diff --git a/src/bundles/Elsa.WorkflowServer.Web/Program.cs b/src/bundles/Elsa.WorkflowServer.Web/Program.cs
index bddd2ed19..f195c710d 100644
--- a/src/bundles/Elsa.WorkflowServer.Web/Program.cs
+++ b/src/bundles/Elsa.WorkflowServer.Web/Program.cs
@@ -1,4 +1,3 @@
-using System.Globalization;
 using System.IdentityModel.Tokens.Jwt;
 using System.Security.Claims;
 using Elsa;
diff --git a/src/common/Elsa.Api.Common/Abstractions/Endpoints.cs b/src/common/Elsa.Api.Common/Abstractions/Endpoints.cs
index ab90d2592..7c7765b3d 100644
--- a/src/common/Elsa.Api.Common/Abstractions/Endpoints.cs
+++ b/src/common/Elsa.Api.Common/Abstractions/Endpoints.cs
@@ -25,6 +25,17 @@ public class ElsaEndpoint<TRequest, TResponse> : Endpoint<TRequest, TResponse> w
     }
 }
 
+public class ElsaEndpoint<TRequest, TResponse, TMapper> : Endpoint<TRequest, TResponse, TMapper> where TRequest : notnull, new() where TResponse : notnull where TMapper : IMapper, new()
+{
+    protected void ConfigurePermissions(params string[] permissions)
+    {
+        if (!EndpointSecurityOptions.SecurityIsEnabled)
+            AllowAnonymous();
+        else
+            Permissions((new[] { PermissionNames.All }).Concat(permissions).ToArray());
+    }
+}
+
 public class ElsaEndpoint<TRequest> : Endpoint<TRequest> where TRequest : notnull, new()
 {
     protected void ConfigurePermissions(params string[] permissions)
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Endpoint.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Endpoint.cs
index 77a4df9c1..f71debeb3 100644
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Endpoint.cs
+++ b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Endpoint.cs
@@ -1,4 +1,3 @@
-using System.Diagnostics.CodeAnalysis;
 using System.Text.Json;
 using Elsa.Abstractions;
 using Elsa.ActivityDefinitions.Entities;
@@ -8,7 +7,6 @@ using Elsa.Models;
 using Elsa.Workflows.Core.Serialization;
 using Elsa.Workflows.Core.Services;
 using Elsa.Workflows.Management.Mappers;
-using FastEndpoints;
 
 namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.Get;
 
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Endpoint.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Endpoint.cs
index 3fcc41154..7cdd902c8 100644
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Endpoint.cs
+++ b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Endpoint.cs
@@ -2,7 +2,6 @@ using Elsa.Abstractions;
 using Elsa.ActivityDefinitions.Models;
 using Elsa.ActivityDefinitions.Services;
 using Elsa.Models;
-using FastEndpoints;
 
 namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.List;
 
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Endpoint.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Endpoint.cs
index f41ea7b50..11d6aa264 100644
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Endpoint.cs
+++ b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Endpoint.cs
@@ -6,7 +6,6 @@ using Elsa.Workflows.Core.Activities.Flowchart.Activities;
 using Elsa.Workflows.Core.Serialization;
 using Elsa.Workflows.Management.Mappers;
 using Elsa.Workflows.Management.Models;
-using FastEndpoints;
 
 namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.Post;
 
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Endpoint.cs
index 7f6d8650b..df5e9cd4f 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Endpoint.cs
@@ -4,7 +4,6 @@ using System.Threading.Tasks;
 using Elsa.Abstractions;
 using Elsa.Workflows.Core.Services;
 using Elsa.Workflows.Management.Services;
-using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.ActivityDescriptors.List;
 
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/Events/Trigger/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/Events/Trigger/Endpoint.cs
index 42372c65e..086104630 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/Events/Trigger/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/Events/Trigger/Endpoint.cs
@@ -1,6 +1,7 @@
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Core.Activities;
 using Elsa.Workflows.Core.Helpers;
 using Elsa.Workflows.Core.Models;
@@ -11,7 +12,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.Events.Trigger;
 
-public class Trigger : Endpoint<Request, Response>
+public class Trigger : ElsaEndpoint<Request, Response>
 {
     private readonly IHasher _hasher;
     private readonly IStimulusInterpreter _stimulusInterpreter;
@@ -27,9 +28,7 @@ public class Trigger : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/events/{eventName}/trigger");
-        Policies(Constants.PolicyName);
-        Permissions("all", "trigger:event");
-        Roles("Admin");
+        ConfigurePermissions("trigger:event");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/StorageDrivers/List/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/StorageDrivers/List/Endpoint.cs
index 9c2b614b9..479f4e06f 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/StorageDrivers/List/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/StorageDrivers/List/Endpoint.cs
@@ -1,12 +1,13 @@
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Core.Services;
 using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.StorageDrivers.List;
 
-public class List : EndpointWithoutRequest<Response>
+public class List : ElsaEndpointWithoutRequest<Response>
 {
     private readonly IStorageDriverManager _registry;
 
@@ -18,8 +19,7 @@ public class List : EndpointWithoutRequest<Response>
     public override void Configure()
     {
         Get("/descriptors/storage-drivers");
-        Policies(Constants.PolicyName);
-        Permissions("all", "read:storage-drivers");
+        ConfigurePermissions("read:storage-drivers");
     }
 
     public override Task<Response> ExecuteAsync(CancellationToken ct)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkDelete/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkDelete/Endpoint.cs
index 395dc8160..7b2fb0976 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkDelete/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkDelete/Endpoint.cs
@@ -1,12 +1,13 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Core.Serialization;
 using Elsa.Workflows.Management.Services;
 using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.BulkDelete;
 
-public class BulkDelete : Endpoint<Request, Response>
+public class BulkDelete : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowDefinitionManager _workflowDefinitionManager;
 
@@ -18,6 +19,7 @@ public class BulkDelete : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/bulk-actions/delete/workflow-definitions/by-definition-id");
+        ConfigurePermissions("delete:workflow-definitions");
     }
 
     public override async Task<Response> ExecuteAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkPublish/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkPublish/Endpoint.cs
index 988d2386e..ac0a6e963 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkPublish/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkPublish/Endpoint.cs
@@ -1,6 +1,7 @@
 using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Core.Serialization;
 using Elsa.Workflows.Management.Services;
@@ -9,7 +10,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.BulkPublish;
 
-public class BulkPublish : Endpoint<Request, Response>
+public class BulkPublish : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowDefinitionStore _store;
     private readonly IWorkflowDefinitionPublisher _workflowDefinitionPublisher;
@@ -23,6 +24,7 @@ public class BulkPublish : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/bulk-actions/publish/workflow-definitions/by-definition-id");
+        ConfigurePermissions("publish:workflow-definitions");
     }
 
     public override async Task<Response> ExecuteAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkRetract/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkRetract/Endpoint.cs
index 2ce8d49f3..48583a97d 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkRetract/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/BulkRetract/Endpoint.cs
@@ -1,6 +1,7 @@
 using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Management.Services;
 using Elsa.Workflows.Persistence.Services;
@@ -8,7 +9,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.BulkRetract;
 
-public class BulkRetract : Endpoint<Request, Response>
+public class BulkRetract : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowDefinitionStore _store;
     private readonly IWorkflowDefinitionPublisher _workflowDefinitionPublisher;
@@ -22,6 +23,7 @@ public class BulkRetract : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/bulk-actions/retract/workflow-definitions/by-definition-id");
+        ConfigurePermissions("retract:workflow-definitions");
     }
 
     public override async Task<Response> ExecuteAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Delete/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Delete/Endpoint.cs
index 7ba29896d..3f38774ca 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Delete/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Delete/Endpoint.cs
@@ -1,12 +1,12 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Management.Services;
 using FastEndpoints;
-using Microsoft.AspNetCore.Mvc;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Delete;
 
-public class Delete : Endpoint<Request>
+public class Delete : ElsaEndpoint<Request>
 {
     private readonly IWorkflowDefinitionManager _workflowDefinitionManager;
 
@@ -18,6 +18,7 @@ public class Delete : Endpoint<Request>
     public override void Configure()
     {
         Delete("/workflow-definitions/{definitionId}");
+        ConfigurePermissions("delete:workflow-definitions");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Dispatch/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Dispatch/Endpoint.cs
index 05cd8defa..2c794d992 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Dispatch/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Dispatch/Endpoint.cs
@@ -1,5 +1,6 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Persistence.Services;
 using Elsa.Workflows.Runtime.Models;
@@ -8,7 +9,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Dispatch;
 
-public class Endpoint : Endpoint<Request, Response>
+public class Endpoint : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowDefinitionStore _store;
     private readonly IWorkflowDispatcher _workflowDispatcher;
@@ -22,6 +23,7 @@ public class Endpoint : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/workflow-definitions/{definitionId}/dispatch");
+        ConfigurePermissions("exec:workflow-definitions");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Execute/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Execute/Endpoint.cs
index 227efaf25..bbba03e62 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Execute/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Execute/Endpoint.cs
@@ -1,5 +1,6 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Persistence.Services;
 using Elsa.Workflows.Runtime.Models;
@@ -8,7 +9,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Execute;
 
-public class Execute : Endpoint<Request, Response>
+public class Execute : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowDefinitionStore _store;
     private readonly IWorkflowInvoker _workflowInvoker;
@@ -22,6 +23,7 @@ public class Execute : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/workflow-definitions/{definitionId}/execute");
+        ConfigurePermissions("exec:workflow-definitions");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Export/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Export/Endpoint.cs
index c96e1c40b..0c94f9dc9 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Export/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Export/Endpoint.cs
@@ -2,6 +2,7 @@ using System.Linq;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Api.Models;
 using Elsa.Workflows.Core.Serialization;
@@ -13,7 +14,7 @@ using Humanizer;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Export;
 
-public class Export : Endpoint<Request>
+public class Export : ElsaEndpoint<Request>
 {
     private readonly IWorkflowDefinitionStore _store;
     private readonly IWorkflowDefinitionService _workflowDefinitionService;
@@ -35,6 +36,7 @@ public class Export : Endpoint<Request>
     public override void Configure()
     {
         Get("/workflow-definitions/{definitionId}/export");
+        ConfigurePermissions("read:workflow-definitions");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Get/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Get/Endpoint.cs
index e9a0bb80f..3e978eb18 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Get/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Get/Endpoint.cs
@@ -1,5 +1,6 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Api.Mappers;
 using Elsa.Workflows.Api.Models;
@@ -8,7 +9,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Get;
 
-public class Get : Endpoint<Request, WorkflowDefinitionResponse, WorkflowDefinitionMapper>
+public class Get : ElsaEndpoint<Request, WorkflowDefinitionResponse, WorkflowDefinitionMapper>
 {
     private readonly IWorkflowDefinitionStore _store;
 
@@ -20,6 +21,7 @@ public class Get : Endpoint<Request, WorkflowDefinitionResponse, WorkflowDefinit
     public override void Configure()
     {
         Get("/workflow-definitions/{definitionId}");
+        ConfigurePermissions("read:workflow-definitions");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Import/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Import/Endpoint.cs
index e1cf3570c..716c28ad4 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Import/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Import/Endpoint.cs
@@ -2,6 +2,7 @@ using System.Linq;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Api.Models;
 using Elsa.Workflows.Core.Serialization;
 using Elsa.Workflows.Management.Mappers;
@@ -12,7 +13,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Import;
 
-public class Import : Endpoint<WorkflowDefinitionRequest, WorkflowDefinitionResponse>
+public class Import : ElsaEndpoint<WorkflowDefinitionRequest, WorkflowDefinitionResponse>
 {
     private readonly SerializerOptionsProvider _serializerOptionsProvider;
     private readonly IWorkflowDefinitionPublisher _workflowDefinitionPublisher;
@@ -34,6 +35,7 @@ public class Import : Endpoint<WorkflowDefinitionRequest, WorkflowDefinitionResp
     public override void Configure()
     {
         Post("workflow-definitions/import", "workflow-definitions/{definitionId}/import");
+        ConfigurePermissions("write:workflow-definitions");
     }
 
     public override async Task HandleAsync(WorkflowDefinitionRequest request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/List/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/List/Endpoint.cs
index 4f9de410a..6c38891ef 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/List/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/List/Endpoint.cs
@@ -2,6 +2,7 @@ using System;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Persistence.Services;
 using FastEndpoints;
@@ -9,7 +10,7 @@ using Open.Linq.AsyncExtensions;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.List;
 
-public class List : Endpoint<Request, Response>
+public class List : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowDefinitionStore _store;
 
@@ -21,6 +22,7 @@ public class List : Endpoint<Request, Response>
     public override void Configure()
     {
         Get("/workflow-definitions");
+        ConfigurePermissions("read:workflow-definitions");
     }
 
     public override async Task<Response> ExecuteAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Post/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Post/Endpoint.cs
index 62662cf5e..1d374cc70 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Post/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Post/Endpoint.cs
@@ -3,6 +3,7 @@ using System.Linq;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Api.Models;
 using Elsa.Workflows.Core.Activities;
 using Elsa.Workflows.Core.Serialization;
@@ -14,7 +15,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Post;
 
-public class Post : Endpoint<WorkflowDefinitionRequest, WorkflowDefinitionResponse>
+public class Post : ElsaEndpoint<WorkflowDefinitionRequest, WorkflowDefinitionResponse>
 {
     private readonly SerializerOptionsProvider _serializerOptionsProvider;
     private readonly IWorkflowDefinitionPublisher _workflowDefinitionPublisher;
@@ -33,6 +34,7 @@ public class Post : Endpoint<WorkflowDefinitionRequest, WorkflowDefinitionRespon
     public override void Configure()
     {
         Post("/workflow-definitions");
+        ConfigurePermissions("write:workflow-definitions");
     }
 
     public override async Task HandleAsync(WorkflowDefinitionRequest request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Publish/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Publish/Endpoint.cs
index 28d2d62b4..88bcd9115 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Publish/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Publish/Endpoint.cs
@@ -1,19 +1,16 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Api.Mappers;
 using Elsa.Workflows.Api.Models;
-using Elsa.Workflows.Core.Serialization;
 using Elsa.Workflows.Management.Services;
-using Elsa.Workflows.Persistence.Entities;
 using Elsa.Workflows.Persistence.Services;
 using FastEndpoints;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Publish;
 
-public class Publish : Endpoint<Request, WorkflowDefinitionResponse, WorkflowDefinitionMapper>
+public class Publish : ElsaEndpoint<Request, WorkflowDefinitionResponse, WorkflowDefinitionMapper>
 {
     private readonly IWorkflowDefinitionStore _store;
     private readonly IWorkflowDefinitionPublisher _workflowDefinitionPublisher;
@@ -27,6 +24,7 @@ public class Publish : Endpoint<Request, WorkflowDefinitionResponse, WorkflowDef
     public override void Configure()
     {
         Post("/workflow-definitions/{definitionId}/publish");
+        ConfigurePermissions("publish:workflow-definitions");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Retract/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Retract/Endpoint.cs
index 33eb9f276..1fa20f8f3 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Retract/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowDefinitions/Retract/Endpoint.cs
@@ -1,5 +1,6 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Api.Mappers;
 using Elsa.Workflows.Api.Models;
@@ -9,7 +10,7 @@ using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowDefinitions.Retract;
 
-public class Retract : Endpoint<Request, WorkflowDefinitionResponse, WorkflowDefinitionMapper>
+public class Retract : ElsaEndpoint<Request, WorkflowDefinitionResponse, WorkflowDefinitionMapper>
 {
     private readonly IWorkflowDefinitionStore _store;
     private readonly IWorkflowDefinitionPublisher _workflowDefinitionPublisher;
@@ -23,6 +24,7 @@ public class Retract : Endpoint<Request, WorkflowDefinitionResponse, WorkflowDef
     public override void Configure()
     {
         Post("/workflow-definitions/{definitionId}/retract");
+        ConfigurePermissions("retract:workflow-definitions");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/BulkCancel/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/BulkCancel/Endpoint.cs
index 44b73f610..42b31394f 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/BulkCancel/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/BulkCancel/Endpoint.cs
@@ -2,15 +2,17 @@ using System.Collections.Generic;
 using System.Text.Json.Serialization;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowInstances.BulkCancel;
 
-public class Endpoint : Endpoint<Request, Response>
+public class Endpoint : ElsaEndpoint<Request, Response>
 {
     public override void Configure()
     {
         Post("/bulk-actions/cancel/workflow-instances/by-id");
+        ConfigurePermissions("cancel:workflow-instances");
     }
 
     public override async Task<Response> ExecuteAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/BulkDelete/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/BulkDelete/Endpoint.cs
index 29912a060..d4eaef8c0 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/BulkDelete/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/BulkDelete/Endpoint.cs
@@ -1,12 +1,12 @@
-using System.Text.Json.Serialization;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Persistence.Services;
 using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowInstances.BulkDelete;
 
-public class BulkDelete : Endpoint<Request, Response>
+public class BulkDelete : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowInstanceStore _store;
 
@@ -18,6 +18,7 @@ public class BulkDelete : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/bulk-actions/delete/workflow-instances/by-id");
+        ConfigurePermissions("delete:workflow-instances");
     }
 
     public override async Task<Response> ExecuteAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Delete/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Delete/Endpoint.cs
index 928670e9e..308298cc0 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Delete/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Delete/Endpoint.cs
@@ -1,11 +1,12 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Persistence.Services;
 using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowInstances.Delete;
 
-public class Delete : Endpoint<Request>
+public class Delete : ElsaEndpoint<Request>
 {
     private readonly IWorkflowInstanceStore _store;
     public Delete(IWorkflowInstanceStore store) => _store = store;
@@ -13,6 +14,7 @@ public class Delete : Endpoint<Request>
     public override void Configure()
     {
         Delete("/workflow-instances/{id}");
+        ConfigurePermissions("delete:workflow-instances");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Get/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Get/Endpoint.cs
index 32cceb901..4eae5a236 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Get/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Get/Endpoint.cs
@@ -1,11 +1,12 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Persistence.Services;
 using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowInstances.Get;
 
-public class Get : Endpoint<Request, Response, WorkflowInstanceMapper>
+public class Get : ElsaEndpoint<Request, Response, WorkflowInstanceMapper>
 {
     private readonly IWorkflowInstanceStore _store;
 
@@ -17,6 +18,7 @@ public class Get : Endpoint<Request, Response, WorkflowInstanceMapper>
     public override void Configure()
     {
         Get("/workflow-instances/{id}");
+        ConfigurePermissions("read:workflow-instances");
     }
 
     public override async Task HandleAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Journal/Get/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Journal/Get/Endpoint.cs
index 886519c4f..5e2fdee60 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Journal/Get/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/Journal/Get/Endpoint.cs
@@ -1,13 +1,14 @@
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Workflows.Persistence.Services;
 using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowInstances.Journal.Get;
 
-public class Get : Endpoint<Request, Response>
+public class Get : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowExecutionLogStore _store;
 
@@ -19,6 +20,7 @@ public class Get : Endpoint<Request, Response>
     public override void Configure()
     {
         Get("/workflow-instances/{id}/journal");
+        ConfigurePermissions("read:workflow-instances");
     }
 
     public override async Task<Response> ExecuteAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/List/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/List/Endpoint.cs
index 263e91f5c..28affe8d1 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/List/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/WorkflowInstances/List/Endpoint.cs
@@ -1,16 +1,14 @@
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Models;
 using Elsa.Persistence.Common.Entities;
-using Elsa.Workflows.Core.Models;
-using Elsa.Workflows.Core.Serialization;
 using Elsa.Workflows.Persistence.Services;
 using FastEndpoints;
-using Microsoft.AspNetCore.Mvc;
 
 namespace Elsa.Workflows.Api.Endpoints.WorkflowInstances.List;
 
-public class List : Endpoint<Request, Response>
+public class List : ElsaEndpoint<Request, Response>
 {
     private readonly IWorkflowInstanceStore _store;
 
@@ -22,6 +20,7 @@ public class List : Endpoint<Request, Response>
     public override void Configure()
     {
         Get("/workflow-instances");
+        ConfigurePermissions("read:workflow-instances");
     }
 
     public override async Task<Response> ExecuteAsync(Request request, CancellationToken cancellationToken)
diff --git a/src/modules/Elsa.Workflows.Api/Models/WorkflowDefinitionRequest.cs b/src/modules/Elsa.Workflows.Api/Models/WorkflowDefinitionRequest.cs
index 067ded7f4..1bf20f565 100644
--- a/src/modules/Elsa.Workflows.Api/Models/WorkflowDefinitionRequest.cs
+++ b/src/modules/Elsa.Workflows.Api/Models/WorkflowDefinitionRequest.cs
@@ -1,4 +1,3 @@
-using System;
 using System.Collections.Generic;
 using Elsa.Workflows.Core.Services;
 using Elsa.Workflows.Management.Models;