diff --git a/api/swagger.yml b/api/swagger.yml
index 47660b8acc7..3b11b86fc97 100644
--- a/api/swagger.yml
+++ b/api/swagger.yml
@@ -684,7 +684,7 @@ components:
           items:
             $ref: "#/components/schemas/Policy"
 
-    Config:
+    StorageConfig:
       type: object
       required:
         - blockstore_namespace_example
@@ -2832,18 +2832,18 @@ paths:
         204:
           description: NoContent
 
-  /config:
+  /config/storage:
     get:
       tags:
         - config
-      operationId: getConfig
-      description: retrieve the lakefs config
+      operationId: getStorageConfig
+      description: retrieve lakeFS storage configuration
       responses:
         200:
-          description: the lakefs config
+          description: lakeFS storage configuration
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/Config"
+                $ref: "#/components/schemas/StorageConfig"
         401:
           $ref: "#/components/responses/Unauthorized"
diff --git a/clients/java/README.md b/clients/java/README.md
index c6e5daec279..fc940ec0f43 100644
--- a/clients/java/README.md
+++ b/clients/java/README.md
@@ -167,7 +167,7 @@ Class | Method | HTTP request | Description
 *CommitsApi* | [**commit**](docs/CommitsApi.md#commit) | **POST** /repositories/{repository}/branches/{branch}/commits | create commit
 *CommitsApi* | [**getCommit**](docs/CommitsApi.md#getCommit) | **GET** /repositories/{repository}/commits/{commitId} | get commit
 *CommitsApi* | [**logBranchCommits**](docs/CommitsApi.md#logBranchCommits) | **GET** /repositories/{repository}/branches/{branch}/commits | get commit log from branch. Deprecated: replaced by logCommits by passing branch name as ref 
-*ConfigApi* | [**getConfig**](docs/ConfigApi.md#getConfig) | **GET** /config | 
+*ConfigApi* | [**getStorageConfig**](docs/ConfigApi.md#getStorageConfig) | **GET** /config/storage | 
 *ConfigApi* | [**setup**](docs/ConfigApi.md#setup) | **POST** /setup_lakefs | setup lakeFS and create a first user
 *HealthCheckApi* | [**healthCheck**](docs/HealthCheckApi.md#healthCheck) | **GET** /healthcheck | 
 *MetadataApi* | [**createSymlinkFile**](docs/MetadataApi.md#createSymlinkFile) | **POST** /repositories/{repository}/refs/{branch}/symlink | creates symlink files corresponding to the given directory
@@ -207,7 +207,6 @@ Class | Method | HTTP request | Description
  - [Commit](docs/Commit.md)
  - [CommitCreation](docs/CommitCreation.md)
  - [CommitList](docs/CommitList.md)
- - [Config](docs/Config.md)
  - [Credentials](docs/Credentials.md)
  - [CredentialsList](docs/CredentialsList.md)
  - [CredentialsWithSecret](docs/CredentialsWithSecret.md)
@@ -242,6 +241,7 @@ Class | Method | HTTP request | Description
  - [StagingLocation](docs/StagingLocation.md)
  - [StagingMetadata](docs/StagingMetadata.md)
  - [Statement](docs/Statement.md)
+ - [StorageConfig](docs/StorageConfig.md)
  - [StorageURI](docs/StorageURI.md)
  - [TagCreation](docs/TagCreation.md)
  - [UnderlyingObjectProperties](docs/UnderlyingObjectProperties.md)
diff --git a/clients/java/api/openapi.yaml b/clients/java/api/openapi.yaml
index a9084579704..ded8490d6bc 100644
--- a/clients/java/api/openapi.yaml
+++ b/clients/java/api/openapi.yaml
@@ -3749,17 +3749,17 @@ paths:
       tags:
       - healthCheck
       x-accepts: application/json
-  /config:
+  /config/storage:
     get:
-      description: retrieve the lakefs config
-      operationId: getConfig
+      description: retrieve lakeFS storage configuration
+      operationId: getStorageConfig
       responses:
         "200":
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/Config'
-          description: the lakefs config
+                $ref: '#/components/schemas/StorageConfig'
+          description: lakeFS storage configuration
         "401":
           content:
             application/json:
@@ -4686,7 +4686,7 @@ components:
       - pagination
       - results
       type: object
-    Config:
+    StorageConfig:
       example:
         blockstore_namespace_example: blockstore_namespace_example
         blockstore_namespace_ValidityRegex: blockstore_namespace_ValidityRegex
diff --git a/clients/java/docs/ConfigApi.md b/clients/java/docs/ConfigApi.md
index 13eb5d3cf7e..d6433aeadb6 100644
--- a/clients/java/docs/ConfigApi.md
+++ b/clients/java/docs/ConfigApi.md
@@ -4,17 +4,17 @@ All URIs are relative to *http://localhost/api/v1*
 
 Method | HTTP request | Description
 ------------- | ------------- | -------------
-[**getConfig**](ConfigApi.md#getConfig) | **GET** /config | 
+[**getStorageConfig**](ConfigApi.md#getStorageConfig) | **GET** /config/storage | 
 [**setup**](ConfigApi.md#setup) | **POST** /setup_lakefs | setup lakeFS and create a first user
 
 
-<a name="getConfig"></a>
-# **getConfig**
-> Config getConfig()
+<a name="getStorageConfig"></a>
+# **getStorageConfig**
+> StorageConfig getStorageConfig()
 
 
 
-retrieve the lakefs config
+retrieve lakeFS storage configuration
 
 ### Example
 ```java
@@ -48,10 +48,10 @@ public class Example {
 
     ConfigApi apiInstance = new ConfigApi(defaultClient);
     try {
-      Config result = apiInstance.getConfig();
+      StorageConfig result = apiInstance.getStorageConfig();
       System.out.println(result);
     } catch (ApiException e) {
-      System.err.println("Exception when calling ConfigApi#getConfig");
+      System.err.println("Exception when calling ConfigApi#getStorageConfig");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -66,7 +66,7 @@ This endpoint does not need any parameter.
 
 ### Return type
 
-[**Config**](Config.md)
+[**StorageConfig**](StorageConfig.md)
 
 ### Authorization
 
@@ -80,7 +80,7 @@ This endpoint does not need any parameter.
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | the lakefs config |  -  |
+**200** | lakeFS storage configuration |  -  |
 **401** | Unauthorized |  -  |
 
 <a name="setup"></a>
diff --git a/clients/java/docs/StorageConfig.md b/clients/java/docs/StorageConfig.md
new file mode 100644
index 00000000000..1f95d00ac37
--- /dev/null
+++ b/clients/java/docs/StorageConfig.md
@@ -0,0 +1,14 @@
+
+
+# StorageConfig
+
+
+## Properties
+
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**blockstoreNamespaceExample** | **String** |  | 
+**blockstoreNamespaceValidityRegex** | **String** |  | 
+
+
+
diff --git a/clients/java/src/main/java/io/lakefs/clients/api/ConfigApi.java b/clients/java/src/main/java/io/lakefs/clients/api/ConfigApi.java
index 59920da05f9..1f8f29a2939 100644
--- a/clients/java/src/main/java/io/lakefs/clients/api/ConfigApi.java
+++ b/clients/java/src/main/java/io/lakefs/clients/api/ConfigApi.java
@@ -27,10 +27,10 @@
 import java.io.IOException;
 
 
-import io.lakefs.clients.api.model.Config;
 import io.lakefs.clients.api.model.CredentialsWithSecret;
 import io.lakefs.clients.api.model.Error;
 import io.lakefs.clients.api.model.Setup;
+import io.lakefs.clients.api.model.StorageConfig;
 
 import java.lang.reflect.Type;
 import java.util.ArrayList;
@@ -58,22 +58,22 @@ public void setApiClient(ApiClient apiClient) {
     }
 
     /**
-     * Build call for getConfig
+     * Build call for getStorageConfig
      * @param _callback Callback for upload/download progress
      * @return Call to execute
      * @throws ApiException If fail to serialize the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> the lakefs config </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS storage configuration </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getConfigCall(final ApiCallback _callback) throws ApiException {
+    public okhttp3.Call getStorageConfigCall(final ApiCallback _callback) throws ApiException {
         Object localVarPostBody = null;
 
         // create path and map variables
-        String localVarPath = "/config";
+        String localVarPath = "/config/storage";
 
         List<Pair> localVarQueryParams = new ArrayList<Pair>();
         List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
@@ -100,66 +100,66 @@ public okhttp3.Call getConfigCall(final ApiCallback _callback) throws ApiExcepti
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call getConfigValidateBeforeCall(final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call getStorageConfigValidateBeforeCall(final ApiCallback _callback) throws ApiException {
         
 
-        okhttp3.Call localVarCall = getConfigCall(_callback);
+        okhttp3.Call localVarCall = getStorageConfigCall(_callback);
         return localVarCall;
 
     }
 
     /**
      * 
-     * retrieve the lakefs config
-     * @return Config
+     * retrieve lakeFS storage configuration
+     * @return StorageConfig
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> the lakefs config </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS storage configuration </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
      </table>
      */
-    public Config getConfig() throws ApiException {
-        ApiResponse<Config> localVarResp = getConfigWithHttpInfo();
+    public StorageConfig getStorageConfig() throws ApiException {
+        ApiResponse<StorageConfig> localVarResp = getStorageConfigWithHttpInfo();
         return localVarResp.getData();
     }
 
     /**
      * 
-     * retrieve the lakefs config
-     * @return ApiResponse&lt;Config&gt;
+     * retrieve lakeFS storage configuration
+     * @return ApiResponse&lt;StorageConfig&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> the lakefs config </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS storage configuration </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<Config> getConfigWithHttpInfo() throws ApiException {
-        okhttp3.Call localVarCall = getConfigValidateBeforeCall(null);
-        Type localVarReturnType = new TypeToken<Config>(){}.getType();
+    public ApiResponse<StorageConfig> getStorageConfigWithHttpInfo() throws ApiException {
+        okhttp3.Call localVarCall = getStorageConfigValidateBeforeCall(null);
+        Type localVarReturnType = new TypeToken<StorageConfig>(){}.getType();
         return localVarApiClient.execute(localVarCall, localVarReturnType);
     }
 
     /**
      *  (asynchronously)
-     * retrieve the lakefs config
+     * retrieve lakeFS storage configuration
      * @param _callback The callback to be executed when the API call finishes
      * @return The request call
      * @throws ApiException If fail to process the API call, e.g. serializing the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> the lakefs config </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS storage configuration </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getConfigAsync(final ApiCallback<Config> _callback) throws ApiException {
+    public okhttp3.Call getStorageConfigAsync(final ApiCallback<StorageConfig> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = getConfigValidateBeforeCall(_callback);
-        Type localVarReturnType = new TypeToken<Config>(){}.getType();
+        okhttp3.Call localVarCall = getStorageConfigValidateBeforeCall(_callback);
+        Type localVarReturnType = new TypeToken<StorageConfig>(){}.getType();
         localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
diff --git a/clients/java/src/main/java/io/lakefs/clients/api/model/StorageConfig.java b/clients/java/src/main/java/io/lakefs/clients/api/model/StorageConfig.java
new file mode 100644
index 00000000000..3dc1fb6a3de
--- /dev/null
+++ b/clients/java/src/main/java/io/lakefs/clients/api/model/StorageConfig.java
@@ -0,0 +1,125 @@
+/*
+ * lakeFS API
+ * lakeFS HTTP API
+ *
+ * The version of the OpenAPI document: 0.1.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+package io.lakefs.clients.api.model;
+
+import java.util.Objects;
+import java.util.Arrays;
+import com.google.gson.TypeAdapter;
+import com.google.gson.annotations.JsonAdapter;
+import com.google.gson.annotations.SerializedName;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+import io.swagger.annotations.ApiModel;
+import io.swagger.annotations.ApiModelProperty;
+import java.io.IOException;
+
+/**
+ * StorageConfig
+ */
+@javax.annotation.Generated(value = "org.openapitools.codegen.languages.JavaClientCodegen")
+public class StorageConfig {
+  public static final String SERIALIZED_NAME_BLOCKSTORE_NAMESPACE_EXAMPLE = "blockstore_namespace_example";
+  @SerializedName(SERIALIZED_NAME_BLOCKSTORE_NAMESPACE_EXAMPLE)
+  private String blockstoreNamespaceExample;
+
+  public static final String SERIALIZED_NAME_BLOCKSTORE_NAMESPACE_VALIDITY_REGEX = "blockstore_namespace_ValidityRegex";
+  @SerializedName(SERIALIZED_NAME_BLOCKSTORE_NAMESPACE_VALIDITY_REGEX)
+  private String blockstoreNamespaceValidityRegex;
+
+
+  public StorageConfig blockstoreNamespaceExample(String blockstoreNamespaceExample) {
+    
+    this.blockstoreNamespaceExample = blockstoreNamespaceExample;
+    return this;
+  }
+
+   /**
+   * Get blockstoreNamespaceExample
+   * @return blockstoreNamespaceExample
+  **/
+  @ApiModelProperty(required = true, value = "")
+
+  public String getBlockstoreNamespaceExample() {
+    return blockstoreNamespaceExample;
+  }
+
+
+  public void setBlockstoreNamespaceExample(String blockstoreNamespaceExample) {
+    this.blockstoreNamespaceExample = blockstoreNamespaceExample;
+  }
+
+
+  public StorageConfig blockstoreNamespaceValidityRegex(String blockstoreNamespaceValidityRegex) {
+    
+    this.blockstoreNamespaceValidityRegex = blockstoreNamespaceValidityRegex;
+    return this;
+  }
+
+   /**
+   * Get blockstoreNamespaceValidityRegex
+   * @return blockstoreNamespaceValidityRegex
+  **/
+  @ApiModelProperty(required = true, value = "")
+
+  public String getBlockstoreNamespaceValidityRegex() {
+    return blockstoreNamespaceValidityRegex;
+  }
+
+
+  public void setBlockstoreNamespaceValidityRegex(String blockstoreNamespaceValidityRegex) {
+    this.blockstoreNamespaceValidityRegex = blockstoreNamespaceValidityRegex;
+  }
+
+
+  @Override
+  public boolean equals(Object o) {
+    if (this == o) {
+      return true;
+    }
+    if (o == null || getClass() != o.getClass()) {
+      return false;
+    }
+    StorageConfig storageConfig = (StorageConfig) o;
+    return Objects.equals(this.blockstoreNamespaceExample, storageConfig.blockstoreNamespaceExample) &&
+        Objects.equals(this.blockstoreNamespaceValidityRegex, storageConfig.blockstoreNamespaceValidityRegex);
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(blockstoreNamespaceExample, blockstoreNamespaceValidityRegex);
+  }
+
+  @Override
+  public String toString() {
+    StringBuilder sb = new StringBuilder();
+    sb.append("class StorageConfig {\n");
+    sb.append("    blockstoreNamespaceExample: ").append(toIndentedString(blockstoreNamespaceExample)).append("\n");
+    sb.append("    blockstoreNamespaceValidityRegex: ").append(toIndentedString(blockstoreNamespaceValidityRegex)).append("\n");
+    sb.append("}");
+    return sb.toString();
+  }
+
+  /**
+   * Convert the given object to string with each line indented by 4 spaces
+   * (except the first line).
+   */
+  private String toIndentedString(Object o) {
+    if (o == null) {
+      return "null";
+    }
+    return o.toString().replace("\n", "\n    ");
+  }
+
+}
+
diff --git a/clients/java/src/test/java/io/lakefs/clients/api/model/StorageConfigTest.java b/clients/java/src/test/java/io/lakefs/clients/api/model/StorageConfigTest.java
new file mode 100644
index 00000000000..353608c0cdf
--- /dev/null
+++ b/clients/java/src/test/java/io/lakefs/clients/api/model/StorageConfigTest.java
@@ -0,0 +1,59 @@
+/*
+ * lakeFS API
+ * lakeFS HTTP API
+ *
+ * The version of the OpenAPI document: 0.1.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+package io.lakefs.clients.api.model;
+
+import com.google.gson.TypeAdapter;
+import com.google.gson.annotations.JsonAdapter;
+import com.google.gson.annotations.SerializedName;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+import io.swagger.annotations.ApiModel;
+import io.swagger.annotations.ApiModelProperty;
+import java.io.IOException;
+import org.junit.Assert;
+import org.junit.Ignore;
+import org.junit.Test;
+
+
+/**
+ * Model tests for StorageConfig
+ */
+public class StorageConfigTest {
+    private final StorageConfig model = new StorageConfig();
+
+    /**
+     * Model tests for StorageConfig
+     */
+    @Test
+    public void testStorageConfig() {
+        // TODO: test StorageConfig
+    }
+
+    /**
+     * Test the property 'blockstoreNamespaceExample'
+     */
+    @Test
+    public void blockstoreNamespaceExampleTest() {
+        // TODO: test blockstoreNamespaceExample
+    }
+
+    /**
+     * Test the property 'blockstoreNamespaceValidityRegex'
+     */
+    @Test
+    public void blockstoreNamespaceValidityRegexTest() {
+        // TODO: test blockstoreNamespaceValidityRegex
+    }
+
+}
diff --git a/clients/python/.openapi-generator/FILES b/clients/python/.openapi-generator/FILES
index 35fecabd6b1..947f87aa22e 100644
--- a/clients/python/.openapi-generator/FILES
+++ b/clients/python/.openapi-generator/FILES
@@ -13,7 +13,6 @@ docs/Commit.md
 docs/CommitCreation.md
 docs/CommitList.md
 docs/CommitsApi.md
-docs/Config.md
 docs/ConfigApi.md
 docs/Credentials.md
 docs/CredentialsList.md
@@ -55,6 +54,7 @@ docs/StagingApi.md
 docs/StagingLocation.md
 docs/StagingMetadata.md
 docs/Statement.md
+docs/StorageConfig.md
 docs/StorageURI.md
 docs/TagCreation.md
 docs/TagsApi.md
@@ -89,7 +89,6 @@ lakefs_client/model/branch_creation.py
 lakefs_client/model/commit.py
 lakefs_client/model/commit_creation.py
 lakefs_client/model/commit_list.py
-lakefs_client/model/config.py
 lakefs_client/model/credentials.py
 lakefs_client/model/credentials_list.py
 lakefs_client/model/credentials_with_secret.py
@@ -124,6 +123,7 @@ lakefs_client/model/setup.py
 lakefs_client/model/staging_location.py
 lakefs_client/model/staging_metadata.py
 lakefs_client/model/statement.py
+lakefs_client/model/storage_config.py
 lakefs_client/model/storage_uri.py
 lakefs_client/model/tag_creation.py
 lakefs_client/model/underlying_object_properties.py
diff --git a/clients/python/README.md b/clients/python/README.md
index d188a9783c7..c828972eb83 100644
--- a/clients/python/README.md
+++ b/clients/python/README.md
@@ -148,7 +148,7 @@ Class | Method | HTTP request | Description
 *CommitsApi* | [**commit**](docs/CommitsApi.md#commit) | **POST** /repositories/{repository}/branches/{branch}/commits | create commit
 *CommitsApi* | [**get_commit**](docs/CommitsApi.md#get_commit) | **GET** /repositories/{repository}/commits/{commitId} | get commit
 *CommitsApi* | [**log_branch_commits**](docs/CommitsApi.md#log_branch_commits) | **GET** /repositories/{repository}/branches/{branch}/commits | get commit log from branch. Deprecated: replaced by logCommits by passing branch name as ref 
-*ConfigApi* | [**get_config**](docs/ConfigApi.md#get_config) | **GET** /config | 
+*ConfigApi* | [**get_storage_config**](docs/ConfigApi.md#get_storage_config) | **GET** /config/storage | 
 *ConfigApi* | [**setup**](docs/ConfigApi.md#setup) | **POST** /setup_lakefs | setup lakeFS and create a first user
 *HealthCheckApi* | [**health_check**](docs/HealthCheckApi.md#health_check) | **GET** /healthcheck | 
 *MetadataApi* | [**create_symlink_file**](docs/MetadataApi.md#create_symlink_file) | **POST** /repositories/{repository}/refs/{branch}/symlink | creates symlink files corresponding to the given directory
@@ -188,7 +188,6 @@ Class | Method | HTTP request | Description
  - [Commit](docs/Commit.md)
  - [CommitCreation](docs/CommitCreation.md)
  - [CommitList](docs/CommitList.md)
- - [Config](docs/Config.md)
  - [Credentials](docs/Credentials.md)
  - [CredentialsList](docs/CredentialsList.md)
  - [CredentialsWithSecret](docs/CredentialsWithSecret.md)
@@ -223,6 +222,7 @@ Class | Method | HTTP request | Description
  - [StagingLocation](docs/StagingLocation.md)
  - [StagingMetadata](docs/StagingMetadata.md)
  - [Statement](docs/Statement.md)
+ - [StorageConfig](docs/StorageConfig.md)
  - [StorageURI](docs/StorageURI.md)
  - [TagCreation](docs/TagCreation.md)
  - [UnderlyingObjectProperties](docs/UnderlyingObjectProperties.md)
diff --git a/clients/python/docs/ConfigApi.md b/clients/python/docs/ConfigApi.md
index 6b5e4d943f0..9c77b315a79 100644
--- a/clients/python/docs/ConfigApi.md
+++ b/clients/python/docs/ConfigApi.md
@@ -4,16 +4,16 @@ All URIs are relative to *http://localhost/api/v1*
 
 Method | HTTP request | Description
 ------------- | ------------- | -------------
-[**get_config**](ConfigApi.md#get_config) | **GET** /config | 
+[**get_storage_config**](ConfigApi.md#get_storage_config) | **GET** /config/storage | 
 [**setup**](ConfigApi.md#setup) | **POST** /setup_lakefs | setup lakeFS and create a first user
 
 
-# **get_config**
-> Config get_config()
+# **get_storage_config**
+> StorageConfig get_storage_config()
 
 
 
-retrieve the lakefs config
+retrieve lakeFS storage configuration
 
 ### Example
 
@@ -24,8 +24,8 @@ retrieve the lakefs config
 import time
 import lakefs_client
 from lakefs_client.api import config_api
-from lakefs_client.model.config import Config
 from lakefs_client.model.error import Error
+from lakefs_client.model.storage_config import StorageConfig
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -62,10 +62,10 @@ with lakefs_client.ApiClient(configuration) as api_client:
 
     # example, this endpoint has no required or optional parameters
     try:
-        api_response = api_instance.get_config()
+        api_response = api_instance.get_storage_config()
         pprint(api_response)
     except lakefs_client.ApiException as e:
-        print("Exception when calling ConfigApi->get_config: %s\n" % e)
+        print("Exception when calling ConfigApi->get_storage_config: %s\n" % e)
 ```
 
 
@@ -74,7 +74,7 @@ This endpoint does not need any parameter.
 
 ### Return type
 
-[**Config**](Config.md)
+[**StorageConfig**](StorageConfig.md)
 
 ### Authorization
 
@@ -89,7 +89,7 @@ This endpoint does not need any parameter.
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | the lakefs config |  -  |
+**200** | lakeFS storage configuration |  -  |
 **401** | Unauthorized |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
diff --git a/clients/python/docs/StorageConfig.md b/clients/python/docs/StorageConfig.md
new file mode 100644
index 00000000000..b7ca6d7d905
--- /dev/null
+++ b/clients/python/docs/StorageConfig.md
@@ -0,0 +1,12 @@
+# StorageConfig
+
+
+## Properties
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**blockstore_namespace_example** | **str** |  | 
+**blockstore_namespace_validity_regex** | **str** |  | 
+
+[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
+
+
diff --git a/clients/python/lakefs_client/api/config_api.py b/clients/python/lakefs_client/api/config_api.py
index 6e3eea9fc02..8c4ddf8cec1 100644
--- a/clients/python/lakefs_client/api/config_api.py
+++ b/clients/python/lakefs_client/api/config_api.py
@@ -22,10 +22,10 @@
     none_type,
     validate_and_convert_types
 )
-from lakefs_client.model.config import Config
 from lakefs_client.model.credentials_with_secret import CredentialsWithSecret
 from lakefs_client.model.error import Error
 from lakefs_client.model.setup import Setup
+from lakefs_client.model.storage_config import StorageConfig
 
 
 class ConfigApi(object):
@@ -40,17 +40,17 @@ def __init__(self, api_client=None):
             api_client = ApiClient()
         self.api_client = api_client
 
-        def __get_config(
+        def __get_storage_config(
             self,
             **kwargs
         ):
-            """get_config  # noqa: E501
+            """get_storage_config  # noqa: E501
 
-            retrieve the lakefs config  # noqa: E501
+            retrieve lakeFS storage configuration  # noqa: E501
             This method makes a synchronous HTTP request by default. To make an
             asynchronous HTTP request, please pass async_req=True
 
-            >>> thread = api.get_config(async_req=True)
+            >>> thread = api.get_storage_config(async_req=True)
             >>> result = thread.get()
 
 
@@ -76,7 +76,7 @@ def __get_config(
                 async_req (bool): execute request asynchronously
 
             Returns:
-                Config
+                StorageConfig
                     If the method is called asynchronously, returns the request
                     thread.
             """
@@ -101,16 +101,16 @@ def __get_config(
             kwargs['_host_index'] = kwargs.get('_host_index')
             return self.call_with_http_info(**kwargs)
 
-        self.get_config = _Endpoint(
+        self.get_storage_config = _Endpoint(
             settings={
-                'response_type': (Config,),
+                'response_type': (StorageConfig,),
                 'auth': [
                     'basic_auth',
                     'cookie_auth',
                     'jwt_token'
                 ],
-                'endpoint_path': '/config',
-                'operation_id': 'get_config',
+                'endpoint_path': '/config/storage',
+                'operation_id': 'get_storage_config',
                 'http_method': 'GET',
                 'servers': None,
             },
@@ -146,7 +146,7 @@ def __get_config(
                 'content_type': [],
             },
             api_client=api_client,
-            callable=__get_config
+            callable=__get_storage_config
         )
 
         def __setup(
diff --git a/clients/python/lakefs_client/model/storage_config.py b/clients/python/lakefs_client/model/storage_config.py
new file mode 100644
index 00000000000..fce6d061958
--- /dev/null
+++ b/clients/python/lakefs_client/model/storage_config.py
@@ -0,0 +1,174 @@
+"""
+    lakeFS API
+
+    lakeFS HTTP API  # noqa: E501
+
+    The version of the OpenAPI document: 0.1.0
+    Contact: services@treeverse.io
+    Generated by: https://openapi-generator.tech
+"""
+
+
+import re  # noqa: F401
+import sys  # noqa: F401
+
+from lakefs_client.model_utils import (  # noqa: F401
+    ApiTypeError,
+    ModelComposed,
+    ModelNormal,
+    ModelSimple,
+    cached_property,
+    change_keys_js_to_python,
+    convert_js_args_to_python_args,
+    date,
+    datetime,
+    file_type,
+    none_type,
+    validate_get_composed_info,
+)
+
+
+class StorageConfig(ModelNormal):
+    """NOTE: This class is auto generated by OpenAPI Generator.
+    Ref: https://openapi-generator.tech
+
+    Do not edit the class manually.
+
+    Attributes:
+      allowed_values (dict): The key is the tuple path to the attribute
+          and the for var_name this is (var_name,). The value is a dict
+          with a capitalized key describing the allowed value and an allowed
+          value. These dicts store the allowed enum values.
+      attribute_map (dict): The key is attribute name
+          and the value is json key in definition.
+      discriminator_value_class_map (dict): A dict to go from the discriminator
+          variable value to the discriminator class name.
+      validations (dict): The key is the tuple path to the attribute
+          and the for var_name this is (var_name,). The value is a dict
+          that stores validations for max_length, min_length, max_items,
+          min_items, exclusive_maximum, inclusive_maximum, exclusive_minimum,
+          inclusive_minimum, and regex.
+      additional_properties_type (tuple): A tuple of classes accepted
+          as additional properties values.
+    """
+
+    allowed_values = {
+    }
+
+    validations = {
+    }
+
+    additional_properties_type = None
+
+    _nullable = False
+
+    @cached_property
+    def openapi_types():
+        """
+        This must be a method because a model may have properties that are
+        of type self, this must run after the class is loaded
+
+        Returns
+            openapi_types (dict): The key is attribute name
+                and the value is attribute type.
+        """
+        return {
+            'blockstore_namespace_example': (str,),  # noqa: E501
+            'blockstore_namespace_validity_regex': (str,),  # noqa: E501
+        }
+
+    @cached_property
+    def discriminator():
+        return None
+
+
+    attribute_map = {
+        'blockstore_namespace_example': 'blockstore_namespace_example',  # noqa: E501
+        'blockstore_namespace_validity_regex': 'blockstore_namespace_ValidityRegex',  # noqa: E501
+    }
+
+    _composed_schemas = {}
+
+    required_properties = set([
+        '_data_store',
+        '_check_type',
+        '_spec_property_naming',
+        '_path_to_item',
+        '_configuration',
+        '_visited_composed_classes',
+    ])
+
+    @convert_js_args_to_python_args
+    def __init__(self, blockstore_namespace_example, blockstore_namespace_validity_regex, *args, **kwargs):  # noqa: E501
+        """StorageConfig - a model defined in OpenAPI
+
+        Args:
+            blockstore_namespace_example (str):
+            blockstore_namespace_validity_regex (str):
+
+        Keyword Args:
+            _check_type (bool): if True, values for parameters in openapi_types
+                                will be type checked and a TypeError will be
+                                raised if the wrong type is input.
+                                Defaults to True
+            _path_to_item (tuple/list): This is a list of keys or values to
+                                drill down to the model in received_data
+                                when deserializing a response
+            _spec_property_naming (bool): True if the variable names in the input data
+                                are serialized names, as specified in the OpenAPI document.
+                                False if the variable names in the input data
+                                are pythonic names, e.g. snake case (default)
+            _configuration (Configuration): the instance to use when
+                                deserializing a file_type parameter.
+                                If passed, type conversion is attempted
+                                If omitted no type conversion is done.
+            _visited_composed_classes (tuple): This stores a tuple of
+                                classes that we have traveled through so that
+                                if we see that class again we will not use its
+                                discriminator again.
+                                When traveling through a discriminator, the
+                                composed schema that is
+                                is traveled through is added to this set.
+                                For example if Animal has a discriminator
+                                petType and we pass in "Dog", and the class Dog
+                                allOf includes Animal, we move through Animal
+                                once using the discriminator, and pick Dog.
+                                Then in Dog, we will make an instance of the
+                                Animal class but this time we won't travel
+                                through its discriminator because we passed in
+                                _visited_composed_classes = (Animal,)
+        """
+
+        _check_type = kwargs.pop('_check_type', True)
+        _spec_property_naming = kwargs.pop('_spec_property_naming', False)
+        _path_to_item = kwargs.pop('_path_to_item', ())
+        _configuration = kwargs.pop('_configuration', None)
+        _visited_composed_classes = kwargs.pop('_visited_composed_classes', ())
+
+        if args:
+            raise ApiTypeError(
+                "Invalid positional arguments=%s passed to %s. Remove those invalid positional arguments." % (
+                    args,
+                    self.__class__.__name__,
+                ),
+                path_to_item=_path_to_item,
+                valid_classes=(self.__class__,),
+            )
+
+        self._data_store = {}
+        self._check_type = _check_type
+        self._spec_property_naming = _spec_property_naming
+        self._path_to_item = _path_to_item
+        self._configuration = _configuration
+        self._visited_composed_classes = _visited_composed_classes + (self.__class__,)
+
+        self.blockstore_namespace_example = blockstore_namespace_example
+        self.blockstore_namespace_validity_regex = blockstore_namespace_validity_regex
+        for var_name, var_value in kwargs.items():
+            if var_name not in self.attribute_map and \
+                        self._configuration is not None and \
+                        self._configuration.discard_unknown_keys and \
+                        self.additional_properties_type is None:
+                # discard variable.
+                continue
+            setattr(self, var_name, var_value)
diff --git a/clients/python/lakefs_client/models/__init__.py b/clients/python/lakefs_client/models/__init__.py
index d905e515556..31c89feb1b1 100644
--- a/clients/python/lakefs_client/models/__init__.py
+++ b/clients/python/lakefs_client/models/__init__.py
@@ -17,7 +17,6 @@
 from lakefs_client.model.commit import Commit
 from lakefs_client.model.commit_creation import CommitCreation
 from lakefs_client.model.commit_list import CommitList
-from lakefs_client.model.config import Config
 from lakefs_client.model.credentials import Credentials
 from lakefs_client.model.credentials_list import CredentialsList
 from lakefs_client.model.credentials_with_secret import CredentialsWithSecret
@@ -52,6 +51,7 @@
 from lakefs_client.model.staging_location import StagingLocation
 from lakefs_client.model.staging_metadata import StagingMetadata
 from lakefs_client.model.statement import Statement
+from lakefs_client.model.storage_config import StorageConfig
 from lakefs_client.model.storage_uri import StorageURI
 from lakefs_client.model.tag_creation import TagCreation
 from lakefs_client.model.underlying_object_properties import UnderlyingObjectProperties
diff --git a/clients/python/test/test_storage_config.py b/clients/python/test/test_storage_config.py
new file mode 100644
index 00000000000..abc7b3cf043
--- /dev/null
+++ b/clients/python/test/test_storage_config.py
@@ -0,0 +1,36 @@
+"""
+    lakeFS API
+
+    lakeFS HTTP API  # noqa: E501
+
+    The version of the OpenAPI document: 0.1.0
+    Contact: services@treeverse.io
+    Generated by: https://openapi-generator.tech
+"""
+
+
+import sys
+import unittest
+
+import lakefs_client
+from lakefs_client.model.storage_config import StorageConfig
+
+
+class TestStorageConfig(unittest.TestCase):
+    """StorageConfig unit test stubs"""
+
+    def setUp(self):
+        pass
+
+    def tearDown(self):
+        pass
+
+    def testStorageConfig(self):
+        """Test StorageConfig"""
+        # FIXME: construct object with mandatory attributes with example values
+        # model = StorageConfig()  # noqa: E501
+        pass
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/docs/assets/js/swagger.yml b/docs/assets/js/swagger.yml
index 395c4710de0..15f5f62fde2 100644
--- a/docs/assets/js/swagger.yml
+++ b/docs/assets/js/swagger.yml
@@ -35,12 +35,14 @@ components:
       description: return items prefixed with this value
       schema:
         type: string
+
     PaginationAfter:
       in: query
       name: after
       description: return items after this value
       schema:
         type: string
+
     PaginationAmount:
       in: query
       name: amount
@@ -51,6 +53,13 @@ components:
         maximum: 1000
         default: 100
 
+    PaginationDelimiter:
+      in: query
+      name: delimiter
+      description: delimiter used to group common prefixes by
+      schema:
+        type: string
+
   responses:
     Unauthorized:
       description: Unauthorized
@@ -70,6 +79,12 @@ components:
         application/json:
           schema:
             $ref: "#/components/schemas/Error"
+    Conflict:
+      description: Resource Conflicts With Target
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/Error"
     PreconditionFailed:
       description: Precondition Failed
       content:
@@ -236,6 +251,10 @@ components:
         size_bytes:
           type: integer
           format: int64
+        mtime:
+          type: integer
+          format: int64
+          description: Unix Epoch in seconds
         metadata:
           type: object
           additionalProperties:
@@ -286,6 +305,10 @@ components:
         path_type:
           type: string
           enum: [ common_prefix, object ]
+        size_bytes:
+          type: integer
+          description: represents the size of the added/changed/deleted entry
+          format: int64
 
     DiffList:
       type: object
@@ -307,9 +330,7 @@ components:
       properties:
         type:
           type: string
-          enum: [ object, common_prefix, commit, reset ]
-        commit:
-          type: string
+          enum: [ object, common_prefix, reset ]
         path:
           type: string
 
@@ -663,7 +684,7 @@ components:
           items:
             $ref: "#/components/schemas/Policy"
 
-    Config:
+    StorageConfig:
       type: object
       required:
         - blockstore_namespace_example
@@ -1560,6 +1581,8 @@ paths:
           $ref: "#/components/responses/ValidationError"
         401:
           $ref: "#/components/responses/Unauthorized"
+        409:
+          $ref: "#/components/responses/Conflict"
         default:
           $ref: "#/components/responses/ServerError"
 
@@ -1714,6 +1737,8 @@ paths:
           $ref: "#/components/responses/Unauthorized"
         404:
           $ref: "#/components/responses/NotFound"
+        409:
+          $ref: "#/components/responses/Conflict"
         default:
           $ref: "#/components/responses/ServerError"
 
@@ -1815,6 +1840,8 @@ paths:
           $ref: "#/components/responses/Unauthorized"
         404:
           $ref: "#/components/responses/NotFound"
+        409:
+          $ref: "#/components/responses/Conflict"
         default:
           $ref: "#/components/responses/ServerError"
 
@@ -2080,6 +2107,8 @@ paths:
     parameters:
       - $ref: "#/components/parameters/PaginationAfter"
       - $ref: "#/components/parameters/PaginationAmount"
+      - $ref: "#/components/parameters/PaginationPrefix"
+      - $ref: "#/components/parameters/PaginationDelimiter"
       - in: path
         name: repository
         required: true
@@ -2090,6 +2119,7 @@ paths:
         required: true
         schema:
           type: string
+
     get:
       tags:
         - branches
@@ -2130,6 +2160,8 @@ paths:
         description: a reference (could be either a branch or a commit ID) to compare against
       - $ref: "#/components/parameters/PaginationAfter"
       - $ref: "#/components/parameters/PaginationAmount"
+      - $ref: "#/components/parameters/PaginationPrefix"
+      - $ref: "#/components/parameters/PaginationDelimiter"
       - in: query
         name: type
         schema:
@@ -2140,6 +2172,7 @@ paths:
           type: string
           enum: [two_dot, three_dot]
           default: three_dot
+
     get:
       tags:
         - refs
@@ -2518,18 +2551,11 @@ paths:
         schema:
           type: string
         description: a reference (could be either a branch or a commit ID)
-      - in: query
-        name: prefix
-        required: false
-        schema:
-          type: string
       - $ref: "#/components/parameters/PaginationAfter"
       - $ref: "#/components/parameters/PaginationAmount"
-      - in: query
-        name: delimiter
-        schema:
-          type: string
-          default: "/"
+      - $ref: "#/components/parameters/PaginationDelimiter"
+      - $ref: "#/components/parameters/PaginationPrefix"
+
     get:
       tags:
         - objects
@@ -2806,18 +2832,18 @@ paths:
         204:
           description: NoContent
 
-  /config:
+  /config/storage:
     get:
       tags:
         - config
-      operationId: getConfig
-      description: retrieve the lakefs config
+      operationId: getStorageConfig
+      description: retrieve the lakefs storage configuration
       responses:
         200:
-          description: the lakefs config
+          description: the lakefs storage configuration
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/Config"
+                $ref: "#/components/schemas/StorageConfig"
         401:
           $ref: "#/components/responses/Unauthorized"
diff --git a/docs/reference/authorization.md b/docs/reference/authorization.md
index 3697df40f7a..21b3a244bbc 100644
--- a/docs/reference/authorization.md
+++ b/docs/reference/authorization.md
@@ -161,7 +161,7 @@ For the full list of actions and their required permissions see the following ta
 |List Group Policies            |`auth:ReadGroup`        |`arn:lakefs:auth:::group/{groupId}`                                     |GET /auth/groups/{groupId}/policies                                                |-                                                                    |
 |Attach Policy To Group         |`auth:AttachPolicy`     |`arn:lakefs:auth:::group/{groupId}`                                     |PUT /auth/groups/{groupId}/policies/{policyId}                                     |-                                                                    |
 |Detach Policy From Group       |`auth:DetachPolicy`     |`arn:lakefs:auth:::group/{groupId}`                                     |DELETE /auth/groups/{groupId}/policies/{policyId}                                  |-                                                                    |
-|List Config                    |`auth:ReadConfig`       |`*`                                                                     |GET /config                                                                        |-                                                                    |
+|Read Storage Config            |`fs:ReadConfig`         |`*`                                                                     |GET /config/storage                                                                |-                                                                    |
 
 
 ### Preconfigured Policies
diff --git a/docs/reference/commands.md b/docs/reference/commands.md
index 1a8f701449b..cf5b207db2b 100644
--- a/docs/reference/commands.md
+++ b/docs/reference/commands.md
@@ -53,10 +53,13 @@ lakectl is a CLI tool allowing exploration and manipulation of a lakeFS environm
 #### Options
 
 ```
-      --base-uri string   base URI used for lakeFS address parse
-  -c, --config string     config file (default is $HOME/.lakectl.yaml)
-  -h, --help              help for lakectl
-      --no-color          don't use fancy output colors (default when not attached to an interactive terminal)
+      --base-uri string     base URI used for lakeFS address parse
+  -c, --config string       config file (default is $HOME/.lakectl.yaml)
+  -h, --help                help for lakectl
+      --log-format string   set logging output format
+      --log-level string    set logging level (default "none")
+      --log-output string   set logging output file
+      --no-color            don't use fancy output colors (default when not attached to an interactive terminal)
 ```
 
 
@@ -1121,10 +1124,9 @@ reset changes to specified commit, or reset uncommitted changes - all changes, o
 #### Synopsis
 
 reset changes.  There are four different ways to reset changes:
-  1. reset to previous commit, set HEAD of branch to given commit - reset lakefs://myrepo/main --commit commitId
-  2. reset all uncommitted changes - reset lakefs://myrepo/main 
-  3. reset uncommitted changes under specific path -	reset lakefs://myrepo/main --prefix path
-  4. reset uncommitted changes for specific object - reset lakefs://myrepo/main --object path
+  1. reset all uncommitted changes - reset lakefs://myrepo/main 
+  2. reset uncommitted changes under specific path -	reset lakefs://myrepo/main --prefix path
+  3. reset uncommitted changes for specific object - reset lakefs://myrepo/main --object path
 
 ```
 lakectl branch reset <branch uri> [flags]
@@ -1133,7 +1135,6 @@ lakectl branch reset <branch uri> [flags]
 #### Options
 
 ```
-      --commit string   commit ID to reset branch to
   -h, --help            help for reset
       --object string   path to object to be reset
       --prefix string   prefix of the objects to be reset
@@ -1541,11 +1542,12 @@ lakectl ingest --from <object store URI> --to <lakeFS path URI> [--dry-run] [fla
 #### Options
 
 ```
-      --dry-run       only print the paths to be ingested
-      --from string   prefix to read from (e.g. "s3://bucket/sub/path/")
-  -h, --help          help for ingest
-      --to string     lakeFS path to load objects into (e.g. "lakefs://repo/branch/sub/path/")
-  -v, --verbose       print stats for each individual object staged
+  -C, --concurrency int   max concurrent API calls to make to the lakeFS server (default 64)
+      --dry-run           only print the paths to be ingested
+      --from string       prefix to read from (e.g. "s3://bucket/sub/path/")
+  -h, --help              help for ingest
+      --to string         lakeFS path to load objects into (e.g. "lakefs://repo/branch/sub/path/")
+  -v, --verbose           print stats for each individual object staged
 ```
 
 
diff --git a/pkg/api/controller.go b/pkg/api/controller.go
index d4dc3673f06..5db3c14d642 100644
--- a/pkg/api/controller.go
+++ b/pkg/api/controller.go
@@ -1004,17 +1004,17 @@ func (c *Controller) AttachPolicyToUser(w http.ResponseWriter, r *http.Request,
 	writeResponse(w, http.StatusCreated, nil)
 }
 
-func (c *Controller) GetConfig(w http.ResponseWriter, r *http.Request) {
+func (c *Controller) GetStorageConfig(w http.ResponseWriter, r *http.Request) {
 	if !c.authorize(w, r, []permissions.Permission{
 		{
-			Action:   permissions.ReadConfigAction,
+			Action:   permissions.ReadStorageConfiguration,
 			Resource: permissions.All,
 		},
 	}) {
 		return
 	}
 	info := c.BlockAdapter.GetStorageNamespaceInfo()
-	response := Config{
+	response := StorageConfig{
 		BlockstoreNamespaceValidityRegex: info.ValidityRegex,
 		BlockstoreNamespaceExample:       info.Example,
 	}
diff --git a/pkg/api/controller_test.go b/pkg/api/controller_test.go
index 51ba3b7c7b4..cb759403ff1 100644
--- a/pkg/api/controller_test.go
+++ b/pkg/api/controller_test.go
@@ -1284,8 +1284,8 @@ func TestController_ConfigHandlers(t *testing.T) {
 
 	var ExpectedExample = onBlock(deps, "example-bucket/")
 
-	t.Run("Get config (currently only block store type)", func(t *testing.T) {
-		resp, err := clt.GetConfigWithResponse(ctx)
+	t.Run("Get storage config", func(t *testing.T) {
+		resp, err := clt.GetStorageConfigWithResponse(ctx)
 		verifyResponseOK(t, resp, err)
 
 		example := resp.JSON200.BlockstoreNamespaceExample
diff --git a/pkg/ddl/000028_fs_config_policy.down.sql b/pkg/ddl/000028_fs_config_policy.down.sql
new file mode 100644
index 00000000000..818e366ce12
--- /dev/null
+++ b/pkg/ddl/000028_fs_config_policy.down.sql
@@ -0,0 +1,15 @@
+BEGIN;
+
+UPDATE auth_policies
+SET statement = statement - (SELECT ordinality-1 AS index
+                             FROM auth_policies CROSS JOIN jsonb_array_elements(statement) WITH ORDINALITY
+                             WHERE display_name = 'RepoManagementReadAll' AND value = '{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}')::int
+WHERE display_name = 'RepoManagementReadAll' AND statement @> '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb;
+
+UPDATE auth_policies
+SET statement = statement - (SELECT ordinality-1 AS index
+                             FROM auth_policies CROSS JOIN jsonb_array_elements(statement) WITH ORDINALITY
+                             WHERE display_name = 'RepoManagementFullAccess' AND value = '{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}')::int
+WHERE display_name = 'RepoManagementFullAccess' AND statement @> '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb;
+
+COMMIT;
diff --git a/pkg/ddl/000028_fs_config_policy.up.sql b/pkg/ddl/000028_fs_config_policy.up.sql
new file mode 100644
index 00000000000..bac022a1b96
--- /dev/null
+++ b/pkg/ddl/000028_fs_config_policy.up.sql
@@ -0,0 +1,11 @@
+BEGIN;
+
+UPDATE auth_policies
+SET statement = statement || '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb
+WHERE display_name = 'RepoManagementReadAll' AND NOT statement @> '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb;
+
+UPDATE auth_policies
+SET statement = statement || '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb
+WHERE display_name = 'RepoManagementFullAccess' AND NOT statement @> '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb;
+
+COMMIT;
diff --git a/pkg/permissions/actions.go b/pkg/permissions/actions.go
index 0857f3e6007..104208c2690 100644
--- a/pkg/permissions/actions.go
+++ b/pkg/permissions/actions.go
@@ -12,26 +12,27 @@ var (
 )
 
 const (
-	ReadRepositoryAction   = "fs:ReadRepository"
-	CreateRepositoryAction = "fs:CreateRepository"
-	DeleteRepositoryAction = "fs:DeleteRepository"
-	ListRepositoriesAction = "fs:ListRepositories"
-	ReadObjectAction       = "fs:ReadObject"
-	WriteObjectAction      = "fs:WriteObject"
-	DeleteObjectAction     = "fs:DeleteObject"
-	ListObjectsAction      = "fs:ListObjects"
-	CreateCommitAction     = "fs:CreateCommit"
-	ReadCommitAction       = "fs:ReadCommit"
-	ListCommitsAction      = "fs:ListCommits"
-	CreateBranchAction     = "fs:CreateBranch"
-	DeleteBranchAction     = "fs:DeleteBranch"
-	ReadBranchAction       = "fs:ReadBranch"
-	RevertBranchAction     = "fs:RevertBranch"
-	ListBranchesAction     = "fs:ListBranches"
-	CreateTagAction        = "fs:CreateTag"
-	DeleteTagAction        = "fs:DeleteTag"
-	ReadTagAction          = "fs:ReadTag"
-	ListTagsAction         = "fs:ListTags"
+	ReadRepositoryAction     = "fs:ReadRepository"
+	CreateRepositoryAction   = "fs:CreateRepository"
+	DeleteRepositoryAction   = "fs:DeleteRepository"
+	ListRepositoriesAction   = "fs:ListRepositories"
+	ReadObjectAction         = "fs:ReadObject"
+	WriteObjectAction        = "fs:WriteObject"
+	DeleteObjectAction       = "fs:DeleteObject"
+	ListObjectsAction        = "fs:ListObjects"
+	CreateCommitAction       = "fs:CreateCommit"
+	ReadCommitAction         = "fs:ReadCommit"
+	ListCommitsAction        = "fs:ListCommits"
+	CreateBranchAction       = "fs:CreateBranch"
+	DeleteBranchAction       = "fs:DeleteBranch"
+	ReadBranchAction         = "fs:ReadBranch"
+	RevertBranchAction       = "fs:RevertBranch"
+	ListBranchesAction       = "fs:ListBranches"
+	CreateTagAction          = "fs:CreateTag"
+	DeleteTagAction          = "fs:DeleteTag"
+	ReadTagAction            = "fs:ReadTag"
+	ListTagsAction           = "fs:ListTags"
+	ReadStorageConfiguration = "fs:ReadConfig"
 
 	ReadUserAction          = "auth:ReadUser"
 	CreateUserAction        = "auth:CreateUser"
@@ -54,7 +55,6 @@ const (
 	CreateCredentialsAction = "auth:CreateCredentials"
 	DeleteCredentialsAction = "auth:DeleteCredentials"
 	ListCredentialsAction   = "auth:ListCredentials"
-	ReadConfigAction        = "auth:ReadConfig"
 
 	ReadActionsAction = "ci:ReadAction"
 )
diff --git a/webui/src/lib/api/index.js b/webui/src/lib/api/index.js
index 29dcb2f37ed..647a4c132b9 100644
--- a/webui/src/lib/api/index.js
+++ b/webui/src/lib/api/index.js
@@ -67,6 +67,8 @@ const apiRequest = async (uri, requestData = {}, additionalHeaders = {}) => {
         if (errorMessage === authenticationError) {
             cache.delete('user')
             throw new AuthenticationError('Authentication Error');
+        } else {
+            throw new AuthorizationError(errorMessage);
         }
     }
 
@@ -81,6 +83,12 @@ export class NotFoundError extends Error {
     }
 }
 
+export class AuthorizationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AuthorizationError"
+    }
+}
 
 export class AuthenticationError extends Error {
     constructor(message) {
@@ -628,8 +636,8 @@ class Setup {
 }
 
 class Config {
-    async get() {
-        const response = await apiRequest('/config', {
+    async getStorageConfig() {
+        const response = await apiRequest('/config/storage', {
             method: 'GET',
         });
         switch (response.status) {
diff --git a/webui/src/pages/repositories/index.jsx b/webui/src/pages/repositories/index.jsx
index 8cc23b03957..4f4491aa01a 100644
--- a/webui/src/pages/repositories/index.jsx
+++ b/webui/src/pages/repositories/index.jsx
@@ -35,7 +35,7 @@ import RepositoryPage from './repository';
 const CreateRepositoryModal = ({show, error, onSubmit, onCancel}) => {
 
     const { response, error: err, loading } = useAPI(() => {
-        return config.get()
+        return config.getStorageConfig()
     })
 
     const showError = (!!error) ? error : err