diff --git a/installers/auth.example.org/applications/insite.edn b/installers/auth.example.org/applications/insite.edn
index 01c0564a5..2186bb46d 100644
--- a/installers/auth.example.org/applications/insite.edn
+++ b/installers/auth.example.org/applications/insite.edn
@@ -13,4 +13,4 @@
    :juxt.site/resource-server "https://data.example.org"
    :juxt.site/redirect-uris ["https://surveyor.apps.com/oauth-redirect.html"]
    :juxt.site/scope #{"https://auth.example.org/scopes/system/read"
-                      "https://auth.example.org/scopes/system/self-identification"}}}}
+                      "https://data.example.org/_site/scopes/system/self-identification"}}}}
diff --git a/installers/auth.example.org/operations/oauth/register-application.edn b/installers/auth.example.org/operations/oauth/register-application.edn
index f265eee8c..7e3688ba9 100644
--- a/installers/auth.example.org/operations/oauth/register-application.edn
+++ b/installers/auth.example.org/operations/oauth/register-application.edn
@@ -48,7 +48,7 @@
      {:optional true}
      [:maybe
       [:set
-       [:re "https://auth.example.org/scopes/.+?(,https://auth.example.org/scopes/.+?)*"]]]]]
+       [:re "(https://auth.example.org/scopes/.+?(,https://auth.example.org/scopes/.+?)*|https://data.example.org/_site/scopes/.+?(,https://data.example.org/_site/scopes/.+?)*)"]]]]]
 
    ;; TODO: Check that scope actually exists
 
diff --git a/installers/auth.example.org/permissions/{{username}}/whoami.edn b/installers/auth.example.org/permissions/{{username}}/whoami.edn
index 95890e39e..c9c154563 100644
--- a/installers/auth.example.org/permissions/{{username}}/whoami.edn
+++ b/installers/auth.example.org/permissions/{{username}}/whoami.edn
@@ -1,9 +1,9 @@
 {:deps
- ["https://auth.example.org/operations/whoami"]
+ ["https://data.example.org/_site/operations/whoami"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/grant-permission"
   :juxt.site/input
   {:xt/id "{{$id}}"
-   :juxt.site/operation-uri "https://auth.example.org/operations/whoami"
+   :juxt.site/operation-uri "https://data.example.org/_site/operations/whoami"
    :juxt.site/user "https://data.example.org/_site/users/{{username}}"}}}
diff --git a/installers/bundles.edn b/installers/bundles.edn
index 24ce45acb..010ecc957 100644
--- a/installers/bundles.edn
+++ b/installers/bundles.edn
@@ -211,10 +211,10 @@
   :juxt.site/description "An API to discover and install OpenAPIs"
   :juxt.site/installers
   [ ;; Openapis
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/operations/get-openapis"}
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/operations/post-openapi"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/operations/get-openapis"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/operations/post-openapi"}
 
    ;; Endpoints
    {:juxt.site/base-uri "https://data.example.org"
@@ -225,30 +225,29 @@
     :juxt.site/installer-path "/_site/openapis.edn"}
 
    ;; Permissions
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/permissions/by-role/{{role}}/{{operation}}"
     :juxt.site/parameters {"role" "SiteAdmin"
                            "operation" "put-openapi-document"}}
-
+   
    ;; Used by System API
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/operations/get-openapi-document"}
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/get-openapi-document"}
-
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/operations/put-openapi-document"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/operations/get-openapi-document"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/permissions/get-openapi-document"}
 
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/system/put-openapi-document"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/operations/put-openapi-document"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/permissions/put-openapi-document"}
 
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/permissions/by-role/{{role}}/{{operation}}"
     :juxt.site/parameters {"role" "SiteAdmin"
                            "operation" "post-openapi"}}
 
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/permissions/by-role/{{role}}/{{operation}}"
     :juxt.site/parameters {"role" "SiteAdmin"
                            "operation" "get-openapis"}}]}
 
@@ -270,13 +269,11 @@
  {:juxt.site/title "Users API"
   :juxt.site/description "Users API"
   :juxt.site/installers
-  [
-   ;; HTML
+  [ ;; HTML
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/templates/document-base.html"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/templates/fetch-html-content.html"}
-
    ;; Endpoints
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/users"}
@@ -287,26 +284,27 @@
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/users.html"}
    {:juxt.site/base-uri "https://data.example.org"
-    :juxt.site/installer-path "/_site/users/{username}"}
-
-   ;; Role assignments
-   ;; SiteAdmin role
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
-    :juxt.site/parameters {"role" "SiteAdmin"
-                           "operation" "get-users"}}
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
-    :juxt.site/parameters {"role" "SiteAdmin"
-                           "operation" "get-user"}}
+    :juxt.site/installer-path "/_site/users/{username}"}]}
+ 
+ "juxt/site/users-api-permissions"
+ {:juxt.site/title "Users API Permissions"
+  :juxt.site/description "Users API Permissions"
+  :juxt.site/installers
+  [
    {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
-    :juxt.site/parameters {"role" "SiteAdmin"
-                           "operation" "put-user"}}
-
+   :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
+   :juxt.site/parameters {"role" "SiteAdmin"
+                          "operation" "get-users"}}
+  {:juxt.site/base-uri "https://auth.example.org"
+   :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
+   :juxt.site/parameters {"role" "SiteAdmin"
+                          "operation" "get-user"}}
+  {:juxt.site/base-uri "https://auth.example.org"
+   :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
+   :juxt.site/parameters {"role" "SiteAdmin"
+                          "operation" "put-user"}}
    ;; SiteBootstrap role
    ;; It is necessary for bootstrapping to be able to create a user
-
    ;; We could use our permission to install-bundle but the user of
    ;; the users API is more convenient for specifying ad-hoc
    ;; parameters.
@@ -338,16 +336,23 @@
    {:juxt.site/base-uri "https://auth.example.org"
     :juxt.site/installer-path "/operations/oauth/get-applications"}
 
+   ;; SiteAdmin
+   {:juxt.site/base-uri "https://auth.example.org"
+    :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
+    :juxt.site/parameters {"role" "SiteAdmin" "operation" "oauth/get-applications"}}
+   ]}
+
+ "juxt/site/applications-endpoint"
+ {:juxt.site/title "Apps API endpoint"
+  :juxt.site/description "Applications API endpoint"
+  :juxt.site/installers
+  [
    ;; Endpoints
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/applications"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/applications.json"}
-
    ;; SiteAdmin
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/by-role/{{role}}/{{operation}}"
-    :juxt.site/parameters {"role" "SiteAdmin" "operation" "oauth/get-applications"}}
 
    ]}
 
@@ -357,10 +362,10 @@
   :juxt.site/installers
   [
    ;; Operations
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/operations/get-operations"}
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/get-operations"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/operations/get-operations"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/permissions/get-operations"}
 
    ;; Endpoints
    {:juxt.site/base-uri "https://data.example.org"
@@ -376,26 +381,26 @@
  {:juxt.site/title "Whoami API"
   :juxt.site/description "Whoami API"
   :juxt.site/installers
-  [{:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/scopes/system/self-identification"}
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/operations/whoami"}
+  [{:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/scopes/system/self-identification"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/operations/whoami"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/whoami"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/whoami.json"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/whoami.edn"}
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/operations/get-access-token"}
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/get-access-token"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/operations/get-access-token"}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/permissions/get-access-token"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/access-token"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/access-token.txt"}
-   {:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/permissions/whoami"}]}
+   {:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/permissions/whoami"}]}
 
  ;; TODO: Shouldn't SystemAPI be broken up into individual endpoints?
  #_"juxt/site/system-api"
@@ -816,8 +821,8 @@
  "juxt/site/browser-client"
  {:juxt.site/title "Browser client"
   :juxt.site/installers
-  [{:juxt.site/base-uri "https://auth.example.org"
-    :juxt.site/installer-path "/applications/browser"}
+  [{:juxt.site/base-uri "https://data.example.org"
+    :juxt.site/installer-path "/_site/applications/browser"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/browser/browser-oauth-redirect.html"}]}
 
@@ -1096,8 +1101,8 @@
 
  "juxt/site/testing/basic-auth-protected-resource"
  {:juxt.site/installers
-  [{:juxt.site/base-uri "https://auth.example.org" :juxt.site/installer-path "/operations/testing/basic-auth-protected-resource-operation"}
-   {:juxt.site/base-uri "https://auth.example.org" :juxt.site/installer-path "/permissions/testing/basic-auth-protected-resource-operation"}
+  [{:juxt.site/base-uri "https://data.example.org" :juxt.site/installer-path "/_site/testing/operations/basic-auth-protected-resource-operation"}
+   {:juxt.site/base-uri "https://data.example.org" :juxt.site/installer-path "/_site/testing/permissions/basic-auth-protected-resource-operation"}
    {:juxt.site/base-uri "https://data.example.org" :juxt.site/installer-path "/_site/testing/basic-auth-protected-resource"}
    {:juxt.site/base-uri "https://data.example.org" :juxt.site/installer-path "/_site/testing/client-credentials-protected-resource"}
    ]}
@@ -1110,7 +1115,7 @@
  "juxt/site/testing/test-admin-client"
  {:juxt.site/description "A client, with the SiteAdmin role, for use in tests"
   :juxt.site/installers
-  [{:juxt.site/base-uri "https://auth.example.test" :juxt.site/installer-path "/applications/test-admin-client"}
+  [{:juxt.site/base-uri "https://data.example.test" :juxt.site/installer-path "/_site/applications/test-admin-client"}
    {:juxt.site/base-uri "https://data.example.org"
     :juxt.site/installer-path "/_site/application-role-assignments/{{clientid}}-{{rolename}}"
     :juxt.site/parameters {"clientid" "test-admin-client" "rolename" "SiteAdmin"}}]}}
diff --git a/installers/data.example.org/_site/access-token.edn b/installers/data.example.org/_site/access-token.edn
index a8053bfcf..46ca2a2ea 100644
--- a/installers/data.example.org/_site/access-token.edn
+++ b/installers/data.example.org/_site/access-token.edn
@@ -1,5 +1,5 @@
 {:deps
- ["https://auth.example.org/operations/get-access-token"
+ ["https://data.example.org/_site/operations/get-access-token"
   "https://auth.example.org/protection-spaces/bearer"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
@@ -11,7 +11,7 @@
 
    :juxt.site/methods
    {:get
-    {:juxt.site/operation-uri "https://auth.example.org/operations/get-access-token"
+    {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-access-token"
      :openapi.v3/metadata {"tags" ["Introspection"]
                            "summary" "Show the access token as text so it can be saved"}}}
 
diff --git a/installers/data.example.org/_site/access-token.txt.edn b/installers/data.example.org/_site/access-token.txt.edn
index 2ff04260f..49570d86c 100644
--- a/installers/data.example.org/_site/access-token.txt.edn
+++ b/installers/data.example.org/_site/access-token.txt.edn
@@ -1,13 +1,13 @@
 {:deps
  ["https://data.example.org/_site/access-token"
-  "https://auth.example.org/operations/get-access-token"]
+  "https://data.example.org/_site/operations/get-access-token"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/operations/put-resource"
   :juxt.site/input
   {:xt/id "{{$id}}"
    :juxt.site/methods
-   {:get {:juxt.site/operation-uri "https://auth.example.org/operations/get-access-token"}}
+   {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-access-token"}}
    :juxt.site/variant-of "https://data.example.org/_site/access-token"
    :juxt.http/content-type "text/plain;charset=us-ascii"
 
diff --git a/installers/auth.example.org/applications/browser.edn b/installers/data.example.org/_site/applications/browser.edn
similarity index 100%
rename from installers/auth.example.org/applications/browser.edn
rename to installers/data.example.org/_site/applications/browser.edn
diff --git a/installers/auth.example.org/applications/test-admin-client.edn b/installers/data.example.org/_site/applications/test-admin-client.edn
similarity index 100%
rename from installers/auth.example.org/applications/test-admin-client.edn
rename to installers/data.example.org/_site/applications/test-admin-client.edn
diff --git a/installers/data.example.org/_site/openapi.json.edn b/installers/data.example.org/_site/openapi.json.edn
index 46b4a5274..efb38994a 100644
--- a/installers/data.example.org/_site/openapi.json.edn
+++ b/installers/data.example.org/_site/openapi.json.edn
@@ -1,8 +1,8 @@
 {:deps
- ["https://auth.example.org/operations/put-openapi-document"]
+ ["https://data.example.org/_site/operations/put-openapi-document"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
-  :juxt.site/operation-uri "https://auth.example.org/operations/put-openapi-document"
+  :juxt.site/operation-uri "https://data.example.org/_site/operations/put-openapi-document"
   :juxt.site/input
   {:xt/id "{{$id}}"
 
@@ -41,14 +41,14 @@ Some useful links:
         {"authorizationUrl" "https://auth.example.org/oauth/authorize"
          "scopes"
          {"https://auth.example.org/scopes/system/read" "Read system info"
-          "https://auth.example.org/scopes/system/self-identification" "Self identification"
+          "https://data.example.org/_site/scopes/system/self-identification" "Self identification"
           "https://auth.example.org/scopes/system/write" "Administer system"}
          "tokenUrl" "https://auth.example.org/oauth/token"}
 
         "clientCredentials"
         {"scopes"
          {"https://auth.example.org/scopes/system/read" "Read system info"
-          "https://auth.example.org/scopes/system/self-identification" "Self identification"
+          "https://data.example.org/_site/scopes/system/self-identification" "Self identification"
           "https://auth.example.org/scopes/system/write" "Administer system"}
          "tokenUrl" "https://auth.example.org/oauth/token"}
 
@@ -56,12 +56,12 @@ Some useful links:
         {"authorizationUrl" "https://auth.example.org/oauth/authorize"
          "scopes"
          {"https://auth.example.org/scopes/system/read" "Read system info"
-          "https://auth.example.org/scopes/system/self-identification" "Self identification"
+          "https://data.example.org/_site/scopes/system/self-identification" "Self identification"
           "https://auth.example.org/scopes/system/write" "Administer system"}}
 
         "password"
         {"scopes"
          {"https://auth.example.org/scopes/system/read" "Read system info"
-          "https://auth.example.org/scopes/system/self-identification" "Self identification"
+          "https://data.example.org/_site/scopes/system/self-identification" "Self identification"
           "https://auth.example.org/scopes/system/write" "Administer system"}
          "tokenUrl" "https://auth.example.org/oauth/token"}}}}}}}}}
diff --git a/installers/data.example.org/_site/openapis.edn b/installers/data.example.org/_site/openapis.edn
index 867df1e6d..c40ac9115 100644
--- a/installers/data.example.org/_site/openapis.edn
+++ b/installers/data.example.org/_site/openapis.edn
@@ -1,6 +1,6 @@
 {:deps
- ["https://auth.example.org/operations/get-openapis"
-  "https://auth.example.org/operations/post-openapi"
+ ["https://data.example.org/_site/operations/get-openapis"
+  "https://data.example.org/_site/operations/post-openapi"
   "https://auth.example.org/protection-spaces/bearer"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
@@ -12,14 +12,14 @@
 
    :juxt.site/methods
    {:get
-    {:juxt.site/operation-uri "https://auth.example.org/operations/get-openapis"
+    {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-openapis"
      :openapi.v3/metadata {"tags" ["OpenAPIs"]
                            "summary" "Get OpenAPIs"}}
 
     :post
     {:juxt.site/operation-uri
      ;; TODO: Rename to register-users
-     "https://auth.example.org/operations/post-openapi"
+     "https://data.example.org/_site/operations/post-openapi"
      :openapi.v3/metadata
      {"tags" ["OpenAPIs"]
       "summary" "Install an OpenAPI"
diff --git a/installers/data.example.org/_site/openapis.edn.edn b/installers/data.example.org/_site/openapis.edn.edn
index 7b7fb3e5f..44e826105 100644
--- a/installers/data.example.org/_site/openapis.edn.edn
+++ b/installers/data.example.org/_site/openapis.edn.edn
@@ -1,13 +1,13 @@
 {:deps
  ["https://data.example.org/_site/openapis"
-  "https://auth.example.org/operations/get-openapis"]
+  "https://data.example.org/_site/operations/get-openapis"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/operations/put-resource"
   :juxt.site/input
   {:xt/id "{{$id}}"
    :juxt.site/methods
-   {:get {:juxt.site/operation-uri "https://auth.example.org/operations/get-openapis"}}
+   {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-openapis"}}
    :juxt.site/variant-of "https://data.example.org/_site/openapis"
    :juxt.http/content-type "application/edn"
    :juxt.pick/quality-of-source 0.5 ; downgrade in content-negotiation
diff --git a/installers/data.example.org/_site/openapis.json.edn b/installers/data.example.org/_site/openapis.json.edn
index 59dddc168..b1cfb438e 100644
--- a/installers/data.example.org/_site/openapis.json.edn
+++ b/installers/data.example.org/_site/openapis.json.edn
@@ -1,13 +1,13 @@
 {:deps
  ["https://data.example.org/_site/openapis"
-  "https://auth.example.org/operations/get-openapis"]
+  "https://data.example.org/_site/operations/get-openapis"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/operations/put-resource"
   :juxt.site/input
   {:xt/id "{{$id}}"
    :juxt.site/methods
-   {:get {:juxt.site/operation-uri "https://auth.example.org/operations/get-openapis"}}
+   {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-openapis"}}
    :juxt.site/variant-of "https://data.example.org/_site/openapis"
    :juxt.http/content-type "application/json"
 
diff --git a/installers/data.example.org/_site/operations.edn b/installers/data.example.org/_site/operations.edn
index 436a8222d..0b7f88267 100644
--- a/installers/data.example.org/_site/operations.edn
+++ b/installers/data.example.org/_site/operations.edn
@@ -1,5 +1,5 @@
 {:deps
- ["https://auth.example.org/operations/get-operations"
+ ["https://data.example.org/_site/operations/get-operations"
   "https://auth.example.org/protection-spaces/bearer"
   "https://auth.example.org/operations/put-resource"]
  :install
@@ -12,7 +12,7 @@
 
    :juxt.site/methods
    {:get
-    {:juxt.site/operation-uri "https://auth.example.org/operations/get-operations"
+    {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-operations"
      :openapi.v3/metadata
      {"tags" ["Operations"]
       "summary" "Get all permitted operations"}}
diff --git a/installers/data.example.org/_site/operations.edn.edn b/installers/data.example.org/_site/operations.edn.edn
index 340412679..0e088d9eb 100644
--- a/installers/data.example.org/_site/operations.edn.edn
+++ b/installers/data.example.org/_site/operations.edn.edn
@@ -1,13 +1,13 @@
 {:deps
  ["https://data.example.org/_site/operations"
-  "https://auth.example.org/operations/get-operations"]
+  "https://data.example.org/_site/operations/get-operations"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/operations/put-resource"
   :juxt.site/input
   {:xt/id "{{$id}}"
    :juxt.site/methods
-   {:get {:juxt.site/operation-uri "https://auth.example.org/operations/get-operations"}}
+   {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-operations"}}
    :juxt.site/variant-of "https://data.example.org/_site/operations"
    :juxt.http/content-type "application/edn"
    :juxt.pick/quality-of-source 0.5 ; downgrade in content-negotiation
diff --git a/installers/data.example.org/_site/operations.json.edn b/installers/data.example.org/_site/operations.json.edn
index 7dce64bec..c22734431 100644
--- a/installers/data.example.org/_site/operations.json.edn
+++ b/installers/data.example.org/_site/operations.json.edn
@@ -1,13 +1,13 @@
 {:deps
  ["https://data.example.org/_site/operations"
-  "https://auth.example.org/operations/get-operations"]
+  "https://data.example.org/_site/operations/get-operations"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/operations/put-resource"
   :juxt.site/input
   {:xt/id "{{$id}}"
    :juxt.site/methods
-   {:get {:juxt.site/operation-uri "https://auth.example.org/operations/get-operations"}}
+   {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-operations"}}
    :juxt.site/variant-of "https://data.example.org/_site/operations"
    :juxt.http/content-type "application/json"
 
diff --git a/installers/auth.example.org/operations/get-access-token.edn b/installers/data.example.org/_site/operations/get-access-token.edn
similarity index 79%
rename from installers/auth.example.org/operations/get-access-token.edn
rename to installers/data.example.org/_site/operations/get-access-token.edn
index 63cc115cb..7eb5b0906 100644
--- a/installers/auth.example.org/operations/get-access-token.edn
+++ b/installers/data.example.org/_site/operations/get-access-token.edn
@@ -1,4 +1,4 @@
-{:deps ["https://auth.example.org/scopes/system/self-identification"]
+{:deps ["https://data.example.org/_site/scopes/system/self-identification"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/create-operation"
@@ -12,7 +12,7 @@
     (get-in *ctx* [:juxt.site/access-token :juxt.site/token])}
 
    :juxt.site/scope
-   #{"https://auth.example.org/scopes/system/self-identification"}
+   #{"https://data.example.org/_site/scopes/system/self-identification"}
 
    ;; Anyone should be able to call whoami
    :juxt.site/rules
diff --git a/installers/auth.example.org/operations/get-openapi-document.edn b/installers/data.example.org/_site/operations/get-openapi-document.edn
similarity index 100%
rename from installers/auth.example.org/operations/get-openapi-document.edn
rename to installers/data.example.org/_site/operations/get-openapi-document.edn
diff --git a/installers/auth.example.org/operations/get-openapis.edn b/installers/data.example.org/_site/operations/get-openapis.edn
similarity index 100%
rename from installers/auth.example.org/operations/get-openapis.edn
rename to installers/data.example.org/_site/operations/get-openapis.edn
diff --git a/installers/auth.example.org/operations/get-operations.edn b/installers/data.example.org/_site/operations/get-operations.edn
similarity index 100%
rename from installers/auth.example.org/operations/get-operations.edn
rename to installers/data.example.org/_site/operations/get-operations.edn
diff --git a/installers/auth.example.org/operations/post-openapi.edn b/installers/data.example.org/_site/operations/post-openapi.edn
similarity index 98%
rename from installers/auth.example.org/operations/post-openapi.edn
rename to installers/data.example.org/_site/operations/post-openapi.edn
index 504b9723b..843880a0b 100644
--- a/installers/auth.example.org/operations/post-openapi.edn
+++ b/installers/data.example.org/_site/operations/post-openapi.edn
@@ -45,7 +45,7 @@
          {:xt/id (str base-uri "/openapi.json")
           :juxt.site/type "https://meta.juxt.site/types/openapi-document"
           :juxt.http/content-type "application/json"
-          :juxt.site/methods {:get {:juxt.site/operation-uri "https://auth.example.org/operations/get-openapi-document"}}
+          :juxt.site/methods {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-openapi-document"}}
           :openapi.v3/definition openapi
 
           :juxt.site/access-control-allow-origins
diff --git a/installers/auth.example.org/operations/put-openapi-document.edn b/installers/data.example.org/_site/operations/put-openapi-document.edn
similarity index 91%
rename from installers/auth.example.org/operations/put-openapi-document.edn
rename to installers/data.example.org/_site/operations/put-openapi-document.edn
index e1e22553d..8877e463e 100644
--- a/installers/auth.example.org/operations/put-openapi-document.edn
+++ b/installers/data.example.org/_site/operations/put-openapi-document.edn
@@ -1,6 +1,6 @@
 {:deps
- ["https://auth.example.org/operations/get-openapi-document"
-  "https://auth.example.org/permissions/get-openapi-document" ; arguably in bundles, not here ; TODO: Remove
+ ["https://data.example.org/_site/operations/get-openapi-document"
+  "https://data.example.org/_site/permissions/get-openapi-document" ; arguably in bundles, not here ; TODO: Remove
   "https://auth.example.org/scopes/system/write"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
@@ -39,7 +39,7 @@
              {:juxt.site/type "https://meta.juxt.site/types/openapi-document"
 
               :juxt.site/methods
-              {:get {:juxt.site/operation-uri "https://auth.example.org/operations/get-openapi-document"}}
+              {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/get-openapi-document"}}
 
               :juxt.site/access-control-allow-origins
               [[".*" {:juxt.site/access-control-allow-origin "*"
diff --git a/installers/auth.example.org/operations/whoami.edn b/installers/data.example.org/_site/operations/whoami.edn
similarity index 96%
rename from installers/auth.example.org/operations/whoami.edn
rename to installers/data.example.org/_site/operations/whoami.edn
index 8e45b7fc2..33c4885b2 100644
--- a/installers/auth.example.org/operations/whoami.edn
+++ b/installers/data.example.org/_site/operations/whoami.edn
@@ -1,4 +1,4 @@
-{:deps ["https://auth.example.org/scopes/system/self-identification"]
+{:deps ["https://data.example.org/_site/scopes/system/self-identification"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/create-operation"
@@ -78,7 +78,7 @@
               :else {})))}
 
    :juxt.site/scope
-   #{"https://auth.example.org/scopes/system/self-identification"}
+   #{"https://data.example.org/_site/scopes/system/self-identification"}
 
    ;; Anyone should be able to call whoami
    :juxt.site/rules
diff --git a/installers/auth.example.org/permissions/get-access-token.edn b/installers/data.example.org/_site/permissions/get-access-token.edn
similarity index 59%
rename from installers/auth.example.org/permissions/get-access-token.edn
rename to installers/data.example.org/_site/permissions/get-access-token.edn
index 302a172ae..ce26a19fd 100644
--- a/installers/auth.example.org/permissions/get-access-token.edn
+++ b/installers/data.example.org/_site/permissions/get-access-token.edn
@@ -1,8 +1,8 @@
 {:deps
- ["https://auth.example.org/operations/whoami"]
+ ["https://data.example.org/_site/operations/whoami"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/grant-permission"
   :juxt.site/input
   {:xt/id "{{$id}}"
-   :juxt.site/operation-uri "https://auth.example.org/operations/get-access-token"}}}
+   :juxt.site/operation-uri "https://data.example.org/_site/operations/get-access-token"}}}
diff --git a/installers/auth.example.org/permissions/get-openapi-document.edn b/installers/data.example.org/_site/permissions/get-openapi-document.edn
similarity index 57%
rename from installers/auth.example.org/permissions/get-openapi-document.edn
rename to installers/data.example.org/_site/permissions/get-openapi-document.edn
index 99ebfc66b..37d926614 100644
--- a/installers/auth.example.org/permissions/get-openapi-document.edn
+++ b/installers/data.example.org/_site/permissions/get-openapi-document.edn
@@ -1,8 +1,8 @@
 {:deps
- ["https://auth.example.org/operations/get-openapi-document"]
+ ["https://data.example.org/_site/operations/get-openapi-document"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/grant-permission"
   :juxt.site/input
   {:xt/id "{{$id}}"
-   :juxt.site/operation-uri "https://auth.example.org/operations/get-openapi-document"}}}
+   :juxt.site/operation-uri "https://data.example.org/_site/operations/get-openapi-document"}}}
diff --git a/installers/auth.example.org/permissions/get-operations.edn b/installers/data.example.org/_site/permissions/get-operations.edn
similarity index 58%
rename from installers/auth.example.org/permissions/get-operations.edn
rename to installers/data.example.org/_site/permissions/get-operations.edn
index 8785e9e0e..e5bf66b1b 100644
--- a/installers/auth.example.org/permissions/get-operations.edn
+++ b/installers/data.example.org/_site/permissions/get-operations.edn
@@ -1,8 +1,8 @@
 {:deps
- ["https://auth.example.org/operations/get-operations"]
+ ["https://data.example.org/_site/operations/get-operations"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/grant-permission"
   :juxt.site/input
   {:xt/id "{{$id}}"
-   :juxt.site/operation-uri "https://auth.example.org/operations/get-operations"}}}
+   :juxt.site/operation-uri "https://data.example.org/_site/operations/get-operations"}}}
diff --git a/installers/auth.example.org/permissions/system/put-openapi-document.edn b/installers/data.example.org/_site/permissions/put-openapi-document.edn
similarity index 63%
rename from installers/auth.example.org/permissions/system/put-openapi-document.edn
rename to installers/data.example.org/_site/permissions/put-openapi-document.edn
index 319322afb..3d7b6f2b5 100644
--- a/installers/auth.example.org/permissions/system/put-openapi-document.edn
+++ b/installers/data.example.org/_site/permissions/put-openapi-document.edn
@@ -1,9 +1,9 @@
 {:deps
- ["https://auth.example.org/operations/put-openapi-document"]
+ ["https://data.example.org/_site/operations/put-openapi-document"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/grant-permission"
   :juxt.site/input
   {:xt/id "{{$id}}"
    :juxt.site/subject "https://auth.example.org/_site/subjects/system"
-   :juxt.site/operation-uri "https://auth.example.org/operations/put-openapi-document"}}}
+   :juxt.site/operation-uri "https://data.example.org/_site/operations/put-openapi-document"}}}
diff --git a/installers/auth.example.org/permissions/whoami.edn b/installers/data.example.org/_site/permissions/whoami.edn
similarity index 61%
rename from installers/auth.example.org/permissions/whoami.edn
rename to installers/data.example.org/_site/permissions/whoami.edn
index c2bb4bce3..5f647eea4 100644
--- a/installers/auth.example.org/permissions/whoami.edn
+++ b/installers/data.example.org/_site/permissions/whoami.edn
@@ -1,8 +1,8 @@
 {:deps
- ["https://auth.example.org/operations/whoami"]
+ ["https://data.example.org/_site/operations/whoami"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/grant-permission"
   :juxt.site/input
   {:xt/id "{{$id}}"
-   :juxt.site/operation-uri "https://auth.example.org/operations/whoami"}}}
+   :juxt.site/operation-uri "https://data.example.org/_site/operations/whoami"}}}
diff --git a/installers/auth.example.org/scopes/system/self-identification.edn b/installers/data.example.org/_site/scopes/system/self-identification.edn
similarity index 100%
rename from installers/auth.example.org/scopes/system/self-identification.edn
rename to installers/data.example.org/_site/scopes/system/self-identification.edn
diff --git a/installers/data.example.org/_site/testing/basic-auth-protected-resource.edn b/installers/data.example.org/_site/testing/basic-auth-protected-resource.edn
index 200ec0393..f2c0a9378 100644
--- a/installers/data.example.org/_site/testing/basic-auth-protected-resource.edn
+++ b/installers/data.example.org/_site/testing/basic-auth-protected-resource.edn
@@ -1,7 +1,7 @@
 {:deps
  ["https://auth.example.org/operations/put-resource"
   "https://auth.example.org/protection-spaces/basic"
-  "https://auth.example.org/operations/testing/basic-auth-protected-resource-operation"]
+  "https://data.example.org/_site/testing/operations/basic-auth-protected-resource-operation"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/operations/put-resource"
@@ -10,10 +10,10 @@
    :juxt.site/protection-space-uris #{"https://auth.example.org/protection-spaces/basic"}
    :juxt.site/methods
    {:get
-    {:juxt.site/operation-uri "https://auth.example.org/operations/testing/basic-auth-protected-resource-operation"}}
+    {:juxt.site/operation-uri "https://data.example.org/_site/testing/operations/basic-auth-protected-resource-operation"}}
 
    :juxt.http/content-type "text/plain"
    :juxt.http/content "Hello World!"
 
-
+   
    }}}
diff --git a/installers/data.example.org/_site/testing/client-credentials-protected-resource.edn b/installers/data.example.org/_site/testing/client-credentials-protected-resource.edn
index 9e7ca425e..936432c06 100644
--- a/installers/data.example.org/_site/testing/client-credentials-protected-resource.edn
+++ b/installers/data.example.org/_site/testing/client-credentials-protected-resource.edn
@@ -1,7 +1,7 @@
 {:deps
  ["https://auth.example.org/operations/put-resource"
   "https://auth.example.org/protection-spaces/client-credentials"
-  "https://auth.example.org/operations/testing/basic-auth-protected-resource-operation"]
+  "https://data.example.org/_site/testing/operations/basic-auth-protected-resource-operation"]
  :install
  {:juxt.site/subject-uri "https://auth.example.org/_site/subjects/system"
   :juxt.site/operation-uri "https://auth.example.org/operations/put-resource"
@@ -10,7 +10,7 @@
    :juxt.site/protection-space-uris #{"https://auth.example.org/protection-spaces/client-credentials"}
    :juxt.site/methods
    {:get
-    {:juxt.site/operation-uri "https://auth.example.org/operations/testing/basic-auth-protected-resource-operation"}}
+    {:juxt.site/operation-uri "https://data.example.org/_site/testing/operations/basic-auth-protected-resource-operation"}}
 
    :juxt.http/content-type "text/plain"
    :juxt.http/content "Hello World!"
diff --git a/installers/auth.example.org/operations/testing/basic-auth-protected-resource-operation.edn b/installers/data.example.org/_site/testing/operations/basic-auth-protected-resource-operation.edn
similarity index 100%
rename from installers/auth.example.org/operations/testing/basic-auth-protected-resource-operation.edn
rename to installers/data.example.org/_site/testing/operations/basic-auth-protected-resource-operation.edn
diff --git a/installers/auth.example.org/permissions/testing/basic-auth-protected-resource-operation.edn b/installers/data.example.org/_site/testing/permissions/basic-auth-protected-resource-operation.edn
similarity index 63%
rename from installers/auth.example.org/permissions/testing/basic-auth-protected-resource-operation.edn
rename to installers/data.example.org/_site/testing/permissions/basic-auth-protected-resource-operation.edn
index 5326130a2..15253a281 100644
--- a/installers/auth.example.org/permissions/testing/basic-auth-protected-resource-operation.edn
+++ b/installers/data.example.org/_site/testing/permissions/basic-auth-protected-resource-operation.edn
@@ -3,4 +3,4 @@
   :juxt.site/operation-uri "https://auth.example.org/_site/operations/grant-permission"
   :juxt.site/input
   {:xt/id "{{$id}}"
-   :juxt.site/operation-uri "https://auth.example.org/operations/testing/basic-auth-protected-resource-operation"}}}
+   :juxt.site/operation-uri "https://data.example.org/_site/testing/operations/basic-auth-protected-resource-operation"}}}
diff --git a/installers/data.example.org/_site/whoami.edn b/installers/data.example.org/_site/whoami.edn
index c43445d9b..abf158f05 100644
--- a/installers/data.example.org/_site/whoami.edn
+++ b/installers/data.example.org/_site/whoami.edn
@@ -1,5 +1,5 @@
 {:deps
- ["https://auth.example.org/operations/whoami"
+ ["https://data.example.org/_site/operations/whoami"
   "https://auth.example.org/operations/put-resource"
   "https://auth.example.org/protection-spaces/bearer"]
  :install
@@ -12,7 +12,7 @@
 
    :juxt.site/methods
    {:get
-    {:juxt.site/operation-uri "https://auth.example.org/operations/whoami"
+    {:juxt.site/operation-uri "https://data.example.org/_site/operations/whoami"
      :openapi.v3/metadata {"tags" ["Introspection"]
                            "summary" "Find out information about the requestor"}}}
 
diff --git a/installers/data.example.org/_site/whoami.edn.edn b/installers/data.example.org/_site/whoami.edn.edn
index 67641168e..c34591fe4 100644
--- a/installers/data.example.org/_site/whoami.edn.edn
+++ b/installers/data.example.org/_site/whoami.edn.edn
@@ -1,5 +1,5 @@
 {:deps
- ["https://auth.example.org/operations/whoami"
+ ["https://data.example.org/_site/operations/whoami"
   "https://auth.example.org/operations/put-resource"
   "https://auth.example.org/protection-spaces/bearer"]
  :install
@@ -8,7 +8,7 @@
   :juxt.site/input
   {:xt/id "{{$id}}"
    :juxt.site/methods
-   {:get {:juxt.site/operation-uri "https://auth.example.org/operations/whoami"}}
+   {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/whoami"}}
    :juxt.site/variant-of "https://data.example.org/_site/whoami"
    :juxt.http/content-type "application/edn"
    :juxt.pick/quality-of-source 0.5 ; downgrade in content-negotiation
diff --git a/installers/data.example.org/_site/whoami.json.edn b/installers/data.example.org/_site/whoami.json.edn
index 3dbff2e1f..4ef4879d7 100644
--- a/installers/data.example.org/_site/whoami.json.edn
+++ b/installers/data.example.org/_site/whoami.json.edn
@@ -1,5 +1,5 @@
 {:deps
- ["https://auth.example.org/operations/whoami"
+ ["https://data.example.org/_site/operations/whoami"
   "https://auth.example.org/operations/put-resource"
   "https://auth.example.org/protection-spaces/bearer"]
  :install
@@ -8,7 +8,7 @@
   :juxt.site/input
   {:xt/id "{{$id}}"
    :juxt.site/methods
-   {:get {:juxt.site/operation-uri "https://auth.example.org/operations/whoami"}}
+   {:get {:juxt.site/operation-uri "https://data.example.org/_site/operations/whoami"}}
    :juxt.site/variant-of "https://data.example.org/_site/whoami"
    :juxt.http/content-type "application/json"
    :juxt.site/respond
diff --git a/installers/data.example.org/petstore/operations/add-pet.edn b/installers/data.example.org/petstore/operations/add-pet.edn
index f9a710491..46c06cf1e 100644
--- a/installers/data.example.org/petstore/operations/add-pet.edn
+++ b/installers/data.example.org/petstore/operations/add-pet.edn
@@ -16,7 +16,7 @@
       [:xtdb.api/put doc])}
 
    :juxt.site/scope
-   #{"https://auth.example.org/scopes/petstore/write"}
+   #{"https://data.example.org/scopes/petstore/write"}
    :juxt.site/rules
    [[(allowed? subject operation resource permission)
      [subject :juxt.site/user user]
diff --git a/installers/data.example.org/petstore/operations/delete-pet-by-id.edn b/installers/data.example.org/petstore/operations/delete-pet-by-id.edn
index f61951380..dc45f6851 100644
--- a/installers/data.example.org/petstore/operations/delete-pet-by-id.edn
+++ b/installers/data.example.org/petstore/operations/delete-pet-by-id.edn
@@ -18,7 +18,7 @@
       [:xtdb.api/delete doc])}
 
    :juxt.site/scope
-   #{"https://auth.example.org/scopes/petstore/write"}
+   #{"https://data.example.org/scopes/petstore/write"}
    
    :juxt.site/rules
    [
diff --git a/installers/data.example.org/petstore/operations/order/delete-by-id.edn b/installers/data.example.org/petstore/operations/order/delete-by-id.edn
index 298957989..23d13c13e 100644
--- a/installers/data.example.org/petstore/operations/order/delete-by-id.edn
+++ b/installers/data.example.org/petstore/operations/order/delete-by-id.edn
@@ -18,7 +18,7 @@
        [:xtdb.api/delete doc])}
 
    :juxt.site/scope
-   #{"https://auth.example.org/scopes/petstore/write"}
+   #{"https://data.example.org/scopes/petstore/write"}
 
    :juxt.site/rules
    [[(allowed? subject operation resource permission)
diff --git a/installers/data.example.org/petstore/operations/order/place.edn b/installers/data.example.org/petstore/operations/order/place.edn
index e221ce1c4..8f8399a41 100644
--- a/installers/data.example.org/petstore/operations/order/place.edn
+++ b/installers/data.example.org/petstore/operations/order/place.edn
@@ -97,7 +97,7 @@
           :ring.response/body (format "No pet with ID %s found" (->> docs first :petId))}))}
 
    :juxt.site/scope
-   #{"https://auth.example.org/scopes/petstore/write"}
+   #{"https://data.example.org/scopes/petstore/write"}
 
    :juxt.site/rules
    [[(allowed? subject operation resource permission)
diff --git a/server/test/juxt/site/application_registration_test.clj b/server/test/juxt/site/application_registration_test.clj
index ead88c696..fbfc7688a 100644
--- a/server/test/juxt/site/application_registration_test.clj
+++ b/server/test/juxt/site/application_registration_test.clj
@@ -27,6 +27,7 @@
     "juxt/site/oauth-token-endpoint"
     "juxt/site/resources-api"
     "juxt/site/applications-api"
+    "juxt/site/applications-endpoint"
     "juxt/site/testing/system-permissions"
     "juxt/site/testing/test-admin-client"
     "juxt/site/oauth-token-endpoint"
diff --git a/server/test/juxt/site/bundle_test.clj b/server/test/juxt/site/bundle_test.clj
index 2f251e930..e6d3e99ca 100644
--- a/server/test/juxt/site/bundle_test.clj
+++ b/server/test/juxt/site/bundle_test.clj
@@ -58,6 +58,7 @@
     ["juxt/site/events-api" {}]
     ["juxt/site/whoami-api" {}]
     ["juxt/site/users-api" {}]
+    ["juxt/site/users-api-permissions" {}]
     ["juxt/site/openapis-api" {}]
     ["juxt/site/bundles-api" {}]
 
diff --git a/server/test/juxt/site/error_test.clj b/server/test/juxt/site/error_test.clj
index 2778cda27..4a4f3eff3 100644
--- a/server/test/juxt/site/error_test.clj
+++ b/server/test/juxt/site/error_test.clj
@@ -20,7 +20,8 @@
     "juxt/site/user-model"
     "juxt/site/protection-spaces"
     "juxt/site/resources-api"
-    "juxt/site/users-api"]
+    "juxt/site/users-api"
+    "juxt/site/users-api-permissions"]
    RESOURCE_SERVER)
   (f))
 
diff --git a/server/test/juxt/site/installer_test.clj b/server/test/juxt/site/installer_test.clj
index 527e23a48..f70d819d8 100644
--- a/server/test/juxt/site/installer_test.clj
+++ b/server/test/juxt/site/installer_test.clj
@@ -59,7 +59,7 @@
           (map first
                (xt/q db
                      '{:find [(pull ev [*])]
-                       :where [[ev :juxt.site/operation-uri "https://auth.example.test/operations/put-openapi-document"]
+                       :where [[ev :juxt.site/operation-uri "https://data.example.test/_site/operations/put-openapi-document"]
                                [ev :juxt.site/type "https://meta.juxt.site/types/event"]]}))
 
           ev (first events)]
diff --git a/server/test/juxt/site/post_openapi_test.clj b/server/test/juxt/site/post_openapi_test.clj
index 33d4071dc..446f67ca7 100644
--- a/server/test/juxt/site/post_openapi_test.clj
+++ b/server/test/juxt/site/post_openapi_test.clj
@@ -64,7 +64,7 @@
                     (update-in ["servers" 0 "url"] #(str data-base-uri %)))
         resource (edn/read-string
                   {:readers {'juxt.pprint (fn [x] (with-out-str (pprint x)))}}
-                  (slurp (io/file "../installers/auth.example.org/operations/post-openapi.edn")))
+                  (slurp (io/file "../installers/data.example.org/_site/operations/post-openapi.edn")))
         program (get-in resource [:install :juxt.site/input :juxt.site/transact :juxt.site.sci/program])]
 
     (sci/eval-string
diff --git a/server/test/juxt/site/system_api_test.clj b/server/test/juxt/site/system_api_test.clj
index 06820c64c..ad15eedb0 100644
--- a/server/test/juxt/site/system_api_test.clj
+++ b/server/test/juxt/site/system_api_test.clj
@@ -34,6 +34,7 @@
     "juxt/site/user-model"
     "juxt/site/resources-api"
     "juxt/site/users-api"
+    "juxt/site/users-api-permissions"
     "juxt/site/openapis-api"
     "juxt/site/system-api-openapi"
     ["juxt/site/sessions" {}]
@@ -85,7 +86,7 @@
               "flows"
               {"implicit"
                {"scopes"
-                {"https://auth.example.test/scopes/system/self-identification"
+                {"https://data.example.test/_site/scopes/system/self-identification"
                  "Self identification",
                  "https://auth.example.test/scopes/system/read"
                  "Read system info",
@@ -95,7 +96,7 @@
                "authorizationCode"
                {"tokenUrl" "https://auth.example.test/oauth/token",
                 "scopes"
-                {"https://auth.example.test/scopes/system/self-identification"
+                {"https://data.example.test/_site/scopes/system/self-identification"
                  "Self identification",
                  "https://auth.example.test/scopes/system/read"
                  "Read system info",
@@ -105,7 +106,7 @@
                "password"
                {"tokenUrl" "https://auth.example.test/oauth/token",
                 "scopes"
-                {"https://auth.example.test/scopes/system/self-identification"
+                {"https://data.example.test/_site/scopes/system/self-identification"
                  "Self identification",
                  "https://auth.example.test/scopes/system/read"
                  "Read system info",
@@ -114,7 +115,7 @@
                "clientCredentials"
                {"tokenUrl" "https://auth.example.test/oauth/token",
                 "scopes"
-                {"https://auth.example.test/scopes/system/self-identification"
+                {"https://data.example.test/_site/scopes/system/self-identification"
                  "Self identification",
                  "https://auth.example.test/scopes/system/read"
                  "Read system info",
diff --git a/server/test/juxt/site/test_helpers/init.clj b/server/test/juxt/site/test_helpers/init.clj
index d2ddefa17..72ea2400a 100644
--- a/server/test/juxt/site/test_helpers/init.clj
+++ b/server/test/juxt/site/test_helpers/init.clj
@@ -29,6 +29,7 @@
     "juxt/site/events-api"
     "juxt/site/whoami-api"
     "juxt/site/users-api"
+    "juxt/site/users-api-permissions"
     "juxt/site/openapis-api"
     "juxt/site/bundles-api"
     "juxt/site/sessions"
diff --git a/server/tests.edn b/server/tests.edn
index a13b6df06..0f5e4ba45 100644
--- a/server/tests.edn
+++ b/server/tests.edn
@@ -18,7 +18,7 @@
            "juxt.site.oauth-grants-test"
            "juxt.site.openid-test"
            "juxt.site.system-api-test"
-           "juxt.site.whoami-test"
+           "juxt.site.1whoami-test"
            "juxt.site.schema-test"
            "juxt.site.basic-auth-test"
            "juxt.site.create-users-test"
diff --git a/src/juxt/site/site_cli/tasks.clj b/src/juxt/site/site_cli/tasks.clj
index c1cc95558..7af67b063 100644
--- a/src/juxt/site/site_cli/tasks.clj
+++ b/src/juxt/site/site_cli/tasks.clj
@@ -469,7 +469,9 @@
            ["juxt/site/logs-api" {}]
            ["juxt/site/whoami-api" {}]
            ["juxt/site/users-api" {}]
+           ["juxt/site/users-api-permissions" {}]
            ["juxt/site/applications-api" {}]
+           ["juxt/site/applications-endpoint" {}]
            ["juxt/site/openapis-api" {}]
            ["juxt/site/bundles-api" {}]