diff --git a/services/graph/mocks/gateway_client.go b/services/graph/mocks/gateway_client.go
index bc60230b667..49d6b0867f4 100644
--- a/services/graph/mocks/gateway_client.go
+++ b/services/graph/mocks/gateway_client.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.14.1. DO NOT EDIT.
+// Code generated by mockery v2.22.1. DO NOT EDIT.
 
 package mocks
 
@@ -30,6 +30,10 @@ func (_m *GatewayClient) Authenticate(ctx context.Context, in *gatewayv1beta1.Au
 	ret := _m.Called(_ca...)
 
 	var r0 *gatewayv1beta1.AuthenticateResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *gatewayv1beta1.AuthenticateRequest, ...grpc.CallOption) (*gatewayv1beta1.AuthenticateResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *gatewayv1beta1.AuthenticateRequest, ...grpc.CallOption) *gatewayv1beta1.AuthenticateResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -38,7 +42,6 @@ func (_m *GatewayClient) Authenticate(ctx context.Context, in *gatewayv1beta1.Au
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *gatewayv1beta1.AuthenticateRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -60,6 +63,10 @@ func (_m *GatewayClient) CreateStorageSpace(ctx context.Context, in *providerv1b
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.CreateStorageSpaceResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.CreateStorageSpaceRequest, ...grpc.CallOption) (*providerv1beta1.CreateStorageSpaceResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.CreateStorageSpaceRequest, ...grpc.CallOption) *providerv1beta1.CreateStorageSpaceResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -68,7 +75,6 @@ func (_m *GatewayClient) CreateStorageSpace(ctx context.Context, in *providerv1b
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.CreateStorageSpaceRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -90,6 +96,10 @@ func (_m *GatewayClient) DeleteStorageSpace(ctx context.Context, in *providerv1b
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.DeleteStorageSpaceResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.DeleteStorageSpaceRequest, ...grpc.CallOption) (*providerv1beta1.DeleteStorageSpaceResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.DeleteStorageSpaceRequest, ...grpc.CallOption) *providerv1beta1.DeleteStorageSpaceResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -98,7 +108,6 @@ func (_m *GatewayClient) DeleteStorageSpace(ctx context.Context, in *providerv1b
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.DeleteStorageSpaceRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -120,6 +129,10 @@ func (_m *GatewayClient) GetHome(ctx context.Context, in *providerv1beta1.GetHom
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.GetHomeResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.GetHomeRequest, ...grpc.CallOption) (*providerv1beta1.GetHomeResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.GetHomeRequest, ...grpc.CallOption) *providerv1beta1.GetHomeResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -128,7 +141,6 @@ func (_m *GatewayClient) GetHome(ctx context.Context, in *providerv1beta1.GetHom
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.GetHomeRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -150,6 +162,10 @@ func (_m *GatewayClient) GetPath(ctx context.Context, in *providerv1beta1.GetPat
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.GetPathResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.GetPathRequest, ...grpc.CallOption) (*providerv1beta1.GetPathResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.GetPathRequest, ...grpc.CallOption) *providerv1beta1.GetPathResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -158,7 +174,6 @@ func (_m *GatewayClient) GetPath(ctx context.Context, in *providerv1beta1.GetPat
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.GetPathRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -180,6 +195,10 @@ func (_m *GatewayClient) GetQuota(ctx context.Context, in *gatewayv1beta1.GetQuo
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.GetQuotaResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *gatewayv1beta1.GetQuotaRequest, ...grpc.CallOption) (*providerv1beta1.GetQuotaResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *gatewayv1beta1.GetQuotaRequest, ...grpc.CallOption) *providerv1beta1.GetQuotaResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -188,7 +207,6 @@ func (_m *GatewayClient) GetQuota(ctx context.Context, in *gatewayv1beta1.GetQuo
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *gatewayv1beta1.GetQuotaRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -210,6 +228,10 @@ func (_m *GatewayClient) InitiateFileDownload(ctx context.Context, in *providerv
 	ret := _m.Called(_ca...)
 
 	var r0 *gatewayv1beta1.InitiateFileDownloadResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.InitiateFileDownloadRequest, ...grpc.CallOption) (*gatewayv1beta1.InitiateFileDownloadResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.InitiateFileDownloadRequest, ...grpc.CallOption) *gatewayv1beta1.InitiateFileDownloadResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -218,7 +240,6 @@ func (_m *GatewayClient) InitiateFileDownload(ctx context.Context, in *providerv
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.InitiateFileDownloadRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -240,6 +261,10 @@ func (_m *GatewayClient) ListContainer(ctx context.Context, in *providerv1beta1.
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.ListContainerResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ListContainerRequest, ...grpc.CallOption) (*providerv1beta1.ListContainerResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ListContainerRequest, ...grpc.CallOption) *providerv1beta1.ListContainerResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -248,7 +273,6 @@ func (_m *GatewayClient) ListContainer(ctx context.Context, in *providerv1beta1.
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.ListContainerRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -270,6 +294,10 @@ func (_m *GatewayClient) ListStorageSpaces(ctx context.Context, in *providerv1be
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.ListStorageSpacesResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ListStorageSpacesRequest, ...grpc.CallOption) (*providerv1beta1.ListStorageSpacesResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ListStorageSpacesRequest, ...grpc.CallOption) *providerv1beta1.ListStorageSpacesResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -278,7 +306,6 @@ func (_m *GatewayClient) ListStorageSpaces(ctx context.Context, in *providerv1be
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.ListStorageSpacesRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -300,6 +327,10 @@ func (_m *GatewayClient) SetArbitraryMetadata(ctx context.Context, request *prov
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.SetArbitraryMetadataResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.SetArbitraryMetadataRequest, ...grpc.CallOption) (*providerv1beta1.SetArbitraryMetadataResponse, error)); ok {
+		return rf(ctx, request, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.SetArbitraryMetadataRequest, ...grpc.CallOption) *providerv1beta1.SetArbitraryMetadataResponse); ok {
 		r0 = rf(ctx, request, opts...)
 	} else {
@@ -308,7 +339,6 @@ func (_m *GatewayClient) SetArbitraryMetadata(ctx context.Context, request *prov
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.SetArbitraryMetadataRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, request, opts...)
 	} else {
@@ -330,6 +360,10 @@ func (_m *GatewayClient) Stat(ctx context.Context, in *providerv1beta1.StatReque
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.StatResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.StatRequest, ...grpc.CallOption) (*providerv1beta1.StatResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.StatRequest, ...grpc.CallOption) *providerv1beta1.StatResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -338,7 +372,6 @@ func (_m *GatewayClient) Stat(ctx context.Context, in *providerv1beta1.StatReque
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.StatRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -348,6 +381,32 @@ func (_m *GatewayClient) Stat(ctx context.Context, in *providerv1beta1.StatReque
 	return r0, r1
 }
 
+// TouchFile provides a mock function with given fields: ctx, req
+func (_m *GatewayClient) TouchFile(ctx context.Context, req *providerv1beta1.TouchFileRequest) (*providerv1beta1.TouchFileResponse, error) {
+	ret := _m.Called(ctx, req)
+
+	var r0 *providerv1beta1.TouchFileResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.TouchFileRequest) (*providerv1beta1.TouchFileResponse, error)); ok {
+		return rf(ctx, req)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.TouchFileRequest) *providerv1beta1.TouchFileResponse); ok {
+		r0 = rf(ctx, req)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*providerv1beta1.TouchFileResponse)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.TouchFileRequest) error); ok {
+		r1 = rf(ctx, req)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // UpdateStorageSpace provides a mock function with given fields: ctx, in, opts
 func (_m *GatewayClient) UpdateStorageSpace(ctx context.Context, in *providerv1beta1.UpdateStorageSpaceRequest, opts ...grpc.CallOption) (*providerv1beta1.UpdateStorageSpaceResponse, error) {
 	_va := make([]interface{}, len(opts))
@@ -360,6 +419,10 @@ func (_m *GatewayClient) UpdateStorageSpace(ctx context.Context, in *providerv1b
 	ret := _m.Called(_ca...)
 
 	var r0 *providerv1beta1.UpdateStorageSpaceResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.UpdateStorageSpaceRequest, ...grpc.CallOption) (*providerv1beta1.UpdateStorageSpaceResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.UpdateStorageSpaceRequest, ...grpc.CallOption) *providerv1beta1.UpdateStorageSpaceResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -368,7 +431,6 @@ func (_m *GatewayClient) UpdateStorageSpace(ctx context.Context, in *providerv1b
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.UpdateStorageSpaceRequest, ...grpc.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
diff --git a/services/graph/mocks/http_client.go b/services/graph/mocks/http_client.go
index 0b46538ab5c..a46a482762f 100644
--- a/services/graph/mocks/http_client.go
+++ b/services/graph/mocks/http_client.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.14.1. DO NOT EDIT.
+// Code generated by mockery v2.22.1. DO NOT EDIT.
 
 package mocks
 
@@ -18,6 +18,10 @@ func (_m *HTTPClient) Do(req *http.Request) (*http.Response, error) {
 	ret := _m.Called(req)
 
 	var r0 *http.Response
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*http.Request) (*http.Response, error)); ok {
+		return rf(req)
+	}
 	if rf, ok := ret.Get(0).(func(*http.Request) *http.Response); ok {
 		r0 = rf(req)
 	} else {
@@ -26,7 +30,6 @@ func (_m *HTTPClient) Do(req *http.Request) (*http.Response, error) {
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(*http.Request) error); ok {
 		r1 = rf(req)
 	} else {
diff --git a/services/graph/mocks/ldapclient.go b/services/graph/mocks/ldapclient.go
index 7893c5dcca6..a90b562032c 100644
--- a/services/graph/mocks/ldapclient.go
+++ b/services/graph/mocks/ldapclient.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.14.1. DO NOT EDIT.
+// Code generated by mockery v2.22.1. DO NOT EDIT.
 
 package mocks
 
@@ -54,13 +54,16 @@ func (_m *Client) Compare(dn string, attribute string, value string) (bool, erro
 	ret := _m.Called(dn, attribute, value)
 
 	var r0 bool
+	var r1 error
+	if rf, ok := ret.Get(0).(func(string, string, string) (bool, error)); ok {
+		return rf(dn, attribute, value)
+	}
 	if rf, ok := ret.Get(0).(func(string, string, string) bool); ok {
 		r0 = rf(dn, attribute, value)
 	} else {
 		r0 = ret.Get(0).(bool)
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(string, string, string) error); ok {
 		r1 = rf(dn, attribute, value)
 	} else {
@@ -145,6 +148,10 @@ func (_m *Client) ModifyWithResult(_a0 *ldap.ModifyRequest) (*ldap.ModifyResult,
 	ret := _m.Called(_a0)
 
 	var r0 *ldap.ModifyResult
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*ldap.ModifyRequest) (*ldap.ModifyResult, error)); ok {
+		return rf(_a0)
+	}
 	if rf, ok := ret.Get(0).(func(*ldap.ModifyRequest) *ldap.ModifyResult); ok {
 		r0 = rf(_a0)
 	} else {
@@ -153,7 +160,6 @@ func (_m *Client) ModifyWithResult(_a0 *ldap.ModifyRequest) (*ldap.ModifyResult,
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(*ldap.ModifyRequest) error); ok {
 		r1 = rf(_a0)
 	} else {
@@ -182,6 +188,10 @@ func (_m *Client) PasswordModify(_a0 *ldap.PasswordModifyRequest) (*ldap.Passwor
 	ret := _m.Called(_a0)
 
 	var r0 *ldap.PasswordModifyResult
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*ldap.PasswordModifyRequest) (*ldap.PasswordModifyResult, error)); ok {
+		return rf(_a0)
+	}
 	if rf, ok := ret.Get(0).(func(*ldap.PasswordModifyRequest) *ldap.PasswordModifyResult); ok {
 		r0 = rf(_a0)
 	} else {
@@ -190,7 +200,6 @@ func (_m *Client) PasswordModify(_a0 *ldap.PasswordModifyRequest) (*ldap.Passwor
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(*ldap.PasswordModifyRequest) error); ok {
 		r1 = rf(_a0)
 	} else {
@@ -205,6 +214,10 @@ func (_m *Client) Search(_a0 *ldap.SearchRequest) (*ldap.SearchResult, error) {
 	ret := _m.Called(_a0)
 
 	var r0 *ldap.SearchResult
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*ldap.SearchRequest) (*ldap.SearchResult, error)); ok {
+		return rf(_a0)
+	}
 	if rf, ok := ret.Get(0).(func(*ldap.SearchRequest) *ldap.SearchResult); ok {
 		r0 = rf(_a0)
 	} else {
@@ -213,7 +226,6 @@ func (_m *Client) Search(_a0 *ldap.SearchRequest) (*ldap.SearchResult, error) {
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(*ldap.SearchRequest) error); ok {
 		r1 = rf(_a0)
 	} else {
@@ -228,6 +240,10 @@ func (_m *Client) SearchWithPaging(searchRequest *ldap.SearchRequest, pagingSize
 	ret := _m.Called(searchRequest, pagingSize)
 
 	var r0 *ldap.SearchResult
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*ldap.SearchRequest, uint32) (*ldap.SearchResult, error)); ok {
+		return rf(searchRequest, pagingSize)
+	}
 	if rf, ok := ret.Get(0).(func(*ldap.SearchRequest, uint32) *ldap.SearchResult); ok {
 		r0 = rf(searchRequest, pagingSize)
 	} else {
@@ -236,7 +252,6 @@ func (_m *Client) SearchWithPaging(searchRequest *ldap.SearchRequest, pagingSize
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(*ldap.SearchRequest, uint32) error); ok {
 		r1 = rf(searchRequest, pagingSize)
 	} else {
@@ -256,6 +271,10 @@ func (_m *Client) SimpleBind(_a0 *ldap.SimpleBindRequest) (*ldap.SimpleBindResul
 	ret := _m.Called(_a0)
 
 	var r0 *ldap.SimpleBindResult
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*ldap.SimpleBindRequest) (*ldap.SimpleBindResult, error)); ok {
+		return rf(_a0)
+	}
 	if rf, ok := ret.Get(0).(func(*ldap.SimpleBindRequest) *ldap.SimpleBindResult); ok {
 		r0 = rf(_a0)
 	} else {
@@ -264,7 +283,6 @@ func (_m *Client) SimpleBind(_a0 *ldap.SimpleBindRequest) (*ldap.SimpleBindResul
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(*ldap.SimpleBindRequest) error); ok {
 		r1 = rf(_a0)
 	} else {
@@ -298,13 +316,16 @@ func (_m *Client) TLSConnectionState() (tls.ConnectionState, bool) {
 	ret := _m.Called()
 
 	var r0 tls.ConnectionState
+	var r1 bool
+	if rf, ok := ret.Get(0).(func() (tls.ConnectionState, bool)); ok {
+		return rf()
+	}
 	if rf, ok := ret.Get(0).(func() tls.ConnectionState); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(tls.ConnectionState)
 	}
 
-	var r1 bool
 	if rf, ok := ret.Get(1).(func() bool); ok {
 		r1 = rf()
 	} else {
diff --git a/services/graph/mocks/permissions.go b/services/graph/mocks/permissions.go
index 422e0c0a4bf..7a0dd07cd9f 100644
--- a/services/graph/mocks/permissions.go
+++ b/services/graph/mocks/permissions.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.14.1. DO NOT EDIT.
+// Code generated by mockery v2.22.1. DO NOT EDIT.
 
 package mocks
 
@@ -29,6 +29,10 @@ func (_m *Permissions) GetPermissionByID(ctx context.Context, request *v0.GetPer
 	ret := _m.Called(_ca...)
 
 	var r0 *v0.GetPermissionByIDResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0.GetPermissionByIDRequest, ...client.CallOption) (*v0.GetPermissionByIDResponse, error)); ok {
+		return rf(ctx, request, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *v0.GetPermissionByIDRequest, ...client.CallOption) *v0.GetPermissionByIDResponse); ok {
 		r0 = rf(ctx, request, opts...)
 	} else {
@@ -37,7 +41,6 @@ func (_m *Permissions) GetPermissionByID(ctx context.Context, request *v0.GetPer
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *v0.GetPermissionByIDRequest, ...client.CallOption) error); ok {
 		r1 = rf(ctx, request, opts...)
 	} else {
@@ -59,6 +62,10 @@ func (_m *Permissions) ListPermissions(ctx context.Context, req *v0.ListPermissi
 	ret := _m.Called(_ca...)
 
 	var r0 *v0.ListPermissionsResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0.ListPermissionsRequest, ...client.CallOption) (*v0.ListPermissionsResponse, error)); ok {
+		return rf(ctx, req, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *v0.ListPermissionsRequest, ...client.CallOption) *v0.ListPermissionsResponse); ok {
 		r0 = rf(ctx, req, opts...)
 	} else {
@@ -67,7 +74,6 @@ func (_m *Permissions) ListPermissions(ctx context.Context, req *v0.ListPermissi
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *v0.ListPermissionsRequest, ...client.CallOption) error); ok {
 		r1 = rf(ctx, req, opts...)
 	} else {
@@ -89,6 +95,10 @@ func (_m *Permissions) ListPermissionsByResource(ctx context.Context, in *v0.Lis
 	ret := _m.Called(_ca...)
 
 	var r0 *v0.ListPermissionsByResourceResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0.ListPermissionsByResourceRequest, ...client.CallOption) (*v0.ListPermissionsByResourceResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *v0.ListPermissionsByResourceRequest, ...client.CallOption) *v0.ListPermissionsByResourceResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -97,7 +107,6 @@ func (_m *Permissions) ListPermissionsByResource(ctx context.Context, in *v0.Lis
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *v0.ListPermissionsByResourceRequest, ...client.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
diff --git a/services/graph/mocks/publisher.go b/services/graph/mocks/publisher.go
index 4c5b115b83b..40dd7e5f2c3 100644
--- a/services/graph/mocks/publisher.go
+++ b/services/graph/mocks/publisher.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.14.1. DO NOT EDIT.
+// Code generated by mockery v2.22.1. DO NOT EDIT.
 
 package mocks
 
diff --git a/services/graph/mocks/role_service.go b/services/graph/mocks/role_service.go
index b2d3063dbbf..3729b66ccbb 100644
--- a/services/graph/mocks/role_service.go
+++ b/services/graph/mocks/role_service.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.14.1. DO NOT EDIT.
+// Code generated by mockery v2.22.1. DO NOT EDIT.
 
 package mocks
 
@@ -31,6 +31,10 @@ func (_m *RoleService) AssignRoleToUser(ctx context.Context, in *v0.AssignRoleTo
 	ret := _m.Called(_ca...)
 
 	var r0 *v0.AssignRoleToUserResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0.AssignRoleToUserRequest, ...client.CallOption) (*v0.AssignRoleToUserResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *v0.AssignRoleToUserRequest, ...client.CallOption) *v0.AssignRoleToUserResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -39,7 +43,6 @@ func (_m *RoleService) AssignRoleToUser(ctx context.Context, in *v0.AssignRoleTo
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *v0.AssignRoleToUserRequest, ...client.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -61,6 +64,10 @@ func (_m *RoleService) ListRoleAssignments(ctx context.Context, in *v0.ListRoleA
 	ret := _m.Called(_ca...)
 
 	var r0 *v0.ListRoleAssignmentsResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0.ListRoleAssignmentsRequest, ...client.CallOption) (*v0.ListRoleAssignmentsResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *v0.ListRoleAssignmentsRequest, ...client.CallOption) *v0.ListRoleAssignmentsResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -69,7 +76,6 @@ func (_m *RoleService) ListRoleAssignments(ctx context.Context, in *v0.ListRoleA
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *v0.ListRoleAssignmentsRequest, ...client.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -91,6 +97,10 @@ func (_m *RoleService) ListRoles(ctx context.Context, in *v0.ListBundlesRequest,
 	ret := _m.Called(_ca...)
 
 	var r0 *v0.ListBundlesResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0.ListBundlesRequest, ...client.CallOption) (*v0.ListBundlesResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *v0.ListBundlesRequest, ...client.CallOption) *v0.ListBundlesResponse); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -99,7 +109,6 @@ func (_m *RoleService) ListRoles(ctx context.Context, in *v0.ListBundlesRequest,
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *v0.ListBundlesRequest, ...client.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
@@ -121,6 +130,10 @@ func (_m *RoleService) RemoveRoleFromUser(ctx context.Context, in *v0.RemoveRole
 	ret := _m.Called(_ca...)
 
 	var r0 *emptypb.Empty
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0.RemoveRoleFromUserRequest, ...client.CallOption) (*emptypb.Empty, error)); ok {
+		return rf(ctx, in, opts...)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *v0.RemoveRoleFromUserRequest, ...client.CallOption) *emptypb.Empty); ok {
 		r0 = rf(ctx, in, opts...)
 	} else {
@@ -129,7 +142,6 @@ func (_m *RoleService) RemoveRoleFromUser(ctx context.Context, in *v0.RemoveRole
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *v0.RemoveRoleFromUserRequest, ...client.CallOption) error); ok {
 		r1 = rf(ctx, in, opts...)
 	} else {
diff --git a/services/graph/pkg/config/config.go b/services/graph/pkg/config/config.go
index 718d8c63e44..15b1d966cc5 100644
--- a/services/graph/pkg/config/config.go
+++ b/services/graph/pkg/config/config.go
@@ -30,6 +30,8 @@ type Config struct {
 	Identity    Identity    `yaml:"identity"`
 	Events      Events      `yaml:"events"`
 
+	MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY;USERLOG_MACHINE_AUTH_API_KEY" desc:"Machine auth API key used to validate internal requests necessary to access resources from other services."`
+
 	Context context.Context `yaml:"-"`
 }
 
diff --git a/services/graph/pkg/config/defaults/defaultconfig.go b/services/graph/pkg/config/defaults/defaultconfig.go
index 3cbbaaac2c2..ae9bfab02f2 100644
--- a/services/graph/pkg/config/defaults/defaultconfig.go
+++ b/services/graph/pkg/config/defaults/defaultconfig.go
@@ -149,6 +149,10 @@ func EnsureDefaults(cfg *config.Config) {
 	if cfg.Commons != nil {
 		cfg.HTTP.TLS = cfg.Commons.HTTPServiceTLS
 	}
+
+	if cfg.MachineAuthAPIKey == "" && cfg.Commons != nil && cfg.Commons.MachineAuthAPIKey != "" {
+		cfg.MachineAuthAPIKey = cfg.Commons.MachineAuthAPIKey
+	}
 }
 
 // Sanitize sanitized the configuration
diff --git a/services/graph/pkg/identity/mocks/backend.go b/services/graph/pkg/identity/mocks/backend.go
index 89586889dfc..5d61790f623 100644
--- a/services/graph/pkg/identity/mocks/backend.go
+++ b/services/graph/pkg/identity/mocks/backend.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.14.1. DO NOT EDIT.
+// Code generated by mockery v2.22.1. DO NOT EDIT.
 
 package mocks
 
@@ -38,6 +38,10 @@ func (_m *Backend) CreateGroup(ctx context.Context, group libregraph.Group) (*li
 	ret := _m.Called(ctx, group)
 
 	var r0 *libregraph.Group
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, libregraph.Group) (*libregraph.Group, error)); ok {
+		return rf(ctx, group)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, libregraph.Group) *libregraph.Group); ok {
 		r0 = rf(ctx, group)
 	} else {
@@ -46,7 +50,6 @@ func (_m *Backend) CreateGroup(ctx context.Context, group libregraph.Group) (*li
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, libregraph.Group) error); ok {
 		r1 = rf(ctx, group)
 	} else {
@@ -61,6 +64,10 @@ func (_m *Backend) CreateUser(ctx context.Context, user libregraph.User) (*libre
 	ret := _m.Called(ctx, user)
 
 	var r0 *libregraph.User
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, libregraph.User) (*libregraph.User, error)); ok {
+		return rf(ctx, user)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, libregraph.User) *libregraph.User); ok {
 		r0 = rf(ctx, user)
 	} else {
@@ -69,7 +76,6 @@ func (_m *Backend) CreateUser(ctx context.Context, user libregraph.User) (*libre
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, libregraph.User) error); ok {
 		r1 = rf(ctx, user)
 	} else {
@@ -112,6 +118,10 @@ func (_m *Backend) GetGroup(ctx context.Context, nameOrID string, queryParam url
 	ret := _m.Called(ctx, nameOrID, queryParam)
 
 	var r0 *libregraph.Group
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, url.Values) (*libregraph.Group, error)); ok {
+		return rf(ctx, nameOrID, queryParam)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string, url.Values) *libregraph.Group); ok {
 		r0 = rf(ctx, nameOrID, queryParam)
 	} else {
@@ -120,7 +130,6 @@ func (_m *Backend) GetGroup(ctx context.Context, nameOrID string, queryParam url
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string, url.Values) error); ok {
 		r1 = rf(ctx, nameOrID, queryParam)
 	} else {
@@ -135,6 +144,10 @@ func (_m *Backend) GetGroupMembers(ctx context.Context, id string, oreq *godata.
 	ret := _m.Called(ctx, id, oreq)
 
 	var r0 []*libregraph.User
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, *godata.GoDataRequest) ([]*libregraph.User, error)); ok {
+		return rf(ctx, id, oreq)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string, *godata.GoDataRequest) []*libregraph.User); ok {
 		r0 = rf(ctx, id, oreq)
 	} else {
@@ -143,7 +156,6 @@ func (_m *Backend) GetGroupMembers(ctx context.Context, id string, oreq *godata.
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string, *godata.GoDataRequest) error); ok {
 		r1 = rf(ctx, id, oreq)
 	} else {
@@ -158,6 +170,10 @@ func (_m *Backend) GetGroups(ctx context.Context, queryParam url.Values) ([]*lib
 	ret := _m.Called(ctx, queryParam)
 
 	var r0 []*libregraph.Group
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, url.Values) ([]*libregraph.Group, error)); ok {
+		return rf(ctx, queryParam)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, url.Values) []*libregraph.Group); ok {
 		r0 = rf(ctx, queryParam)
 	} else {
@@ -166,7 +182,6 @@ func (_m *Backend) GetGroups(ctx context.Context, queryParam url.Values) ([]*lib
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, url.Values) error); ok {
 		r1 = rf(ctx, queryParam)
 	} else {
@@ -181,6 +196,10 @@ func (_m *Backend) GetUser(ctx context.Context, nameOrID string, oreq *godata.Go
 	ret := _m.Called(ctx, nameOrID, oreq)
 
 	var r0 *libregraph.User
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, *godata.GoDataRequest) (*libregraph.User, error)); ok {
+		return rf(ctx, nameOrID, oreq)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string, *godata.GoDataRequest) *libregraph.User); ok {
 		r0 = rf(ctx, nameOrID, oreq)
 	} else {
@@ -189,7 +208,6 @@ func (_m *Backend) GetUser(ctx context.Context, nameOrID string, oreq *godata.Go
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string, *godata.GoDataRequest) error); ok {
 		r1 = rf(ctx, nameOrID, oreq)
 	} else {
@@ -204,6 +222,10 @@ func (_m *Backend) GetUsers(ctx context.Context, oreq *godata.GoDataRequest) ([]
 	ret := _m.Called(ctx, oreq)
 
 	var r0 []*libregraph.User
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *godata.GoDataRequest) ([]*libregraph.User, error)); ok {
+		return rf(ctx, oreq)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, *godata.GoDataRequest) []*libregraph.User); ok {
 		r0 = rf(ctx, oreq)
 	} else {
@@ -212,7 +234,6 @@ func (_m *Backend) GetUsers(ctx context.Context, oreq *godata.GoDataRequest) ([]
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, *godata.GoDataRequest) error); ok {
 		r1 = rf(ctx, oreq)
 	} else {
@@ -241,6 +262,10 @@ func (_m *Backend) UpdateUser(ctx context.Context, nameOrID string, user libregr
 	ret := _m.Called(ctx, nameOrID, user)
 
 	var r0 *libregraph.User
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, libregraph.User) (*libregraph.User, error)); ok {
+		return rf(ctx, nameOrID, user)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string, libregraph.User) *libregraph.User); ok {
 		r0 = rf(ctx, nameOrID, user)
 	} else {
@@ -249,7 +274,6 @@ func (_m *Backend) UpdateUser(ctx context.Context, nameOrID string, user libregr
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string, libregraph.User) error); ok {
 		r1 = rf(ctx, nameOrID, user)
 	} else {
diff --git a/services/graph/pkg/identity/mocks/education_backend.go b/services/graph/pkg/identity/mocks/education_backend.go
index 1de863c454c..da0db3e5304 100644
--- a/services/graph/pkg/identity/mocks/education_backend.go
+++ b/services/graph/pkg/identity/mocks/education_backend.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.14.1. DO NOT EDIT.
+// Code generated by mockery v2.22.1. DO NOT EDIT.
 
 package mocks
 
@@ -62,6 +62,10 @@ func (_m *EducationBackend) CreateEducationClass(ctx context.Context, class libr
 	ret := _m.Called(ctx, class)
 
 	var r0 *libregraph.EducationClass
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, libregraph.EducationClass) (*libregraph.EducationClass, error)); ok {
+		return rf(ctx, class)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, libregraph.EducationClass) *libregraph.EducationClass); ok {
 		r0 = rf(ctx, class)
 	} else {
@@ -70,7 +74,6 @@ func (_m *EducationBackend) CreateEducationClass(ctx context.Context, class libr
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, libregraph.EducationClass) error); ok {
 		r1 = rf(ctx, class)
 	} else {
@@ -85,6 +88,10 @@ func (_m *EducationBackend) CreateEducationSchool(ctx context.Context, group lib
 	ret := _m.Called(ctx, group)
 
 	var r0 *libregraph.EducationSchool
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, libregraph.EducationSchool) (*libregraph.EducationSchool, error)); ok {
+		return rf(ctx, group)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, libregraph.EducationSchool) *libregraph.EducationSchool); ok {
 		r0 = rf(ctx, group)
 	} else {
@@ -93,7 +100,6 @@ func (_m *EducationBackend) CreateEducationSchool(ctx context.Context, group lib
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, libregraph.EducationSchool) error); ok {
 		r1 = rf(ctx, group)
 	} else {
@@ -108,6 +114,10 @@ func (_m *EducationBackend) CreateEducationUser(ctx context.Context, user libreg
 	ret := _m.Called(ctx, user)
 
 	var r0 *libregraph.EducationUser
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, libregraph.EducationUser) (*libregraph.EducationUser, error)); ok {
+		return rf(ctx, user)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, libregraph.EducationUser) *libregraph.EducationUser); ok {
 		r0 = rf(ctx, user)
 	} else {
@@ -116,7 +126,6 @@ func (_m *EducationBackend) CreateEducationUser(ctx context.Context, user libreg
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, libregraph.EducationUser) error); ok {
 		r1 = rf(ctx, user)
 	} else {
@@ -173,6 +182,10 @@ func (_m *EducationBackend) GetEducationClass(ctx context.Context, namedOrID str
 	ret := _m.Called(ctx, namedOrID)
 
 	var r0 *libregraph.EducationClass
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (*libregraph.EducationClass, error)); ok {
+		return rf(ctx, namedOrID)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string) *libregraph.EducationClass); ok {
 		r0 = rf(ctx, namedOrID)
 	} else {
@@ -181,7 +194,6 @@ func (_m *EducationBackend) GetEducationClass(ctx context.Context, namedOrID str
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
 		r1 = rf(ctx, namedOrID)
 	} else {
@@ -196,6 +208,10 @@ func (_m *EducationBackend) GetEducationClassMembers(ctx context.Context, nameOr
 	ret := _m.Called(ctx, nameOrID)
 
 	var r0 []*libregraph.EducationUser
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]*libregraph.EducationUser, error)); ok {
+		return rf(ctx, nameOrID)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string) []*libregraph.EducationUser); ok {
 		r0 = rf(ctx, nameOrID)
 	} else {
@@ -204,7 +220,6 @@ func (_m *EducationBackend) GetEducationClassMembers(ctx context.Context, nameOr
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
 		r1 = rf(ctx, nameOrID)
 	} else {
@@ -219,6 +234,10 @@ func (_m *EducationBackend) GetEducationClassTeachers(ctx context.Context, class
 	ret := _m.Called(ctx, classID)
 
 	var r0 []*libregraph.EducationUser
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]*libregraph.EducationUser, error)); ok {
+		return rf(ctx, classID)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string) []*libregraph.EducationUser); ok {
 		r0 = rf(ctx, classID)
 	} else {
@@ -227,7 +246,6 @@ func (_m *EducationBackend) GetEducationClassTeachers(ctx context.Context, class
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
 		r1 = rf(ctx, classID)
 	} else {
@@ -242,6 +260,10 @@ func (_m *EducationBackend) GetEducationClasses(ctx context.Context) ([]*libregr
 	ret := _m.Called(ctx)
 
 	var r0 []*libregraph.EducationClass
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) ([]*libregraph.EducationClass, error)); ok {
+		return rf(ctx)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context) []*libregraph.EducationClass); ok {
 		r0 = rf(ctx)
 	} else {
@@ -250,7 +272,6 @@ func (_m *EducationBackend) GetEducationClasses(ctx context.Context) ([]*libregr
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
 		r1 = rf(ctx)
 	} else {
@@ -265,6 +286,10 @@ func (_m *EducationBackend) GetEducationSchool(ctx context.Context, nameOrID str
 	ret := _m.Called(ctx, nameOrID)
 
 	var r0 *libregraph.EducationSchool
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (*libregraph.EducationSchool, error)); ok {
+		return rf(ctx, nameOrID)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string) *libregraph.EducationSchool); ok {
 		r0 = rf(ctx, nameOrID)
 	} else {
@@ -273,7 +298,6 @@ func (_m *EducationBackend) GetEducationSchool(ctx context.Context, nameOrID str
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
 		r1 = rf(ctx, nameOrID)
 	} else {
@@ -288,6 +312,10 @@ func (_m *EducationBackend) GetEducationSchoolClasses(ctx context.Context, schoo
 	ret := _m.Called(ctx, schoolNumberOrID)
 
 	var r0 []*libregraph.EducationClass
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]*libregraph.EducationClass, error)); ok {
+		return rf(ctx, schoolNumberOrID)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string) []*libregraph.EducationClass); ok {
 		r0 = rf(ctx, schoolNumberOrID)
 	} else {
@@ -296,7 +324,6 @@ func (_m *EducationBackend) GetEducationSchoolClasses(ctx context.Context, schoo
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
 		r1 = rf(ctx, schoolNumberOrID)
 	} else {
@@ -311,6 +338,10 @@ func (_m *EducationBackend) GetEducationSchoolUsers(ctx context.Context, id stri
 	ret := _m.Called(ctx, id)
 
 	var r0 []*libregraph.EducationUser
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]*libregraph.EducationUser, error)); ok {
+		return rf(ctx, id)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string) []*libregraph.EducationUser); ok {
 		r0 = rf(ctx, id)
 	} else {
@@ -319,7 +350,6 @@ func (_m *EducationBackend) GetEducationSchoolUsers(ctx context.Context, id stri
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
 		r1 = rf(ctx, id)
 	} else {
@@ -334,6 +364,10 @@ func (_m *EducationBackend) GetEducationSchools(ctx context.Context) ([]*libregr
 	ret := _m.Called(ctx)
 
 	var r0 []*libregraph.EducationSchool
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) ([]*libregraph.EducationSchool, error)); ok {
+		return rf(ctx)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context) []*libregraph.EducationSchool); ok {
 		r0 = rf(ctx)
 	} else {
@@ -342,7 +376,6 @@ func (_m *EducationBackend) GetEducationSchools(ctx context.Context) ([]*libregr
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
 		r1 = rf(ctx)
 	} else {
@@ -357,6 +390,10 @@ func (_m *EducationBackend) GetEducationUser(ctx context.Context, nameOrID strin
 	ret := _m.Called(ctx, nameOrID)
 
 	var r0 *libregraph.EducationUser
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (*libregraph.EducationUser, error)); ok {
+		return rf(ctx, nameOrID)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string) *libregraph.EducationUser); ok {
 		r0 = rf(ctx, nameOrID)
 	} else {
@@ -365,7 +402,6 @@ func (_m *EducationBackend) GetEducationUser(ctx context.Context, nameOrID strin
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
 		r1 = rf(ctx, nameOrID)
 	} else {
@@ -380,6 +416,10 @@ func (_m *EducationBackend) GetEducationUsers(ctx context.Context) ([]*libregrap
 	ret := _m.Called(ctx)
 
 	var r0 []*libregraph.EducationUser
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) ([]*libregraph.EducationUser, error)); ok {
+		return rf(ctx)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context) []*libregraph.EducationUser); ok {
 		r0 = rf(ctx)
 	} else {
@@ -388,7 +428,6 @@ func (_m *EducationBackend) GetEducationUsers(ctx context.Context) ([]*libregrap
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
 		r1 = rf(ctx)
 	} else {
@@ -445,6 +484,10 @@ func (_m *EducationBackend) UpdateEducationClass(ctx context.Context, id string,
 	ret := _m.Called(ctx, id, class)
 
 	var r0 *libregraph.EducationClass
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, libregraph.EducationClass) (*libregraph.EducationClass, error)); ok {
+		return rf(ctx, id, class)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string, libregraph.EducationClass) *libregraph.EducationClass); ok {
 		r0 = rf(ctx, id, class)
 	} else {
@@ -453,7 +496,6 @@ func (_m *EducationBackend) UpdateEducationClass(ctx context.Context, id string,
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string, libregraph.EducationClass) error); ok {
 		r1 = rf(ctx, id, class)
 	} else {
@@ -468,6 +510,10 @@ func (_m *EducationBackend) UpdateEducationSchool(ctx context.Context, numberOrI
 	ret := _m.Called(ctx, numberOrID, school)
 
 	var r0 *libregraph.EducationSchool
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, libregraph.EducationSchool) (*libregraph.EducationSchool, error)); ok {
+		return rf(ctx, numberOrID, school)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string, libregraph.EducationSchool) *libregraph.EducationSchool); ok {
 		r0 = rf(ctx, numberOrID, school)
 	} else {
@@ -476,7 +522,6 @@ func (_m *EducationBackend) UpdateEducationSchool(ctx context.Context, numberOrI
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string, libregraph.EducationSchool) error); ok {
 		r1 = rf(ctx, numberOrID, school)
 	} else {
@@ -491,6 +536,10 @@ func (_m *EducationBackend) UpdateEducationUser(ctx context.Context, nameOrID st
 	ret := _m.Called(ctx, nameOrID, user)
 
 	var r0 *libregraph.EducationUser
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, libregraph.EducationUser) (*libregraph.EducationUser, error)); ok {
+		return rf(ctx, nameOrID, user)
+	}
 	if rf, ok := ret.Get(0).(func(context.Context, string, libregraph.EducationUser) *libregraph.EducationUser); ok {
 		r0 = rf(ctx, nameOrID, user)
 	} else {
@@ -499,7 +548,6 @@ func (_m *EducationBackend) UpdateEducationUser(ctx context.Context, nameOrID st
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(context.Context, string, libregraph.EducationUser) error); ok {
 		r1 = rf(ctx, nameOrID, user)
 	} else {
diff --git a/services/graph/pkg/service/v0/graph.go b/services/graph/pkg/service/v0/graph.go
index 79b52fdd583..0a6793e72c6 100644
--- a/services/graph/pkg/service/v0/graph.go
+++ b/services/graph/pkg/service/v0/graph.go
@@ -45,6 +45,10 @@ type GatewayClient interface {
 	// Returns the resource information at the provided reference.
 	// MUST return CODE_NOT_FOUND if the reference does not exist.
 	Stat(ctx context.Context, in *provider.StatRequest, opts ...grpc.CallOption) (*provider.StatResponse, error)
+	// TouchFile allows to touch a file
+	TouchFile(ctx context.Context, req *provider.TouchFileRequest, opts ...grpc.CallOption) (*provider.TouchFileResponse, error)
+	// Initiates the upload of a file using an out-of-band data transfer mechanism.
+	InitiateFileUpload(ctx context.Context, in *provider.InitiateFileUploadRequest, opts ...grpc.CallOption) (*gateway.InitiateFileUploadResponse, error)
 	// Initiates the download of a file using an
 	// out-of-band data transfer mechanism.
 	InitiateFileDownload(ctx context.Context, in *provider.InitiateFileDownloadRequest, opts ...grpc.CallOption) (*gateway.InitiateFileDownloadResponse, error)
diff --git a/services/graph/pkg/service/v0/personaldata.go b/services/graph/pkg/service/v0/personaldata.go
new file mode 100644
index 00000000000..3a334d0cc39
--- /dev/null
+++ b/services/graph/pkg/service/v0/personaldata.go
@@ -0,0 +1,126 @@
+package svc
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	revaCtx "github.com/cs3org/reva/v2/pkg/ctx"
+	revactx "github.com/cs3org/reva/v2/pkg/ctx"
+	"github.com/cs3org/reva/v2/pkg/rhttp"
+	"github.com/cs3org/reva/v2/pkg/utils"
+)
+
+var (
+	_backupFileName = "personal_data_export.json"
+
+	// TokenTransportHeader holds the header key for the reva transfer token
+	TokenTransportHeader = "X-Reva-Transfer"
+)
+
+// ExportPersonalDataRequest is the body of the request
+type ExportPersonalDataRequest struct {
+	StorageLocation string `json:"storageLocation"`
+}
+
+// ExportPersonalData exports all personal data the system holds
+func (g Graph) ExportPersonalData(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	u := revactx.ContextMustGetUser(ctx)
+	// Get location from request
+	loc := ""
+	if loc == "" {
+		loc = _backupFileName
+	}
+
+	ref := &provider.Reference{
+		ResourceId: &provider.ResourceId{SpaceId: u.GetId().GetOpaqueId(), OpaqueId: u.GetId().GetOpaqueId()},
+		Path:       loc,
+	}
+
+	// touch file
+	gwc := g.GetGatewayClient()
+	resp, err := gwc.TouchFile(ctx, &provider.TouchFileRequest{
+		Opaque: utils.AppendPlainToOpaque(nil, "markprocessing", "true"),
+		Ref:    ref,
+	})
+	if err != nil || resp.GetStatus().GetCode() != rpc.Code_CODE_OK {
+		g.logger.Error().Err(err).Str("status", resp.GetStatus().GetMessage()).Msg("error touching file")
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	// go start gathering
+	go func() {
+		time.Sleep(10 * time.Second)
+		by, _ := json.Marshal(map[string]string{u.GetId().GetOpaqueId(): "no data stored"})
+		b := bytes.NewBuffer(by)
+		th := r.Header.Get(revaCtx.TokenHeader)
+		err := g.upload(u, b, ref, th)
+		fmt.Println("Upload error", err)
+	}()
+
+	w.WriteHeader(http.StatusOK)
+	return
+}
+
+func (g Graph) upload(u *user.User, data io.Reader, ref *provider.Reference, th string) error {
+	uReq := &provider.InitiateFileUploadRequest{
+		Ref: ref,
+		//Opaque: &typespb.Opaque{
+		//Map: map[string]*typespb.OpaqueEntry{
+		//"Upload-Length": {
+		//Decoder: "plain",
+		//// TODO: handle case where size is not known in advance
+		//Value: []byte(strconv.FormatUint(cp.sourceInfo.GetSize(), 10)),
+		//},
+		//},
+		//},
+	}
+
+	gwc := g.GetGatewayClient()
+	ctx, _, err := utils.Impersonate(u.GetId(), gwc.(gateway.GatewayAPIClient), g.config.MachineAuthAPIKey)
+	ctx = revaCtx.ContextSetToken(ctx, th)
+	uRes, err := gwc.InitiateFileUpload(ctx, uReq)
+	if err != nil {
+		return err
+	}
+
+	if uRes.Status.Code != rpc.Code_CODE_OK {
+		return fmt.Errorf("wrong status code while initiating upload: %s", uRes.GetStatus().GetMessage())
+	}
+
+	var uploadEP, uploadToken string
+	for _, p := range uRes.Protocols {
+		if p.Protocol == "simple" {
+			uploadEP, uploadToken = p.UploadEndpoint, p.Token
+		}
+	}
+
+	httpUploadReq, err := rhttp.NewRequest(ctx, "PUT", uploadEP, data)
+	if err != nil {
+		return err
+	}
+	httpUploadReq.Header.Set(TokenTransportHeader, uploadToken)
+
+	httpUploadRes, err := rhttp.GetHTTPClient(
+		// rhttp.Timeout(time.Duration(conf.Timeout*int64(time.Second))),
+		rhttp.Insecure(true),
+	).Do(httpUploadReq)
+	if err != nil {
+		return err
+	}
+	defer httpUploadRes.Body.Close()
+	if httpUploadRes.StatusCode != http.StatusOK {
+		return fmt.Errorf("wrong status uploading file: %d", httpUploadRes.StatusCode)
+	}
+
+	return nil
+}
diff --git a/services/graph/pkg/service/v0/service.go b/services/graph/pkg/service/v0/service.go
index 7ed796eb419..8541167af6c 100644
--- a/services/graph/pkg/service/v0/service.go
+++ b/services/graph/pkg/service/v0/service.go
@@ -207,6 +207,7 @@ func NewService(opts ...Option) (Graph, error) {
 				r.Route("/{userID}", func(r chi.Router) {
 					r.Get("/", svc.GetUser)
 					r.Get("/drive", svc.GetUserDrive)
+					r.Post("/exportPersonalData", svc.ExportPersonalData)
 					r.With(requireAdmin).Delete("/", svc.DeleteUser)
 					r.With(requireAdmin).Patch("/", svc.PatchUser)
 					if svc.roleService != nil {