diff --git a/src/bundle/Resources/api_platform/examples/user/groups/GET/UserGroupRefList.json.example b/src/bundle/Resources/api_platform/examples/user/groups/GET/UserGroupRefList.json.example
new file mode 100644
index 000000000..1d5808dc1
--- /dev/null
+++ b/src/bundle/Resources/api_platform/examples/user/groups/GET/UserGroupRefList.json.example
@@ -0,0 +1,12 @@
+{
+    "UserGroupRefList": {
+        "_media-type": "application/vnd.ibexa.api.UserGroupRefList+json",
+        "_href": "/api/ibexa/v2/user/users/57/groups",
+        "UserGroup": [
+            {
+                "_media-type": "application/vnd.ibexa.api.UserGroup+json",
+                "_href": "/api/ibexa/v2/user/groups/1/5/13"
+            }
+        ]
+    }
+}
diff --git a/src/bundle/Resources/api_platform/examples/user/groups/GET/UserGroupRefList.xml.example b/src/bundle/Resources/api_platform/examples/user/groups/GET/UserGroupRefList.xml.example
new file mode 100644
index 000000000..ed2ceff01
--- /dev/null
+++ b/src/bundle/Resources/api_platform/examples/user/groups/GET/UserGroupRefList.xml.example
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<UserGroupRefList media-type="application/vnd.ibexa.api.UserGroupRefList+xml" href="/api/ibexa/v2/user/users/115/groups">
+    <UserGroup media-type="application/vnd.ibexa.api.UserGroup+xml" href="/api/ibexa/v2/user/groups/1/5/12">
+        <unassign href="/api/ibexa/v2/user/users/79/groups/12" method="DELETE"/>
+    </UserGroup>
+    <UserGroup media-type="application/vnd.ibexa.api.UserGroup+xml" href="/api/ibexa/v2/user/groups/1/5/13">
+        <unassign href="/api/ibexa/v2/user/users/115/groups/13" method="DELETE"/>
+    </UserGroup>
+</UserGroupRefList>
diff --git a/src/bundle/Resources/api_platform/schemas/user/roles_schemas.yml b/src/bundle/Resources/api_platform/schemas/user/roles_schemas.yml
index cbad71f3a..78fe592b2 100644
--- a/src/bundle/Resources/api_platform/schemas/user/roles_schemas.yml
+++ b/src/bundle/Resources/api_platform/schemas/user/roles_schemas.yml
@@ -136,7 +136,7 @@ schemas:
                 description: A read-only list of IDs or identifiers for which the limitation should be applied. The value of this property must conform to a hash, which means that it may only consist of array and scalar values, but must not contain objects or resources.
                 type: object
                 required:
-                    - $ref
+                    - ref
                 properties:
                     ref:
                         type: array
diff --git a/src/contracts/Security/AuthorizationHeaderRESTRequestMatcher.php b/src/contracts/Security/AuthorizationHeaderRESTRequestMatcher.php
deleted file mode 100644
index e69de29bb..000000000
diff --git a/src/lib/Server/Controller/JWT.php b/src/lib/Server/Controller/JWT.php
index 9ad54d68a..4d76e5bd6 100644
--- a/src/lib/Server/Controller/JWT.php
+++ b/src/lib/Server/Controller/JWT.php
@@ -19,6 +19,7 @@
     uriTemplate: '/user/token/jwt',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.create_token',
         summary: 'Create JWT token',
         description: 'Creates JWT authentication token.',
         tags: [
diff --git a/src/lib/Server/Controller/Session/SessionCheckController.php b/src/lib/Server/Controller/Session/SessionCheckController.php
index 786e9661e..ed04a60b4 100644
--- a/src/lib/Server/Controller/Session/SessionCheckController.php
+++ b/src/lib/Server/Controller/Session/SessionCheckController.php
@@ -17,6 +17,7 @@
 #[Get(
     uriTemplate: '/user/sessions/current',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.check_session',
         summary: 'Get current session',
         description: 'Get current user session, if any.',
         tags: [
@@ -26,38 +27,29 @@
             new Model\Parameter(
                 name: 'Cookie',
                 in: 'header',
-                required: true,
+                required: false,
                 description: 'Only needed for session\'s checking {sessionName}={sessionID}.',
                 schema: [
                     'type' => 'string',
                 ],
             ),
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'If set, the session is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
         ],
         responses: [
             Response::HTTP_OK => [
                 'description' => 'User is currently logged in and has a valid session.',
                 'content' => [
-                    'application/vnd.ibexa.api.Session+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/Session',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.xml.example',
-                    ],
                     'application/vnd.ibexa.api.Session+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/SessionWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/session_id/refresh/POST/Session.json.example',
                     ],
+                    'application/vnd.ibexa.api.Session+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/Session',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_NOT_FOUND => [
diff --git a/src/lib/Server/Controller/Session/SessionCreateController.php b/src/lib/Server/Controller/Session/SessionCreateController.php
index 3ae2ef0be..3d16f3bde 100644
--- a/src/lib/Server/Controller/Session/SessionCreateController.php
+++ b/src/lib/Server/Controller/Session/SessionCreateController.php
@@ -24,34 +24,17 @@
     uriTemplate: '/user/sessions',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.create_session',
         summary: 'Create session (login a User)',
         description: 'Performs a login for the user or checks if session exists and returns the session and session cookie. The client will need to remember both session name/ID and CSRF token as this is for security reasons not exposed via GET.',
         tags: [
             'User Session',
         ],
         parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'If set, the session is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-            new Model\Parameter(
-                name: 'Content-Type',
-                in: 'header',
-                required: true,
-                description: 'The SessionInput schema encoded in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
             new Model\Parameter(
                 name: 'Cookie',
                 in: 'header',
-                required: true,
+                required: false,
                 description: 'Only needed for session\'s checking {sessionName}={sessionID}.',
                 schema: [
                     'type' => 'string',
@@ -60,61 +43,62 @@
             new Model\Parameter(
                 name: 'X-CSRF-Token',
                 in: 'header',
-                required: true,
-                description: 'Only needed for session\'s checking. The {csrfToken} needed on all unsafe HTTP methods with session.',
+                required: false,
+                description: 'Only needed for session\'s checking. The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
             ),
         ],
         requestBody: new Model\RequestBody(
+            description: 'The session input in XML or JSON format.',
             content: new \ArrayObject([
-                'application/vnd.ibexa.api.SessionInput+xml' => [
-                    'schema' => [
-                        '$ref' => '#/components/schemas/SessionInput',
-                    ],
-                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/SessionInput.xml.example',
-                ],
                 'application/vnd.ibexa.api.SessionInput+json' => [
                     'schema' => [
                         '$ref' => '#/components/schemas/SessionInputWrapper',
                     ],
                     'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/SessionInput.json.example',
                 ],
+                'application/vnd.ibexa.api.SessionInput+xml' => [
+                    'schema' => [
+                        '$ref' => '#/components/schemas/SessionInput',
+                    ],
+                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/SessionInput.xml.example',
+                ],
             ]),
         ),
         responses: [
             Response::HTTP_OK => [
                 'description' => 'Session already exists.',
                 'content' => [
-                    'application/vnd.ibexa.api.Session+xml' => [
+                    'application/vnd.ibexa.api.Session+json' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/Session',
+                            '$ref' => '#/components/schemas/SessionWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.json.example',
                     ],
-                    'application/vnd.ibexa.api.Session+json' => [
+                    'application/vnd.ibexa.api.Session+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/SessionWrapper',
+                            '$ref' => '#/components/schemas/Session',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/session_id/refresh/POST/Session.json.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.xml.example',
                     ],
                 ],
             ],
             Response::HTTP_CREATED => [
                 'description' => 'Session is created.',
                 'content' => [
-                    'application/vnd.ibexa.api.Session+xml' => [
+                    'application/vnd.ibexa.api.Session+json' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/Session',
+                            '$ref' => '#/components/schemas/SessionWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.json.example',
                     ],
-                    'application/vnd.ibexa.api.Session+json' => [
+                    'application/vnd.ibexa.api.Session+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/SessionWrapper',
+                            '$ref' => '#/components/schemas/Session',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/session_id/refresh/POST/Session.json.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.xml.example',
                     ],
                 ],
             ],
diff --git a/src/lib/Server/Controller/Session/SessionDeleteController.php b/src/lib/Server/Controller/Session/SessionDeleteController.php
index 4a646e2e0..510de34e4 100644
--- a/src/lib/Server/Controller/Session/SessionDeleteController.php
+++ b/src/lib/Server/Controller/Session/SessionDeleteController.php
@@ -17,6 +17,7 @@
 #[Delete(
     uriTemplate: '/user/sessions/{sessionId}',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.delete_session',
         summary: 'Delete session (logout a User)',
         description: 'The user session is removed i.e. the user is logged out.',
         tags: [
@@ -35,8 +36,8 @@
             new Model\Parameter(
                 name: 'X-CSRF-Token',
                 in: 'header',
-                required: true,
-                description: 'The {csrfToken} needed on all unsafe HTTP methods with session.',
+                required: false,
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
diff --git a/src/lib/Server/Controller/Session/SessionRefreshController.php b/src/lib/Server/Controller/Session/SessionRefreshController.php
index f93bf9b6f..b9d22fc41 100644
--- a/src/lib/Server/Controller/Session/SessionRefreshController.php
+++ b/src/lib/Server/Controller/Session/SessionRefreshController.php
@@ -19,6 +19,7 @@
     uriTemplate: '/user/sessions/{sessionId}/refresh',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.refresh_session',
         summary: 'Refresh session (deprecated)',
         description: 'Get the session\'s User information. Deprecated as of Ibexa DXP 4.6, use GET /user/sessions/current instead.',
         tags: [
@@ -37,16 +38,8 @@
             new Model\Parameter(
                 name: 'X-CSRF-Token',
                 in: 'header',
-                required: true,
-                description: 'The {csrfToken} needed on all unsafe HTTP methods with session.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
+                required: false,
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
@@ -60,30 +53,32 @@
                 ],
             ),
         ],
+        requestBody: new Model\RequestBody(
+            description: 'No payload required',
+            content: new \ArrayObject(),
+        ),
         responses: [
             Response::HTTP_OK => [
+                'description' => 'OK - returns the Session in XML or JSON format.',
                 'content' => [
-                    'application/vnd.ibexa.api.Session+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/Session',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/POST/Session.xml.example',
-                    ],
                     'application/vnd.ibexa.api.Session+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/SessionWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/session_id/refresh/POST/Session.json.example',
                     ],
+                    'application/vnd.ibexa.api.Session+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/Session',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/sessions/session_id/refresh/POST/Session.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_NOT_FOUND => [
                 'description' => 'Error - the session does not exist.',
             ],
         ],
-        requestBody: new Model\RequestBody(
-            content: new \ArrayObject(),
-        ),
     ),
 )]
 /**
diff --git a/src/lib/Server/Controller/SessionController.php b/src/lib/Server/Controller/SessionController.php
deleted file mode 100644
index e69de29bb..000000000
diff --git a/src/lib/Server/Controller/User/UserAssignToUserGroupController.php b/src/lib/Server/Controller/User/UserAssignToUserGroupController.php
index 6e075d157..ca716657f 100644
--- a/src/lib/Server/Controller/User/UserAssignToUserGroupController.php
+++ b/src/lib/Server/Controller/User/UserAssignToUserGroupController.php
@@ -22,6 +22,7 @@
     uriTemplate: '/user/users/{userId}/groups',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.assign_user_to_user_group',
         summary: 'Assign User Group',
         description: 'Assigns the User to a User Group.',
         tags: [
@@ -29,10 +30,10 @@
         ],
         parameters: [
             new Model\Parameter(
-                name: 'Accept',
+                name: 'X-CSRF-Token',
                 in: 'header',
                 required: true,
-                description: 'If set, the link list of User Groups is returned in XML or JSON format.',
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
@@ -46,20 +47,25 @@
                 ],
             ),
         ],
+        requestBody: new Model\RequestBody(
+            description: 'No payload required',
+            content: new \ArrayObject(),
+        ),
         responses: [
             Response::HTTP_OK => [
+                'description' => 'If set, the link list of User Groups is returned in XML or JSON format.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
+                    'application/vnd.ibexa.api.UserGroupRefList+json' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupRefList',
+                            '$ref' => '#/components/schemas/UserGroupRefListWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/POST/UserGroupRefList.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/POST/UserGroupRefList.json.example',
                     ],
-                    'application/vnd.ibexa.api.UserGroupRefList+json' => [
+                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupRefListWrapper',
+                            '$ref' => '#/components/schemas/UserGroupRefList',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/group_id/UserGroupRefList.json.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/POST/UserGroupRefList.xml.example',
                     ],
                 ],
             ],
@@ -73,9 +79,6 @@
                 'description' => 'Error - the User does not exist.',
             ],
         ],
-        requestBody: new Model\RequestBody(
-            content: new \ArrayObject(),
-        ),
     ),
 )]
 final class UserAssignToUserGroupController extends UserBaseController
diff --git a/src/lib/Server/Controller/User/UserCreateController.php b/src/lib/Server/Controller/User/UserCreateController.php
index d2fc144cb..f48f062c9 100644
--- a/src/lib/Server/Controller/User/UserCreateController.php
+++ b/src/lib/Server/Controller/User/UserCreateController.php
@@ -24,6 +24,7 @@
     uriTemplate: '/user/groups/{path}/users',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.create_user',
         summary: 'Create User',
         description: 'Creates a new User in the given Group.',
         tags: [
@@ -31,19 +32,10 @@
         ],
         parameters: [
             new Model\Parameter(
-                name: 'Accept',
+                name: 'X-CSRF-Token',
                 in: 'header',
                 required: true,
-                description: 'If set, the new User is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-            new Model\Parameter(
-                name: 'Content-Type',
-                in: 'header',
-                required: true,
-                description: 'The UserCreate schema encoded in XML or JSON format.',
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
@@ -58,35 +50,37 @@
             ),
         ],
         requestBody: new Model\RequestBody(
+            description: 'The UserCreate schema encoded in XML or JSON format.',
             content: new \ArrayObject([
-                'application/vnd.ibexa.api.UserCreate+xml' => [
-                    'schema' => [
-                        '$ref' => '#/components/schemas/UserCreate',
-                    ],
-                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/users/POST/UserCreate.xml.example',
-                ],
                 'application/vnd.ibexa.api.UserCreate+json' => [
                     'schema' => [
                         '$ref' => '#/components/schemas/UserCreateWrapper',
                     ],
                     'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/users/POST/UserCreate.json.example',
                 ],
+                'application/vnd.ibexa.api.UserCreate+xml' => [
+                    'schema' => [
+                        '$ref' => '#/components/schemas/UserCreate',
+                    ],
+                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/users/POST/UserCreate.xml.example',
+                ],
             ]),
         ),
         responses: [
             Response::HTTP_CREATED => [
+                'description' => 'If set, the new User is returned in XML or JSON format.',
                 'content' => [
-                    'application/vnd.ibexa.api.User+xml' => [
+                    'application/vnd.ibexa.api.User+json' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/User',
+                            '$ref' => '#/components/schemas/UserWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/PATCH/User.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/users/POST/User.json.example',
                     ],
-                    'application/vnd.ibexa.api.User+json' => [
+                    'application/vnd.ibexa.api.User+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserWrapper',
+                            '$ref' => '#/components/schemas/User',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/PATCH/User.json.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/users/POST/User.xml.example',
                     ],
                 ],
             ],
diff --git a/src/lib/Server/Controller/User/UserDeleteController.php b/src/lib/Server/Controller/User/UserDeleteController.php
index 41e87cc70..3ac568ef7 100644
--- a/src/lib/Server/Controller/User/UserDeleteController.php
+++ b/src/lib/Server/Controller/User/UserDeleteController.php
@@ -17,12 +17,22 @@
 #[Delete(
     uriTemplate: '/user/users/{userId}',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.delete_user',
         summary: 'Delete User',
         description: 'Deletes the given User.',
         tags: [
             'User',
         ],
         parameters: [
+            new Model\Parameter(
+                name: 'X-CSRF-Token',
+                in: 'header',
+                required: true,
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
+                schema: [
+                    'type' => 'string',
+                ],
+            ),
             new Model\Parameter(
                 name: 'userId',
                 in: 'path',
diff --git a/src/lib/Server/Controller/User/UserDraftListController.php b/src/lib/Server/Controller/User/UserDraftListController.php
index 8ccc95699..7dfc34162 100644
--- a/src/lib/Server/Controller/User/UserDraftListController.php
+++ b/src/lib/Server/Controller/User/UserDraftListController.php
@@ -21,21 +21,13 @@
     uriTemplate: '/user/users/{userId}/drafts',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_user_drafts',
         summary: 'Load user drafts',
         description: 'Loads user\'s drafts',
         tags: [
             'User',
         ],
         parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'If set, the version list is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
             new Model\Parameter(
                 name: 'userId',
                 in: 'path',
@@ -49,14 +41,14 @@
             Response::HTTP_OK => [
                 'description' => 'OK - List the draft versions',
                 'content' => [
-                    'application/vnd.ibexa.api.VersionList+xml' => [
+                    'application/vnd.ibexa.api.VersionList+json' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/VersionList',
+                            '$ref' => '#/components/schemas/VersionListWrapper',
                         ],
                     ],
-                    'application/vnd.ibexa.api.VersionList+json' => [
+                    'application/vnd.ibexa.api.VersionList+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/VersionListWrapper',
+                            '$ref' => '#/components/schemas/VersionList',
                         ],
                     ],
                 ],
diff --git a/src/lib/Server/Controller/User/UserGroupCreateController.php b/src/lib/Server/Controller/User/UserGroupCreateController.php
index c8b6b8752..9f345cd50 100644
--- a/src/lib/Server/Controller/User/UserGroupCreateController.php
+++ b/src/lib/Server/Controller/User/UserGroupCreateController.php
@@ -21,6 +21,7 @@
     uriTemplate: '/user/groups/subgroups',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.create_root_user_group',
         summary: 'Create a top level User Group',
         description: 'Creates a top level User Group under the root. To create a child group under a parent group use \'/user/groups/{path}/subgroups\'.',
         tags: [
@@ -28,56 +29,48 @@
         ],
         parameters: [
             new Model\Parameter(
-                name: 'Accept',
+                name: 'X-CSRF-Token',
                 in: 'header',
                 required: true,
-                description: 'If set, the new User Group is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-            new Model\Parameter(
-                name: 'Content-Type',
-                in: 'header',
-                required: true,
-                description: 'The UserGroupCreate schema encoded in XML or JSON format.',
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
             ),
         ],
         requestBody: new Model\RequestBody(
+            description: 'The UserGroupCreate schema encoded in XML or JSON format.',
             content: new \ArrayObject([
-                'application/vnd.ibexa.api.UserGroupCreate+xml' => [
-                    'schema' => [
-                        '$ref' => '#/components/schemas/UserGroupCreate',
-                    ],
-                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroupCreate.xml.example',
-                ],
                 'application/vnd.ibexa.api.UserGroupCreate+json' => [
                     'schema' => [
                         '$ref' => '#/components/schemas/UserGroupCreateWrapper',
                     ],
                     'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroupCreate.json.example',
                 ],
+                'application/vnd.ibexa.api.UserGroupCreate+xml' => [
+                    'schema' => [
+                        '$ref' => '#/components/schemas/UserGroupCreate',
+                    ],
+                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroupCreate.xml.example',
+                ],
             ]),
         ),
         responses: [
             Response::HTTP_CREATED => [
                 'description' => 'Created - the User Group has been created',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroup+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserGroup',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.xml.example',
-                    ],
                     'application/vnd.ibexa.api.UserGroup+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserGroupWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.json.example',
                     ],
+                    'application/vnd.ibexa.api.UserGroup+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserGroup',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_BAD_REQUEST => [
@@ -93,6 +86,7 @@
     uriTemplate: '/user/groups/{path}/subgroups',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.create_user_group',
         summary: 'Create User Group',
         description: 'Creates a new User Group under the given parent. To create a top level group use \'/user/groups/subgroups\'.',
         tags: [
@@ -100,19 +94,10 @@
         ],
         parameters: [
             new Model\Parameter(
-                name: 'Accept',
+                name: 'X-CSRF-Token',
                 in: 'header',
                 required: true,
-                description: 'If set, the new User Group is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-            new Model\Parameter(
-                name: 'Content-Type',
-                in: 'header',
-                required: true,
-                description: 'The UserGroupCreate schema encoded in XML or JSON format.',
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
@@ -127,36 +112,38 @@
             ),
         ],
         requestBody: new Model\RequestBody(
+            description: 'The UserGroupCreate schema encoded in XML or JSON format.',
             content: new \ArrayObject([
-                'application/vnd.ibexa.api.UserGroupCreate+xml' => [
-                    'schema' => [
-                        '$ref' => '#/components/schemas/UserGroupCreate',
-                    ],
-                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroupCreate.xml.example',
-                ],
                 'application/vnd.ibexa.api.UserGroupCreate+json' => [
                     'schema' => [
                         '$ref' => '#/components/schemas/UserGroupCreateWrapper',
                     ],
                     'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroupCreate.json.example',
                 ],
+                'application/vnd.ibexa.api.UserGroupCreate+xml' => [
+                    'schema' => [
+                        '$ref' => '#/components/schemas/UserGroupCreate',
+                    ],
+                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroupCreate.xml.example',
+                ],
             ]),
         ),
         responses: [
             Response::HTTP_CREATED => [
+                'description' => 'If set, the new User Group is returned in XML or JSON format.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroup+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserGroup',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.xml.example',
-                    ],
                     'application/vnd.ibexa.api.UserGroup+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserGroupWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.json.example',
                     ],
+                    'application/vnd.ibexa.api.UserGroup+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserGroup',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_BAD_REQUEST => [
diff --git a/src/lib/Server/Controller/User/UserGroupDeleteController.php b/src/lib/Server/Controller/User/UserGroupDeleteController.php
index b0800ae7a..cfc1eccfe 100644
--- a/src/lib/Server/Controller/User/UserGroupDeleteController.php
+++ b/src/lib/Server/Controller/User/UserGroupDeleteController.php
@@ -19,12 +19,22 @@
     uriTemplate: '/user/groups/{path}',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.delete_user_group',
         summary: 'Delete User Group',
         description: 'The given User Group is deleted.',
         tags: [
             'User Group',
         ],
         parameters: [
+            new Model\Parameter(
+                name: 'X-CSRF-Token',
+                in: 'header',
+                required: true,
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
+                schema: [
+                    'type' => 'string',
+                ],
+            ),
             new Model\Parameter(
                 name: 'path',
                 in: 'path',
diff --git a/src/lib/Server/Controller/User/UserGroupListController.php b/src/lib/Server/Controller/User/UserGroupListController.php
index f31376483..90086c5c4 100644
--- a/src/lib/Server/Controller/User/UserGroupListController.php
+++ b/src/lib/Server/Controller/User/UserGroupListController.php
@@ -23,48 +23,39 @@
     uriTemplate: '/user/groups',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_user_groups',
         summary: 'Load User Groups',
         description: 'Loads User Groups for either an an ID or a remote ID or a Role.',
         tags: [
             'User Group',
         ],
-        parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'UserGroupList - If set, the User Group List is returned in XML or JSON format. UserGroupRefList - If set, the link list of User Group is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-        ],
         responses: [
             Response::HTTP_OK => [
+                'description' => 'UserGroupList - If set, the User Group List is returned in XML or JSON format. UserGroupRefList - If set, the link list of User Group is returned in XML or JSON format.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroupList+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupList',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/GET/UserGroupList.xml.example',
-                    ],
                     'application/vnd.ibexa.api.UserGroupList+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserGroupListWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/GET/UserGroupList.json.example',
                     ],
-                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
+                    'application/vnd.ibexa.api.UserGroupList+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupRefList',
+                            '$ref' => '#/components/schemas/UserGroupList',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/POST/UserGroupRefList.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/GET/UserGroupList.xml.example',
                     ],
                     'application/vnd.ibexa.api.UserGroupRefList+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserGroupRefListWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/group_id/UserGroupRefList.json.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/GET/UserGroupRefList.json.example',
+                    ],
+                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserGroupRefList',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/GET/UserGroupRefList.xml.example',
                     ],
                 ],
             ],
diff --git a/src/lib/Server/Controller/User/UserGroupLoadByPathController.php b/src/lib/Server/Controller/User/UserGroupLoadByPathController.php
index a46b13595..6cb7a50d4 100644
--- a/src/lib/Server/Controller/User/UserGroupLoadByPathController.php
+++ b/src/lib/Server/Controller/User/UserGroupLoadByPathController.php
@@ -19,25 +19,17 @@
 #[Get(
     uriTemplate: '/user/groups/{path}',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_user_group',
         summary: 'Load User Group',
         description: 'Loads User Groups for the given {path}.',
         tags: [
             'User Group',
         ],
         parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'If set, the new User Group is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
             new Model\Parameter(
                 name: 'If-None-Match',
                 in: 'header',
-                required: true,
+                required: false,
                 description: 'ETag',
                 schema: [
                     'type' => 'string',
@@ -56,17 +48,17 @@
             Response::HTTP_OK => [
                 'description' => 'OK - loads User Groups.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroup+xml' => [
+                    'application/vnd.ibexa.api.UserGroup+json' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserGroup',
+                            '$ref' => '#/components/schemas/UserGroupWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/GET/UserGroup.json.example',
                     ],
-                    'application/vnd.ibexa.api.UserGroup+json' => [
+                    'application/vnd.ibexa.api.UserGroup+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupWrapper',
+                            '$ref' => '#/components/schemas/UserGroup',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.json.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/GET/UserGroup.xml.example',
                     ],
                 ],
             ],
diff --git a/src/lib/Server/Controller/User/UserGroupOfRootLoadController.php b/src/lib/Server/Controller/User/UserGroupOfRootLoadController.php
index de115c55c..4adcca257 100644
--- a/src/lib/Server/Controller/User/UserGroupOfRootLoadController.php
+++ b/src/lib/Server/Controller/User/UserGroupOfRootLoadController.php
@@ -18,13 +18,12 @@
     uriTemplate: '/user/groups/root',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_root_user_group',
         summary: 'Get root User Group',
         description: 'Redirects to the root User Group.',
         tags: [
             'User Group',
         ],
-        parameters: [
-        ],
         responses: [
             Response::HTTP_MOVED_PERMANENTLY => [
                 'description' => 'Moved permanently.',
diff --git a/src/lib/Server/Controller/User/UserGroupUpdateController.php b/src/lib/Server/Controller/User/UserGroupUpdateController.php
index 378eb05ee..4cd20154d 100644
--- a/src/lib/Server/Controller/User/UserGroupUpdateController.php
+++ b/src/lib/Server/Controller/User/UserGroupUpdateController.php
@@ -20,6 +20,7 @@
     uriTemplate: '/user/groups/{path}',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.update_user_group',
         summary: 'Update User Group',
         description: 'Updates a User Group. PATCH or POST with header X-HTTP-Method-Override PATCH.',
         tags: [
@@ -27,19 +28,10 @@
         ],
         parameters: [
             new Model\Parameter(
-                name: 'Accept',
+                name: 'X-CSRF-Token',
                 in: 'header',
                 required: true,
-                description: 'If set, the new User Group is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-            new Model\Parameter(
-                name: 'Content-Type',
-                in: 'header',
-                required: true,
-                description: 'The UserGroupUpdate schema encoded in XML or JSON format.',
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
@@ -63,36 +55,37 @@
             ),
         ],
         requestBody: new Model\RequestBody(
+            description: 'The UserGroupUpdate schema encoded in XML or JSON format.',
             content: new \ArrayObject([
-                'application/vnd.ibexa.api.UserGroupUpdate+xml' => [
-                    'schema' => [
-                        '$ref' => '#/components/schemas/UserGroupUpdate',
-                    ],
-                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/PATCH/UserGroupUpdate.xml.example',
-                ],
                 'application/vnd.ibexa.api.UserGroupUpdate+json' => [
                     'schema' => [
                         '$ref' => '#/components/schemas/UserGroupUpdateWrapper',
                     ],
                     'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/PATCH/UserGroupUpdate.json.example',
                 ],
+                'application/vnd.ibexa.api.UserGroupUpdate+xml' => [
+                    'schema' => [
+                        '$ref' => '#/components/schemas/UserGroupUpdate',
+                    ],
+                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/PATCH/UserGroupUpdate.xml.example',
+                ],
             ]),
         ),
         responses: [
             Response::HTTP_OK => [
                 'description' => 'OK - updated User Group.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroup+xml' => [
+                    'application/vnd.ibexa.api.UserGroup+json' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserGroup',
+                            '$ref' => '#/components/schemas/UserGroupWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/PATCH/UserGroup.json.example',
                     ],
-                    'application/vnd.ibexa.api.UserGroup+json' => [
+                    'application/vnd.ibexa.api.UserGroup+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupWrapper',
+                            '$ref' => '#/components/schemas/UserGroup',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/subgroups/POST/UserGroup.json.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/path/PATCH/UserGroup.xml.example',
                     ],
                 ],
             ],
diff --git a/src/lib/Server/Controller/User/UserGroupUsersListController.php b/src/lib/Server/Controller/User/UserGroupUsersListController.php
index 59a84b123..a110e3265 100644
--- a/src/lib/Server/Controller/User/UserGroupUsersListController.php
+++ b/src/lib/Server/Controller/User/UserGroupUsersListController.php
@@ -20,21 +20,13 @@
 #[Get(
     uriTemplate: '/user/groups/{path}/users',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_users_from_group',
         summary: 'Load Users of Group',
         description: 'Loads the Users of the Group with the given ID.',
         tags: [
             'User Group',
         ],
         parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'UserList - If set, the User list returned in XML or JSON format. UserRefList - If set, the link list of Users returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
             new Model\Parameter(
                 name: 'path',
                 in: 'path',
@@ -48,21 +40,15 @@
             Response::HTTP_OK => [
                 'description' => 'OK - the Users of the Group with the given ID.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserList+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserList',
-                        ],
-                    ],
                     'application/vnd.ibexa.api.UserList+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserList',
                         ],
                     ],
-                    'application/vnd.ibexa.api.UserRefList+xml' => [
+                    'application/vnd.ibexa.api.UserList+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserRefList',
+                            '$ref' => '#/components/schemas/UserList',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/GET/UserRefList.xml.example',
                     ],
                     'application/vnd.ibexa.api.UserRefList+json' => [
                         'schema' => [
@@ -70,6 +56,12 @@
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/id/users/GET/UserRefList.json.example',
                     ],
+                    'application/vnd.ibexa.api.UserRefList+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserRefList',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/id/users/GET/UserRefList.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_UNAUTHORIZED => [
diff --git a/src/lib/Server/Controller/User/UserGroupsOfUserListController.php b/src/lib/Server/Controller/User/UserGroupsOfUserListController.php
index 66dc5112d..347f8ed59 100644
--- a/src/lib/Server/Controller/User/UserGroupsOfUserListController.php
+++ b/src/lib/Server/Controller/User/UserGroupsOfUserListController.php
@@ -20,21 +20,13 @@
 #[Get(
     uriTemplate: '/user/users/{userId}/groups',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_user_groups_of_user',
         summary: 'Load Groups of User',
         description: 'Returns a list of User Groups the User belongs to. The returned list includes the resources for unassigning a User Group if the User is in multiple groups.',
         tags: [
             'User',
         ],
         parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'If set, the link list of User Groups is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
             new Model\Parameter(
                 name: 'userId',
                 in: 'path',
@@ -46,19 +38,20 @@
         ],
         responses: [
             Response::HTTP_OK => [
+                'description' => 'If set, the link list of User Groups is returned in XML or JSON format.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupRefList',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/POST/UserGroupRefList.xml.example',
-                    ],
                     'application/vnd.ibexa.api.UserGroupRefList+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserGroupRefListWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/group_id/UserGroupRefList.json.example',
                     ],
+                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserGroupRefList',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/GET/UserGroupRefList.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_UNAUTHORIZED => [
diff --git a/src/lib/Server/Controller/User/UserListController.php b/src/lib/Server/Controller/User/UserListController.php
index c926568ab..2e1ec4c4e 100644
--- a/src/lib/Server/Controller/User/UserListController.php
+++ b/src/lib/Server/Controller/User/UserListController.php
@@ -15,37 +15,32 @@
 #[Get(
     uriTemplate: '/user/users',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_users',
         summary: 'List Users',
         description: 'Load Users either for a given remote ID or Role.',
         tags: [
             'User',
         ],
-        parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'UserList - If set, the User list is returned in XML or JSON format. UserRefList - If set, the link list of Users is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-        ],
         responses: [
             Response::HTTP_OK => [
                 'description' => 'OK - Loads Users either for a given remote ID or Role.',
                 'content' => [
+                    'application/vnd.ibexa.api.UserList+json' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserListWrapper',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/GET/UserList.json.example',
+                    ],
                     'application/vnd.ibexa.api.UserList+xml' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserList',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/GET/User.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/GET/UserList.xml.example',
                     ],
-                    'application/vnd.ibexa.api.UserList+json' => [
+                    'application/vnd.ibexa.api.UserRefList+json' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserListWrapper',
+                            '$ref' => '#/components/schemas/UserRefListWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/GET/User.json.example',
                     ],
                     'application/vnd.ibexa.api.UserRefList+xml' => [
                         'schema' => [
@@ -53,11 +48,6 @@
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/GET/UserRefList.xml.example',
                     ],
-                    'application/vnd.ibexa.api.UserRefList+json' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserRefListWrapper',
-                        ],
-                    ],
                 ],
             ],
             Response::HTTP_NOT_FOUND => [
diff --git a/src/lib/Server/Controller/User/UserLoadByIdController.php b/src/lib/Server/Controller/User/UserLoadByIdController.php
index 3b07f02a1..de5b4c53a 100644
--- a/src/lib/Server/Controller/User/UserLoadByIdController.php
+++ b/src/lib/Server/Controller/User/UserLoadByIdController.php
@@ -20,25 +20,17 @@
 #[Get(
     uriTemplate: '/user/users/{userId}',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_user',
         summary: 'Load User',
         description: 'Loads User with the given ID.',
         tags: [
             'User',
         ],
         parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'If set, the User is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
             new Model\Parameter(
                 name: 'If-None-Match',
                 in: 'header',
-                required: true,
+                required: false,
                 description: 'ETag',
                 schema: [
                     'type' => 'string',
@@ -57,18 +49,18 @@
             Response::HTTP_OK => [
                 'description' => 'OK - the User with the given ID.',
                 'content' => [
-                    'application/vnd.ibexa.api.User+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserList',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/GET/User.xml.example',
-                    ],
                     'application/vnd.ibexa.api.User+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserListWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/GET/User.json.example',
                     ],
+                    'application/vnd.ibexa.api.User+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserList',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/GET/User.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_UNAUTHORIZED => [
diff --git a/src/lib/Server/Controller/User/UserRedirectToCurrentUserController.php b/src/lib/Server/Controller/User/UserRedirectToCurrentUserController.php
index 893ee44c8..83acec668 100644
--- a/src/lib/Server/Controller/User/UserRedirectToCurrentUserController.php
+++ b/src/lib/Server/Controller/User/UserRedirectToCurrentUserController.php
@@ -20,38 +20,28 @@
     uriTemplate: '/user/current',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.current_user',
         summary: 'Load current User',
         description: 'Loads the current user.',
         tags: [
             'User',
         ],
-        parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'If set, the User is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-        ],
         responses: [
             Response::HTTP_OK => [
                 'description' => 'OK - the User with the given ID.',
                 'content' => [
-                    'application/vnd.ibexa.api.User+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserList',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/GET/User.xml.example',
-                    ],
                     'application/vnd.ibexa.api.User+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserListWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/GET/User.json.example',
                     ],
+                    'application/vnd.ibexa.api.User+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserList',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/GET/User.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_UNAUTHORIZED => [
diff --git a/src/lib/Server/Controller/User/UserSubGroupListController.php b/src/lib/Server/Controller/User/UserSubGroupListController.php
index d8c9b1275..4bbcc2046 100644
--- a/src/lib/Server/Controller/User/UserSubGroupListController.php
+++ b/src/lib/Server/Controller/User/UserSubGroupListController.php
@@ -20,21 +20,13 @@
 #[Get(
     uriTemplate: '/user/groups/{path}/subgroups',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.load_sub_user_groups',
         summary: 'Load subgroups',
         description: 'Returns a list of the subgroups.',
         tags: [
             'User Group',
         ],
         parameters: [
-            new Model\Parameter(
-                name: 'Accept',
-                in: 'header',
-                required: true,
-                description: 'UserGroupList - If set, the User Group list is returned in XML or JSON format. UserGroupRefList - If set, the link list of User Groups is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
             new Model\Parameter(
                 name: 'path',
                 in: 'path',
@@ -48,29 +40,29 @@
             Response::HTTP_OK => [
                 'description' => 'OK - list of the subgroups.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroupList+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupList',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/GET/UserGroupList.xml.example',
-                    ],
                     'application/vnd.ibexa.api.UserGroupList+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserGroupListWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/GET/UserGroupList.json.example',
                     ],
-                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
+                    'application/vnd.ibexa.api.UserGroupList+xml' => [
                         'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupRefList',
+                            '$ref' => '#/components/schemas/UserGroupList',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/POST/UserGroupRefList.xml.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/GET/UserGroupList.xml.example',
                     ],
                     'application/vnd.ibexa.api.UserGroupRefList+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserGroupRefListWrapper',
                         ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/group_id/UserGroupRefList.json.example',
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/id/subgroups/GET/UserGroupRefList.json.example',
+                    ],
+                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserGroupRefList',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/groups/id/subgroups/GET/UserGroupRefList.xml.example',
                     ],
                 ],
             ],
diff --git a/src/lib/Server/Controller/User/UserUnassignFromUserGroupController.php b/src/lib/Server/Controller/User/UserUnassignFromUserGroupController.php
index 330a49850..705f0b154 100644
--- a/src/lib/Server/Controller/User/UserUnassignFromUserGroupController.php
+++ b/src/lib/Server/Controller/User/UserUnassignFromUserGroupController.php
@@ -19,6 +19,7 @@
 #[Delete(
     uriTemplate: '/user/users/{userId}/groups/{groupId}',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.unassign_user_from_user_group',
         summary: 'Unassign User Group',
         description: 'Unassigns the User from a User Group.',
         tags: [
@@ -26,10 +27,10 @@
         ],
         parameters: [
             new Model\Parameter(
-                name: 'Accept',
+                name: 'X-CSRF-Token',
                 in: 'header',
                 required: true,
-                description: 'If set, the link list of User Groups is returned in XML or JSON format.',
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
@@ -53,19 +54,20 @@
         ],
         responses: [
             Response::HTTP_OK => [
+                'description' => 'If set, the link list of User Groups is returned in XML or JSON format.',
                 'content' => [
-                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/UserGroupRefList',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/POST/UserGroupRefList.xml.example',
-                    ],
                     'application/vnd.ibexa.api.UserGroupRefList+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserGroupRefListWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/group_id/UserGroupRefList.json.example',
                     ],
+                    'application/vnd.ibexa.api.UserGroupRefList+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/UserGroupRefList',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/groups/group_id/DELETE/UserGroupRefList.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_UNAUTHORIZED => [
diff --git a/src/lib/Server/Controller/User/UserUpdateController.php b/src/lib/Server/Controller/User/UserUpdateController.php
index 80941b7d6..d38bac4d0 100644
--- a/src/lib/Server/Controller/User/UserUpdateController.php
+++ b/src/lib/Server/Controller/User/UserUpdateController.php
@@ -21,6 +21,7 @@
     uriTemplate: '/user/users/{userId}',
     extraProperties: [OpenApiFactory::OVERRIDE_OPENAPI_RESPONSES => false],
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.update_user',
         summary: 'Update User',
         description: 'Updates a User.',
         tags: [
@@ -28,19 +29,10 @@
         ],
         parameters: [
             new Model\Parameter(
-                name: 'Accept',
+                name: 'X-CSRF-Token',
                 in: 'header',
                 required: true,
-                description: 'If set, the updated User is returned in XML or JSON format.',
-                schema: [
-                    'type' => 'string',
-                ],
-            ),
-            new Model\Parameter(
-                name: 'Content-Type',
-                in: 'header',
-                required: true,
-                description: 'The UserUpdate schema encoded in XML or JSON format.',
+                description: 'The CSRF Token needed on all unsafe HTTP methods with session.',
                 schema: [
                     'type' => 'string',
                 ],
@@ -64,37 +56,38 @@
             ),
         ],
         requestBody: new Model\RequestBody(
+            description: 'The UserUpdate schema encoded in XML or JSON format.',
             content: new \ArrayObject([
-                'application/vnd.ibexa.api.UserUpdate+xml' => [
-                    'schema' => [
-                        '$ref' => '#/components/schemas/UserUpdate',
-                    ],
-                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/PATCH/UserUpdate.xml.example',
-                ],
                 'application/vnd.ibexa.api.UserUpdate+json' => [
                     'schema' => [
                         '$ref' => '#/components/schemas/UserUpdateWrapper',
                     ],
                     'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/PATCH/UserUpdate.json.example',
                 ],
+                'application/vnd.ibexa.api.UserUpdate+xml' => [
+                    'schema' => [
+                        '$ref' => '#/components/schemas/UserUpdate',
+                    ],
+                    'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/PATCH/UserUpdate.xml.example',
+                ],
             ]),
         ),
         responses: [
             Response::HTTP_OK => [
                 'description' => 'OK - User updated.',
                 'content' => [
-                    'application/vnd.ibexa.api.User+xml' => [
-                        'schema' => [
-                            '$ref' => '#/components/schemas/User',
-                        ],
-                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/PATCH/User.xml.example',
-                    ],
                     'application/vnd.ibexa.api.User+json' => [
                         'schema' => [
                             '$ref' => '#/components/schemas/UserWrapper',
                         ],
                         'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/PATCH/User.json.example',
                     ],
+                    'application/vnd.ibexa.api.User+xml' => [
+                        'schema' => [
+                            '$ref' => '#/components/schemas/User',
+                        ],
+                        'x-ibexa-example-file' => '@IbexaRestBundle/Resources/api_platform/examples/user/users/user_id/PATCH/User.xml.example',
+                    ],
                 ],
             ],
             Response::HTTP_BAD_REQUEST => [
diff --git a/src/lib/Server/Controller/User/UserVerifyController.php b/src/lib/Server/Controller/User/UserVerifyController.php
index 1ef4c8637..e9b913861 100644
--- a/src/lib/Server/Controller/User/UserVerifyController.php
+++ b/src/lib/Server/Controller/User/UserVerifyController.php
@@ -18,13 +18,12 @@
 #[Head(
     uriTemplate: '/user/users',
     openapi: new Model\Operation(
+        operationId: 'ibexa.rest.verify_users',
         summary: 'Verify Users',
         description: 'Verifies if there are Users matching given filter.',
         tags: [
             'User',
         ],
-        parameters: [
-        ],
         responses: [
             Response::HTTP_OK => [
                 'description' => 'OK - verifies if there are Users matching the given filter.',
diff --git a/src/lib/Server/Security/RestAuthenticator.php b/src/lib/Server/Security/RestAuthenticator.php
deleted file mode 100644
index e69de29bb..000000000