return errors.WrapInternalf(err, errors.CodeInternal, "error in deleting explorer query")
-	}
-	return nil
+	return module.store.Delete(ctx, orgID, uuid)
 }
 
 func (module *module) Collect(ctx context.Context, orgID valuer.UUID) (map[string]any, error) {
-	savedViews := []*savedviewtypes.SavedView{}
-
-	err := module.
-		sqlstore.
-		BunDB().
-		NewSelect().
-		Model(&savedViews).
-		Where("org_id = ?", orgID).
-		Scan(ctx)
+	savedViews, err := module.store.List(ctx, orgID.StringValue(), savedviewtypes.SourcePage{}, "")
 	if err != nil {
 		return nil, err
 	}

pkg/modules/savedview/implsavedview/module_test.go

@@ -0,0 +1,283 @@
+package implsavedview_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/modules/savedview"
+	"github.com/SigNoz/signoz/pkg/modules/savedview/implsavedview"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/sqlstore/sqlstoretest"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes/savedviewtypestest"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestStore() (savedview.Module, *savedviewtypestest.StoreTest) {
+	sqlStore := sqlstoretest.New(sqlstore.Config{Provider: "sqlite"}, sqlmock.QueryMatcherRegexp)
+	store := implsavedview.NewStore(sqlStore)
+	return implsavedview.NewModule(store), savedviewtypestest.New(store, sqlStore.Mock())
+}
+
+func testPostableSavedView(name string, sourcePage savedviewtypes.SourcePage) savedviewtypes.PostableSavedView {
+	return savedviewtypes.PostableSavedView{
+		Name:       name,
+		SourcePage: sourcePage,
+		Data: savedviewtypes.SavedViewData{
+			SchemaVersion: savedviewtypes.SavedViewSchemaVersion,
+			Spec: savedviewtypes.SavedViewSpec{
+				PanelType: savedviewtypes.PanelTypeGraph,
+				Queries: []qbtypes.QueryEnvelope{
+					{
+						Type: qbtypes.QueryTypeBuilder,
+						Spec: qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]{
+							Signal:       telemetrytypes.SignalLogs,
+							Aggregations: []qbtypes.LogAggregation{{Expression: "count()"}},
+						},
+					},
+				},
+				SelectedFields: []telemetrytypes.TelemetryFieldKey{},
+			},
+		},
+	}
+}
+
+func testSavedView(orgID string, id valuer.UUID, updatedBy string, view savedviewtypes.PostableSavedView) *savedviewtypes.SavedView {
+	savedView := savedviewtypes.NewSavedView(orgID, "creator@signoz.io", updatedBy, view)
+	savedView.ID = id
+	return savedView
+}
+
+func contextWithClaims(orgID, email string) context.Context {
+	return authtypes.NewContextWithClaims(context.Background(), authtypes.Claims{
+		OrgID: orgID,
+		Email: email,
+	})
+}
+
+func TestModule_CreateAndGetView(t *testing.T) {
+	m, st := newTestStore()
+
+	orgID := valuer.GenerateUUID().StringValue()
+	ctx := contextWithClaims(orgID, "creator@signoz.io")
+	view := testPostableSavedView("my view", savedviewtypes.SourcePageLogs)
+
+	st.ExpectCreate()
+	id, err := m.CreateView(ctx, orgID, view)
+	require.NoError(t, err)
+	require.False(t, id.IsZero())
+
+	stored := testSavedView(orgID, id, "creator@signoz.io", view)
+	st.ExpectGet(orgID, id, stored)
+	got, err := m.GetView(ctx, orgID, id)
+	require.NoError(t, err)
+	assert.Equal(t, id, got.ID)
+	assert.Equal(t, "my view", got.Name)
+	assert.Equal(t, savedviewtypes.SourcePageLogs, got.SourcePage)
+	assert.Equal(t, "creator@signoz.io", got.CreatedBy)
+	assert.Equal(t, "creator@signoz.io", got.UpdatedBy)
+	assert.Equal(t, savedviewtypes.PanelTypeGraph, got.Data.Spec.PanelType)
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_GetView_NotFound(t *testing.T) {
+	m, st := newTestStore()
+
+	orgID := valuer.GenerateUUID().StringValue()
+	id := valuer.GenerateUUID()
+
+	st.ExpectGet(orgID, id, nil)
+	_, err := m.GetView(contextWithClaims(orgID, "someone@signoz.io"), orgID, id)
+	require.Error(t, err)
+	assert.True(t, errors.Ast(err, errors.TypeNotFound), "expected a not-found error, got %v", err)
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_GetView_ScopedToOrg(t *testing.T) {
+	m, st := newTestStore()
+
+	orgB := valuer.GenerateUUID().StringValue()
+	id := valuer.GenerateUUID()
+
+	// The mock only has an expectation for orgB's WHERE clause; a lookup
+	// scoped to org A's real id must not accidentally match it.
+	st.ExpectGet(orgB, id, nil)
+	_, err := m.GetView(contextWithClaims(orgB, "b@signoz.io"), orgB, id)
+	require.Error(t, err, "a view created under org A must not be visible to org B")
+	assert.True(t, errors.Ast(err, errors.TypeNotFound), "expected a not-found error, got %v", err)
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_UpdateView(t *testing.T) {
+	m, st := newTestStore()
+
+	orgID := valuer.GenerateUUID().StringValue()
+	id := valuer.GenerateUUID()
+
+	updated := testPostableSavedView("renamed", savedviewtypes.SourcePageTraces)
+	updated.Data.Spec.PanelType = savedviewtypes.PanelTypeTable
+
+	st.ExpectUpdate(orgID, id, 1)
+	require.NoError(t, m.UpdateView(contextWithClaims(orgID, "updater@signoz.io"), orgID, id, updated))
+
+	stored := testSavedView(orgID, id, "updater@signoz.io", updated)
+	st.ExpectGet(orgID, id, stored)
+	got, err := m.GetView(contextWithClaims(orgID, "creator@signoz.io"), orgID, id)
+	require.NoError(t, err)
+	assert.Equal(t, "renamed", got.Name)
+	assert.Equal(t, savedviewtypes.SourcePageTraces, got.SourcePage)
+	assert.Equal(t, savedviewtypes.PanelTypeTable, got.Data.Spec.PanelType)
+	assert.Equal(t, "updater@signoz.io", got.UpdatedBy)
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_UpdateView_NotFound(t *testing.T) {
+	m, st := newTestStore()
+
+	orgID := valuer.GenerateUUID().StringValue()
+	ctx := contextWithClaims(orgID, "someone@signoz.io")
+	id := valuer.GenerateUUID()
+
+	st.ExpectUpdate(orgID, id, 0)
+	err := m.UpdateView(ctx, orgID, id, testPostableSavedView("does not exist", savedviewtypes.SourcePageLogs))
+	require.Error(t, err)
+	assert.True(t, errors.Ast(err, errors.TypeNotFound), "expected a not-found error, got %v", err)
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_UpdateView_ScopedToOrg(t *testing.T) {
+	m, st := newTestStore()
+
+	orgB := valuer.GenerateUUID().StringValue()
+	id := valuer.GenerateUUID()
+
+	// Only an update scoped to orgB's WHERE clause is registered; updating
+	// org A's view while authenticated as org B must not match it.
+	st.ExpectUpdate(orgB, id, 0)
+	err := m.UpdateView(contextWithClaims(orgB, "b@signoz.io"), orgB, id, testPostableSavedView("hijacked", savedviewtypes.SourcePageLogs))
+	require.Error(t, err, "org B must not be able to update org A's view")
+	assert.True(t, errors.Ast(err, errors.TypeNotFound))
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_DeleteView(t *testing.T) {
+	m, st := newTestStore()
+
+	orgID := valuer.GenerateUUID().StringValue()
+	ctx := contextWithClaims(orgID, "creator@signoz.io")
+	id := valuer.GenerateUUID()
+
+	st.ExpectDelete(orgID, id, 1)
+	require.NoError(t, m.DeleteView(ctx, orgID, id))
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_DeleteView_NotFound(t *testing.T) {
+	m, st := newTestStore()
+
+	orgID := valuer.GenerateUUID().StringValue()
+	ctx := contextWithClaims(orgID, "someone@signoz.io")
+	id := valuer.GenerateUUID()
+
+	st.ExpectDelete(orgID, id, 0)
+	err := m.DeleteView(ctx, orgID, id)
+	require.Error(t, err)
+	assert.True(t, errors.Ast(err, errors.TypeNotFound), "expected a not-found error, got %v", err)
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_DeleteView_ScopedToOrg(t *testing.T) {
+	m, st := newTestStore()
+
+	orgB := valuer.GenerateUUID().StringValue()
+	id := valuer.GenerateUUID()
+
+	st.ExpectDelete(orgB, id, 0)
+	err := m.DeleteView(contextWithClaims(orgB, "b@signoz.io"), orgB, id)
+	require.Error(t, err, "org B must not be able to delete org A's view")
+	assert.True(t, errors.Ast(err, errors.TypeNotFound))
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_GetViewsForFilters(t *testing.T) {
+	m, st := newTestStore()
+
+	orgID := valuer.GenerateUUID().StringValue()
+	ctx := contextWithClaims(orgID, "creator@signoz.io")
+
+	logsOverview := testSavedView(orgID, valuer.GenerateUUID(), "creator@signoz.io", testPostableSavedView("logs overview", savedviewtypes.SourcePageLogs))
+	logsErrors := testSavedView(orgID, valuer.GenerateUUID(), "creator@signoz.io", testPostableSavedView("logs errors", savedviewtypes.SourcePageLogs))
+	tracesOverview := testSavedView(orgID, valuer.GenerateUUID(), "creator@signoz.io", testPostableSavedView("traces overview", savedviewtypes.SourcePageTraces))
+
+	t.Run("filters by source page", func(t *testing.T) {
+		st.ExpectList(orgID, []*savedviewtypes.SavedView{logsOverview, logsErrors})
+		views, err := m.GetViewsForFilters(ctx, orgID, savedviewtypes.SourcePageLogs, "")
+		require.NoError(t, err)
+		assert.Len(t, views, 2)
+	})
+
+	t.Run("filters by name substring", func(t *testing.T) {
+		st.ExpectList(orgID, []*savedviewtypes.SavedView{logsErrors})
+		views, err := m.GetViewsForFilters(ctx, orgID, savedviewtypes.SourcePageLogs, "errors")
+		require.NoError(t, err)
+		require.Len(t, views, 1)
+		assert.Equal(t, "logs errors", views[0].Name)
+	})
+
+	t.Run("omitted source page returns everything, not nothing", func(t *testing.T) {
+		// Fixes a bug: source_page used to be an unconditional exact-match
+		// clause, so a zero-value sourcePage matched zero rows -- even though
+		// ListSavedViewsParams.Validate() treats a zero SourcePage as valid
+		// ("no filter"). Store.List now only applies the source_page clause
+		// when it's non-zero.
+		st.ExpectList(orgID, []*savedviewtypes.SavedView{logsOverview, logsErrors, tracesOverview})
+		views, err := m.GetViewsForFilters(ctx, orgID, savedviewtypes.SourcePage{}, "")
+		require.NoError(t, err)
+		assert.Len(t, views, 3)
+	})
+
+	t.Run("scoped to org", func(t *testing.T) {
+		otherOrgID := valuer.GenerateUUID().StringValue()
+		st.ExpectList(otherOrgID, nil)
+		views, err := m.GetViewsForFilters(ctx, otherOrgID, savedviewtypes.SourcePageLogs, "")
+		require.NoError(t, err)
+		assert.Empty(t, views)
+	})
+
+	require.NoError(t, st.AssertExpectations())
+}
+
+func TestModule_Collect(t *testing.T) {
+	m, st := newTestStore()
+
+	orgID := valuer.GenerateUUID()
+
+	logsA := testSavedView(orgID.StringValue(), valuer.GenerateUUID(), "creator@signoz.io", testPostableSavedView("logs a", savedviewtypes.SourcePageLogs))
+	logsB := testSavedView(orgID.StringValue(), valuer.GenerateUUID(), "creator@signoz.io", testPostableSavedView("logs b", savedviewtypes.SourcePageLogs))
+	tracesA := testSavedView(orgID.StringValue(), valuer.GenerateUUID(), "creator@signoz.io", testPostableSavedView("traces a", savedviewtypes.SourcePageTraces))
+
+	st.ExpectList(orgID.StringValue(), []*savedviewtypes.SavedView{logsA, logsB, tracesA})
+	stats, err := m.Collect(context.Background(), orgID)
+	require.NoError(t, err)
+	assert.Equal(t, int64(3), stats["savedview.count"])
+	assert.Equal(t, int64(2), stats["savedview.source.logs.count"])
+	assert.Equal(t, int64(1), stats["savedview.source.traces.count"])
+
+	require.NoError(t, st.AssertExpectations())
+}

pkg/modules/savedview/implsavedview/store.go

@@ -0,0 +1,109 @@
+package implsavedview
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+type store struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewStore(sqlstore sqlstore.SQLStore) savedviewtypes.Store {
+	return &store{sqlstore: sqlstore}
+}
+
+func (store *store) Create(ctx context.Context, view *savedviewtypes.SavedView) error {
+	_, err := store.sqlstore.BunDB().NewInsert().Model(view).Exec(ctx)
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "error in creating saved view")
+	}
+	return nil
+}
+
+func (store *store) Get(ctx context.Context, orgID string, id valuer.UUID) (*savedviewtypes.SavedView, error) {
+	var view savedviewtypes.SavedView
+	err := store.sqlstore.BunDB().NewSelect().Model(&view).Where("org_id = ? AND id = ?", orgID, id.StringValue()).Scan(ctx)
+	if err != nil {
+		return nil, store.sqlstore.WrapNotFoundErrf(err, savedviewtypes.ErrCodeSavedViewNotFound, "saved view %s not found", id.StringValue())
+	}
+
+	normalizeSelectedFields(&view)
+	return &view, nil
+}
+
+func (store *store) Update(ctx context.Context, view *savedviewtypes.SavedView) error {
+	res, err := store.sqlstore.BunDB().NewUpdate().
+		Model(&savedviewtypes.SavedView{}).
+		Set("updated_at = ?, updated_by = ?, name = ?, source_page = ?, data = ?",
+			view.UpdatedAt, view.UpdatedBy, view.Name, view.SourcePage, view.Data).
+		Where("id = ?", view.ID.StringValue()).
+		Where("org_id = ?", view.OrgID).
+		Exec(ctx)
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "error in updating saved view")
+	}
+
+	rowsAffected, err := res.RowsAffected()
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "error in verifying the updated saved view")
+	}
+	if rowsAffected == 0 {
+		return errors.NewNotFoundf(savedviewtypes.ErrCodeSavedViewNotFound, "saved view %s not found", view.ID.StringValue())
+	}
+
+	return nil
+}
+
+func (store *store) Delete(ctx context.Context, orgID string, id valuer.UUID) error {
+	res, err := store.sqlstore.BunDB().NewDelete().
+		Model(&savedviewtypes.SavedView{}).
+		Where("id = ?", id.StringValue()).
+		Where("org_id = ?", orgID).
+		Exec(ctx)
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "error in deleting saved view")
+	}
+
+	rowsAffected, err := res.RowsAffected()
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "error in verifying the deleted saved view")
+	}
+	if rowsAffected == 0 {
+		return errors.NewNotFoundf(savedviewtypes.ErrCodeSavedViewNotFound, "saved view %s not found", id.StringValue())
+	}
+
+	return nil
+}
+
+func (store *store) List(ctx context.Context, orgID string, sourcePage savedviewtypes.SourcePage, name string) ([]*savedviewtypes.SavedView, error) {
+	var views []*savedviewtypes.SavedView
+	q := store.sqlstore.BunDB().NewSelect().Model(&views).
+		Where("org_id = ?", orgID).
+		Where("name LIKE ?", "%"+name+"%")
+	if !sourcePage.IsZero() {
+		q = q.Where("source_page = ?", sourcePage)
+	}
+
+	if err := q.Scan(ctx); err != nil {
+		return nil, errors.WrapInternalf(err, errors.CodeInternal, "error in getting saved views")
+	}
+
+	for _, view := range views {
+		normalizeSelectedFields(view)
+	}
+
+	return views, nil
+}
+
+// normalizeSelectedFields fixes up a scanned row's nil SelectedFields.
+func normalizeSelectedFields(view *savedviewtypes.SavedView) {
+	if view.Data.Spec.SelectedFields == nil {
+		view.Data.Spec.SelectedFields = []telemetrytypes.TelemetryFieldKey{}
+	}
+}

pkg/modules/savedview/savedview.go

@@ -4,19 +4,19 @@ import (
 	"context"
 	"net/http"
 
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/statsreporter"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 type Module interface {
-	GetViewsForFilters(ctx context.Context, orgID string, sourcePage string, name string, category string) ([]*v3.SavedView, error)
+	GetViewsForFilters(ctx context.Context, orgID string, sourcePage savedviewtypes.SourcePage, name string) ([]*savedviewtypes.SavedView, error)
 
-	CreateView(ctx context.Context, orgID string, view v3.SavedView) (valuer.UUID, error)
+	CreateView(ctx context.Context, orgID string, view savedviewtypes.PostableSavedView) (valuer.UUID, error)
 
-	GetView(ctx context.Context, orgID string, uuid valuer.UUID) (*v3.SavedView, error)
+	GetView(ctx context.Context, orgID string, uuid valuer.UUID) (*savedviewtypes.SavedView, error)
 
-	UpdateView(ctx context.Context, orgID string, uuid valuer.UUID, view v3.SavedView) error
+	UpdateView(ctx context.Context, orgID string, uuid valuer.UUID, view savedviewtypes.UpdatableSavedView) error
 
 	DeleteView(ctx context.Context, orgID string, uuid valuer.UUID) error
 
@@ -33,9 +33,22 @@ type Handler interface {
 	// Updates the saved view
 	Update(http.ResponseWriter, *http.Request)
 
-	// Deletes the saved view
+	// Deletes the saved view. Shared by both API generations -- delete has no
+	// request/response body to reshape.
 	Delete(http.ResponseWriter, *http.Request)
 
 	// Lists the saved views
 	List(http.ResponseWriter, *http.Request)
+
+	// CreateV2 is the /api/v2/saved_views typed-spec variant of Create.
+	CreateV2(http.ResponseWriter, *http.Request)
+
+	// GetV2 is the /api/v2/saved_views typed-spec variant of Get.
+	GetV2(http.ResponseWriter, *http.Request)
+
+	// UpdateV2 is the /api/v2/saved_views typed-spec variant of Update.
+	UpdateV2(http.ResponseWriter, *http.Request)
+
+	// ListV2 is the /api/v2/saved_views typed-spec variant of List.
+	ListV2(http.ResponseWriter, *http.Request)
 }

pkg/query-service/app/http_handler.go

@@ -507,9 +507,9 @@ func (aH *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 
 	router.HandleFunc("/api/v1/explorer/views", am.ViewAccess(aH.Signoz.Handlers.SavedView.List)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/explorer/views", am.EditAccess(aH.Signoz.Handlers.SavedView.Create)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/explorer/views/{viewId}", am.ViewAccess(aH.Signoz.Handlers.SavedView.Get)).Methods(http.MethodGet)
-	router.HandleFunc("/api/v1/explorer/views/{viewId}", am.EditAccess(aH.Signoz.Handlers.SavedView.Update)).Methods(http.MethodPut)
-	router.HandleFunc("/api/v1/explorer/views/{viewId}", am.EditAccess(aH.Signoz.Handlers.SavedView.Delete)).Methods(http.MethodDelete)
+	router.HandleFunc("/api/v1/explorer/views/{id}", am.ViewAccess(aH.Signoz.Handlers.SavedView.Get)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v1/explorer/views/{id}", am.EditAccess(aH.Signoz.Handlers.SavedView.Update)).Methods(http.MethodPut)
+	router.HandleFunc("/api/v1/explorer/views/{id}", am.EditAccess(aH.Signoz.Handlers.SavedView.Delete)).Methods(http.MethodDelete)
 	router.HandleFunc("/api/v1/event", am.ViewAccess(aH.registerEvent)).Methods(http.MethodPost)
 
 	router.HandleFunc("/api/v1/services", am.ViewAccess(aH.getServices)).Methods(http.MethodPost) // Deprecated Usage, use the below endpoint /v2/services

pkg/signoz/module.go

@@ -139,7 +139,7 @@ func NewModules(
 		OrgGetter:           orgGetter,
 		OrgSetter:           orgSetter,
 		Preference:          implpreference.NewModule(implpreference.NewStore(sqlstore), preferencetypes.NewAvailablePreference()),
-		SavedView:           implsavedview.NewModule(sqlstore),
+		SavedView:           implsavedview.NewModule(implsavedview.NewStore(sqlstore)),
 		Apdex:               implapdex.NewModule(sqlstore),
 		Dashboard:           dashboard,
 		UserSetter:          userSetter,

pkg/signoz/openapi.go

@@ -30,6 +30,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/promote"
 	"github.com/SigNoz/signoz/pkg/modules/rawdataexport"
 	"github.com/SigNoz/signoz/pkg/modules/rulestatehistory"
+	"github.com/SigNoz/signoz/pkg/modules/savedview"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/session"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
@@ -88,6 +89,7 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ tracedetail.Handler }{},
 		struct{ ruler.Handler }{},
 		struct{ statsreporter.Handler }{},
+		struct{ savedview.Handler }{},
 	).New(ctx, instrumentation.ToProviderSettings(), apiserver.Config{})
 	if err != nil {
 		return nil, err

pkg/signoz/provider.go

@@ -234,6 +234,9 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewUpdateRoleTransactionGroupsFactory(),
 		sqlmigration.NewFillDashboardSpecCollectionsFactory(sqlstore, dashboardStore),
 		sqlmigration.NewScrubEmailChannelTransportFactory(sqlstore),
+		sqlmigration.NewAddDashboardTuplesFactory(sqlstore),
+		sqlmigration.NewRestructureSavedViewSpecFactory(sqlstore),
+		sqlmigration.NewAddSavedViewTuplesFactory(sqlstore),
 	)
 }
 
@@ -334,6 +337,7 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.TraceDetail,
 			handlers.RulerHandler,
 			handlers.StatsHandler,
+			handlers.SavedView,
 		),
 	)
 }

pkg/sqlmigration/108_add_dashboard_tuples.go

@@ -0,0 +1,149 @@
+package sqlmigration
+
+import (
+	"context"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addDashboardTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddDashboardTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_dashboard_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addDashboardTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addDashboardTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addDashboardTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	rows, err := tx.QueryContext(ctx, `SELECT id FROM organizations`)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var orgID string
+		if err := rows.Scan(&orgID); err != nil {
+			return err
+		}
+		orgIDs = append(orgIDs, orgID)
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// The dashboard routes, including the public sharing config, now authorize per
+	// resource, so every org needs the managed-role dashboard tuples. Orgs
+	// bootstrapped before these entries landed in ManagedRoleToTransactions never
+	// got them.
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "list"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "update"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "delete"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "create"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "dashboard", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "dashboard", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addDashboardTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/sqlmigration/109_restructure_saved_view_spec.go

@@ -0,0 +1,144 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/migrate"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+)
+
+type restructureSavedViewSpec struct {
+	store sqlstore.SQLStore
+}
+
+func NewRestructureSavedViewSpecFactory(store sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("restructure_saved_view_spec"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &restructureSavedViewSpec{store: store}, nil
+	})
+}
+
+func (migration *restructureSavedViewSpec) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+// legacySavedViewCompositeQuery is the bare shape saved_view.data held
+// before this migration -- just the relevant fields of composite query.
+// Queries is kept as raw JSON since the migration only needs to relocate it, not interpret it.
+type legacySavedViewCompositeQuery struct {
+	PanelType string          `json:"panelType"`
+	Queries   json.RawMessage `json:"queries"`
+}
+
+// legacySavedViewExtraData mirrors the frontend defined extraData JSON shape.
+type legacySavedViewExtraData struct {
+	Color         string          `json:"color,omitempty"`
+	SelectColumns json.RawMessage `json:"selectColumns,omitempty"`
+	Format        string          `json:"format,omitempty"`
+	MaxLines      int             `json:"maxLines,omitempty"`
+	FontSize      string          `json:"fontSize,omitempty"`
+}
+
+type savedViewDisplay struct {
+	MaxLines int    `json:"maxLines"`
+	FontSize string `json:"fontSize"`
+	Format   string `json:"format"`
+	Color    string `json:"color"`
+}
+
+type savedViewSpec struct {
+	PanelType      string           `json:"panelType"`
+	Queries        json.RawMessage  `json:"queries"`
+	SelectedFields json.RawMessage  `json:"selectedFields"`
+	Display        savedViewDisplay `json:"display"`
+}
+
+type savedViewData struct {
+	SchemaVersion string        `json:"schemaVersion"`
+	Spec          savedViewSpec `json:"spec"`
+}
+
+func (migration *restructureSavedViewSpec) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var savedViews []struct {
+		ID        string `bun:"id"`
+		Data      string `bun:"data"`
+		ExtraData string `bun:"extra_data"`
+	}
+
+	err = tx.NewSelect().
+		Table("saved_views").
+		Column("id", "data", "extra_data").
+		Scan(ctx, &savedViews)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	for _, savedView := range savedViews {
+		var compositeQuery legacySavedViewCompositeQuery
+		if err := json.Unmarshal([]byte(savedView.Data), &compositeQuery); err != nil {
+			continue // skip the row on error rather than fail the whole migration
+		}
+
+		var extraData legacySavedViewExtraData
+		if savedView.ExtraData != "" {
+			// best-effort: malformed/older extraData shapes never fail the migration,
+			// they just leave selectedFields/display empty.
+			_ = json.Unmarshal([]byte(savedView.ExtraData), &extraData)
+		}
+
+		dataJSON, err := json.Marshal(savedViewData{
+			SchemaVersion: "v2",
+			Spec: savedViewSpec{
+				PanelType:      compositeQuery.PanelType,
+				Queries:        compositeQuery.Queries,
+				SelectedFields: extraData.SelectColumns,
+				Display: savedViewDisplay{
+					MaxLines: extraData.MaxLines,
+					FontSize: extraData.FontSize,
+					Format:   extraData.Format,
+					Color:    extraData.Color,
+				},
+			},
+		})
+		if err != nil {
+			return err
+		}
+
+		_, err = tx.NewUpdate().
+			Table("saved_views").
+			Set("data = ?", string(dataJSON)).
+			Where("id = ?", savedView.ID).
+			Exec(ctx)
+		if err != nil {
+			return err
+		}
+	}
+
+	for _, column := range []string{"category", "tags"} {
+		if err := migration.store.Dialect().DropColumn(ctx, tx, "saved_views", column); err != nil {
+			return err
+		}
+	}
+
+	// matching the singular table-name convention.
+	if _, err := tx.ExecContext(ctx, "ALTER TABLE saved_views RENAME TO saved_view"); err != nil {
+		return err
+	}
+
+	return tx.Commit()
+}
+
+func (migration *restructureSavedViewSpec) Down(context.Context, *bun.DB) error {
+	// this migration is not reversible as we're transforming the structure
+	return nil
+}

pkg/sqlmigration/110_add_saved_view_tuples.go

@@ -0,0 +1,144 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addSavedViewTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddSavedViewTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_saved_view_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addSavedViewTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addSavedViewTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addSavedViewTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// saved-view moved from the legacy ViewAccess/EditAccess role gate to
+	// CheckResources, which on enterprise requires real tuples -- existing orgs
+	// never had these written, only new orgs get them from the registry at bootstrap.
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "saved-view", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "saved-view", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "saved-view", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "saved-view", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "saved-view", "list"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "saved-view", "create"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "saved-view", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "saved-view", "update"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "saved-view", "delete"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "saved-view", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "saved-view", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "saved-view", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addSavedViewTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/types/coretypes/registry_resource.go

@@ -54,7 +54,7 @@ var (
 	ResourceMetaResourceCloudIntegration                 = NewResourceMetaResource(KindCloudIntegration)
 	ResourceMetaResourceCloudIntegrationService          = NewResourceMetaResource(KindCloudIntegrationService)
 	ResourceMetaResourceIntegration                      = NewResourceMetaResource(KindIntegration)
-	ResourceMetaResourceDashboard                        = NewResourceMetaResource(KindDashboard)
+	ResourceMetaResourceDashboard                        = NewResourceMetaResource(KindDashboard, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourcePublicDashboard                  = NewResourceMetaResource(KindPublicDashboard)
 	ResourceMetaResourceIngestionKey                     = NewResourceMetaResource(KindIngestionKey)
 	ResourceMetaResourceIngestionLimit                   = NewResourceMetaResource(KindIngestionLimit)
@@ -65,7 +65,7 @@ var (
 	ResourceMetaResourceTTLSetting                       = NewResourceMetaResource(KindTTLSetting)
 	ResourceMetaResourceRule                             = NewResourceMetaResource(KindRule)
 	ResourceMetaResourcePlannedMaintenance               = NewResourceMetaResource(KindPlannedMaintenance)
-	ResourceMetaResourceSavedView                        = NewResourceMetaResource(KindSavedView)
+	ResourceMetaResourceSavedView                        = NewResourceMetaResource(KindSavedView, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceTraceFunnel                      = NewResourceMetaResource(KindTraceFunnel)
 	ResourceMetaResourceFactorPassword                   = NewResourceMetaResource(KindFactorPassword)
 	ResourceMetaResourceFactorAPIKey                     = NewResourceMetaResource(KindFactorAPIKey, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)

pkg/types/savedviewtypes/savedview.go

@@ -2,30 +2,106 @@ package savedviewtypes
 
 import (
 	"strings"
+	"time"
 
+	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/uptrace/bun"
 )
 
+var (
+	ErrCodeSavedViewInvalidInput = errors.MustNewCode("saved_view_invalid_input")
+	ErrCodeSavedViewNotFound     = errors.MustNewCode("saved_view_not_found")
+)
+
+var (
+	SourcePageTraces  = SourcePage{valuer.NewString("traces")}
+	SourcePageLogs    = SourcePage{valuer.NewString("logs")}
+	SourcePageMetrics = SourcePage{valuer.NewString("metrics")}
+	SourcePageMeter   = SourcePage{valuer.NewString("meter")}
+)
+
 type SavedView struct {
-	bun.BaseModel `bun:"table:saved_views"`
+	bun.BaseModel `bun:"table:saved_view"`
 
 	types.Identifiable
 	types.TimeAuditable
 	types.UserAuditable
-	OrgID      string `json:"orgId" bun:"org_id,notnull"`
-	Name       string `json:"name" bun:"name,type:text,notnull"`
-	Category   string `json:"category" bun:"category,type:text,notnull"`
-	SourcePage string `json:"sourcePage" bun:"source_page,type:text,notnull"`
-	Tags       string `json:"tags" bun:"tags,type:text"`
-	Data       string `json:"data" bun:"data,type:text,notnull"`
-	ExtraData  string `json:"extraData" bun:"extra_data,type:text"`
+	OrgID      string        `json:"-" bun:"org_id,notnull"`
+	Name       string        `json:"name" bun:"name,type:text,notnull"`
+	SourcePage SourcePage    `json:"sourcePage" bun:"source_page,type:text,notnull"`
+	Data       SavedViewData `json:"data" bun:"data,type:text,notnull"`
+}
+
+type PostableSavedView struct {
+	Name       string        `json:"name" required:"true"`
+	SourcePage SourcePage    `json:"sourcePage" required:"true"`
+	Data       SavedViewData `json:"data" required:"true"`
+}
+
+type UpdatableSavedView = PostableSavedView
+
+type ListSavedViewsParams struct {
+	SourcePage SourcePage `query:"sourcePage"`
+	Name       string     `query:"name"`
+}
+
+type SourcePage struct {
+	valuer.String
+}
+
+func (SourcePage) Enum() []any {
+	return []any{
+		SourcePageTraces,
+		SourcePageLogs,
+		SourcePageMetrics,
+		SourcePageMeter,
+	}
+}
+
+func (s SourcePage) Validate() error {
+	switch s {
+	case SourcePageTraces, SourcePageLogs, SourcePageMetrics, SourcePageMeter:
+		return nil
+	default:
+		return errors.NewInvalidInputf(ErrCodeSavedViewInvalidInput, "invalid source page: %s", s.StringValue())
+	}
+}
+
+func (p *PostableSavedView) Validate() error {
+	if err := p.SourcePage.Validate(); err != nil {
+		return err
+	}
+
+	return p.Data.Validate()
+}
+
+func (p *ListSavedViewsParams) Validate() error {
+	if p.SourcePage.IsZero() {
+		return nil
+	}
+
+	return p.SourcePage.Validate()
+}
+
+func NewSavedView(orgID string, createdBy string, updatedBy string, view PostableSavedView) *SavedView {
+	now := time.Now()
+	return &SavedView{
+		Identifiable:  types.Identifiable{ID: valuer.GenerateUUID()},
+		TimeAuditable: types.TimeAuditable{CreatedAt: now, UpdatedAt: now},
+		UserAuditable: types.UserAuditable{CreatedBy: createdBy, UpdatedBy: updatedBy},
+		OrgID:         orgID,
+		Name:          view.Name,
+		SourcePage:    view.SourcePage,
+		Data:          view.Data,
+	}
 }
 
 func NewStatsFromSavedViews(savedViews []*SavedView) map[string]any {
 	stats := make(map[string]any)
 	for _, savedView := range savedViews {
-		key := "savedview.source." + strings.ToLower(string(savedView.SourcePage)) + ".count"
+		key := "savedview.source." + strings.ToLower(savedView.SourcePage.StringValue()) + ".count"
 		if _, ok := stats[key]; !ok {
 			stats[key] = int64(1)
 		} else {

pkg/types/savedviewtypes/savedview_test.go

@@ -0,0 +1,112 @@
+package savedviewtypes
+
+import (
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+)
+
+func validPostableSavedView() PostableSavedView {
+	return PostableSavedView{
+		Name:       "my view",
+		SourcePage: SourcePageLogs,
+		Data: SavedViewData{
+			SchemaVersion: SavedViewSchemaVersion,
+			Spec:          SavedViewSpec{PanelType: PanelTypeGraph, Queries: validQueries()},
+		},
+	}
+}
+
+func TestSourcePageValidate(t *testing.T) {
+	cases := []struct {
+		name        string
+		sourcePage  SourcePage
+		expectError bool
+	}{
+		{name: "traces", sourcePage: SourcePageTraces},
+		{name: "logs", sourcePage: SourcePageLogs},
+		{name: "metrics", sourcePage: SourcePageMetrics},
+		{name: "meter", sourcePage: SourcePageMeter},
+		{name: "unknown is rejected", sourcePage: SourcePage{valuer.NewString("bogus")}, expectError: true},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := c.sourcePage.Validate()
+			if c.expectError {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestPostableSavedViewValidate(t *testing.T) {
+	t.Run("valid view", func(t *testing.T) {
+		view := validPostableSavedView()
+		assert.NoError(t, view.Validate())
+	})
+
+	t.Run("invalid source page is rejected", func(t *testing.T) {
+		view := validPostableSavedView()
+		view.SourcePage = SourcePage{valuer.NewString("bogus")}
+		assert.Error(t, view.Validate())
+	})
+
+	t.Run("invalid saved view data is rejected", func(t *testing.T) {
+		view := validPostableSavedView()
+		view.Data.SchemaVersion = "v1"
+		assert.Error(t, view.Validate())
+	})
+}
+
+func TestListSavedViewsParamsValidate(t *testing.T) {
+	t.Run("zero source page is allowed", func(t *testing.T) {
+		params := ListSavedViewsParams{}
+		assert.NoError(t, params.Validate())
+	})
+
+	t.Run("valid source page is allowed", func(t *testing.T) {
+		params := ListSavedViewsParams{SourcePage: SourcePageLogs}
+		assert.NoError(t, params.Validate())
+	})
+
+	t.Run("invalid source page is rejected", func(t *testing.T) {
+		params := ListSavedViewsParams{SourcePage: SourcePage{valuer.NewString("bogus")}}
+		assert.Error(t, params.Validate())
+	})
+}
+
+func TestNewSavedView(t *testing.T) {
+	orgID := valuer.GenerateUUID().StringValue()
+	view := validPostableSavedView()
+
+	savedView := NewSavedView(orgID, "creator@signoz.io", "updater@signoz.io", view)
+
+	assert.False(t, savedView.ID.IsZero())
+	assert.Equal(t, orgID, savedView.OrgID)
+	assert.Equal(t, "creator@signoz.io", savedView.CreatedBy)
+	assert.Equal(t, "updater@signoz.io", savedView.UpdatedBy)
+	assert.Equal(t, view.Name, savedView.Name)
+	assert.Equal(t, view.SourcePage, savedView.SourcePage)
+	assert.Equal(t, view.Data, savedView.Data)
+	assert.False(t, savedView.CreatedAt.IsZero())
+	assert.Equal(t, savedView.CreatedAt, savedView.UpdatedAt)
+}
+
+func TestNewStatsFromSavedViews(t *testing.T) {
+	views := []*SavedView{
+		{SourcePage: SourcePageLogs},
+		{SourcePage: SourcePageLogs},
+		{SourcePage: SourcePageTraces},
+	}
+
+	stats := NewStatsFromSavedViews(views)
+
+	assert.Equal(t, int64(3), stats["savedview.count"])
+	assert.Equal(t, int64(2), stats["savedview.source.logs.count"])
+	assert.Equal(t, int64(1), stats["savedview.source.traces.count"])
+	assert.NotContains(t, stats, "savedview.source.metrics.count")
+}

pkg/types/savedviewtypes/savedviewtypestest/store.go

@@ -0,0 +1,88 @@
+package savedviewtypestest
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"regexp"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/SigNoz/signoz/pkg/types/savedviewtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+var savedViewColumns = []string{"id", "created_at", "updated_at", "created_by", "updated_by", "org_id", "name", "source_page", "data"}
+
+type StoreTest struct {
+	store savedviewtypes.Store
+	mock  sqlmock.Sqlmock
+}
+
+func New(store savedviewtypes.Store, mock sqlmock.Sqlmock) *StoreTest {
+	return &StoreTest{store: store, mock: mock}
+}
+
+// Store returns the savedviewtypes.Store for calling methods under test.
+func (t *StoreTest) Store() savedviewtypes.Store { return t.store }
+
+// Mock returns the sqlmock handle for setting query expectations.
+func (t *StoreTest) Mock() sqlmock.Sqlmock { return t.mock }
+
+func savedViewRow(view *savedviewtypes.SavedView) []driver.Value {
+	data, _ := json.Marshal(view.Data)
+	return []driver.Value{
+		view.ID.StringValue(),
+		view.CreatedAt,
+		view.UpdatedAt,
+		view.CreatedBy,
+		view.UpdatedBy,
+		view.OrgID,
+		view.Name,
+		view.SourcePage.StringValue(),
+		string(data),
+	}
+}
+
+// ExpectCreate sets up the SQL expectation for a Create call.
+func (t *StoreTest) ExpectCreate() {
+	t.mock.ExpectExec(`INSERT INTO "saved_view"`).WillReturnResult(sqlmock.NewResult(1, 1))
+}
+
+// ExpectGet sets up the SQL expectation for a Get call. Pass view = nil to
+// simulate a not-found row.
+func (t *StoreTest) ExpectGet(orgID string, id valuer.UUID, view *savedviewtypes.SavedView) {
+	rows := sqlmock.NewRows(savedViewColumns)
+	if view != nil {
+		rows.AddRow(savedViewRow(view)...)
+	}
+
+	t.mock.ExpectQuery(`SELECT (.+) FROM "saved_view".+WHERE \(org_id = '` + regexp.QuoteMeta(orgID) + `' AND id = '` + regexp.QuoteMeta(id.StringValue()) + `'\)`).
+		WillReturnRows(rows)
+}
+
+// ExpectUpdate sets up the SQL expectation for an Update call scoped to
+// orgID/id. rowsAffected = 0 simulates a not-found target row.
+func (t *StoreTest) ExpectUpdate(orgID string, id valuer.UUID, rowsAffected int64) {
+	t.mock.ExpectExec(`UPDATE "saved_view".+WHERE \(id = '` + regexp.QuoteMeta(id.StringValue()) + `'\) AND \(org_id = '` + regexp.QuoteMeta(orgID) + `'\)`).
+		WillReturnResult(sqlmock.NewResult(0, rowsAffected))
+}
+
+// ExpectDelete sets up the SQL expectation for a Delete call scoped to
+// orgID/id. rowsAffected = 0 simulates a not-found target row.
+func (t *StoreTest) ExpectDelete(orgID string, id valuer.UUID, rowsAffected int64) {
+	t.mock.ExpectExec(`DELETE FROM "saved_view".+WHERE \(id = '` + regexp.QuoteMeta(id.StringValue()) + `'\) AND \(org_id = '` + regexp.QuoteMeta(orgID) + `'\)`).
+		WillReturnResult(sqlmock.NewResult(0, rowsAffected))
+}
+
+// ExpectList sets up the SQL expectation for a List call scoped to orgID.
+func (t *StoreTest) ExpectList(orgID string, views []*savedviewtypes.SavedView) {
+	rows := sqlmock.NewRows(savedViewColumns)
+	for _, view := range views {
+		rows.AddRow(savedViewRow(view)...)
+	}
+
+	t.mock.ExpectQuery(`SELECT (.+) FROM "saved_view".+WHERE \(org_id = '` + regexp.QuoteMeta(orgID) + `'\)`).WillReturnRows(rows)
+}
+
+func (t *StoreTest) AssertExpectations() error {
+	return t.mock.ExpectationsWereMet()
+}

pkg/types/savedviewtypes/spec.go

@@ -0,0 +1,81 @@
+package savedviewtypes
+
+import (
+	"github.com/SigNoz/signoz/pkg/errors"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+// SavedViewSchemaVersion is the only schemaVersion currently.
+const SavedViewSchemaVersion = "v2"
+
+var (
+	PanelTypeValue = PanelType{valuer.NewString("value")}
+	PanelTypeGraph = PanelType{valuer.NewString("graph")}
+	PanelTypeTable = PanelType{valuer.NewString("table")}
+	PanelTypeList  = PanelType{valuer.NewString("list")}
+	PanelTypeTrace = PanelType{valuer.NewString("trace")}
+)
+
+// Display holds view-rendering preferences.
+type Display struct {
+	MaxLines int    `json:"maxLines"`
+	FontSize string `json:"fontSize"`
+	Format   string `json:"format"`
+	Color    string `json:"color"`
+}
+
+// SavedViewSpec is the typed content of a saved view, mirroring the dashboardtypes v2 spec pattern.
+type SavedViewSpec struct {
+	PanelType      PanelType                          `json:"panelType" required:"true"`
+	Queries        []qbtypes.QueryEnvelope            `json:"queries" required:"true" nullable:"false"`
+	SelectedFields []telemetrytypes.TelemetryFieldKey `json:"selectedFields" required:"true" nullable:"false"`
+	Display        Display                            `json:"display" required:"true"`
+}
+
+// SavedViewData is what's persisted as saved view data.
+type SavedViewData struct {
+	SchemaVersion string        `json:"schemaVersion" required:"true"`
+	Spec          SavedViewSpec `json:"spec" required:"true"`
+}
+
+// PanelType is the explore-page panel a saved view renders as.
+type PanelType struct {
+	valuer.String
+}
+
+func (PanelType) Enum() []any {
+	return []any{
+		PanelTypeValue,
+		PanelTypeGraph,
+		PanelTypeTable,
+		PanelTypeList,
+		PanelTypeTrace,
+	}
+}
+
+func (p PanelType) Validate() error {
+	switch p {
+	case PanelTypeValue, PanelTypeGraph, PanelTypeTable, PanelTypeList, PanelTypeTrace:
+		return nil
+	default:
+		return errors.NewInvalidInputf(ErrCodeSavedViewInvalidInput, "invalid panel type: %s", p.StringValue())
+	}
+}
+
+func (s *SavedViewSpec) Validate() error {
+	if err := s.PanelType.Validate(); err != nil {
+		return err
+	}
+
+	return (&qbtypes.CompositeQuery{Queries: s.Queries}).Validate()
+}
+
+func (d *SavedViewData) Validate() error {
+	if d.SchemaVersion != SavedViewSchemaVersion {
+		return errors.NewInvalidInputf(ErrCodeSavedViewInvalidInput, "schemaVersion must be %q, got %q", SavedViewSchemaVersion, d.SchemaVersion)
+	}
+
+	return d.Spec.Validate()
+}

pkg/types/savedviewtypes/spec_test.go

@@ -0,0 +1,134 @@
+package savedviewtypes
+
+import (
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func validQueries() []qbtypes.QueryEnvelope {
+	return []qbtypes.QueryEnvelope{
+		{
+			Type: qbtypes.QueryTypeBuilder,
+			Spec: qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]{
+				Signal:       telemetrytypes.SignalLogs,
+				Aggregations: []qbtypes.LogAggregation{{Expression: "count()"}},
+			},
+		},
+	}
+}
+
+func TestPanelTypeValidate(t *testing.T) {
+	cases := []struct {
+		name        string
+		panelType   PanelType
+		expectError bool
+	}{
+		{name: "value", panelType: PanelTypeValue},
+		{name: "graph", panelType: PanelTypeGraph},
+		{name: "table", panelType: PanelTypeTable},
+		{name: "list", panelType: PanelTypeList},
+		{name: "trace", panelType: PanelTypeTrace},
+		{name: "unknown is rejected", panelType: PanelType{valuer.NewString("bogus")}, expectError: true},
+		{name: "empty is rejected", panelType: PanelType{}, expectError: true},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := c.panelType.Validate()
+			if c.expectError {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestSavedViewSpecValidate(t *testing.T) {
+	cases := []struct {
+		name        string
+		spec        SavedViewSpec
+		expectError bool
+	}{
+		{
+			name:        "valid spec",
+			spec:        SavedViewSpec{PanelType: PanelTypeGraph, Queries: validQueries()},
+			expectError: false,
+		},
+		{
+			name:        "invalid panel type is rejected before queries are checked",
+			spec:        SavedViewSpec{PanelType: PanelType{valuer.NewString("bogus")}, Queries: validQueries()},
+			expectError: true,
+		},
+		{
+			name:        "no queries is rejected",
+			spec:        SavedViewSpec{PanelType: PanelTypeGraph},
+			expectError: true,
+		},
+		{
+			name: "selected fields and display are not required",
+			spec: SavedViewSpec{
+				PanelType:      PanelTypeTable,
+				Queries:        validQueries(),
+				SelectedFields: []telemetrytypes.TelemetryFieldKey{{Name: "service.name"}},
+				Display:        Display{MaxLines: 3, FontSize: "small", Format: "table", Color: "blue"},
+			},
+			expectError: false,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := c.spec.Validate()
+			if c.expectError {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestSavedViewDataValidate(t *testing.T) {
+	cases := []struct {
+		name        string
+		data        SavedViewData
+		expectError bool
+	}{
+		{
+			name:        "valid data",
+			data:        SavedViewData{SchemaVersion: SavedViewSchemaVersion, Spec: SavedViewSpec{PanelType: PanelTypeGraph, Queries: validQueries()}},
+			expectError: false,
+		},
+		{
+			name:        "wrong schema version is rejected",
+			data:        SavedViewData{SchemaVersion: "v1", Spec: SavedViewSpec{PanelType: PanelTypeGraph, Queries: validQueries()}},
+			expectError: true,
+		},
+		{
+			name:        "empty schema version is rejected",
+			data:        SavedViewData{Spec: SavedViewSpec{PanelType: PanelTypeGraph, Queries: validQueries()}},
+			expectError: true,
+		},
+		{
+			name:        "invalid spec is rejected",
+			data:        SavedViewData{SchemaVersion: SavedViewSchemaVersion, Spec: SavedViewSpec{PanelType: PanelTypeGraph}},
+			expectError: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := c.data.Validate()
+			if c.expectError {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

pkg/types/savedviewtypes/store.go

@@ -0,0 +1,15 @@
+package savedviewtypes
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+type Store interface {
+	Create(ctx context.Context, view *SavedView) error
+	Get(ctx context.Context, orgID string, id valuer.UUID) (*SavedView, error)
+	Update(ctx context.Context, view *SavedView) error
+	Delete(ctx context.Context, orgID string, id valuer.UUID) error
+	List(ctx context.Context, orgID string, sourcePage SourcePage, name string) ([]*SavedView, error)
+}

tests/conftest.py

@@ -31,6 +31,7 @@ pytest_plugins = [
     "fixtures.seeder",
     "fixtures.serviceaccount",
     "fixtures.role",
+    "fixtures.savedview",
     "fixtures.seed_golden_dataset",
 ]
 

tests/fixtures/savedview.py

@@ -0,0 +1,48 @@
+"""Fixtures and helpers for saved view tests."""
+
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+
+SAVED_VIEW_BASE = "/api/v2/saved_views"
+
+
+def _body(name: str, source_page: str = "logs") -> dict:
+    return {
+        "name": name,
+        "sourcePage": source_page,
+        "data": {
+            "schemaVersion": "v2",
+            "spec": {
+                "panelType": "table",
+                "queries": [{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "aggregations": [{"expression": "count()"}]}}],
+                "selectedFields": [],
+                "display": {"maxLines": 0, "fontSize": "", "format": "", "color": ""},
+            },
+        },
+    }
+
+
+def create_saved_view(signoz: types.SigNoz, token: str, name: str, source_page: str = "logs") -> str:
+    """Create a saved view and return its ID."""
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(SAVED_VIEW_BASE),
+        json=_body(name, source_page),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.OK, resp.text
+    return resp.json()["data"]["id"]
+
+
+def find_saved_view_by_name(signoz: types.SigNoz, token: str, name: str) -> dict:
+    """Find a saved view by name from the list endpoint."""
+    resp = requests.get(
+        signoz.self.host_configs["8080"].get(SAVED_VIEW_BASE),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.OK, resp.text
+    return next(view for view in resp.json()["data"] if view["name"] == name)

tests/integration/tests/dashboard/06_authz.py

@@ -0,0 +1,623 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+    find_user_by_email,
+)
+from fixtures.role import transaction_group
+from fixtures.types import Operation, SigNoz, TestContainerDocker
+
+V2_BASE_URL = "/api/v2/dashboards"
+MAX_LIST_LIMIT = 200
+
+_EDITOR_EMAIL = "editor+dashboardauthz@integration.test"
+_EDITOR_PASSWORD = "password123Z$"
+_VIEWER_EMAIL = "viewer+dashboardauthz@integration.test"
+_VIEWER_PASSWORD = "password123Z$"
+
+_ACTOR_ROLE_NAME = "dashboard-fga-actor"
+_ACTOR_EMAIL = "customrole+dashboardauthz@integration.test"
+_ACTOR_PASSWORD = "password123Z$"
+
+# Instance verbs are granted on _TARGET_A only; _TARGET_B must stay forbidden.
+_TARGET_A = "dashboard-authz-target-a"
+_TARGET_B = "dashboard-authz-target-b"
+_CLONE_SOURCE = "dashboard-authz-clone-source"
+_VIEW_NAME = "dashboard-authz-view"
+
+_SPEC = {
+    "display": {"name": "Dashboard Authz"},
+    "duration": "1h",
+    "links": [],
+    "variables": [],
+    "panels": {},
+    "layouts": [],
+}
+
+
+# ─── managed roles (community-safe: no license, role gate only) ───────────────
+
+
+def test_setup_managed_role_users(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # A rerun against a --reuse stack starts from the previous run's state, and
+    # inviting an existing address fails, so only invite what is missing.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_emails = {user["email"] for user in response.json()["data"]}
+
+    for email, role, password, name in (
+        (_EDITOR_EMAIL, "EDITOR", _EDITOR_PASSWORD, "dashboard authz editor"),
+        (_VIEWER_EMAIL, "VIEWER", _VIEWER_PASSWORD, "dashboard authz viewer"),
+    ):
+        if email not in existing_emails:
+            create_active_user(signoz, admin_token, email=email, role=role, password=password, name=name)
+
+    # (org_id, name) is unique, so leftovers from an earlier run have to go before
+    # these are recreated.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    for dashboard in response.json()["data"]["dashboards"]:
+        if dashboard["name"] in (_TARGET_A, _TARGET_B, _CLONE_SOURCE):
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{dashboard['id']}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=5,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    for name in (_TARGET_A, _TARGET_B, _CLONE_SOURCE):
+        response = requests.post(
+            signoz.self.host_configs["8080"].get(V2_BASE_URL),
+            json={"schemaVersion": "v6", "name": name, "spec": _SPEC, "tags": []},
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.CREATED, response.text
+
+
+def test_viewer_allowed_on_reads_and_pins(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_TARGET_A]}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users/me/dashboards"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/users/me/dashboards/{ids[_TARGET_A]}/pins"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/users/me/dashboards/{ids[_TARGET_A]}/pins"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_viewer_forbidden_on_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+    target_id = ids[_TARGET_A]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_BASE_URL),
+        json={"schemaVersion": "v6", "name": "viewer-denied", "spec": _SPEC, "tags": []},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"create: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}"),
+        json={"schemaVersion": "v6", "name": _TARGET_A, "spec": _SPEC, "tags": []},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"update: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}"),
+        json=[{"op": "replace", "path": "/spec/display/name", "value": "Patched"}],
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"patch: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}/clone"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"clone: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}/migrate"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"migrate: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}/lock"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"lock: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"delete: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_editor_allowed_on_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_TARGET_A]}"),
+        json={"schemaVersion": "v6", "name": _TARGET_A, "spec": _SPEC, "tags": [{"key": "team", "value": "pulse"}]},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_CLONE_SOURCE]}/clone"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    clone_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{clone_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_viewer_forbidden_on_public_config(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # The public config routes authorize on the dashboard itself, so a viewer is
+    # refused before the handler runs, licensed or not.
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_id = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}[_TARGET_A]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": True, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"create public: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": False, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"update public: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"delete public: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_viewer_allowed_on_saved_views(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # Saved views ride on dashboard list, which a viewer holds, so the whole CRUD
+    # surface is open to them.
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/dashboard_views"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/dashboard_views"),
+        json={"name": _VIEW_NAME, "data": {"version": "v1", "sort": "updated_at", "order": "desc"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    view_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/dashboard_views/{view_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+# ─── per-object FGA scoping (enterprise, custom role) ─────────────────────────
+
+
+def test_apply_license(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+
+def test_editor_allowed_on_public_config(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # An editor holds dashboard update, which is what the public config routes ask
+    # for, so publishing is open to editors and not just admins.
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_id = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}[_TARGET_B]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": True, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    # Reading the config asks only for dashboard read, so a viewer sees it too.
+    viewer_token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {viewer_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_setup_scoped_actor(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    create_role(
+        admin_token,
+        _ACTOR_ROLE_NAME,
+        [
+            transaction_group("read", "metaresource", "dashboard", [ids[_TARGET_A]]),
+            transaction_group("list", "metaresource", "dashboard", ["*"]),
+        ],
+    )
+
+    user_id = create_active_user(signoz, admin_token, email=_ACTOR_EMAIL, role="VIEWER", password=_ACTOR_PASSWORD, name="dashboard fga actor")
+    change_user_role(signoz, admin_token, user_id, "signoz-viewer", _ACTOR_ROLE_NAME)
+
+
+def test_read_scoped_to_granted_dashboard(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_TARGET_A]}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, f"read granted dashboard: {response.text}"
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_TARGET_B]}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"read other dashboard: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_list_returns_every_dashboard(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    # list is collection-scoped: list on "*" returns every dashboard, including
+    # the one the actor cannot read individually.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    names = {dashboard["name"] for dashboard in response.json()["data"]["dashboards"]}
+    assert {_TARGET_A, _TARGET_B} <= names
+
+
+def test_publish_and_unpublish_require_update_on_the_dashboard(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    actor_role_id = find_role_id(admin_token, _ACTOR_ROLE_NAME)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_id = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}[_TARGET_A]
+
+    # read and list alone must not be enough to publish.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "dashboard", [target_id]),
+                transaction_group("list", "metaresource", "dashboard", ["*"]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": True, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"publish without dashboard update: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "dashboard", [target_id]),
+                transaction_group("list", "metaresource", "dashboard", ["*"]),
+                transaction_group("update", "metaresource", "dashboard", [target_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": True, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, f"publish with dashboard update: {response.text}"
+
+    # Unpublishing asks for the same update grant.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "dashboard", [target_id]),
+                transaction_group("list", "metaresource", "dashboard", ["*"]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"unpublish without dashboard update: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "dashboard", [target_id]),
+                transaction_group("list", "metaresource", "dashboard", ["*"]),
+                transaction_group("update", "metaresource", "dashboard", [target_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"unpublish with dashboard update: {response.text}"
+
+
+def test_dashboard_authz_cleanup(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    actor = find_user_by_email(signoz, admin_token, _ACTOR_EMAIL)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v2/users/{actor['id']}/roles"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    actor_entry = next((role for role in response.json()["data"] if role["name"] == _ACTOR_ROLE_NAME), None)
+    if actor_entry is not None:
+        response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"/api/v2/users/{actor['id']}/roles/{actor_entry['id']}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, f"remove role from user: {response.text}"
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_id(admin_token, _ACTOR_ROLE_NAME)}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {_ACTOR_ROLE_NAME}: {response.text}"
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    for name in (_TARGET_A, _TARGET_B, _CLONE_SOURCE):
+        response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[name]}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {name}: {response.text}"

tests/integration/tests/savedview/01_saved_view.py

@@ -0,0 +1,526 @@
+import uuid
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.types import Operation, SigNoz
+
+BASE_URL = "/api/v2/saved_views"
+
+
+def _query(*, disabled: bool = False, legend: str = "") -> dict:
+    return {
+        "type": "builder_query",
+        "spec": {
+            "name": "A",
+            "signal": "logs",
+            "aggregations": [{"expression": "count()"}],
+            "disabled": disabled,
+            "legend": legend,
+        },
+    }
+
+
+def _body(
+    *,
+    name: str = "my-view",
+    source_page: str = "logs",
+    panel_type: str = "table",
+    max_lines: int = 0,
+    font_size: str = "",
+    fmt: str = "",
+    color: str = "",
+    selected_fields: list | None = None,
+    disabled: bool = False,
+    legend: str = "",
+) -> dict:
+    return {
+        "name": name,
+        "sourcePage": source_page,
+        "data": {
+            "schemaVersion": "v2",
+            "spec": {
+                "panelType": panel_type,
+                "queries": [_query(disabled=disabled, legend=legend)],
+                "selectedFields": [] if selected_fields is None else selected_fields,
+                "display": {"maxLines": max_lines, "fontSize": font_size, "format": fmt, "color": color},
+            },
+        },
+    }
+
+
+# ─── failure cases (create no saved views) ───────────────────────────────────
+
+
+def test_create_rejects_wrong_schema_version(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    body = _body()
+    body["data"]["schemaVersion"] = "v9"
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+    assert response.json()["error"]["code"] == "saved_view_invalid_input"
+    assert response.json()["error"]["message"] == 'schemaVersion must be "v2", got "v9"'
+
+
+def test_create_rejects_invalid_panel_type(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    body = _body()
+    body["data"]["spec"]["panelType"] = "bogus"
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+    assert response.json()["error"]["code"] == "saved_view_invalid_input"
+
+
+def test_create_rejects_empty_queries(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    body = _body()
+    body["data"]["spec"]["queries"] = []
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+    # CompositeQuery.Validate() (querybuildertypesv5) raises this with the generic
+    # invalid_input code, not saved_view_invalid_input -- unlike schemaVersion/
+    # panelType/sourcePage, which are validated directly by savedviewtypes.
+    assert response.json()["error"]["code"] == "invalid_input"
+    assert "at least one query is required" in response.json()["error"]["message"]
+
+
+def test_create_rejects_invalid_source_page(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    body = _body()
+    body["sourcePage"] = "bogus"
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+    assert response.json()["error"]["code"] == "saved_view_invalid_input"
+
+
+def test_create_rejects_unknown_field(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Unlike dashboard v2's PostableDashboardV2 (which has a custom UnmarshalJSON
+    # that rewraps this as its own dashboard_invalid_input code), PostableSavedView
+    # relies solely on binding.WithDisallowUnknownFields, so this surfaces as the
+    # generic invalid_input code rather than saved_view_invalid_input.
+    body = _body()
+    body["unknownfield"] = "boom"
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+    assert response.json()["error"]["code"] == "invalid_input"
+    assert "unknown field" in response.json()["error"]["message"]
+
+
+# ─── not-found cases ──────────────────────────────────────────────────────────
+
+
+def test_get_rejects_malformed_id(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/not-a-uuid"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+
+
+def test_get_missing_view_returns_not_found(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{uuid.uuid4()}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.NOT_FOUND
+    assert response.json()["error"]["code"] == "saved_view_not_found"
+
+
+def test_update_missing_view_returns_not_found(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{uuid.uuid4()}"),
+        json=_body(),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.NOT_FOUND
+    assert response.json()["error"]["code"] == "saved_view_not_found"
+
+
+def test_delete_missing_view_returns_not_found(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{uuid.uuid4()}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.NOT_FOUND
+    assert response.json()["error"]["code"] == "saved_view_not_found"
+
+
+# ─── lifecycle ───────────────────────────────────────────────────────────────
+
+
+def test_saved_view_lifecycle(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {token}"}
+
+    # ── create ────────────────────────────────────────────────────────────────
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=_body(name="lc-logs-overview", source_page="logs"),
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    view_id = response.json()["data"]["id"]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=_body(name="lc-traces-overview", source_page="traces"),
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    try:
+        # ── get echoes back the created shape ────────────────────────────────
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        got = response.json()["data"]
+        assert got["id"] == view_id
+        assert got["name"] == "lc-logs-overview"
+        assert got["sourcePage"] == "logs"
+        assert got["data"]["spec"]["panelType"] == "table"
+
+        # ── list filters by sourcePage and name ──────────────────────────────
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params={"sourcePage": "logs"},
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        assert {v["name"] for v in response.json()["data"]} == {"lc-logs-overview"}
+
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params={"sourcePage": "logs", "name": "overview"},
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        assert {v["name"] for v in response.json()["data"]} == {"lc-logs-overview"}
+
+        # ── update mutates name, sourcePage and spec ─────────────────────────
+        response = requests.put(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            json=_body(name="lc-logs-renamed", source_page="metrics", panel_type="graph"),
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        updated = response.json()["data"]
+        assert updated["name"] == "lc-logs-renamed"
+        assert updated["sourcePage"] == "metrics"
+        assert updated["data"]["spec"]["panelType"] == "graph"
+    finally:
+        requests.delete(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+
+    # ── delete removes it from get and list ──────────────────────────────────
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NOT_FOUND
+
+
+# ─── round-trip serialization: zero/empty values must not get corrupted ──────
+# A value that's genuinely zero (maxLines: 0), empty (""), or an explicit empty
+# list must survive being written and read back exactly as sent — never dropped,
+# defaulted, or turned into null. The riskier case is not create -> GET (a fresh
+# row), it's UPDATE -> GET: overwriting a *previously non-zero* value down to its
+# zero value must actually take effect on the persisted row, not silently retain
+# the old value or lose the field. See test_dashboard_v2_roundtrip_preserves_zero_values
+# for the analogous dashboard v2 case.
+
+
+def test_create_roundtrip_preserves_zero_values(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {token}"}
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=_body(
+            name="create-zero-values",
+            max_lines=0,
+            font_size="",
+            fmt="",
+            color="",
+            selected_fields=[],
+            disabled=False,
+            legend="",
+        ),
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    view_id = response.json()["data"]["id"]
+
+    try:
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        spec = response.json()["data"]["data"]["spec"]
+        query = spec["queries"][0]["spec"]
+
+        cases = [
+            ("maxLines 0", spec["display"]["maxLines"], 0),
+            ("fontSize empty", spec["display"]["fontSize"], ""),
+            ("format empty", spec["display"]["format"], ""),
+            ("color empty", spec["display"]["color"], ""),
+            ("selectedFields explicit empty list", spec["selectedFields"], []),
+            ("query disabled false", query["disabled"], False),
+            ("query legend empty", query["legend"], ""),
+        ]
+        for description, actual, expected in cases:
+            assert actual == expected, description
+    finally:
+        requests.delete(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+
+
+def test_selected_fields_omitted_on_create_reads_back_as_empty_list_not_null(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {token}"}
+
+    body = _body(name="omitted-selected-fields")
+    del body["data"]["spec"]["selectedFields"]
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=body,
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    view_id = response.json()["data"]["id"]
+
+    try:
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        assert response.json()["data"]["data"]["spec"]["selectedFields"] == []
+    finally:
+        requests.delete(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+
+
+def test_update_does_not_corrupt_zero_values(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    """The failure mode this guards against: an update that writes maxLines=0 (or
+    any other zero/empty value) either silently keeps the previous non-zero value
+    (a partial-update bug) or drops/nulls the field on read-back (a serialization
+    bug). Both are round-trip corruption; only an exact zero on GET proves neither
+    happened."""
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {token}"}
+
+    # ── create with deliberately non-zero values everywhere ──────────────────
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=_body(
+            name="update-zero-values",
+            max_lines=25,
+            font_size="large",
+            fmt="table",
+            color="blue",
+            selected_fields=[{"name": "service.name"}],
+            disabled=True,
+            legend="Custom Legend",
+        ),
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    view_id = response.json()["data"]["id"]
+
+    try:
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        spec = response.json()["data"]["data"]["spec"]
+        assert spec["display"]["maxLines"] == 25
+        # signal/fieldContext/fieldDataType always serialize on TelemetryFieldKey
+        # (no omitempty -- see pkg/types/telemetrytypes/field.go), so an entry sent
+        # with only "name" reads back with those three as explicit "".
+        assert spec["selectedFields"] == [{"name": "service.name", "signal": "", "fieldContext": "", "fieldDataType": ""}]
+        assert spec["queries"][0]["spec"]["disabled"] is True
+
+        # ── update overwrites every one of those fields down to its zero value ──
+        response = requests.put(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            json=_body(
+                name="update-zero-values",
+                max_lines=0,
+                font_size="",
+                fmt="",
+                color="",
+                selected_fields=[],
+                disabled=False,
+                legend="",
+            ),
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+
+        # ── the zero values took effect -- not retained, not dropped, not null ──
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        spec = response.json()["data"]["data"]["spec"]
+        query = spec["queries"][0]["spec"]
+
+        cases = [
+            ("maxLines reset to 0", spec["display"]["maxLines"], 0),
+            ("fontSize reset to empty", spec["display"]["fontSize"], ""),
+            ("format reset to empty", spec["display"]["format"], ""),
+            ("color reset to empty", spec["display"]["color"], ""),
+            ("selectedFields reset to empty list", spec["selectedFields"], []),
+            ("query disabled reset to false", query["disabled"], False),
+            ("query legend reset to empty", query["legend"], ""),
+        ]
+        for description, actual, expected in cases:
+            assert actual == expected, description
+    finally:
+        requests.delete(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers=headers,
+            timeout=5,
+        )

tests/integration/tests/savedview/02_authz.py

@@ -0,0 +1,349 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+    find_user_by_email,
+)
+from fixtures.role import transaction_group
+from fixtures.savedview import SAVED_VIEW_BASE, create_saved_view, find_saved_view_by_name
+
+_SAVED_VIEW_FGA_CUSTOM_ROLE_NAME = "saved-view-fga-readonly"
+_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL = "customrole+savedviewfga@integration.test"
+_SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD = "password123Z$"
+_SAVED_VIEW_FGA_TARGET_NAME = "saved-view-fga-target"
+_SAVED_VIEW_FGA_OTHER_NAME = "saved-view-fga-other"
+_SAVED_VIEW_FGA_CREATED_NAME = "saved-view-fga-created"
+
+
+def test_apply_license(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+
+def test_create_custom_role_readonly_view(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    target_id = create_saved_view(signoz, admin_token, _SAVED_VIEW_FGA_TARGET_NAME)
+    create_saved_view(signoz, admin_token, _SAVED_VIEW_FGA_OTHER_NAME)
+
+    create_role(
+        admin_token,
+        _SAVED_VIEW_FGA_CUSTOM_ROLE_NAME,
+        [
+            transaction_group("read", "metaresource", "saved-view", [target_id]),
+            transaction_group("list", "metaresource", "saved-view", ["*"]),
+        ],
+    )
+
+    user_id = create_active_user(
+        signoz,
+        admin_token,
+        email=_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL,
+        role="VIEWER",
+        password=_SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD,
+        name="saved-view-fga-test-user",
+    )
+    change_user_role(signoz, admin_token, user_id, "signoz-viewer", _SAVED_VIEW_FGA_CUSTOM_ROLE_NAME)
+
+
+def test_read_scoped_to_granted_view(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL, _SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD)
+    target_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_TARGET_NAME)["id"]
+    other_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_OTHER_NAME)["id"]
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{target_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"get granted saved view: {resp.text}"
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{other_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"get other saved view: expected 403, got {resp.status_code}: {resp.text}"
+
+
+def test_list_returns_every_view(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL, _SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD)
+    target_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_TARGET_NAME)["id"]
+    other_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_OTHER_NAME)["id"]
+
+    # list is collection-scoped: list on "*" returns every saved view, including
+    # the one the user cannot read individually.
+    resp = requests.get(signoz.self.host_configs["8080"].get(SAVED_VIEW_BASE), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, resp.text
+    ids = {view["id"] for view in resp.json()["data"]}
+    assert {target_id, other_id} <= ids
+
+
+def test_write_forbidden_without_grant(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL, _SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD)
+    target_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_TARGET_NAME)["id"]
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{target_id}"),
+        json={
+            "name": _SAVED_VIEW_FGA_TARGET_NAME,
+            "sourcePage": "logs",
+            "data": {
+                "schemaVersion": "v2",
+                "spec": {
+                    "panelType": "table",
+                    "queries": [{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "aggregations": [{"expression": "count()"}]}}],
+                    "selectedFields": [],
+                    "display": {"maxLines": 0, "fontSize": "", "format": "", "color": ""},
+                },
+            },
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"update saved view: expected 403, got {resp.status_code}: {resp.text}"
+
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(SAVED_VIEW_BASE),
+        json={
+            "name": "saved-view-fga-create-attempt",
+            "sourcePage": "logs",
+            "data": {
+                "schemaVersion": "v2",
+                "spec": {
+                    "panelType": "table",
+                    "queries": [{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "aggregations": [{"expression": "count()"}]}}],
+                    "selectedFields": [],
+                    "display": {"maxLines": 0, "fontSize": "", "format": "", "color": ""},
+                },
+            },
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"create saved view: expected 403, got {resp.status_code}: {resp.text}"
+
+
+def test_create_is_collection_scoped(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    role_id = find_role_id(admin_token, _SAVED_VIEW_FGA_CUSTOM_ROLE_NAME)
+    target_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_TARGET_NAME)["id"]
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "saved-view", [target_id]),
+                transaction_group("list", "metaresource", "saved-view", ["*"]),
+                transaction_group("create", "metaresource", "saved-view", ["*"]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.NO_CONTENT, resp.text
+
+    token = get_token(_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL, _SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD)
+    created_id = create_saved_view(signoz, token, _SAVED_VIEW_FGA_CREATED_NAME)
+
+    resp = requests.delete(signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{created_id}"), headers={"Authorization": f"Bearer {admin_token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"cleanup {_SAVED_VIEW_FGA_CREATED_NAME}: {resp.text}"
+
+
+def test_update_scoped_to_granted_view(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    role_id = find_role_id(admin_token, _SAVED_VIEW_FGA_CUSTOM_ROLE_NAME)
+    target_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_TARGET_NAME)["id"]
+    other_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_OTHER_NAME)["id"]
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "saved-view", [target_id]),
+                transaction_group("list", "metaresource", "saved-view", ["*"]),
+                transaction_group("create", "metaresource", "saved-view", ["*"]),
+                transaction_group("update", "metaresource", "saved-view", [target_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.NO_CONTENT, resp.text
+
+    token = get_token(_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL, _SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD)
+    updated_body = {
+        "name": _SAVED_VIEW_FGA_TARGET_NAME,
+        "sourcePage": "logs",
+        "data": {
+            "schemaVersion": "v2",
+            "spec": {
+                "panelType": "graph",
+                "queries": [{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "aggregations": [{"expression": "count()"}]}}],
+                "selectedFields": [],
+                "display": {"maxLines": 0, "fontSize": "", "format": "", "color": ""},
+            },
+        },
+    }
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{target_id}"),
+        json=updated_body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.OK, f"update granted saved view: {resp.text}"
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{other_id}"),
+        json=updated_body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"update other saved view: expected 403, got {resp.status_code}: {resp.text}"
+
+
+def test_delete_scoped_to_granted_view(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    role_id = find_role_id(admin_token, _SAVED_VIEW_FGA_CUSTOM_ROLE_NAME)
+    target_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_TARGET_NAME)["id"]
+    other_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_OTHER_NAME)["id"]
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "saved-view", [target_id]),
+                transaction_group("list", "metaresource", "saved-view", ["*"]),
+                transaction_group("create", "metaresource", "saved-view", ["*"]),
+                transaction_group("update", "metaresource", "saved-view", [target_id]),
+                transaction_group("delete", "metaresource", "saved-view", [target_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.NO_CONTENT, resp.text
+
+    token = get_token(_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL, _SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD)
+
+    resp = requests.delete(signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{other_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"delete other saved view: expected 403, got {resp.status_code}: {resp.text}"
+
+    resp = requests.delete(signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{target_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"delete granted saved view: {resp.text}"
+
+
+def test_revoke_read_scoped(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    role_id = find_role_id(admin_token, _SAVED_VIEW_FGA_CUSTOM_ROLE_NAME)
+    other_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_OTHER_NAME)["id"]
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "saved-view", [other_id]),
+                transaction_group("list", "metaresource", "saved-view", ["*"]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.NO_CONTENT, resp.text
+
+    token = get_token(_SAVED_VIEW_FGA_CUSTOM_USER_EMAIL, _SAVED_VIEW_FGA_CUSTOM_USER_PASSWORD)
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{other_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"read after grant: {resp.text}"
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"),
+        json={"description": "", "transactionGroups": [transaction_group("list", "metaresource", "saved-view", ["*"])]},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.NO_CONTENT, resp.text
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{other_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"read after revoke: expected 403, got {resp.status_code}: {resp.text}"
+
+
+def test_saved_view_fga_cleanup(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    user = find_user_by_email(signoz, admin_token, _SAVED_VIEW_FGA_CUSTOM_USER_EMAIL)
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"/api/v2/users/{user['id']}/roles"), headers={"Authorization": f"Bearer {admin_token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, resp.text
+    custom_entry = next((r for r in resp.json()["data"] if r["name"] == _SAVED_VIEW_FGA_CUSTOM_ROLE_NAME), None)
+    if custom_entry is not None:
+        resp = requests.delete(
+            signoz.self.host_configs["8080"].get(f"/api/v2/users/{user['id']}/roles/{custom_entry['id']}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert resp.status_code == HTTPStatus.NO_CONTENT, f"remove role from user: {resp.text}"
+
+    resp = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_id(admin_token, _SAVED_VIEW_FGA_CUSTOM_ROLE_NAME)}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.NO_CONTENT, resp.text
+
+    other_id = find_saved_view_by_name(signoz, admin_token, _SAVED_VIEW_FGA_OTHER_NAME)["id"]
+    resp = requests.delete(signoz.self.host_configs["8080"].get(f"{SAVED_VIEW_BASE}/{other_id}"), headers={"Authorization": f"Bearer {admin_token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"delete {_SAVED_VIEW_FGA_OTHER_NAME}: {resp.text}"