Merge branch 'main' into v17/feature/hook-api

pull_request events from forks cannot access OIDC tokens, causing the
job to fail. pull_request_target runs in the base repo context and has
access to secrets/OIDC while still reading the PR diff via the API.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/settings.json

@@ -1,35 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(dir:*)",
-      "Bash(do)",
-      "Bash(done)",
-      "Bash(echo:*)",
-      "Bash(find:*)",
-      "Bash(for:*)",
-      "Bash(gh pr diff:*)",
-      "Bash(gh pr view:*)",
-      "Bash(git log:*)",
-      "Bash(grep:*)",
-      "Bash(npm run build:*)",
-      "Bash(npm run check:*)",
-      "Bash(npm run compile:*)",
-      "Bash(npm run lint:*)",
-      "Bash(npm run:*)",
-      "Bash(npx eslint:*)",
-      "Bash(npx tsc:*)",
-      "Bash(tree:*)",
-      "Bash(gh issue view:*)",
-      "Bash(npm test:*)",
-      "mcp__umbraco__create*",
-      "mcp__umbraco__get*",
-      "mcp__playwright__browser_click",
-      "mcp__playwright__browser_type",
-      "mcp__playwright__browser_wait_for"
-    ]
-  },
-  "enableAllProjectMcpServers": true,
-  "enabledMcpjsonServers": [
-    "umbraco-cms"
-  ]
-}

.claude/skills/umb-review/SKILL.md

@@ -0,0 +1,251 @@
+---
+name: umb-review
+description: Automated PR code review for Umbraco CMS. Analyzes changed files for intent, impact on consumers, breaking changes, architecture compliance, and code quality. Non-interactive — outputs a full structured review. Use this skill whenever the user asks to review a branch, review a PR, check their changes for issues, analyze a diff, or validate breaking change patterns — even if they don't say "review" explicitly. Does NOT apply to writing new code, fixing bugs, refactoring, explaining architecture, writing tests, or reviewing documentation content.
+argument-hint: <target-branch>
+---
+
+# PR Review - Umbraco CMS
+
+Automated, non-interactive PR code review. Analyzes changed files for intent, impact on consumers, breaking changes, architecture compliance, and code quality.
+
+**Do NOT use AskUserQuestion at any point. This skill runs fully autonomously.**
+
+## Arguments
+
+- `$ARGUMENTS` - Optional: target branch to diff against (auto-detected from PR, falls back to `origin/main`)
+
+## Instructions
+
+### 0. Verify GH CLI is Available
+
+Run `gh auth status`. If it fails, read `references/gh-cli-setup.md` and present the setup instructions to the user. Do not proceed with the review.
+
+### 1. Resolve Target Branch
+
+Determine the target branch for comparison using this priority order:
+
+1. **Explicit argument**: If `$ARGUMENTS` is provided and non-empty, use it as the target branch
+2. **PR target branch**: If no argument, run `gh pr view --json baseRefName --jq '.baseRefName'` to detect the target branch of the current branch's open PR. If a PR exists, use `origin/{baseRefName}` as the target branch.
+3. **Fallback**: If no argument and no PR found (command fails or returns empty), default to `origin/main`
+
+Store the resolved target branch for use in subsequent steps. Log which resolution method was used (e.g., "Target branch: `origin/v18/dev` (from PR #1234)").
+
+### 2. Load Review Standards
+
+#### 2a. Load coding preferences
+
+Read the coding preferences and code review scoring criteria from:
+
+- `references/coding-preferences.md` (relative to this skill file)
+
+Parse and internalize all rules, conventions, scoring categories, and severity definitions. These are your review criteria.
+
+#### 2b. Load area-specific documentation
+
+Once the changed file list is known (after step 3a), determine which areas of the codebase are touched and load the relevant documentation. Execute this sub-step between 3a and 3b. This documentation takes precedence over sibling comparison for architectural and pattern validation.
+
+**Resolution order for each changed file:**
+
+1. **Find the nearest `CLAUDE.md`** — walk up from the changed file's directory toward the repository root. The first `CLAUDE.md` found is the area guide for that file. Read it.
+2. **Read referenced docs** — if the `CLAUDE.md` references documentation files (e.g., a `docs/` directory), use the descriptions in the `CLAUDE.md` to determine which docs are relevant to the type of code being changed, and read those. If unsure, read all referenced docs — the cost of reading is low, the cost of missing a convention is high.
+3. **Follow cross-references in loaded docs** — if a loaded doc references another doc as covering a complementary or related concern, and the changed files touch that concern, read the referenced doc too. Repeat until no new relevant cross-references remain.
+4. **Check for applicable skills** — review the available skills list. If a skill exists for the type of code being changed, read the skill file to understand the expected patterns, structure, and conventions it enforces. Do NOT invoke the skill — just use it as a reference for what the correct implementation should look like.
+
+**Store all loaded documentation** for use in step 4. These docs define the authoritative patterns and conventions that the review evaluates against.
+
+### 3. Gather Changed Files
+
+#### 3a. Collect file list, stats, and diff
+
+Run these git commands (where `{target}` is the resolved target branch):
+
+```bash
+git diff {target}...HEAD --name-only --diff-filter=d   # changed files (excluding deleted)
+git diff {target}...HEAD --stat                         # line counts per file
+git log {target}...HEAD --oneline                       # commit history
+git diff {target}...HEAD                                # full diff (primary review source)
+```
+
+**If no changes found**: Output "No changes found between current branch and `{target}`. Nothing to review." and stop.
+
+#### 3b. Filter out noise files
+
+From the changed file list, classify each file as **noise** or **reviewable**.
+
+**Noise files** (skip entirely — do not read, do not review):
+
+| Pattern                                              | Reason                          |
+| ---------------------------------------------------- | ------------------------------- |
+| `*.gen.ts`, `*.gen.cs`                               | Auto-generated API client code  |
+| `*.generated.cs`, `*.Designer.cs` (in `Migrations/`) | Auto-generated models/snapshots |
+| `*/assets/lang/*.ts` (except `en.ts`)                | Non-English translation files   |
+| `*/mocks/data/*.ts`                                  | Test fixture data               |
+| `*/dist-cms/*`, `*/storybook-static/*`               | Build output                    |
+| `*/TEMP/InMemoryAuto/*`                              | Runtime-generated models        |
+| `package-lock.json`                                  | Dependency lock file            |
+| `appsettings-schema.*.json`                          | Generated JSON schema           |
+
+Log the skip list: "Skipped {N} noise files: {comma-separated list of filenames}"
+
+#### 3c. Read reviewable changed files
+
+Read the full file for every reviewable changed file.
+
+#### 3d. Track file counts
+
+Keep track of these numbers for the review output in step 7: total changed files, noise files skipped, and reviewable files read. Also record: distinct production layers touched, distinct project directories, and total lines changed — these feed step 3e.
+
+#### 3e. Assess PR complexity
+
+Follow the procedure in `references/complexity-assessment.md`. Store the triggered dimensions and suggestions for step 7.
+
+#### 3f. Classify PR scope
+
+Classify the PR to determine which review steps are relevant:
+
+| Classification  | Condition                                                                       | Effect                                                                          |
+| --------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
+| **Gen-only**    | All reviewable files are `gen.ts`                                               | Skip steps 5 and 6; step 4 reviews impact on other code only                    |
+| **Docs-only**   | All reviewable files are `.md`                                                  | Skip steps 5 and 6; step 4 reviews intent and readability only                  |
+| **Test-only**   | All reviewable files are in `tests/`                                            | Skip steps 5 and 6; step 4 reviews intent, code quality, and test coverage only |
+| **Config-only** | All reviewable files are `.csproj`, `.props`, `.json` config, or CI/build files | Skip step 5; step 6 checks dependency version changes only                      |
+| **Standard**    | Anything else                                                                   | No skips — run all steps                                                        |
+
+### 4. Raw Code Review
+
+Review each changed file holistically. Think like a senior developer reading a colleague's PR. Note all findings without worrying about format or severity yet.
+
+#### 4a. Read and reason about each file
+
+For each changed file, reason about: What does this code do? Is it correct? What's missing — validation, error handling, notifications, cleanup, edge cases? Could this break anything for consumers?
+
+#### 4b. Validate against documentation and patterns
+
+Use a **docs-first** approach: classify the code by what it does, check it against documented conventions, and only fall back to sibling comparison when docs don't cover the pattern.
+
+**Step 1 — Determine the correct approach from documentation, then check whether the PR matches**
+
+A PR is a proposed solution, not the source of truth. This step has two parts that must happen in order — do not start part B until part A is complete.
+
+**Part A — Before validating/judging the implementation**, determine what the correct approach is for each new class or file based on what it does. Use the documentation loaded in step 2b to identify the expected base classes, patterns, and conventions. Write down the expected approach. Classify based on what the code does, not based on what neighboring files look like.
+
+**Part B — Now compare the PR's implementation** against the expected approach from Part A. If it deviates from the documented approach, flag it. If the documentation specifies reference examples, read those examples to verify the implementation matches.
+
+**Pattern match is the leading finding.** If the documentation defines a pattern that fits what the code does, the first and most important finding is whether the code follows that pattern.
+
+**Step 2 — Fall back to sibling comparison**
+
+If the documentation does not cover the specific pattern, or for cross-cutting concerns not addressed in docs, fall back to sibling comparison:
+
+1. **New method on existing class/interface**: Grep for the most similar existing method on the same class using `-A 80` to capture the full method body (e.g., `UpdateCurrentUserAsync` → grep for `UpdateAsync` in the same file with `-A 80`). Compare line by line for missing cross-cutting concerns: notifications/events, validation, scoping, authorization, error handling, audit logging.
+2. **New TS class**: Grep for siblings by base class (`extends {BaseClass}`) or by interface (`implements {Interface}`) or by name suffix (e.g., `CurrentUserController` → grep for `UserController`). Compare for missing concerns.
+3. **New CS class**: Grep for siblings by base class (`class {ClassName} : {BaseClass}`) or by interface (`class {ClassName} : {Interface}`) or by name suffix (e.g., `ManagementApiComposer` → grep for `ApiComposer`). Compare for missing concerns.
+
+**Important:** Sibling comparison validates cross-cutting concerns, but it must not override documented conventions. If a sibling deviates from documented patterns, that sibling is wrong — do not copy its deviation.
+
+Store your raw findings — they feed into step 7.
+
+### 5. Impact Analysis
+
+**Skip this step if PR scope is docs-only, test-only, or config-only.**
+
+Follow the procedure in `references/impact-analysis.md`.
+
+### 6. Breaking Changes Check
+
+**Skip this step if PR scope is docs-only or test-only. If config-only, only check for dependency version changes that could break consumers.**
+
+Follow the procedure in `references/breaking-changes.md`.
+
+### 7. Consolidate and Output Review
+
+Merge findings from step 4 (raw review), step 5 (impact analysis), and step 6 (breaking changes). For each finding, assign severity (Critical/Important/Suggestion) and verify it relates to changed code — not pre-existing issues. Before outputting, drop any finding about whitespace, blank lines, formatting, or comment wording. Then present the review in this exact format:
+
+```markdown
+## PR Review
+
+**Target:** `{target_branch}` · **Based on commit:** `{head_sha}`
+[If any skipped files, append: · **Skipped:** {skipped} files out of {total} total]
+[If step 3f classification is not "Standard", append: · **Classified as:** {classification}]
+
+[1–2 sentences: what this PR accomplishes , keep it as short as possible, only highlight the primary essence.]
+
+- **Modified public API:** {changed existing interfaces/types/classes/methods}
+  [Omit bullet if none]
+- **Affected implementations (outside this PR):** {interfaces/types/classes/methods using modified public API}
+  [Omit bullet if none]
+- **Breaking changes:** {violations with specifics}
+  [Omit bullet if none]
+- **Other changes:** {changes not listed above that an Umbraco user, plugin developer, or API consumer would notice — e.g., behavior changes, default value changes, error message changes, new configuration options, removed functionality. Exclude internal renames, formatting, and private implementation details.}
+  [Omit bullet if none]
+
+[If step 3e triggered any dimensions, insert this block. Omit entirely if nothing triggered:]
+
+> [!NOTE]
+> **Complexity advisory** — This PR may benefit from splitting.
+>
+> - **{Dimension}:** {Explanation and concrete split suggestion from step 3e}
+>   [one bullet per triggered dimension]
+>
+> _This is an observation, not a blocker. The full review follows below._
+
+---
+
+### Critical
+
+[Must fix before merge — security vulnerabilities, data loss, broken functionality, breaking changes without proper patterns]
+
+- **`{file}:{line}`**: {problem} → {fix}
+
+[Omit section if none]
+
+### Important
+
+[Should fix — performance issues, missing tests, architectural violations, pattern misuse]
+
+- **`{file}:{line}`**: {observation} → {suggestion}
+
+[Omit section if none]
+
+### Suggestions
+
+[Nice to have — readability, minor refactoring, alternative approaches]
+
+- **`{file}:{line}`**: {detail}
+
+[Omit section if none]
+
+---
+
+[One of:]
+
+## Approved
+
+This looks good to be merged as-is, but please do a manual sanity check and testing before merging.
+
+## Approved with Suggestions for improvement
+
+Good to go, but please carefully consider the importance of the suggestions.
+
+## Request Changes
+
+Critical and important issues must be addressed first.
+
+## Needs re-work
+
+This is in such a bad state that the feedback of this review is not sufficient to guide improvements, the PR cannot be approved.
+```
+
+**Guidelines for the review output:**
+
+— When reporting information, be extremely concise and sacrifice grammar for sake of concision.
+
+- Only review code that was changed in the diff — pre-existing issues are out of scope. Focus on what compilers and linters cannot catch: behavioral side-effects (e.g., a changed default alters runtime behavior for consumers), architectural violations (e.g., a new dependency breaks layering), breaking changes for external consumers of the public API, and security implications. Leave type errors, missing imports, and broken references to CI.
+- Be specific — always reference file and line number
+- Explain WHY something is an issue, not just WHAT, but avoid stating the obvious.
+- For complex matters, provide concrete fix suggestions, including code snippets when helpful
+- Keep it constructive — the goal is to help, not gatekeep
+- Don't repeat the same finding for every occurrence — mention it once and note "same pattern in {other files}"
+- Focus on substantive issues only. Do NOT flag purely cosmetic or stylistic concerns. Specifically, never flag: code formatting or whitespace, comment grammar or wording, redundant-but-harmless syntax (e.g., optional chaining after a truthiness check), code duplication that doesn't cause bugs, or HTML template cosmetics. The only exception is when a stylistic issue has a concrete impact on performance or rendering. Note: missing JSDoc/documentation on public or exported APIs is a substantive finding (per coding preferences), not a cosmetic one — flag it as a Suggestion.
+- For breaking changes, reference the specific pattern from the CLAUDE.md that should be applied
+- Do not suggest changes that would themselves introduce breaking changes. If a suggestion would alter public API surface (e.g., changing return types, renaming public members), it is not appropriate for a PR targeting `main` within a major version. Only suggest non-breaking alternatives.

.claude/skills/umb-review/evals/evals.json

@@ -0,0 +1,97 @@
+{
+  "skill_name": "umb-review",
+  "evals": [
+    {
+      "id": 0,
+      "name": "pr-22214-large-frontend-refactor",
+      "prompt": "Review the changes in PR #22214 (branch origin/pr/22214 targeting main). This is a large frontend refactor migrating create entity actions to use entityCreateOptionAction extensions, with deprecations.",
+      "expected_output": "A structured review that identifies frontend deprecation patterns, flags the large PR complexity, handles 75+ files correctly, checks for breaking changes in exported components, and produces the correct output format.",
+      "pr_number": 22214,
+      "pr_branch": "origin/pr/22214",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "deprecation-patterns-noted", "text": "Review identifies deprecation patterns (@deprecated, UmbDeprecation)"},
+        {"id": "frontend-breaking-change-awareness", "text": "Checks frontend-specific breaking changes (exports, custom elements) not just backend"},
+        {"id": "file-references-present", "text": "Findings reference specific files with line numbers"},
+        {"id": "no-false-critical-on-deprecations", "text": "Properly deprecated code is NOT flagged as Critical breaking change"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "manifest-alias-rename-detected", "text": "Alias renames (CreateOptions → Create) flagged as Critical breaking change"},
+        {"id": "non-exported-deletions-dismissed", "text": "Deleted action classes NOT flagged as breaking (verified against package.json exports)"},
+        {"id": "noise-files-filtered", "text": "Does not review noise files (generated files, lock files, etc.)"},
+        {"id": "complexity-advisory-triggers", "text": "Review includes a complexity/split advisory for the large 75+ file scope"}
+      ]
+    },
+    {
+      "id": 1,
+      "name": "pr-21672-small-frontend-bugfix",
+      "prompt": "Review the changes in PR #21672 (branch origin/pr/21672 targeting main). This is a small 4-file frontend bugfix implementing tab validation badges in the block editor.",
+      "expected_output": "A clean review that correctly identifies this as a small focused bugfix, avoids false positives, and either approves or approves with minor suggestions.",
+      "pr_number": 21672,
+      "pr_branch": "origin/pr/21672",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "complexity-advisory-absent", "text": "Review does NOT include a complexity/split advisory"},
+        {"id": "no-false-breaking-changes", "text": "Review does not flag breaking changes"},
+        {"id": "proportionate-verdict", "text": "Verdict is 'Request Changes'"},
+        {"id": "concise-review", "text": "Review output is under 200 lines"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."}
+      ]
+    },
+    {
+      "id": 2,
+      "name": "pr-22217-small-backend-webhook",
+      "prompt": "Review the changes in PR #22217 (branch origin/pr/22217 targeting v18/dev). This is a tiny 3-file backend change to the default webhook payload type.",
+      "expected_output": "A concise review that correctly resolves v18/dev as target branch, handles the small change proportionately, and considers the behavioral impact of changing a default value.",
+      "pr_number": 22217,
+      "pr_branch": "origin/pr/22217",
+      "base_branch": "origin/v18/dev",
+      "files": [],
+      "assertions": [
+        {"id": "correct-target-branch", "text": "Review references 'v18/dev' as the target branch (not 'main')"},
+        {"id": "default-value-change-noted", "text": "Review discusses the behavioral impact of changing the default payload type"},
+        {"id": "proportionate-review", "text": "Review output is under 150 lines"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "ignores-preexisting-issues", "text": "Does NOT flag the ~30 builder extension methods with Legacy defaults (pre-existing, not changed in the PR)"},
+        {"id": "side-effect-detection", "text": "Flags stale WebhookSettings.cs docs as a side-effect of the constant value change"},
+        {"id": "consumer-identification", "text": "Identifies affected consumers outside the PR (WebhookSettings, UmbracoBuilder, or WebhookEventCollectionBuilderExtensions)"}
+      ]
+    },
+    {
+      "id": 3,
+      "name": "pr-22268-frontend-feature-workspace-modal",
+      "prompt": "Review the changes in PR #22268 (branch origin/pr/22268 targeting main). This is a 29-file frontend feature adding a current user workspace modal.",
+      "expected_output": "A review of a medium-sized new feature PR. Should assess the new code for architectural compliance, check for breaking changes (new exports, custom elements), and evaluate code quality without flagging pre-existing issues.",
+      "pr_number": 22268,
+      "pr_branch": "origin/pr/22268",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "complexity-advisory-triggers", "text": "Review includes a complexity/split advisory (3 layers: Core, API, Frontend across 27+ files)"},
+        {"id": "breaking-changes-on-interface-additions", "text": "Flags new interface methods without default implementations as breaking changes (Pattern 3)"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "diff-scoped", "text": "All findings reference code that was changed in the diff, not pre-existing issues"},
+        {"id": "new-feature-assessed", "text": "Review assesses the new feature's architecture, patterns, or integration approach — not just absence of bugs"},
+        {"id": "no-false-notification-finding", "text": "Review does NOT flag UpdateCurrentUserAsync as missing UserSavingNotification/UserSavedNotification — the sibling UpdateAsync also does not publish these notifications, so flagging their absence would be a false positive"}
+      ]
+    },
+    {
+      "id": 4,
+      "name": "pr-22215-frontend-architecture-violation",
+      "prompt": "Review the changes in PR #22215 (branch origin/pr/22215 targeting main). This is a 2-file frontend feature adding user management to the user group workspace.",
+      "expected_output": "A review that catches the architecture violation: the workspace context directly imports and calls UserService and UserGroupService (generated API clients) instead of going through a repository. In the Umbraco backoffice, workspace contexts access data via repositories, not by calling API services directly. The review should flag this as a significant architecture issue and request changes.",
+      "pr_number": 22215,
+      "pr_branch": "origin/pr/22215",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "service-bypass-detected", "text": "Review flags that the workspace context directly imports/calls UserService or UserGroupService instead of using a repository"},
+        {"id": "repository-pattern-recommended", "text": "Review recommends using the repository pattern (going through a repository/data-source layer) rather than calling API services directly from the workspace context"},
+        {"id": "verdict-request-changes", "text": "Verdict is 'Request Changes' (the architecture violation warrants requesting changes, not just approving with suggestions)"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "no-false-breaking-changes", "text": "Review does not flag breaking changes (this PR only adds new code, no public API is removed or modified)"}
+      ]
+    }
+  ]
+}

.claude/skills/umb-review/references/breaking-changes.md

@@ -0,0 +1,249 @@
+# Breaking Changes Reference
+
+This document describes how to detect and validate breaking changes during PR review. It covers both backend (.NET) and frontend (TypeScript/Lit) patterns.
+
+---
+
+## Version Detection
+
+**Always read `version.json`** at the repository root to determine the current major version. This drives the obsolete removal target calculation:
+
+- Current major version: read from `version.json` → `version` field (e.g., `"17.4.0-rc"` → major version `17`)
+- Obsolete removal target: `current + 2` (e.g., if current is 17, removal is scheduled for Umbraco 19)
+- Format: `[Obsolete("... Scheduled for removal in Umbraco {current+2}.")]`
+
+---
+
+## Backend (.NET) Breaking Changes
+
+### What Constitutes a Breaking Change
+
+Any of these on a `public` or `protected` member:
+
+- Removing or renaming a class, interface, struct, record, or enum
+- Removing or renaming a method, property, or field
+- Changing a method signature (parameters, return type)
+- Adding required parameters to an existing method
+- Adding methods to a public interface (without default implementation)
+- Changing a constructor signature on a public class
+- Removing or changing enum values
+- Changing type hierarchy (base class, implemented interfaces)
+
+### Pattern 1: Obsolete Constructor + StaticServiceProvider
+
+When a public class needs new dependencies, the existing constructor must be preserved.
+
+**Correct pattern:**
+
+```csharp
+[Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+public MyService(IDependencyA depA)
+    : this(
+        depA,
+        StaticServiceProvider.Instance.GetRequiredService<IDependencyB>())
+{
+}
+
+public MyService(IDependencyA depA, IDependencyB depB)
+{
+    _depA = depA;
+    _depB = depB;
+}
+```
+
+**Validation checklist:**
+
+- [ ] Old constructor has `[Obsolete]` attribute with correct removal version
+- [ ] Old constructor calls new constructor via `: this(...)`
+- [ ] `StaticServiceProvider.Instance.GetRequiredService<T>()` used for new params only
+- [ ] DI registration uses the NEW constructor (old is for external consumers only)
+- [ ] Removal version is `{current_major + 2}`
+
+**Common mistakes to flag:**
+
+- Removing the old constructor entirely (breaking change!)
+- Old constructor NOT calling new constructor (code duplication)
+- Wrong removal version in `[Obsolete]`
+- Missing `StaticServiceProvider` resolution for new dependencies
+- DI registration still using the old constructor
+
+### Pattern 2: Obsolete Method + New Overload
+
+When a method signature needs to change, add the new overload and obsolete the old.
+
+**Correct pattern:**
+
+```csharp
+[Obsolete("Use the overload taking all parameters. Scheduled for removal in Umbraco 19.")]
+public void DoThing(string name)
+    => DoThing(name, extraParam: null);
+
+public void DoThing(string name, string? extraParam)
+{
+    // Real implementation here
+}
+```
+
+**Validation checklist:**
+
+- [ ] Old method has `[Obsolete]` attribute with correct removal version
+- [ ] Old method calls new method, providing defaults for new parameters
+- [ ] All internal callers updated to use the new method
+- [ ] No internal code references the obsolete method (except the delegation)
+
+### Pattern 3: Default Interface Implementation
+
+When adding methods to a public interface, provide a default implementation.
+
+**Correct pattern:**
+
+```csharp
+public interface IMyService
+{
+    void ExistingMethod();
+
+    // New method with default implementation
+    void NewMethod(string param)
+        => ExistingMethod(); // delegate to existing if possible
+}
+```
+
+**Strategies for defaults (in order of preference):**
+
+1. Use existing interface methods to satisfy the contract
+2. Return a sensible default (empty collection, null, etc.)
+3. Throw `NotImplementedException` if no reasonable default exists
+
+**Validation checklist:**
+
+- [ ] New interface method has a default implementation
+- [ ] TODO comment present: `// TODO (V{next-major}): Remove the default implementation when {obsolete method} is removed.`
+- [ ] Default implementation is functionally correct (even if not optimal)
+- [ ] If `StaticServiceProvider` is used in default impl, noted as temporary
+
+### Obsolete Attribute Validation
+
+For any `[Obsolete]` attribute found in changed code:
+
+1. **Format**: Must contain `"Scheduled for removal in Umbraco {version}."`
+2. **Version**: Must be `current_major + 2` (read from `version.json`)
+3. **Pragma**: Where obsolete members must call each other, `#pragma warning disable CS0618` / `#pragma warning restore CS0618` must be present
+
+### Internal Caller Check
+
+After finding obsolete patterns, verify:
+
+- Search the codebase for usages of the obsolete member
+- **No internal code** (inside `src/`) should reference obsolete members
+- Only the obsolete member's own delegation (calling the new version) is acceptable
+- External consumers (outside the repo) get the deprecation period to migrate
+
+---
+
+## Frontend (TypeScript/Lit) Breaking Changes
+
+The backoffice is published as `@umbraco-cms/backoffice` with 140+ named exports. Plugin developers depend on this public API surface.
+
+**Critical frontend rule (does not apply to backend .NET where `public`/`protected` visibility determines the API surface): only symbols reachable through the `package.json` `exports` field are public API.** Anything not exported — whether classes, functions, constants, types, or entire files — is an internal implementation detail, even if other internal code imports it. Removing or changing unexported frontend symbols is not a breaking change. Before flagging a frontend deletion or rename as breaking, verify the symbol is reachable via `package.json` exports. If it is not, do not flag it.
+
+### Custom Elements (Web Components)
+
+**Breaking changes:**
+
+- Renaming or removing a registered custom element tag (`umb-*`)
+- Removing elements from `HTMLElementTagNameMap`
+- Removing or changing `@property()` decorated fields on exported components
+- Removing event emissions (checked via `this.dispatchEvent`)
+- Removing CSS custom properties (`@cssprop` in JSDoc)
+- Removing CSS parts (`@csspart` in JSDoc)
+
+**How to detect:**
+
+- Check diff for removed `@customElement('umb-...')` decorators
+- Check diff for removed `@property()` fields on exported components
+- Check diff for removed entries in `HTMLElementTagNameMap` declarations
+
+### Exported Types/Interfaces
+
+**Breaking changes:**
+
+- Removing exports from `package.json` `exports` field
+- Changing the shape of exported interfaces (removing properties, changing types)
+- Renaming exported types (consumers import by name)
+- Removing union type members
+- Changing generic type parameter constraints
+
+**How to detect:**
+
+- Check if `package.json` `exports` field is modified
+- Check diff for removed `export` statements
+- Check diff for changed interface/type shapes
+
+### Manifest/Extension System
+
+**Breaking changes:**
+
+- Renaming a manifest `alias` value — plugin developers reference aliases by string in conditions, overwrites, and extension registry lookups. Alias renames are not caught by the compiler since they are string-based. A renamed alias silently breaks any plugin that references the old string.
+- Removing support for a manifest `type` that plugins use
+- Changing manifest `alias` resolution or validation
+- Removing or renaming manifest `kind` types
+- Changing extension bundle structure
+
+**How to detect:**
+
+- **Alias renames**: Compare `alias:` values in manifest files before and after. Changed alias strings are Critical — the old alias should be preserved as a deprecated entry.
+- Search for changes to manifest type definitions
+- Check for removed or renamed manifest kinds
+
+### Context API
+
+**Breaking changes:**
+
+- Removing context tokens from exports
+- Changing the shape of data provided by a context
+- Removing context provider/consumer mechanisms
+
+**How to detect:**
+
+- Check for removed context token exports
+- Check for changes to context provider classes
+
+### Controllers/Lifecycle
+
+**Breaking changes:**
+
+- Changing controller base class inheritance requirements
+- Removing controller lifecycle hooks
+- Breaking cleanup mechanisms in `disconnectedCallback()`
+
+### Observable/State
+
+**Breaking changes:**
+
+- Removing observable properties from the public API
+- Changing observable emission patterns
+
+### npm Publishing
+
+**Breaking changes:**
+
+- Changing version constraints that exclude previously-supported versions
+- Adding incompatible peer dependency constraints
+
+**How to detect:**
+
+- Check if `package.json` `peerDependencies` or `dependencies` changed
+- Verify version ranges are not narrowed
+
+---
+
+## Reporting Breaking Changes
+
+When a breaking change is detected, report:
+
+1. **What**: The specific change and which public symbol is affected
+2. **Pattern**: Which mitigation pattern should be applied (Pattern 1, 2, or 3 for backend)
+3. **Severity**: Critical (no mitigation present) or Important (mitigation present but incorrect)
+4. **Fix**: Concrete code suggestion showing the correct pattern
+
+If no breaking changes are detected, state: "No breaking changes detected."

.claude/skills/umb-review/references/coding-preferences.md

@@ -0,0 +1,168 @@
+# Coding Preferences & Review Criteria
+
+These are the coding preferences and code review standards used by the review skill. They define what the review evaluates against.
+
+---
+
+## Testing
+
+- **Always create blackbox tests** for new/changed code
+- Choose the appropriate test level:
+  - **Unit tests** for isolated logic
+  - **Integration tests** for application services/use cases
+  - **E2E tests** for API endpoints
+
+### Test Class Naming
+
+- Test classes must be postfixed with `Tests` (e.g., `OrderServiceTests`)
+- One test class per class under test
+
+### Test Method Naming
+
+**C# tests**: Use the `Can_`/`Cannot_` pattern with PascalCase underscore-separated words:
+
+- `Can_Schedule_Publish_Invariant`
+- `Cannot_Delete_Non_Existing`
+- `Can_Schedule_Publish_Single_Culture`
+
+Large test classes are split into partial files by method: `ContentServiceTests.Delete.cs`, `ContentServiceTests.Publish.cs`.
+
+**TypeScript tests**: Use BDD-style `it()` with natural language descriptions:
+
+- `it('should not allow the returned value to be lower than min')`
+- `it('converts string to camelCase')`
+
+### Unit Tests
+
+- Optional, but must be blackbox tests so refactoring does not break tests
+
+### Integration Tests
+
+- Every use case / application service must have integration tests
+- Tests run against real database (containerized or similar)
+- Test the full flow from application layer through infrastructure
+
+### E2E Tests
+
+- Every API endpoint must have E2E tests
+- Test realistic scenarios including error cases
+
+---
+
+## Trade-offs
+
+When making decisions, prioritize:
+
+- **Readability** over cleverness
+- **Flexibility** over rigidity
+- Explain trade-offs when deviating from these defaults
+
+---
+
+## Breaking Changes
+
+- Communicate breaking changes at the **OpenAPI/openapi.json level**
+- Clearly document what changed and the migration path
+
+---
+
+## Documentation
+
+- **Document all public or exported types** (classes, interfaces, types, methods, properties)
+- Keep documentation in sync with code changes
+- Add **JS Docs** on all public frontend APIs (classes, methods, properties)
+- Focus on "why" and usage, not restating the obvious
+
+---
+
+## Dependencies
+
+- Use what's available in the codebase, unless there is no good choice
+- **Flag new dependencies** for review — new packages should be justified
+- Prefer well-maintained, widely-used packages
+
+---
+
+## Error Messages & Logging
+
+- **User-facing errors**: Clear, friendly, actionable
+- **Log messages**: Technical, detailed, with context
+- Include correlation IDs and relevant data in logs
+
+---
+
+## Security
+
+- **Always check for security issues** using OWASP Top 10 as baseline
+- Flag potential vulnerabilities immediately
+- Suggest secure alternatives when spotting risky patterns
+- Apply principle of least privilege
+
+---
+
+## Immutability
+
+- Prefer **immutability** by default
+- Allow internal properties to be mutated, as long as they are not direct references coming from the outside
+
+---
+
+## Nullability
+
+- **TypeScript / JavaScript**
+  - Prefer `undefined` for optional/omitted values (e.g., optional parameters, props, and fields)
+  - Use `null` only when the domain model explicitly encodes "no value" or "not set" (e.g., `string | null` from APIs/DB), and be consistent with existing types
+  - Avoid mixing `null` and `undefined` for the same concept within the same model or API surface
+  
+- **C#**  
+  - use nullable types (e.g., `string?`, `int?`) where absence is valid
+  - Prefer domain modeling (value objects, options/results, empty collections) over `null` where appropriate, but respect existing conventions in the codebase
+
+---
+
+## C# Specific
+
+- use Notification pattern (not C# events), Composer pattern (DI registration), Scoping with `Complete()`, Attempt pattern for operation results.
+
+---
+
+## Architecture
+
+- Follow **Clean Architecture** principles
+- **Fail-fast** principle: detect and report errors as early as possible
+- Within the established layered architecture (Core/Infrastructure/Web/API), organize code by feature inside each layer where practical, while preserving dependency direction
+- One class per file
+- Avoid N+1 queries
+- Profile before optimizing non-critical paths
+
+### Type Hierarchy Consistency
+
+When parallel model types have inconsistent relationships to a shared base type:
+
+**TypeScript**: manipulations via `Omit`, `Pick`, intersection overrides, or workarounds like `as unknown as` / double-casts to bridge type mismatches.
+
+**C#**: hiding base members with `new` to change types, explicit interface implementations to mask mismatches, or downcasting base return types in derived classes.
+
+- **Do NOT suggest** the PR code should deviate from its base type to match a sibling that already deviates. Copying the deviation spreads the problem.
+- **Do flag** the architectural inconsistency: parallel models should share a compatible base contract. The model that manipulates or deviates from the base type is the one that needs attention — not the one that extends it correctly.
+- **Frame the suggestion** as: "These related models have inconsistent type hierarchies. `{deviating type}` manipulates the base contract of `{base type}`, which forces shared consumers like `{shared utility}` to require a shape that conforming subtypes can't satisfy."
+
+---
+
+## Code Style
+
+- Follow standard naming conventions for the language (C# or JS/TS)
+- Keep components small and focused on a single responsibility
+- Prefer early returns
+- Small functions
+- No nested ternaries
+
+---
+
+## Severity Levels
+
+| Severity | Meaning |
+|----------|---------|
+| **Critical** | Must fix before merge — security vulnerabilities, data loss risks, broken functionality |
+| **Important** | Should fix — performance issues, missing tests, architectural violations |
+| **Suggestion** | Nice to have — readability, minor refactoring, alternative approaches |

.claude/skills/umb-review/references/complexity-assessment.md

@@ -0,0 +1,33 @@
+# PR Complexity Assessment
+
+Evaluate whether the PR's scope suggests it should be split. This assessment is **informational only** — it never blocks or shortens the review.
+
+## Always check: Formatting mixed with logic
+
+This check applies to every PR regardless of size or scope.
+
+Run both commands and compare per-file line counts:
+```bash
+git diff {target}...HEAD --stat
+git diff {target}...HEAD --stat --ignore-all-space
+```
+
+For any file where the whitespace-ignored diff is less than **half** the full diff size (and the full diff is over 50 lines), that file has significant formatting changes mixed with logic. Flag it with a split suggestion: "File(s) {list} contain significant formatting changes mixed with logic. Consider a separate formatting-only commit or PR to keep the functional diff reviewable."
+
+## Multi-project scope check
+
+Skip this section entirely if ALL production files reside in a single project directory or if the PR is docs-only, test-only, dependency-bump-only, or rename-only.
+
+Otherwise, flag any dimension that applies:
+
+| Dimension | Condition | Suggestion |
+|---|---|---|
+| **Size** | 30+ files OR 1500+ lines, spanning 2+ projects | "If changes in {projectA} and {projectB} are independently functional, they could be separate PRs." |
+| **Layer spread** | 3+ layers touched (Core/Infrastructure/Web/API/Frontend), 10+ files | "Consider splitting by layer — e.g., Core+Infrastructure first, then API/Frontend consumers." |
+| **Mixed intent** | 2+ intent categories (new feature, bugfix, refactor, dependency update) with 15+ files or 3+ projects | "Consider extracting the {secondary intent} into a separate PR." |
+
+Intent categories — detect from diff characteristics, not commit messages:
+- **New feature**: new files or new `public`/`export` declarations
+- **Bug fix**: small targeted edits, no new files (don't co-flag with new feature)
+- **Refactor**: file renames, symbols moved but logic unchanged
+- **Dependency update**: changes to `.csproj`, `Directory.Packages.props`, `package.json`

.claude/skills/umb-review/references/gh-cli-setup.md

@@ -0,0 +1,23 @@
+# GH CLI Setup Instructions
+
+The GitHub CLI (`gh`) is required for this review skill to detect PR target branches.
+
+## Installation
+
+Install via Homebrew:
+
+```
+brew install gh
+```
+
+Or see https://cli.github.com/ for other installation methods.
+
+## Authentication
+
+After installing, authorize by running this in the terminal (use the `!` prefix in Claude Code):
+
+```
+! gh auth login
+```
+
+Follow the prompts to authenticate with your GitHub account.

.claude/skills/umb-review/references/impact-analysis.md

@@ -0,0 +1,153 @@
+# Impact Analysis Reference
+
+This document describes how to perform impact analysis during PR review. The goal is to look beyond the diff to understand how changes affect consumers in other parts of the codebase.
+
+---
+
+## 1. Extract Changed Public Symbols
+
+Scan the diff output for changes to public API surface:
+
+### Backend (.NET)
+
+Look for added, modified, or removed lines containing:
+
+- `public class`, `public abstract class`, `public sealed class`
+- `public interface`
+- `public record`, `public struct`, `public enum`
+- `public` or `protected` methods, properties, fields
+- `public static` members
+- Constructor signatures on public types
+
+### Frontend (TypeScript/Lit)
+
+Look for changes to:
+
+- `export class`, `export interface`, `export type`, `export enum`
+- `export function`, `export const`
+- `@property()` decorated fields on exported components
+- `@customElement()` registrations
+- Entries in `package.json` `exports` field
+
+Collect a list of all changed public symbol names (type names, method names, property names).
+
+---
+
+## 2. Search for Consumers
+
+For each changed public symbol, search the `src/` directory for usages **outside the changed file itself**.
+
+### Grep Strategy
+
+Use the Grep tool with these settings:
+
+```
+pattern: {symbol name}
+path: src/
+output_mode: files_with_matches
+head_limit: 20
+```
+
+Use `head_limit: 20` to avoid overwhelming results — if there are more than 20 consumers, note "20+ consumers found" and list the first 20.
+
+### What to Search For
+
+For each changed type/method, search for:
+
+- **Type references**: class name, interface name (e.g., `IContentService`)
+- **Method calls**: method name in context (e.g., `\.GetById\(` for a method rename)
+- **Constructor usage**: `new TypeName(`
+- **DI registrations**: `.AddSingleton<IType, Type>`, `.AddScoped<`, `.AddTransient<`
+- **Notification handlers**: if a notification type changed, search for `INotificationHandler<NotificationTypeName>` and `INotificationAsyncHandler<NotificationTypeName>`
+- **Interface implementations**: if an interface changed, search for `: IInterfaceName` or `IInterfaceName,`
+
+### Excluding the Changed File
+
+When reporting consumers, exclude files that are part of the PR's changes (they're already being reviewed). The interesting consumers are those **outside** the PR that may be affected.
+
+---
+
+## 3. Check Dependency Flow Direction
+
+The Umbraco architecture enforces strict unidirectional dependencies:
+
+```
+Api.Management / Api.Delivery (depend on Api.Common)
+  ↓
+Api.Common (depends on Web.Common)
+  ↓
+Web.Common (depends on Infrastructure)
+  ↓
+Infrastructure (depends on Core)
+  ↓
+Core (no dependencies)
+```
+
+### Layer Mapping
+
+Map each changed file to its architectural layer:
+
+| Path prefix | Layer |
+|---|---|
+| `src/Umbraco.Core/` | Core |
+| `src/Umbraco.Infrastructure/` | Infrastructure |
+| `src/Umbraco.PublishedCache.*` | Infrastructure |
+| `src/Umbraco.Examine.Lucene/` | Infrastructure |
+| `src/Umbraco.Cms.Persistence.*` | Infrastructure |
+| `src/Umbraco.Web.Common/` | Web |
+| `src/Umbraco.Web.UI/` | Web (Application) |
+| `src/Umbraco.Web.Website/` | Web |
+| `src/Umbraco.Cms.Api.Common/` | API |
+| `src/Umbraco.Cms.Api.Management/` | API |
+| `src/Umbraco.Cms.Api.Delivery/` | API |
+| `src/Umbraco.Web.UI.Client/` | Frontend |
+| `tests/` | Test |
+
+### Violation Detection
+
+Flag if a change introduces:
+
+- **Core depending on Infrastructure**: Core file importing/referencing Infrastructure types
+- **Core depending on Web/API**: Core file importing/referencing Web or API types
+- **Infrastructure depending on Web/API**: Infrastructure file importing Web or API types
+- **Cross-API dependencies**: Management API depending on Delivery API or vice versa
+
+### How to Check
+
+1. For each changed file, identify its layer
+2. Read the file's `using` statements (C#) or `import` statements (TS)
+3. Check if any imports reference a higher layer
+4. Also check if new parameters or return types come from higher layers
+
+---
+
+## 4. Flag Cross-Project Risks
+
+### High-Risk Patterns
+
+These changes have high ripple potential:
+
+- **Interface changes in Core** — all implementations in Infrastructure must be updated
+- **Notification type changes** — all handlers across the codebase are affected
+- **Base class changes** — all derived classes are affected
+- **Composer changes** — can affect DI container and runtime behavior globally
+- **Shared model/DTO changes** — can affect serialization, API contracts, and consumers
+
+### What to Report
+
+For each cross-project risk found, report:
+
+1. **What changed**: The specific symbol and how it changed
+2. **Who is affected**: List of consuming files/projects found via Grep
+3. **Risk level**: Whether the consumers will break (compile error), behave differently (runtime), or are unaffected
+4. **Recommendation**: Whether the PR should include updates to affected consumers
+
+---
+
+## 5. Performance Notes
+
+- Use `head_limit: 20` on all Grep searches to cap results
+- Only search for symbols that actually changed (not every symbol in the file)
+- For very common type names (e.g., `IScope`, `ILogger`), consider adding more context to the search pattern to reduce false positives
+- Skip impact analysis for test files — they don't have external consumers
+- Skip impact analysis for private/internal members — they can't have external consumers

.github/copilot-instructions.md

@@ -1,218 +1 @@
-# Umbraco CMS Development Guide
-
-Always reference these instructions first and fallback to search or bash commands only when you encounter unexpected information that does not match the info here.
-
-## Working Effectively
-
-Bootstrap, build, and test the repository:
-
--   Install .NET SDK (version specified in global.json):
-    -   `curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --version $(jq -r '.sdk.version' global.json)`
-    -   `export PATH="/home/runner/.dotnet:$PATH"`
--   Install Node.js (version specified in src/Umbraco.Web.UI.Client/.nvmrc):
-    -   `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`
-    -   `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"`
-    -   `nvm install $(cat src/Umbraco.Web.UI.Client/.nvmrc) && nvm use $(cat src/Umbraco.Web.UI.Client/.nvmrc)`
--   Fix shallow clone issue (required for GitVersioning):
-    -   `git fetch --unshallow`
--   Restore packages:
-    -   `dotnet restore` -- takes 50 seconds. NEVER CANCEL. Set timeout to 90+ seconds.
--   Build the solution:
-    -   `dotnet build` -- takes 4.5 minutes. NEVER CANCEL. Set timeout to 10+ minutes.
--   Install and build frontend:
-    -   `cd src/Umbraco.Web.UI.Client`
-    -   `npm ci --no-fund --no-audit --prefer-offline` -- takes 11 seconds.
-    -   `npm run build:for:cms` -- takes 1.25 minutes. NEVER CANCEL. Set timeout to 5+ minutes.
--   Install and build Login
-    -   `cd src/Umbraco.Web.UI.Login`
-    -   `npm ci --no-fund --no-audit --prefer-offline`
-    -   `npm run build`
--   Run the application:
-    -   `cd src/Umbraco.Web.UI`
-    -   `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
-
-Check out [BUILD.md](./BUILD.md) for more detailed instructions.
-
-## Validation
-
--   ALWAYS run through at least one complete end-to-end scenario after making changes.
--   Build and unit tests must pass before committing changes.
--   Frontend build produces output in src/Umbraco.Web.UI.Client/dist-cms/ which gets copied to src/Umbraco.Web.UI/wwwroot/umbraco/backoffice/
--   Always run `dotnet build` and `npm run build:for:cms` before running the application to see your changes.
--   For login-only changes, you can run `npm run build` from src/Umbraco.Web.UI.Login and then `dotnet run --no-build` from src/Umbraco.Web.UI.
--   For frontend-only changes, you can run `npm run dev:server` from src/Umbraco.Web.UI.Client for hot reloading.
--   Frontend changes should be linted using `npm run lint:fix` which uses Eslint.
-
-## Testing
-
-### Unit Tests (.NET)
-
--   Location: tests/Umbraco.Tests.UnitTests/
--   Run: `dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --configuration Release --verbosity minimal`
--   Duration: ~1 minute with 3,343 tests
--   NEVER CANCEL: Set timeout to 5+ minutes
-
-### Integration Tests (.NET)
-
--   Location: tests/Umbraco.Tests.Integration/
--   Run: `dotnet test tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj --configuration Release --verbosity minimal`
--   NEVER CANCEL: Set timeout to 10+ minutes
-
-### Frontend Tests
-
--   Location: src/Umbraco.Web.UI.Client/
--   Run: `npm test` (requires `npx playwright install` first)
--   Frontend tests use Web Test Runner with Playwright
-
-### Acceptance Tests (E2E)
-
--   Location: tests/Umbraco.Tests.AcceptanceTest/
--   Requires running Umbraco application and configuration
--   See tests/Umbraco.Tests.AcceptanceTest/README.md for detailed setup (requires `npx playwright install` first)
-
-## Project Structure
-
-The solution contains 30 C# projects organized as follows:
-
-### Main Application Projects
-
--   **Umbraco.Web.UI**: Main web application project (startup project)
--   **Umbraco.Web.UI.Client**: TypeScript frontend (backoffice)
--   **Umbraco.Web.UI.Login**: Separate login screen frontend
--   **Umbraco.Core**: Core domain models and interfaces
--   **Umbraco.Infrastructure**: Data access and infrastructure
--   **Umbraco.Cms**: Main CMS package
-
-### API Projects
-
--   **Umbraco.Cms.Api.Management**: Management API
--   **Umbraco.Cms.Api.Delivery**: Content Delivery API
--   **Umbraco.Cms.Api.Common**: Shared API components
-
-### Persistence Projects
-
--   **Umbraco.Cms.Persistence.SqlServer**: SQL Server support
--   **Umbraco.Cms.Persistence.Sqlite**: SQLite support
--   **Umbraco.Cms.Persistence.EFCore**: Entity Framework Core abstractions
-
-### Test Projects
-
--   **Umbraco.Tests.UnitTests**: Unit tests
--   **Umbraco.Tests.Integration**: Integration tests
--   **Umbraco.Tests.AcceptanceTest**: End-to-end tests with Playwright
--   **Umbraco.Tests.Common**: Shared test utilities
-
-## Common Tasks
-
-### Running Umbraco in Different Modes
-
-**Production Mode (Standard Development)**
-Use this for backend development, testing full builds, or when you don't need hot reloading:
-
-1. Build frontend assets: `cd src/Umbraco.Web.UI.Client && npm run build:for:cms`
-2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
-3. Access backoffice: `https://localhost:44339/umbraco`
-4. Application uses compiled frontend from `wwwroot/umbraco/backoffice/`
-
-**Vite Dev Server Mode (Frontend Development with Hot Reload)**
-Use this for frontend-only development with hot module reloading:
-
-1. Configure backend for frontend development - Add to `src/Umbraco.Web.UI/appsettings.json` under `Umbraco:CMS:Security`:
-    ```json
-    "BackOfficeHost": "http://localhost:5173",
-    "AuthorizeCallbackPathName": "/oauth_complete",
-    "AuthorizeCallbackLogoutPathName": "/logout",
-    "AuthorizeCallbackErrorPathName": "/error",
-    "BackOfficeTokenCookie": {
-      "SameSite": "None"
-    }
-    ```
-2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
-3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
-4. Access backoffice: `http://localhost:5173/` (no `/umbraco` prefix)
-5. Changes to TypeScript/Lit files hot reload automatically
-
-**Important:** Remove the `BackOfficeHost` configuration before committing or switching back to production mode.
-
-### Backend-Only Development
-
-For backend-only changes, disable frontend builds:
-
--   Comment out the target named "BuildStaticAssetsPreconditions" in src/Umbraco.Cms.StaticAssets.csproj:
-    ```
-    <!--<Target Name="BuildStaticAssetsPreconditions" BeforeTargets="AssignTargetPaths">
-      [...]
-    </Target>-->
-    ```
--   Remember to uncomment before committing
-
-### Building NuGet Packages
-
-To build custom NuGet packages for testing:
-
-```bash
-dotnet pack -c Release -o Build.Out
-dotnet nuget add source [Path to Build.Out folder] -n MyLocalFeed
-```
-
-### Regenerating Frontend API Types
-
-When changing Management API:
-
-```bash
-cd src/Umbraco.Web.UI.Client
-npm run generate:server-api-dev
-```
-
-Also update OpenApi.json from /umbraco/swagger/management/swagger.json
-
-## Database Setup
-
-Default configuration supports SQLite for development. For production-like testing:
-
--   Use SQL Server/LocalDb for better performance
--   Configure connection string in src/Umbraco.Web.UI/appsettings.json
-
-## Clean Up / Reset
-
-To reset development environment:
-
-```bash
-# Remove configuration and database
-rm src/Umbraco.Web.UI/appsettings.json
-rm -rf src/Umbraco.Web.UI/umbraco/Data
-
-# Full clean (removes all untracked files)
-git clean -xdf .
-```
-
-## Version Information
-
--   Target Framework: .NET (version specified in global.json)
--   Current Version: (specified in version.json)
--   Node.js Requirement: (specified in src/Umbraco.Web.UI.Client/.nvmrc)
--   npm Requirement: Latest compatible version
-
-## Known Issues
-
--   Build requires full git history (not shallow clone) due to GitVersioning
--   Some NuGet package security warnings are expected (SixLabors.ImageSharp vulnerabilities)
--   Frontend tests require Playwright browser installation: `npx playwright install`
--   Older Node.js versions may show engine compatibility warnings (check .nvmrc for current requirement)
-
-## Timing Expectations
-
-**NEVER CANCEL** these operations - they are expected to take time:
-
-| Operation               | Expected Time | Timeout Setting |
-| ----------------------- | ------------- | --------------- |
-| `dotnet restore`        | 50 seconds    | 90+ seconds     |
-| `dotnet build`          | 4.5 minutes   | 10+ minutes     |
-| `npm ci`                | 11 seconds    | 30+ seconds     |
-| `npm run build:for:cms` | 1.25 minutes  | 5+ minutes      |
-| `npm test`              | 2 minutes     | 5+ minutes      |
-| `npm run lint`          | 1 minute      | 5+ minutes      |
-| Unit tests              | 1 minute      | 5+ minutes      |
-| Integration tests       | Variable      | 10+ minutes     |
-
-Always wait for commands to complete rather than canceling and retrying.
+The full development guide for this repository lives in [CLAUDE.md](../CLAUDE.md). Please read that file for complete instructions on architecture, build steps, testing, branching conventions, and coding patterns.

.github/workflows/azure-backoffice.yml

@@ -4,9 +4,7 @@ on:
   push:
     branches:
       - main
-      - release/*
       - v*/dev
-      - v*/main
     paths:
       - src/Umbraco.Web.UI.Client/package.json
       - src/Umbraco.Web.UI.Client/package-lock.json
@@ -16,9 +14,7 @@ on:
     types: [opened, synchronize, reopened, closed]
     branches:
       - main
-      - release/*
       - v*/dev
-      - v*/main
   workflow_dispatch:
 
 jobs:

.github/workflows/azure-storybook.yml

@@ -5,7 +5,6 @@ on:
     branches:
       - main
       - v*/dev
-      - v*/main
     paths:
       - src/Umbraco.Web.UI.Client/package.json
       - src/Umbraco.Web.UI.Client/package-lock.json
@@ -16,7 +15,6 @@ on:
     branches:
       - main
       - v*/dev
-      - v*/main
   workflow_dispatch:
 
 env:

.github/workflows/claude-review.yml

@@ -0,0 +1,64 @@
+name: Claude PR Review
+
+on:
+  pull_request_target:
+    types: [opened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  id-token: write
+
+jobs:
+  review:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_03 }}
+          base_branch: "main"
+          additional_permissions: "actions: read"
+          claude_args: "--model claude-sonnet-4-6 --allowedTools 'Bash(gh:*),Bash(git:*)'"
+          prompt: |
+            You are reviewing pull request #${{ github.event.pull_request.number }}
+            in the Umbraco CMS repository.
+
+            Read and execute the review procedure defined in `.claude/skills/umb-review/SKILL.md`.
+
+            For each finding that references a specific file and line:
+            - Post an individual inline PR comment on that line.
+            - Format: **[Severity]** explanation, then suggestion.
+
+            For the overall summary (header, impact, verdict):
+            - Post ONE top-level PR comment.
+
+            Do NOT use sticky/updating comments — post new individual comments.
+
+            After reviewing, apply labels to the PR based on changed files:
+            - `area/frontend` — if files under `src/Umbraco.Web.UI.Client/` are changed
+            - `area/backend` — if .cs files outside the frontend client are changed
+            - `area/test` — if only test files are changed
+            - `category/api` — if Management API or Delivery API files are changed
+            - `category/breaking` — if breaking changes were detected in the review
+            - `category/localization` — if localization/language files are changed
+            - `category/test-automation` — if only test files are changed
+            - `category/refactor` — if the PR is pure refactoring with no new features
+            - `category/performance` — if performance-related changes are detected
+            - `category/ux` — if user-facing changes are detected
+            - `category/ui` — if changes to the UI layer are detected
+
+            Only apply labels you are confident about. Never remove existing labels.
+
+            Be friendly and constructive. This project values community contributions.
+            Frame feedback as suggestions where possible.
+            Reserve firm language for genuine Critical issues only.
+
+            Run fully autonomously. Do NOT ask questions.
+            Only review changed files. Do not flag pre-existing issues.
+            Do not suggest changes that would themselves introduce breaking changes.

.github/workflows/claude.yml

@@ -0,0 +1,91 @@
+name: Claude
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned, labeled]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  id-token: write
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_03 }}
+          assignee_trigger: "claude"
+          label_trigger: "claude"
+          base_branch: "main"
+          additional_permissions: "actions: read"
+          claude_args: "--model claude-sonnet-4-6 --max-turns 50 --allowedTools 'Bash(gh:*),Bash(git:*),Bash(npm:*),Bash(dotnet:*)'"
+          prompt: |
+            You are an AI assistant for the Umbraco CMS repository, an open-source
+            .NET CMS that welcomes community contributions.
+
+            You were triggered on issue/PR #${{ github.event.issue.number || github.event.pull_request.number }}.
+
+            Read the user's message and do what they ask. The trigger phrase
+            `@claude` is stripped before you see the message, so common requests
+            will look like:
+
+            - `review` — Review PR #${{ github.event.issue.number || github.event.pull_request.number }}.
+              Use `gh pr diff ${{ github.event.issue.number || github.event.pull_request.number }}`
+              and `gh pr view ${{ github.event.issue.number || github.event.pull_request.number }}`
+              to read the changes. Do NOT use git diff or the umb-review skill.
+              Focus on bugs, breaking changes, and architectural concerns.
+              Post inline comments for specific issues and a brief summary.
+            - `help` or a general question — Answer based on the codebase.
+              Read CLAUDE.md files for project structure and conventions.
+            - `fix ...` — Implement the requested fix on a new branch.
+            - `label` — Apply appropriate labels to the PR or issue.
+
+            If the message is empty or just whitespace, treat it as `review`
+            when on a PR, or `help` when on an issue.
+
+            If none of these match, read the user's message carefully and respond
+            to what they actually asked for.
+
+            ## Labeling
+
+            When labeling PRs (based on changed files):
+            - `area/frontend`, `area/backend`, `area/test`
+            - `category/api`, `category/breaking`, `category/localization`
+            - `category/refactor`, `category/performance`, `category/ux`, `category/ui`
+            - `category/test-automation`
+
+            When labeling issues (based on content):
+            - `area/frontend`, `area/backend`, `area/test`
+            - `affected/v14` through `affected/v17`, `affected/backoffice`
+            - `category/api`, `category/localization`, `category/performance`
+            - `category/ux`, `category/ui`
+
+            Only apply labels you are confident about. Never remove existing labels.
+
+            ## Tone
+
+            Be friendly and constructive. Frame feedback as suggestions.
+            Reserve firm language for genuine critical issues only.
+
+            ## Constraints
+
+            - Run fully autonomously. Do NOT ask questions.
+            - Do not suggest changes that would introduce breaking changes.

.gitignore

@@ -103,6 +103,7 @@ tools/docfx/
 playwright-report
 trace.zip
 /tests/Umbraco.Tests.AcceptanceTest/results
+/tests/Umbraco.Tests.AcceptanceTest/dist
 
 # Ignore auto-generated schema
 /src/Umbraco.Cms.Targets/tasks/

CLAUDE.md

@@ -198,7 +198,7 @@ Use the format: `Area: Description (closes #IssueID)`
 - Describe the change and its impact
 - Be specific, not vague (describe "a golden retriever" not just "a dog")
 
-**Issue Linking**: Add `(closes #IssueID)` to auto-close linked issues on merge.
+**Issue Linking**: Add `(closes #IssueID)` to the title for readability, AND include a closing keyword on its own line in the PR body (e.g., `Fixes #IssueID`) so GitHub actually auto-links and auto-closes the issue on merge. GitHub only parses closing keywords (`closes`, `fixes`, `resolves`) from the PR body or commit messages — the title suffix is cosmetic and does **not** trigger auto-close on its own.
 
 ### Commit Messages
 
@@ -393,13 +393,18 @@ The repository contains BOTH (actively supported):
 All APIs use **OpenIddict** (OAuth 2.0/OpenID Connect):
 - Reference tokens (not JWT) for better security
 - **Secure cookie-based token storage** (v17+) - tokens stored in HTTP-only cookies with `__Host-` prefix
-- Tokens are redacted from client-side responses and passed via secure cookies only
+- Tokens are redacted from client-side responses and passed via secure cookies only (`[redacted]` placeholder)
 - ASP.NET Core Data Protection for token encryption
 - Configured in `Umbraco.Cms.Api.Common`
 - API requests must include credentials (`credentials: include` for fetch)
 
 **Load Balancing Requirement**: All servers must share the same Data Protection key ring.
 
+**Frontend auth pitfalls** — see `src/Umbraco.Web.UI.Client/docs/edge-cases.md` (Auth & Cross-tab section) and `docs/security.md`. Key points:
+- Never call `validateToken()` per API request — it revokes the previous reference token (ID2019 errors)
+- `window.opener` is set for ANY `window.open()` target, not only OAuth popups — scope guards to the pathname too
+- BroadcastChannel does not deliver messages to the sender's own tab
+
 ### Content Caching Strategy
 
 **HybridCache** (`Umbraco.PublishedCache.HybridCache`):
@@ -414,64 +419,19 @@ APIs use `Asp.Versioning.Mvc`:
 - Delivery API: `/umbraco/delivery/api/v{version}/*`
 - OpenAPI/Swagger docs per version
 
-### Backoffice npm Package Structure
+### Updating `OpenApi.json` (Management API)
 
-The backoffice (`Umbraco.Web.UI.Client`) is published to npm as **`@umbraco-cms/backoffice`** with a plugin architecture:
+When a PR changes Management API controllers or models, the `OpenApi.json` file in the Management API project must be updated:
 
-#### Architecture Overview
+1. Run the Umbraco instance locally
+2. Open Swagger UI and navigate to the swagger.json link (e.g. `https://localhost:44339/umbraco/swagger/management/swagger.json`)
+3. Copy the full JSON content and paste it into `src/Umbraco.Cms.Api.Management/OpenApi.json`
 
-- **Multi-workspace structure**: Subprojects in `src/libs/*`, `src/packages/*`, `src/external/*`
-- **Export model**: All exports defined in root `package.json` → `./exports` field
-- **Importmap-driven runtime**: Dependencies provided at runtime via importmap (single source of truth)
-- **Build-time types**: TypeScript types come from npm peerDependencies
-- **Plugin model**: Developers create plugins that import from `@umbraco-cms/backoffice/*` exports
+**Important**: Commit only the substantive changes — not IDE-applied formatting (whitespace, reordering, etc.). Extraneous formatting diffs make PRs harder to review and merge-ups more error-prone.
 
-#### Dependency Hoisting Strategy
+### Backoffice npm Package
 
-When building for npm (`npm pack`), the `cleanse-pkg.js` script hoists subproject dependencies to root `peerDependencies` with intelligent version range conversion:
-
-**Version Range Logic** (uses `semver` package):
-
-1. **Pre-release (0.x.y)**: Convert to explicit range
-   - Input: `^0.85.0` or `0.85.0`
-   - Output: `>=0.85.0 <1.0.0`
-   - Rationale: Pre-release caret only allows patch updates, explicit range allows minor upgrades within 0.x.x
-   - Example: Plugin can use `@hey-api/openapi-ts@0.91.1` while backoffice uses `0.85.0`
-
-2. **Stable with caret (^X.Y.Z where X ≥ 1)**: Keep as-is
-   - Input: `^3.3.1`
-   - Output: `^3.3.1` (unchanged)
-   - Rationale: Caret already implements correct semantics for stable versions
-
-3. **Stable exact versions (X.Y.Z where X ≥ 1)**: Add caret
-   - Input: `3.16.0`
-   - Output: `^3.16.0`
-   - Rationale: Normalizes to conventional semver format
-
-#### Key Dependencies
-
-**Runtime via importmap** (types available from peerDependencies):
-- `lit`, `rxjs`, `@umbraco-ui/uui` - Core framework
-- `monaco-editor`, `@tiptap/*` - Feature-specific editors
-- `@hey-api/openapi-ts` - HTTP client type generation
-
-**Build-time only** (not hoisted):
-- `vite`, `typescript`, `eslint` - Dev tooling
-
-#### Plugin Development Implications
-
-Plugin developers should:
-- **Declare explicit dependencies** in their own `package.json` (avoid relying on transitive deps)
-- **Understand the version ranges**: `>=0.85.0 <1.0.0` means they can use newer pre-release versions
-- **Know that types match npm ranges**, but runtime comes from importmap (managed by backoffice)
-- **When `@hey-api` hits 1.0.0**: Published constraint will automatically become `^1.0.0`
-
-#### Implementation Details
-
-- Script location: `src/Umbraco.Web.UI.Client/devops/publish/cleanse-pkg.js`
-- Runs as `prepack` hook before npm pack
-- Uses `semver.minVersion()` for robust version range parsing
-- Generates single source of truth for importmap versions
+The backoffice is published to npm as `@umbraco-cms/backoffice`. Runtime dependencies are provided via importmap; npm peerDependencies provide types only. For full details on dependency hoisting, version range logic, and plugin development, see `/src/Umbraco.Web.UI.Client/CLAUDE.md` → "npm Package Publishing".
 
 ### Known Limitations
 
@@ -481,6 +441,68 @@ Plugin developers should:
 
 ---
 
+## 7. CI/CD — Claude AI Assistant
+
+Two GitHub Actions workflows powered by `anthropics/claude-code-action@v1`. Advisory only — does not block merging.
+
+### Workflows
+
+| File | Trigger | Purpose |
+|------|---------|---------|
+| `claude-review.yml` | `pull_request: [opened, ready_for_review]` | Auto-review every non-draft PR using the `umb-review` skill |
+| `claude.yml` | `@claude` comments, issue assign/label | Interactive assistant for PRs and issues |
+
+### Auto-Review (`claude-review.yml`)
+
+Runs the full `.claude/skills/umb-review/SKILL.md` procedure on every newly opened or un-drafted PR. Produces inline comments per finding and one summary comment with a verdict. Skips draft PRs. No turn limit.
+
+### Interactive (`claude.yml`)
+
+Responds to `@claude` mentions on PRs and issues. The trigger phrase is stripped before Claude sees the message, so:
+
+- `@claude review` → light review using `gh pr diff` (not the umb-review skill)
+- `@claude fix ...` → implements a fix on a new branch
+- `@claude help` → answers questions about the codebase
+- `@claude label` → applies labels
+- `@claude` (empty) → defaults to `review` on PRs, `help` on issues
+
+Also triggers on issue assignment to `claude` or adding the `claude` label. Gated: only runs when `@claude` appears in the comment/issue body. Max 25 turns.
+
+**Allowed Bash tools**: `gh`, `git`, `npm`, `dotnet` (interactive only; auto-review allows `gh` and `git`).
+
+### Labels
+
+Both workflows apply labels based on content:
+
+**On PRs** (based on changed files):
+
+| Label | Condition |
+|-------|-----------|
+| `area/frontend` | Files under `src/Umbraco.Web.UI.Client/` |
+| `area/backend` | `.cs` files outside the frontend client |
+| `area/test` | Only test files changed |
+| `category/api` | Management or Delivery API files |
+| `category/breaking` | Breaking changes detected |
+| `category/localization` | Localization/language files |
+| `category/test-automation` | Only test files changed |
+| `category/refactor` | Pure refactoring, no new features |
+| `category/performance` | Performance-related changes |
+| `category/ux` | User-facing changes |
+| `category/ui` | UI layer changes |
+
+**On Issues** (based on content): same `area/*` and `category/*` labels, plus `affected/v14` through `affected/v17` and `affected/backoffice`.
+
+Labels are only added, never removed. Claude applies only labels it is confident about.
+
+### Key Implementation Notes
+
+- **Checkout required** — the action internally runs `git fetch origin main` for trusted file restoration. Without `actions/checkout`, it fails with `fatal: not a git repository`.
+- **`id-token: write` permission** — required for OIDC token exchange with the Claude GitHub App.
+- **Trigger phrase stripping** — the action strips `@claude` from comments before passing to Claude. Prompts must reference commands without the prefix (e.g., `review` not `@claude review`).
+- **PR number injection** — the interactive workflow injects the PR/issue number into the prompt via `${{ github.event.issue.number }}` since Claude can't discover it from `gh pr view` when checked out on `main`.
+
+---
+
 ## Quick Reference
 
 ### Essential Commands
@@ -502,6 +524,16 @@ dotnet format
 dotnet pack -c Release
 ```
 
+### Integration Test Database Configuration
+
+Integration tests are configured in `tests/Umbraco.Tests.Integration/appsettings.Tests.json`.
+
+The `Tests:Database:DatabaseType` setting controls which database is used:
+- `"SQLite"` (default) - No external dependencies
+- `"LocalDb"` - Uses SQL Server LocalDB, required for SQL Server-specific tests (e.g., page-level locking, `sys.dm_tran_locks`)
+
+SQL Server-specific tests use `BaseTestDatabase.IsSqlite()` to skip when running on SQLite.
+
 ### Key Projects
 
 | Project | Type | Description |
@@ -527,6 +559,7 @@ dotnet pack -c Release
 For detailed information about individual projects, see their CLAUDE.md files:
 - **Core Architecture**: `/src/Umbraco.Core/CLAUDE.md` - Service contracts, notification patterns
 - **API Infrastructure**: `/src/Umbraco.Cms.Api.Common/CLAUDE.md` - OpenAPI, authentication, serialization
+- **Backoffice Frontend**: `/src/Umbraco.Web.UI.Client/CLAUDE.md` - Lit web components, extension system, auth client
 
 ### Getting Help
 

Directory.Packages.props

@@ -13,27 +13,27 @@
   </ItemGroup>
   <!-- Microsoft packages -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.2" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.4" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.2.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.4.0" />
     <PackageVersion Include="System.Linq.Async" Version="7.0.0" />
   </ItemGroup>
   <!-- Umbraco packages -->
@@ -50,19 +50,19 @@
     <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
     <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
     <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.14.1" />
-    <PackageVersion Include="Markdig" Version="0.44.0" />
+    <PackageVersion Include="MailKit" Version="4.15.1" />
+    <PackageVersion Include="Markdig" Version="0.45.0" />
     <PackageVersion Include="Markdown" Version="2.2.1" />
     <PackageVersion Include="MessagePack" Version="3.1.4" />
     <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
     <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
     <PackageVersion Include="ncrontab" Version="3.4.0" />
-    <PackageVersion Include="NPoco" Version="6.1.0" />
-    <PackageVersion Include="NPoco.SqlServer" Version="6.1.0" />
+    <PackageVersion Include="NPoco" Version="6.2.0" />
+    <PackageVersion Include="NPoco.SqlServer" Version="6.2.0" />
     <PackageVersion Include="OpenIddict.Abstractions" Version="7.2.0" />
     <PackageVersion Include="OpenIddict.AspNetCore" Version="7.2.0" />
     <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.2.0" />
-    <PackageVersion Include="Serilog" Version="4.3.0" />
+    <PackageVersion Include="Serilog" Version="4.3.1" />
     <PackageVersion Include="Serilog.AspNetCore" Version="9.0.0" />
     <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
     <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
@@ -76,7 +76,8 @@
     <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
     <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
     <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.1.0" />
+    <!-- When updating this version, also update templates/UmbracoExtension/Umbraco.Extension.csproj -->
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.1.4" />
   </ItemGroup>
   <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
   <ItemGroup>
@@ -88,4 +89,4 @@
     <!-- TODO (V19): Remove these pinned dependencies when the Markdown dependency is removed. -->
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
   </ItemGroup>
-</Project>
+</Project>

build/azure-pipelines.yml

@@ -117,7 +117,7 @@ stages:
               artifactName: csharp-docs-dlls
           - powershell: |
               dotnet tool install --global CycloneDX
-              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
+              dotnet-CycloneDX $(solution) --spec-version 1.5 --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
             displayName: 'Generate Backend BOM'
           - powershell: |
               npm install --global @cyclonedx/cyclonedx-npm
@@ -175,6 +175,41 @@ stages:
             artifact: bom-frontend
             displayName: 'Publish Frontend BOM'
 
+      - job: C
+        displayName: Build Test Helpers Package
+        pool:
+          vmImage: "ubuntu-latest"
+        steps:
+          - checkout: self
+            submodules: false
+            lfs: false
+            fetchDepth: 500
+          - template: templates/e2e-install.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
+          - bash: |
+              echo "##[command]Install nbgv"
+              dotnet tool install --tool-path . nbgv
+              echo "##[command]Running nbgv get-version"
+              PACKAGE_VERSION=$(nbgv get-version -v NpmPackageVersion)
+              echo "##[command]Running npm version"
+              echo "##[debug]Version: $PACKAGE_VERSION"
+              cd tests/Umbraco.Tests.AcceptanceTest
+              npm version $PACKAGE_VERSION --allow-same-version --no-git-tag-version
+            displayName: Set NPM Version
+          - bash: |
+              echo "##[command]Running npm pack"
+              mkdir $(Build.ArtifactStagingDirectory)/npm-testhelpers
+              npm pack --pack-destination $(Build.ArtifactStagingDirectory)/npm-testhelpers
+            displayName: Run npm pack
+            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+          - task: PublishPipelineArtifact@1
+            displayName: Publish Test Helpers npm artifact
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/npm-testhelpers
+              artifactName: npm-testhelpers
+
   - stage: E2E_BOM
     displayName: E2E Tests BOM Generation
     dependsOn: []
@@ -579,7 +614,6 @@ stages:
       UMBRACO__CMS__GLOBAL__VERSIONCHECKPERIOD: 0
       UMBRACO__CMS__GLOBAL__USEHTTPS: true
       UMBRACO__CMS__HEALTHCHECKS__NOTIFICATION__ENABLED: false
-      UMBRACO__CMS__KEEPALIVE__DISABLEKEEPALIVETASK: true
       UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
       ASPNETCORE_URLS: https://localhost:44331
     jobs:
@@ -832,6 +866,40 @@ stages:
               npm publish "${files[0]}"
             displayName: Push to npm (MyGet)
             workingDirectory: $(Pipeline.Workspace)/npm
+      - job: PublishTestHelpersNpm
+        displayName: Push TestHelpers to pre-release feed (npm)
+        steps:
+          - checkout: none
+          - download: current
+            artifact: npm-testhelpers
+          - bash: |
+              # Check if we are on a nightly build
+              if [ $isNightly = "False" ]; then
+                  echo "##[debug]Prerelease build detected"
+                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
+              else
+                  echo "##[debug]Nightly build detected"
+                  registry="https://www.myget.org/F/umbraconightly/npm/"
+              fi
+              echo "@umbraco-cms:registry=$registry" >> .npmrc
+            env:
+              isNightly: ${{parameters.isNightly}}
+            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+            displayName: Add scoped registry to .npmrc
+          - task: npmAuthenticate@0
+            displayName: Authenticate with npm (MyGet)
+            inputs:
+              workingFile: "$(Pipeline.Workspace)/npm-testhelpers/.npmrc"
+              customEndpoint: "MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly"
+          - bash: |
+              # Setup temp npm project to load in defaults from the local .npmrc
+              npm init -y
+
+              # Find the first .tgz file in the current directory and publish it
+              files=( ./*.tgz )
+              npm publish "${files[0]}"
+            displayName: Push test helpers to npm (MyGet)
+            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
 
   - stage: Deploy_NuGet
     displayName: NuGet release
@@ -886,6 +954,29 @@ stages:
               npm publish "${files[0]}"
             displayName: Push to npm
             workingDirectory: $(Pipeline.Workspace)/npm
+      - job: PublishTestHelpers
+        displayName: Push Test Helpers to NPM
+        steps:
+          - checkout: none
+          - download: current
+            artifact: npm-testhelpers
+          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
+            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+            displayName: Add scoped registry to .npmrc
+          - task: npmAuthenticate@0
+            displayName: Authenticate with npm
+            inputs:
+              workingFile: $(Pipeline.Workspace)/npm-testhelpers/.npmrc
+              customEndpoint: "NPM - Umbraco Backoffice"
+          - script: |
+              # Setup temp npm project to load in defaults from the local .npmrc
+              npm init -y
+
+              # Find the first .tgz file in the current directory and publish it
+              files=( ./*.tgz )
+              npm publish "${files[0]}"
+            displayName: Push test helpers to npm
+            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
 
   - stage: Upload_API_Docs
     pool:

build/nightly-E2E-test-pipelines.yml

@@ -4,12 +4,10 @@ pr: none
 trigger: none
 
 schedules:
-  - cron: '0 0 * * *'
-    displayName: Daily midnight build
+  - cron: '0 3 * * *'
+    displayName: Daily 3AM build (main)
     branches:
       include:
-        - v15/dev
-        - v16/dev
         - main
 
 parameters:
@@ -321,7 +319,8 @@ stages:
 
   - stage: DefaultConfigE2E
     displayName: Default Config E2E Tests
-    dependsOn: Build
+    dependsOn: Integration
+    condition: always()
     variables:
       npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
       # Enable console logging in Release mode
@@ -340,7 +339,6 @@ stages:
       UMBRACO__CMS__GLOBAL__VERSIONCHECKPERIOD: 0
       UMBRACO__CMS__GLOBAL__USEHTTPS: true
       UMBRACO__CMS__HEALTHCHECKS__NOTIFICATION__ENABLED: false
-      UMBRACO__CMS__KEEPALIVE__DISABLEKEEPALIVETASK: true
       UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
       ASPNETCORE_URLS: https://localhost:44331
     jobs:
@@ -502,7 +500,8 @@ stages:
 
   - stage: AdditionalConfigE2E
     displayName: Additional Config E2E Tests
-    dependsOn: Build
+    dependsOn: DefaultConfigE2E
+    condition: always()
     variables:
       npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
       ASPNETCORE_URLS: https://localhost:44331

build/nightly-build-trigger.yml

@@ -10,6 +10,7 @@ schedules:
     include:
     - v13/dev
     - v16/dev
+    - v18/dev
     - main
 
 steps:

build/templates/e2e-install.yml

@@ -29,7 +29,7 @@ steps:
       "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
       UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
       URL=${{ parameters.ASPNETCORE_URLS }}
-      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
+      STORAGE_STATE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
       CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
     displayName: Generate .env
     workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
@@ -47,3 +47,7 @@ steps:
   - script: npm ci --no-fund --no-audit --prefer-offline
     workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
     displayName: Restore NPM packages
+
+  - script: npm run build
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Build test helpers

src/Umbraco.Cms.Api.Common/DependencyInjection/HideBackOfficeTokensHandler.cs

@@ -1,7 +1,10 @@
 using System.Diagnostics.CodeAnalysis;
+using System.Security.Cryptography;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using OpenIddict.Abstractions;
 using OpenIddict.Server;
 using OpenIddict.Validation;
 using Umbraco.Cms.Core;
@@ -25,6 +28,7 @@ internal sealed class HideBackOfficeTokensHandler
     : IOpenIddictServerHandler<OpenIddictServerEvents.ApplyTokenResponseContext>,
         IOpenIddictServerHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>,
         IOpenIddictServerHandler<OpenIddictServerEvents.ExtractTokenRequestContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractRevocationRequestContext>,
         IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>,
         INotificationHandler<UserLogoutSuccessNotification>
 {
@@ -33,13 +37,16 @@ internal sealed class HideBackOfficeTokensHandler
     // The __Host- prefix enforces secure cookies at browser level (requires Secure, Path=/, no Domain).
     // For local development over HTTP, we use a simpler prefix to avoid browser rejection.
     private const string SecureCookiePrefix = "__Host-";
-    private const string AccessTokenCookieName = "umbAccessToken";
-    private const string RefreshTokenCookieName = "umbRefreshToken";
-    private const string PkceCodeCookieName = "umbPkceCode";
+    private readonly string _accessTokenCookieName = "umbAccessToken";
+    private readonly string _refreshTokenCookieName = "umbRefreshToken";
+    private readonly string _pkceCodeCookieName = "umbPkceCode";
 
     private readonly IHttpContextAccessor _httpContextAccessor;
     private readonly IDataProtectionProvider _dataProtectionProvider;
+    private readonly ILogger<HideBackOfficeTokensHandler> _logger;
+#pragma warning disable CS0618 // Type or member is obsolete
     private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
+#pragma warning restore CS0618 // Type or member is obsolete
     private readonly GlobalSettings _globalSettings;
 
     /// <summary>
@@ -47,18 +54,27 @@ internal sealed class HideBackOfficeTokensHandler
     /// </summary>
     /// <param name="httpContextAccessor">The HTTP context accessor.</param>
     /// <param name="dataProtectionProvider">The data protection provider for encrypting cookie values.</param>
+    /// <param name="logger">The logger.</param>
     /// <param name="backOfficeTokenCookieSettings">The back-office token cookie settings.</param>
     /// <param name="globalSettings">The global settings.</param>
     public HideBackOfficeTokensHandler(
         IHttpContextAccessor httpContextAccessor,
         IDataProtectionProvider dataProtectionProvider,
+        ILogger<HideBackOfficeTokensHandler> logger,
+#pragma warning disable CS0618 // Type or member is obsolete
         IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
+#pragma warning restore CS0618 // Type or member is obsolete
         IOptions<GlobalSettings> globalSettings)
     {
         _httpContextAccessor = httpContextAccessor;
         _dataProtectionProvider = dataProtectionProvider;
+        _logger = logger;
         _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
         _globalSettings = globalSettings.Value;
+
+        _accessTokenCookieName += _backOfficeTokenCookieSettings.SiteName;
+        _refreshTokenCookieName += _backOfficeTokenCookieSettings.SiteName;
+        _pkceCodeCookieName += _backOfficeTokenCookieSettings.SiteName;
     }
 
     /// <summary>
@@ -78,13 +94,13 @@ internal sealed class HideBackOfficeTokensHandler
 
         if (context.Response.AccessToken is not null)
         {
-            SetCookie(httpContext, AccessTokenCookieName, context.Response.AccessToken);
+            SetCookie(httpContext, _accessTokenCookieName, context.Response.AccessToken);
             context.Response.AccessToken = RedactedTokenValue;
         }
 
         if (context.Response.RefreshToken is not null)
         {
-            SetCookie(httpContext, RefreshTokenCookieName, context.Response.RefreshToken);
+            SetCookie(httpContext, _refreshTokenCookieName, context.Response.RefreshToken);
             context.Response.RefreshToken = RedactedTokenValue;
         }
 
@@ -106,7 +122,7 @@ internal sealed class HideBackOfficeTokensHandler
 
         if (context.Response.Code is not null)
         {
-            SetCookie(GetHttpContext(), PkceCodeCookieName, context.Response.Code);
+            SetCookie(GetHttpContext(), _pkceCodeCookieName, context.Response.Code);
             context.Response.Code = RedactedTokenValue;
         }
 
@@ -128,12 +144,12 @@ internal sealed class HideBackOfficeTokensHandler
 
         // Handle when the PKCE code is being exchanged for an access token.
         if (context.Request.Code == RedactedTokenValue
-            && TryGetCookie(httpContext, PkceCodeCookieName, out var code))
+            && TryGetCookie(httpContext, _pkceCodeCookieName, out var code))
         {
             context.Request.Code = code;
 
             // We won't need the PKCE cookie after this, let's remove it.
-            RemoveCookie(httpContext, PkceCodeCookieName);
+            RemoveCookie(httpContext, _pkceCodeCookieName);
         }
         else
         {
@@ -144,7 +160,7 @@ internal sealed class HideBackOfficeTokensHandler
 
         // Handle when a refresh token is being exchanged for a new access token.
         if (context.Request.RefreshToken == RedactedTokenValue
-            && TryGetCookie(httpContext, RefreshTokenCookieName, out var refreshToken))
+            && TryGetCookie(httpContext, _refreshTokenCookieName, out var refreshToken))
         {
             context.Request.RefreshToken = refreshToken;
         }
@@ -159,6 +175,40 @@ internal sealed class HideBackOfficeTokensHandler
         return ValueTask.CompletedTask;
     }
 
+    /// <summary>
+    /// This is invoked when a token revocation request is received.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ExtractRevocationRequestContext context)
+    {
+        if (context.Request?.ClientId != Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        HttpContext httpContext = GetHttpContext();
+
+        // Determine which cookie to read based on the token type hint.
+        var cookieName = context.Request.TokenTypeHint == OpenIddictConstants.TokenTypeHints.RefreshToken
+            ? _refreshTokenCookieName
+            : _accessTokenCookieName;
+
+        if (context.Request.Token == RedactedTokenValue
+            && TryGetCookie(httpContext, cookieName, out var token))
+        {
+            context.Request.Token = token;
+        }
+        else
+        {
+            // If we got here, either the token was not redacted, or nothing was found in the expected cookie.
+            // If OpenIddict found a token, it could be an old token that is potentially still valid. For security
+            // reasons, we cannot accept that; at this point, we expect the tokens to be explicitly redacted.
+            context.Request.Token = null;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
     /// <summary>
     /// This is invoked when extracting the auth context for a client request.
     /// </summary>
@@ -170,7 +220,7 @@ internal sealed class HideBackOfficeTokensHandler
             return ValueTask.CompletedTask;
         }
 
-        if (TryGetCookie(GetHttpContext(), AccessTokenCookieName, out var accessToken))
+        if (TryGetCookie(GetHttpContext(), _accessTokenCookieName, out var accessToken))
         {
             context.AccessToken = accessToken;
         }
@@ -190,8 +240,8 @@ internal sealed class HideBackOfficeTokensHandler
             return;
         }
 
-        RemoveCookie(httpContext, AccessTokenCookieName);
-        RemoveCookie(httpContext, RefreshTokenCookieName);
+        RemoveCookie(httpContext, _accessTokenCookieName);
+        RemoveCookie(httpContext, _refreshTokenCookieName);
     }
 
     private HttpContext GetHttpContext()
@@ -247,8 +297,19 @@ internal sealed class HideBackOfficeTokensHandler
         var key = GetCookieKey(httpContext, cookieName);
         if (httpContext.Request.Cookies.TryGetValue(key, out var cookieValue))
         {
-            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
-            return true;
+            try
+            {
+                value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
+                return true;
+            }
+            catch (CryptographicException ex)
+            {
+                // Decryption can fail if the data protection key ring has changed
+                // (e.g., after deployment, app pool recycle, or slot swap).
+                // Treat this as a missing cookie — the user will need to re-authenticate.
+                _logger.LogWarning(ex, "Failed to decrypt back-office token cookie '{CookieName}'. The user will need to re-authenticate.", cookieName);
+                RemoveCookie(httpContext, cookieName);
+            }
         }
 
         value = null;

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderAuthExtensions.cs

@@ -145,6 +145,12 @@ public static class UmbracoBuilderAuthExtensions
                         .UseSingletonHandler<HideBackOfficeTokensHandler>()
                         .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
                 });
+                options.AddEventHandler<OpenIddictServerEvents.ExtractRevocationRequestContext>(configuration =>
+                {
+                    configuration
+                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractRevocationRequestContext>.Descriptor.Order + 1);
+                });
             })
 
             // Register the OpenIddict validation components.

src/Umbraco.Cms.Api.Delivery/Controllers/DeliveryApiControllerBase.cs

@@ -7,6 +7,7 @@ using Umbraco.Cms.Api.Delivery.Configuration;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Features;
 using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Cms.Web.Common.Controllers;
 
 namespace Umbraco.Cms.Api.Delivery.Controllers;
 
@@ -14,6 +15,7 @@ namespace Umbraco.Cms.Api.Delivery.Controllers;
 [JsonOptionsName(Constants.JsonOptionsNames.DeliveryApi)]
 [MapToApi(DeliveryApiConfiguration.ApiName)]
 [Authorize(Policy = AuthorizationPolicies.UmbracoFeatureEnabled)]
+[MaintenanceModeActionFilter]
 public abstract class DeliveryApiControllerBase : Controller, IUmbracoFeature
 {
     protected string DecodePath(string path)

src/Umbraco.Cms.Api.Delivery/DependencyInjection/UmbracoApplicationBuilderExtensions.cs

@@ -0,0 +1,26 @@
+using Microsoft.AspNetCore.Builder;
+using Umbraco.Cms.Web.Common.ApplicationBuilder;
+
+namespace Umbraco.Extensions;
+
+/// <summary>
+/// <see cref="IApplicationBuilder" /> extensions for the Umbraco Delivery API.
+/// </summary>
+public static class DeliveryApiApplicationBuilderExtensions
+{
+    /// <summary>
+    /// Sets up routes for the Umbraco Delivery API.
+    /// </summary>
+    /// <remarks>
+    /// This method maps attribute-routed controllers including the Delivery API endpoints.
+    /// Call this when using <c>AddDeliveryApi()</c> without <c>AddBackOffice()</c>, as the
+    /// backoffice endpoints normally handle the controller mapping.
+    /// </remarks>
+    /// <param name="builder">The Umbraco endpoint builder context.</param>
+    /// <returns>The <see cref="IUmbracoEndpointBuilderContext" /> for chaining.</returns>
+    public static IUmbracoEndpointBuilderContext UseDeliveryApiEndpoints(this IUmbracoEndpointBuilderContext builder)
+    {
+        builder.EndpointRouteBuilder.MapControllers();
+        return builder;
+    }
+}

src/Umbraco.Cms.Api.Delivery/DependencyInjection/UmbracoBuilderExtensions.cs

@@ -22,7 +22,6 @@ using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Notifications;
-using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Infrastructure.Security;
 using Umbraco.Cms.Web.Common.ApplicationBuilder;
 
@@ -30,8 +29,20 @@ namespace Umbraco.Extensions;
 
 public static class UmbracoBuilderExtensions
 {
+    /// <summary>
+    /// Add services for the Umbraco Delivery API (headless content delivery).
+    /// </summary>
+    /// <remarks>
+    /// This method assumes that either <c>AddBackOffice()</c> or <c>AddCore()</c> has already been called.
+    /// It registers Delivery API-specific services such as controllers, output caching, and member authentication.
+    /// </remarks>
+    /// <param name="builder">The Umbraco builder.</param>
+    /// <returns>The Umbraco builder.</returns>
     public static IUmbracoBuilder AddDeliveryApi(this IUmbracoBuilder builder)
     {
+        // Delivery API supports member authentication for protected content
+        builder.AddMembersIdentity();
+
         builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
         builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
         builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();

src/Umbraco.Cms.Api.Delivery/Filters/DeliveryApiAccessAttribute.cs

@@ -4,7 +4,11 @@ using Umbraco.Cms.Core.DeliveryApi;
 
 namespace Umbraco.Cms.Api.Delivery.Filters;
 
-internal sealed class DeliveryApiAccessAttribute : TypeFilterAttribute
+/// <summary>
+/// An action filter attribute that verifies public or preview access to the Delivery API, returning
+/// a <c>401 Unauthorized</c> result if access is denied.
+/// </summary>
+public sealed class DeliveryApiAccessAttribute : TypeFilterAttribute
 {
     public DeliveryApiAccessAttribute()
         : base(typeof(DeliveryApiAccessFilter))

src/Umbraco.Cms.Api.Delivery/Filters/DeliveryApiMediaAccessAttribute.cs

@@ -4,7 +4,11 @@ using Umbraco.Cms.Core.DeliveryApi;
 
 namespace Umbraco.Cms.Api.Delivery.Filters;
 
-internal sealed class DeliveryApiMediaAccessAttribute : TypeFilterAttribute
+/// <summary>
+/// An action filter attribute that verifies public access to the media Delivery API, returning
+/// a <c>401 Unauthorized</c> result if access is denied.
+/// </summary>
+public sealed class DeliveryApiMediaAccessAttribute : TypeFilterAttribute
 {
     public DeliveryApiMediaAccessAttribute()
         : base(typeof(DeliveryApiMediaAccessFilter))

src/Umbraco.Cms.Api.Delivery/Indexing/Selectors/AncestorsSelectorIndexer.cs

@@ -1,12 +1,13 @@
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Infrastructure.Examine;
 
 namespace Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 
 public sealed class AncestorsSelectorIndexer : IContentIndexHandler
 {
     // NOTE: "id" is a reserved field name
-    internal const string FieldName = "itemId";
+    internal const string FieldName = UmbracoExamineFieldNames.DeliveryApiContentIndex.ItemId;
 
     public IEnumerable<IndexFieldValue> GetFieldValues(IContent content, string? culture)
         => new[] { new IndexFieldValue { FieldName = FieldName, Values = new object[] { content.Key } } };

src/Umbraco.Cms.Api.Delivery/Routing/VersionedDeliveryApiRouteAttribute.cs

@@ -2,7 +2,10 @@ using Umbraco.Cms.Web.Common.Routing;
 
 namespace Umbraco.Cms.Api.Delivery.Routing;
 
-internal sealed class VersionedDeliveryApiRouteAttribute : BackOfficeRouteAttribute
+/// <summary>
+/// A routing attribute that ensures consistent Delivery API endpoint paths.
+/// </summary>
+public sealed class VersionedDeliveryApiRouteAttribute : BackOfficeRouteAttribute
 {
     public VersionedDeliveryApiRouteAttribute(string template)
         : base($"delivery/api/v{{version:apiVersion}}/{template.TrimStart('/')}")

src/Umbraco.Cms.Api.Delivery/Services/ApiContentQueryProvider.cs

@@ -17,7 +17,7 @@ namespace Umbraco.Cms.Api.Delivery.Services;
 /// </summary>
 internal sealed class ApiContentQueryProvider : IApiContentQueryProvider
 {
-    private const string ItemIdFieldName = "itemId";
+    private const string ItemIdFieldName = UmbracoExamineFieldNames.DeliveryApiContentIndex.ItemId;
     private readonly IExamineManager _examineManager;
     private readonly ILogger<ApiContentQueryProvider> _logger;
     private readonly ApiContentQuerySelectorBuilder _selectorBuilder;

src/Umbraco.Cms.Api.Management/CLAUDE.md

@@ -26,7 +26,8 @@ RESTful API for Umbraco backoffice operations. Manages content, media, users, an
 - **Validation**: FluentValidation via base controllers
 - **Serialization**: System.Text.Json with custom converters
 - **Mapping**: Manual presentation factories (no AutoMapper)
-- **Patching**: JsonPatch.Net for PATCH operations
+- **Patching**: Custom patch engine for PATCH operations (Umbraco.Cms.Api.Management.Patching)
+  - ⚠️ Legacy JsonPatch.Net support (IJsonPatchService) still available but **obsolete** - scheduled for removal in v19
 - **Real-time**: SignalR hubs (`BackofficeHub`, `ServerEventHub`)
 - **DI**: Microsoft.Extensions.DependencyInjection via `ManagementApiComposer`
 
@@ -70,7 +71,6 @@ src/Umbraco.Cms.Api.Management/
 - **Umbraco.Cms.Api.Common** - Shared API infrastructure (base controllers, OpenAPI config)
 - **Umbraco.Infrastructure** - Service implementations, data access
 - **Umbraco.PublishedCache.HybridCache** - Published content queries
-- **JsonPatch.Net** - JSON Patch (RFC 6902) support
 - **Swashbuckle.AspNetCore** - OpenAPI generation
 
 ### Design Patterns

src/Umbraco.Cms.Api.Management/CompatibilitySuppressions.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- https://learn.microsoft.com/dotnet/fundamentals/package-validation/diagnostic-ids -->
+<Suppressions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+  <Suppression>
+    <DiagnosticId>CP0002</DiagnosticId>
+    <Target>M:Umbraco.Cms.Api.Management.Controllers.Document.GetPublicAccessDocumentController.GetPublicAccess(System.Threading.CancellationToken,System.Guid)</Target>
+    <Left>lib/net10.0/Umbraco.Cms.Api.Management.dll</Left>
+    <Right>lib/net10.0/Umbraco.Cms.Api.Management.dll</Right>
+    <IsBaselineSuppression>true</IsBaselineSuppression>
+  </Suppression>
+  <Suppression>
+    <DiagnosticId>CP0002</DiagnosticId>
+    <Target>M:Umbraco.Cms.Api.Management.Controllers.UrlSegment.ResizeImagingController.Urls(System.Collections.Generic.HashSet{System.Guid},System.Int32,System.Int32,System.Nullable{Umbraco.Cms.Core.Models.ImageCropMode})</Target>
+    <Left>lib/net10.0/Umbraco.Cms.Api.Management.dll</Left>
+    <Right>lib/net10.0/Umbraco.Cms.Api.Management.dll</Right>
+    <IsBaselineSuppression>true</IsBaselineSuppression>
+  </Suppression>
+</Suppressions>

src/Umbraco.Cms.Api.Management/Configuration/ConfigureBackOfficeCookieOptions.cs

@@ -140,15 +140,20 @@ public class ConfigureBackOfficeCookieOptions : IConfigureNamedOptions<CookieAut
 
                 await securityStampValidator.ValidateAsync(ctx);
 
-                // We have to manually specify Issued and Expires,
-                // because the SecurityStampValidator refreshes the principal every 30 minutes,
-                // When the principal is refreshed the Issued is update to time of refresh, however, the Expires remains unchanged
-                // When we then try and renew, the difference of issued and expires effectively becomes the new ExpireTimeSpan
-                // meaning we effectively lose 30 minutes of our ExpireTimeSpan for EVERY principal refresh if we don't
-                // https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/Cookies/src/CookieAuthenticationHandler.cs#L115
-                ctx.Properties.IssuedUtc = _timeProvider.GetUtcNow();
-                ctx.Properties.ExpiresUtc = _timeProvider.GetUtcNow().Add(_globalSettings.TimeOut);
-                ctx.ShouldRenew = true;
+                // Only reset timestamps when a renewal was already triggered (by the SecurityStampValidator
+                // or by EnsureTicketRenewalIfKeepUserLoggedIn above).
+                // When the SecurityStampValidator refreshes the principal, it sets ShouldRenew but updates
+                // IssuedUtc without updating ExpiresUtc, causing the effective cookie lifetime to shrink
+                // with each validation. The manual reset here fixes that drift.
+                // IMPORTANT: Do NOT unconditionally set ShouldRenew or reset IssuedUtc - doing so prevents
+                // the SecurityStampValidator from ever exceeding its ValidationInterval during active use,
+                // which breaks AllowConcurrentLogins enforcement.
+                if (ctx.ShouldRenew)
+                {
+                    DateTimeOffset now = _timeProvider.GetUtcNow();
+                    ctx.Properties.IssuedUtc = now;
+                    ctx.Properties.ExpiresUtc = now.Add(_globalSettings.TimeOut);
+                }
             },
             OnSigningIn = ctx =>
             {

src/Umbraco.Cms.Api.Management/Configuration/ConfigureBackOfficeExposedCookieOptions.cs

@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Configuration;
+
+/// <summary>
+///     Used to configure <see cref="CookieAuthenticationOptions" /> for the back office "exposed" authentication type
+/// </summary>
+public class ConfigureBackOfficeExposedCookieOptions : IConfigureNamedOptions<CookieAuthenticationOptions>
+{
+    private readonly SecuritySettings _securitySettings;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ConfigureBackOfficeExposedCookieOptions" /> class.
+    /// </summary>
+    /// <param name="securitySettings">The <see cref="SecuritySettings" /> options</param>
+    public ConfigureBackOfficeExposedCookieOptions(IOptions<SecuritySettings> securitySettings)
+        => _securitySettings = securitySettings.Value;
+
+    /// <inheritdoc />
+    public void Configure(string? name, CookieAuthenticationOptions options)
+    {
+        if (name != Constants.Security.BackOfficeExposedAuthenticationType)
+        {
+            return;
+        }
+
+        Configure(options);
+    }
+
+    /// <inheritdoc />
+    public void Configure(CookieAuthenticationOptions options)
+    {
+        options.Cookie.Name = _securitySettings.AuthCookieName.IsNullOrWhiteSpace()
+            ? Constants.Security.BackOfficeExposedCookieName
+            : $"{_securitySettings.AuthCookieName}{Constants.Security.BackOfficeExposedCookieNamePostfix}";
+        options.Cookie.HttpOnly = true;
+        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+        options.SlidingExpiration = true;
+    }
+}

src/Umbraco.Cms.Api.Management/Configuration/ConfigureBackOfficeSecurityStampValidatorOptions.cs

@@ -1,4 +1,4 @@
-using Microsoft.Extensions.Options;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Api.Management.Security;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Web.Common.Security;
@@ -13,6 +13,11 @@ public class ConfigureBackOfficeSecurityStampValidatorOptions : IConfigureOption
     private readonly SecuritySettings _securitySettings;
     private readonly TimeProvider _timeProvider;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigureBackOfficeSecurityStampValidatorOptions"/> class with the specified security settings and time provider.
+    /// </summary>
+    /// <param name="securitySettings">The <see cref="IOptions{SecuritySettings}"/> used to access security-related configuration options.</param>
+    /// <param name="timeProvider">The <see cref="TimeProvider"/> used for time-based operations.</param>
     public ConfigureBackOfficeSecurityStampValidatorOptions(IOptions<SecuritySettings> securitySettings, TimeProvider timeProvider)
     {
         _timeProvider = timeProvider;
@@ -23,6 +28,6 @@ public class ConfigureBackOfficeSecurityStampValidatorOptions : IConfigureOption
     public void Configure(BackOfficeSecurityStampValidatorOptions options)
     {
         options.TimeProvider = _timeProvider;
-        ConfigureSecurityStampOptions.ConfigureOptions(options, _securitySettings);
+        ConfigureSecurityStampOptions.ConfigureOptions(options, _securitySettings.GetUserAllowConcurrentLogins());
     }
 }

src/Umbraco.Cms.Api.Management/Configuration/ConfigureUmbracoManagementApiSwaggerGenOptions.cs

@@ -9,15 +9,30 @@ using Umbraco.Cms.Api.Management.OpenApi;
 
 namespace Umbraco.Cms.Api.Management.Configuration;
 
+/// <summary>
+/// Provides configuration for Swagger generation options specific to the Umbraco Management API.
+/// This class is used to customize the Swagger documentation for the API endpoints.
+/// </summary>
 public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
     private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigureUmbracoManagementApiSwaggerGenOptions"/> class.
+    /// </summary>
+    /// <param name="umbracoJsonTypeInfoResolver">An instance of <see cref="IUmbracoJsonTypeInfoResolver"/> used to resolve JSON type information for Umbraco.</param>
     public ConfigureUmbracoManagementApiSwaggerGenOptions(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
     {
         _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
     }
 
+    /// <summary>
+    /// Configures the <see cref="SwaggerGenOptions"/> for the Umbraco Management API.
+    /// Sets up the Swagger documentation, including API metadata, security definitions for OAuth2 authentication,
+    /// operation filters for response headers and security requirements, and schema filters for non-nullable properties.
+    /// Also configures polymorphism handling and discriminator properties for OpenAPI schemas.
+    /// </summary>
+    /// <param name="swaggerGenOptions">The <see cref="SwaggerGenOptions"/> instance to configure for the Management API.</param>
     public void Configure(SwaggerGenOptions swaggerGenOptions)
     {
         swaggerGenOptions.SwaggerDoc(

src/Umbraco.Cms.Api.Management/Controllers/BackOfficeLoginController.cs

@@ -7,6 +7,9 @@ using Umbraco.Cms.Core.Hosting;
 
 namespace Umbraco.Cms.Api.Management;
 
+/// <summary>
+/// Provides endpoints for managing back office user authentication and login operations.
+/// </summary>
 [ApiExplorerSettings(IgnoreApi = true)]
 [Route(LoginPath)]
 public class BackOfficeLoginController : Controller
@@ -15,6 +18,11 @@ public class BackOfficeLoginController : Controller
     private readonly IHostingEnvironment _hostingEnvironment;
     private readonly GlobalSettings _globalSettings;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BackOfficeLoginController"/> class.
+    /// </summary>
+    /// <param name="globalSettings">A snapshot of the application's global settings options.</param>
+    /// <param name="hostingEnvironment">The current hosting environment for the application.</param>
     public BackOfficeLoginController(
         IOptionsSnapshot<GlobalSettings> globalSettings,
         IHostingEnvironment hostingEnvironment)
@@ -24,6 +32,16 @@ public class BackOfficeLoginController : Controller
     }
 
     // GET
+    /// <summary>
+    /// Handles the GET request for the back office login page.
+    /// If the user is already authenticated, updates the model accordingly.
+    /// Ensures the return URL is a relative path and sets default values if necessary.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
+    /// <param name="model">The model containing login information and the return URL.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> that renders the login view with the model, or a bad request result if the return URL is invalid.
+    /// </returns>
     public async Task<IActionResult> Index(CancellationToken cancellationToken, BackOfficeLoginModel model)
     {
         AuthenticateResult cookieAuthResult = await HttpContext.AuthenticateAsync(Constants.Security.BackOfficeAuthenticationType);

src/Umbraco.Cms.Api.Management/Controllers/BackOfficeLoginModel.cs

@@ -2,6 +2,9 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace Umbraco.Cms.Api.Management;
 
+/// <summary>
+/// Represents a model containing the credentials required for logging into the Umbraco back office.
+/// </summary>
 [BindProperties]
 public class BackOfficeLoginModel
 {
@@ -16,5 +19,8 @@ public class BackOfficeLoginModel
     /// </summary>
     public string? UmbracoUrl { get; set; }
 
+    /// <summary>
+    /// Indicates whether the user is already logged in to the back office.
+    /// </summary>
     public bool UserIsAlreadyLoggedIn { get; set; }
 }

src/Umbraco.Cms.Api.Management/Controllers/Content/ContentCollectionControllerBase.cs

@@ -14,6 +14,13 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Content;
 
+/// <summary>
+/// Serves as a base controller for managing collections of content items, providing shared functionality for handling content collections and their variants.
+/// </summary>
+/// <typeparam name="TContent">The content entity type.</typeparam>
+/// <typeparam name="TCollectionResponseModel">The response model type for the content collection.</typeparam>
+/// <typeparam name="TValueResponseModelBase">The base type for value response models within the collection.</typeparam>
+/// <typeparam name="TVariantResponseModel">The response model type for content variants.</typeparam>
 public abstract class ContentCollectionControllerBase<TContent, TCollectionResponseModel, TValueResponseModelBase, TVariantResponseModel> : ManagementApiControllerBase
     where TContent : class, IContentBase
     where TCollectionResponseModel : ContentResponseModelBase<TValueResponseModelBase, TVariantResponseModel>

src/Umbraco.Cms.Api.Management/Controllers/Content/ContentControllerBase.cs

@@ -8,6 +8,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Content;
 
+/// <summary>
+/// Serves as the base controller for content management operations in the Umbraco CMS API, providing shared functionality for content-related controllers.
+/// </summary>
 public abstract class ContentControllerBase : ManagementApiControllerBase
 {
     protected IActionResult ContentEditingOperationStatusResult(ContentEditingOperationStatus status)
@@ -53,6 +56,15 @@ public abstract class ContentControllerBase : ManagementApiControllerBase
             ContentEditingOperationStatus.PropertyTypeNotFound => NotFound(problemDetailsBuilder
                 .WithTitle("One or more property types could not be found")
                 .Build()),
+            ContentEditingOperationStatus.PropertyTypeCultureVarianceMismatch => BadRequest(problemDetailsBuilder
+                .WithTitle("Property type culture variance mismatch")
+                .WithDetail("One or more property values specify a culture for an invariant property, or are missing a culture for a culture-variant property. "
+                    + "This can happen when a property is inherited from a variant composition on an invariant content type, which downgrades it to invariant.")
+                .Build()),
+            ContentEditingOperationStatus.PropertyTypeSegmentVarianceMismatch => BadRequest(problemDetailsBuilder
+                .WithTitle("Property type segment variance mismatch")
+                .WithDetail("One or more property values have a segment that does not match the property type's segment variance.")
+                .Build()),
             ContentEditingOperationStatus.InTrash => BadRequest(problemDetailsBuilder
                 .WithTitle("Content is in the recycle bin")
                 .WithDetail("Could not perform the operation because the targeted content was in the recycle bin.")
@@ -79,11 +91,11 @@ public abstract class ContentControllerBase : ManagementApiControllerBase
                 .Build()),
             ContentEditingOperationStatus.CannotDeleteWhenReferenced => BadRequest(problemDetailsBuilder
                 .WithTitle("Cannot delete a referenced content item")
-                .WithDetail("Cannot delete a referenced document, while the setting ContentSettings.DisableDeleteWhenReferenced is enabled.")
+                .WithDetail("Cannot delete a referenced content item, while the setting ContentSettings.DisableDeleteWhenReferenced is enabled.")
                 .Build()),
             ContentEditingOperationStatus.CannotMoveToRecycleBinWhenReferenced => BadRequest(problemDetailsBuilder
-                .WithTitle("Cannot move a referenced document to the recycle bin")
-                .WithDetail("Cannot move a referenced document to the recycle bin, while the setting ContentSettings.DisableUnpublishWhenReferenced is enabled.")
+                .WithTitle("Cannot move a referenced content item to the recycle bin")
+                .WithDetail("Cannot move a referenced content item to the recycle bin, while the setting ContentSettings.DisableDeleteWhenReferenced is enabled.")
                 .Build()),
             ContentEditingOperationStatus.Unknown => StatusCode(
                 StatusCodes.Status500InternalServerError,

src/Umbraco.Cms.Api.Management/Controllers/Culture/AllCultureController.cs

@@ -9,18 +9,33 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Culture;
 
+/// <summary>
+/// API controller responsible for retrieving and managing culture information in the system.
+/// </summary>
 [ApiVersion("1.0")]
 public class AllCultureController : CultureControllerBase
 {
     private readonly IUmbracoMapper _umbracoMapper;
     private readonly ICultureService _cultureService;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="AllCultureController"/> class with the specified Umbraco mapper and culture service.
+    /// </summary>
+    /// <param name="umbracoMapper">An instance of <see cref="IUmbracoMapper"/> used for mapping Umbraco objects.</param>
+    /// <param name="cultureService">An instance of <see cref="ICultureService"/> used for managing culture information.</param>
     public AllCultureController(IUmbracoMapper umbracoMapper, ICultureService cultureService)
     {
         _umbracoMapper = umbracoMapper;
         _cultureService = cultureService;
     }
 
+    /// <summary>
+    /// Retrieves a paginated list of all available cultures, including their English and localized names.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="skip">The number of cultures to skip before starting to collect the result set.</param>
+    /// <param name="take">The maximum number of cultures to return.</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains a <see cref="PagedViewModel{CultureReponseModel}"/> with the paginated cultures.</returns>
     [HttpGet]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<CultureReponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Culture/CultureControllerBase.cs

@@ -1,8 +1,11 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Culture;
 
+/// <summary>
+/// Serves as the base controller for API endpoints that manage culture-related operations in the Umbraco CMS.
+/// </summary>
 [VersionedApiBackOfficeRoute("culture")]
 [ApiExplorerSettings(GroupName = "Culture")]
 public abstract class CultureControllerBase : ManagementApiControllerBase

src/Umbraco.Cms.Api.Management/Controllers/DataType/BatchDataTypesController.cs

@@ -0,0 +1,60 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels;
+using Umbraco.Cms.Api.Management.ViewModels.DataType;
+using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType;
+
+/// <summary>
+/// Provides an API controller for retrieving the full details for multiple data types by key.
+/// </summary>
+[ApiVersion("1.0")]
+public class BatchDataTypesController : DataTypeControllerBase
+{
+    private readonly IDataTypeService _dataTypeService;
+    private readonly IUmbracoMapper _umbracoMapper;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BatchDataTypesController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">The data type service.</param>
+    /// <param name="umbracoMapper">The presentation model mapper.</param>
+    public BatchDataTypesController(IDataTypeService dataTypeService, IUmbracoMapper umbracoMapper)
+    {
+        _dataTypeService = dataTypeService;
+        _umbracoMapper = umbracoMapper;
+    }
+
+    [HttpGet("batch")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(BatchResponseModel<DataTypeResponseModel>), StatusCodes.Status200OK)]
+    [EndpointSummary("Gets multiple data types.")]
+    [EndpointDescription("Gets multiple data types identified by the provided Ids.")]
+    public async Task<IActionResult> Batch(
+        CancellationToken cancellationToken,
+        [FromQuery(Name = "id")] HashSet<Guid> ids)
+    {
+        Guid[] requestedIds = [.. ids];
+
+        if (requestedIds.Length == 0)
+        {
+            return Ok(new BatchResponseModel<DataTypeResponseModel>());
+        }
+
+        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(requestedIds);
+
+        List<IDataType> ordered = OrderByRequestedIds(dataTypes, requestedIds);
+
+        var responseModels = ordered.Select(dt => _umbracoMapper.Map<DataTypeResponseModel>(dt)!).ToList();
+
+        return Ok(new BatchResponseModel<DataTypeResponseModel>
+        {
+            Total = responseModels.Count,
+            Items = responseModels,
+        });
+    }
+}

src/Umbraco.Cms.Api.Management/Controllers/DataType/BatchSchemasDataTypeController.cs

@@ -0,0 +1,71 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels;
+using Umbraco.Cms.Api.Management.ViewModels.DataType;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType;
+
+/// <summary>
+/// Controller for retrieving multiple data type value schemas in a single request.
+/// </summary>
+[ApiVersion("1.0")]
+public class BatchSchemasDataTypeController : DataTypeControllerBase
+{
+    private readonly IPropertyEditorSchemaService _schemaService;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BatchSchemasDataTypeController"/> class.
+    /// </summary>
+    /// <param name="schemaService">The property editor schema service.</param>
+    public BatchSchemasDataTypeController(IPropertyEditorSchemaService schemaService)
+        => _schemaService = schemaService;
+
+    /// <summary>
+    /// Gets the value schemas for multiple data types.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <param name="ids">The unique identifiers of the data types.</param>
+    /// <returns>The schema information for the requested data types.</returns>
+    /// <remarks>
+    /// Returns schema information for property editors that implement <c>IValueSchemaProvider</c>.
+    /// Each item includes an error field if the schema could not be retrieved (e.g., data type not found or schema not supported).
+    /// </remarks>
+    [HttpGet("schemas/batch")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(FetchResponseModel<DataTypeSchemaItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<IActionResult> GetSchemas(
+        CancellationToken cancellationToken,
+        [FromQuery(Name = "id")] Guid[] ids)
+    {
+        Guid[] requestedIds = [.. ids.Distinct()];
+
+        if (requestedIds.Length == 0)
+        {
+            return Ok(new FetchResponseModel<DataTypeSchemaItemResponseModel>());
+        }
+
+        var items = new List<DataTypeSchemaItemResponseModel>();
+
+        foreach (Guid id in requestedIds)
+        {
+            Attempt<PropertyValueSchema, PropertyEditorSchemaOperationStatus> attempt = await _schemaService.GetSchemaAsync(id);
+            items.Add(new DataTypeSchemaItemResponseModel
+            {
+                Id = id,
+                ValueTypeName = attempt.Success ? attempt.Result.ValueType?.FullName : null,
+                JsonSchema = attempt.Success ? attempt.Result.JsonSchema : null,
+                Error = attempt.Success ? null : attempt.Status.ToString(),
+            });
+        }
+
+        return Ok(new FetchResponseModel<DataTypeSchemaItemResponseModel>
+        {
+            Total = items.Count,
+            Items = items,
+        });
+    }
+}

src/Umbraco.Cms.Api.Management/Controllers/DataType/ByKeyDataTypeController.cs

@@ -8,18 +8,34 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// Controller for managing data types by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDataTypeController : DataTypeControllerBase
 {
     private readonly IDataTypeService _dataTypeService;
     private readonly IUmbracoMapper _umbracoMapper;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ByKeyDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">Service used for managing and retrieving data types.</param>
+    /// <param name="umbracoMapper">The mapper used to map between Umbraco domain models and API models.</param>
     public ByKeyDataTypeController(IDataTypeService dataTypeService, IUmbracoMapper umbracoMapper)
     {
         _dataTypeService = dataTypeService;
         _umbracoMapper = umbracoMapper;
     }
 
+    /// <summary>
+    /// Retrieves a data type by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the data type to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing the data type if found; otherwise, a 404 Not Found result.
+    /// </returns>
     [HttpGet("{id:guid}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(DataTypeResponseModel), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/ConfigurationDataTypeController.cs

@@ -8,13 +8,25 @@ using Umbraco.Cms.Core.Configuration.Models;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// Controller responsible for managing configuration for data types in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ConfigurationDataTypeController : DataTypeControllerBase
 {
     private readonly DataTypesSettings _dataTypesSettings;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigurationDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypesSettings">An <see cref="IOptionsSnapshot{T}"/> containing the <see cref="DataTypesSettings"/> configuration options.</param>
     public ConfigurationDataTypeController(IOptionsSnapshot<DataTypesSettings> dataTypesSettings) => _dataTypesSettings = dataTypesSettings.Value;
 
+    /// <summary>
+    /// Retrieves the configuration settings for data types, including whether data types can be changed and the identifiers for document and media list views.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token that can be used to cancel the operation.</param>
+    /// <returns>An <see cref="IActionResult"/> containing a <see cref="DatatypeConfigurationResponseModel"/> with the data type configuration settings.</returns>
     [HttpGet("configuration")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(DatatypeConfigurationResponseModel), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/CopyDataTypeController.cs

@@ -12,6 +12,9 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// API controller responsible for handling requests to copy data types within the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class CopyDataTypeController : DataTypeControllerBase
@@ -19,12 +22,26 @@ public class CopyDataTypeController : DataTypeControllerBase
     private readonly IDataTypeService _dataTypeService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CopyDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">An instance of <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="backOfficeSecurityAccessor">An instance of <see cref="IBackOfficeSecurityAccessor"/> used to access back office security information.</param>
     public CopyDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
         _dataTypeService = dataTypeService;
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    /// <summary>
+    /// Creates a copy of the specified data type.
+    /// The new data type will have a unique Id and its name will have " (copy)" appended.
+    /// Optionally, the copy can be placed in a specified container if a target container Id is provided.
+    /// </summary>
+    /// <param name="cancellationToken">Token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to copy.</param>
+    /// <param name="copyDataTypeRequestModel">The request model containing copy options, such as the target container Id.</param>
+    /// <returns>A result indicating the outcome of the copy operation.</returns>
     [HttpPost("{id:guid}/copy")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status201Created)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/CreateDataTypeController.cs

@@ -13,6 +13,9 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// API controller responsible for handling requests to create new data types in Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class CreateDataTypeController : DataTypeControllerBase
@@ -21,6 +24,12 @@ public class CreateDataTypeController : DataTypeControllerBase
     private readonly IDataTypePresentationFactory _dataTypePresentationFactory;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">The <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="dataTypePresentationFactory">The <see cref="IDataTypePresentationFactory"/> used to create data type presentation models.</param>
+    /// <param name="backOfficeSecurityAccessor">The <see cref="IBackOfficeSecurityAccessor"/> used to access back office security information.</param>
     public CreateDataTypeController(IDataTypeService dataTypeService, IDataTypePresentationFactory dataTypePresentationFactory, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
         _dataTypeService = dataTypeService;
@@ -28,6 +37,14 @@ public class CreateDataTypeController : DataTypeControllerBase
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    /// <summary>
+    /// Creates a new data type using the configuration provided in the request model.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="createDataTypeRequestModel">The model containing the configuration details for the new data type.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> that represents the result of the create operation. Returns <c>201 Created</c> on success, or an appropriate error response on failure.
+    /// </returns>
     [HttpPost]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status201Created)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/DataTypeControllerBase.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.Builders;
@@ -9,6 +9,10 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// Serves as the base controller for managing data types in the Umbraco CMS API.
+/// This class is intended to be inherited by controllers that handle data type operations.
+/// </summary>
 [VersionedApiBackOfficeRoute(Constants.UdiEntityType.DataType)]
 [ApiExplorerSettings(GroupName = "Data Type")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentsOrMediaOrMembersOrContentTypes)]
@@ -55,6 +59,21 @@ public abstract class DataTypeControllerBase : ManagementApiControllerBase
 
     protected IActionResult DataTypeNotFound() => OperationStatusResult(DataTypeOperationStatus.NotFound, DataTypeNotFound);
 
+    protected IActionResult PropertyEditorSchemaOperationStatusResult(PropertyEditorSchemaOperationStatus status) =>
+        OperationStatusResult(status, problemDetailsBuilder => status switch
+        {
+            PropertyEditorSchemaOperationStatus.DataTypeNotFound => NotFound(problemDetailsBuilder
+                .WithTitle("The data type could not be found")
+                .Build()),
+            PropertyEditorSchemaOperationStatus.SchemaNotSupported => NotFound(problemDetailsBuilder
+                .WithTitle("Schema not supported")
+                .WithDetail("The property editor for this data type does not support schema information.")
+                .Build()),
+            _ => StatusCode(StatusCodes.Status500InternalServerError, problemDetailsBuilder
+                .WithTitle("Unknown property editor schema operation status.")
+                .Build()),
+        });
+
     private IActionResult DataTypeNotFound(ProblemDetailsBuilder problemDetailsBuilder)
         => NotFound(problemDetailsBuilder
             .WithTitle("The data type could not be found")

src/Umbraco.Cms.Api.Management/Controllers/DataType/DeleteDataTypeController.cs

@@ -11,6 +11,9 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// API controller responsible for handling requests to delete data types in the system.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class DeleteDataTypeController : DataTypeControllerBase
@@ -18,12 +21,23 @@ public class DeleteDataTypeController : DataTypeControllerBase
     private readonly IDataTypeService _dataTypeService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeleteDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage and delete data types.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context and authentication.</param>
     public DeleteDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
         _dataTypeService = dataTypeService;
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    /// <summary>
+    /// Deletes a data type identified by the provided Id.
+    /// </summary>
+    /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
+    /// <param name="id">The unique identifier of the data type to delete.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the delete operation.</returns>
     [HttpDelete("{id:guid}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Filter/DataTypeFilterControllerBase.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;
@@ -6,6 +6,10 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Filter;
 
+/// <summary>
+/// Serves as the base controller for implementing data type filtering operations in the API.
+/// Provides common functionality for derived controllers handling data type filters.
+/// </summary>
 [ApiExplorerSettings(GroupName = "Data Type")]
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Filter}/{Constants.UdiEntityType.DataType}")]
 // This auth policy might become problematic, as when getting DataTypes on Media types, you don't need access to the document tree.

src/Umbraco.Cms.Api.Management/Controllers/DataType/Filter/FilterDataTypeFilterController.cs

@@ -11,18 +11,36 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Filter;
 
+/// <summary>
+/// Controller responsible for handling operations related to filters on data types in the management API.
+/// </summary>
 [ApiVersion("1.0")]
 public class FilterDataTypeFilterController : DataTypeFilterControllerBase
 {
     private readonly IDataTypeService _dataTypeService;
     private readonly IUmbracoMapper _mapper;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.DataType.Filter.FilterDataTypeFilterController"/> class, responsible for filtering data types.
+    /// </summary>
+    /// <param name="dataTypeService">The <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="mapper">The <see cref="IUmbracoMapper"/> used for mapping entities.</param>
     public FilterDataTypeFilterController(IDataTypeService dataTypeService, IUmbracoMapper mapper)
     {
         _dataTypeService = dataTypeService;
         _mapper = mapper;
     }
 
+    /// <summary>
+    /// Retrieves a paginated and filtered list of data types based on the specified criteria.
+    /// </summary>
+    /// <param name="cancellationToken">A token to observe while waiting for the task to complete.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return (used for pagination).</param>
+    /// <param name="name">An optional filter to match data type names.</param>
+    /// <param name="editorUiAlias">An optional filter to match the editor UI alias.</param>
+    /// <param name="editorAlias">An optional filter to match the editor alias.</param>
+    /// <returns>A task that represents the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a paged collection of filtered data types.</returns>
     [HttpGet]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DataTypeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Folder/ByKeyDataTypeFolderController.cs

@@ -7,9 +7,17 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
 
+/// <summary>
+/// Controller for managing data type folders by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Constructor for <see cref="Umbraco.Cms.Api.Management.Controllers.DataType.Folder.ByKeyDataTypeFolderController"/>.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Provides access to back office security features.</param>
+    /// <param name="dataTypeContainerService">Service for managing data type containers.</param>
     public ByKeyDataTypeFolderController(
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
         IDataTypeContainerService dataTypeContainerService)
@@ -17,6 +25,14 @@ public class ByKeyDataTypeFolderController : DataTypeFolderControllerBase
     {
     }
 
+    /// <summary>
+    /// Retrieves a data type folder by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the data type folder to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing a <see cref="FolderResponseModel"/> with the folder data if found; otherwise, a <see cref="ProblemDetails"/> with status 404 if not found.
+    /// </returns>
     [HttpGet("{id:guid}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(FolderResponseModel), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Folder/CreateDataTypeFolderController.cs

@@ -7,9 +7,17 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
 
+/// <summary>
+/// Provides API endpoints for creating folders used to organize data types in the system.
+/// </summary>
 [ApiVersion("1.0")]
 public class CreateDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateDataTypeFolderController"/> class, responsible for handling requests related to creating data type folders.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Provides access to back office security features for authorization and authentication.</param>
+    /// <param name="dataTypeContainerService">Service used to manage data type containers (folders) within the system.</param>
     public CreateDataTypeFolderController(
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
         IDataTypeContainerService dataTypeContainerService)
@@ -17,6 +25,12 @@ public class CreateDataTypeFolderController : DataTypeFolderControllerBase
     {
     }
 
+    /// <summary>
+    /// Creates a new data type folder using the specified details.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="createFolderRequestModel">The request model containing the folder name and parent location.</param>
+    /// <returns>A <see cref="Task{IActionResult}"/> representing the asynchronous operation result.</returns>
     [HttpPost]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status201Created)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Folder/DataTypeFolderControllerBase.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;
@@ -9,6 +9,9 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
 
+/// <summary>
+/// Serves as the base controller for operations related to data type folders in the Umbraco CMS Management API.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.DataType}/folder")]
 [ApiExplorerSettings(GroupName = "Data Type")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentTypes)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Folder/DeleteDataTypeFolderController.cs

@@ -6,9 +6,17 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
 
+/// <summary>
+/// Controller responsible for handling requests to delete data type folders in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class DeleteDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeleteDataTypeFolderController"/> class.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security operations.</param>
+    /// <param name="dataTypeContainerService">Service for managing data type containers (folders).</param>
     public DeleteDataTypeFolderController(
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
         IDataTypeContainerService dataTypeContainerService)
@@ -16,6 +24,12 @@ public class DeleteDataTypeFolderController : DataTypeFolderControllerBase
     {
     }
 
+    /// <summary>
+    /// Deletes a data type folder identified by the provided Id.
+    /// </summary>
+    /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
+    /// <param name="id">The unique identifier of the data type folder to delete.</param>
+    /// <returns>An <see cref="IActionResult"/> representing the result of the delete operation.</returns>
     [HttpDelete("{id:guid}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Folder/UpdateDataTypeFolderController.cs

@@ -7,9 +7,17 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
 
+/// <summary>
+/// API controller responsible for handling requests to update data type folders in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class UpdateDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="UpdateDataTypeFolderController"/> class.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context and authentication.</param>
+    /// <param name="dataTypeContainerService">Service used to manage data type folders (containers).</param>
     public UpdateDataTypeFolderController(
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
         IDataTypeContainerService dataTypeContainerService)

src/Umbraco.Cms.Api.Management/Controllers/DataType/IsUsedDataTypeController.cs

@@ -7,6 +7,9 @@ using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// Controller for checking whether a data type is currently in use.
+/// </summary>
 [ApiVersion("1.0")]
 public class IsUsedDataTypeController : DataTypeControllerBase
 {
@@ -17,6 +20,14 @@ public class IsUsedDataTypeController : DataTypeControllerBase
         _dataTypeUsageService = dataTypeUsageService;
     }
 
+    /// <summary>
+    /// Determines whether the data type specified by the given <paramref name="id"/> is currently used in any content, media, or member types.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to check for usage.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing a boolean value: <c>true</c> if the data type is used; <c>false</c> otherwise. Returns <see cref="StatusCodes.Status404NotFound"/> if the data type does not exist.
+    /// </returns>
     [HttpGet("{id:guid}/is-used")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(bool), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Item/AncestorsDataTypeItemController.cs

@@ -0,0 +1,39 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.ViewModels.Item;
+using Umbraco.Cms.Core.Models;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;
+
+[ApiVersion("1.0")]
+public class AncestorsDataTypeItemController : DatatypeItemControllerBase
+{
+    private readonly IItemAncestorService _itemAncestorService;
+
+    public AncestorsDataTypeItemController(IItemAncestorService itemAncestorService)
+        => _itemAncestorService = itemAncestorService;
+
+    [HttpGet("ancestors")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IEnumerable<ItemAncestorsResponseModel<NamedItemResponseModel>>), StatusCodes.Status200OK)]
+    [EndpointSummary("Gets ancestors for a collection of data type items.")]
+    [EndpointDescription("Gets the ancestor chains for data type items identified by the provided Ids.")]
+    public async Task<IActionResult> Ancestors(
+        CancellationToken cancellationToken,
+        [FromQuery(Name = "id")] HashSet<Guid> ids)
+    {
+        if (ids.Count is 0)
+        {
+            return Ok(Enumerable.Empty<ItemAncestorsResponseModel<NamedItemResponseModel>>());
+        }
+
+        IEnumerable<ItemAncestorsResponseModel<NamedItemResponseModel>> result = await _itemAncestorService.GetAncestorsAsync(
+            UmbracoObjectTypes.DataType,
+            UmbracoObjectTypes.DataTypeContainer,
+            ids);
+
+        return Ok(result);
+    }
+}

src/Umbraco.Cms.Api.Management/Controllers/DataType/Item/DatatypeItemControllerBase.cs

@@ -1,9 +1,12 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;
 
+/// <summary>
+/// Serves as the base controller for operations related to data type items in the management API.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Item}/{Constants.UdiEntityType.DataType}")]
 [ApiExplorerSettings(GroupName = "Data Type")]
 public class DatatypeItemControllerBase : ManagementApiControllerBase

src/Umbraco.Cms.Api.Management/Controllers/DataType/Item/ItemDatatypeItemController.cs

@@ -8,12 +8,20 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;
 
+/// <summary>
+/// API controller responsible for managing individual data type items within the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 public class ItemDatatypeItemController : DatatypeItemControllerBase
 {
     private readonly IDataTypeService _dataTypeService;
     private readonly IUmbracoMapper _mapper;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ItemDatatypeItemController"/> class, which manages item-level operations for data types in the Umbraco CMS Management API.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage and retrieve data type information.</param>
+    /// <param name="mapper">The Umbraco mapper used for mapping between domain and API models.</param>
     public ItemDatatypeItemController(IDataTypeService dataTypeService, IUmbracoMapper mapper)
     {
         _dataTypeService = dataTypeService;

src/Umbraco.Cms.Api.Management/Controllers/DataType/Item/SearchDataTypeItemController.cs

@@ -9,6 +9,9 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;
 
+/// <summary>
+/// Controller responsible for handling search operations for data type items in the management API.
+/// </summary>
 [ApiVersion("1.0")]
 public class SearchDataTypeItemController : DatatypeItemControllerBase
 {
@@ -16,6 +19,12 @@ public class SearchDataTypeItemController : DatatypeItemControllerBase
     private readonly IDataTypeService _dataTypeService;
     private readonly IUmbracoMapper _mapper;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SearchDataTypeItemController"/> class, which handles search operations for data type items.
+    /// </summary>
+    /// <param name="entitySearchService">Service used to perform entity search operations.</param>
+    /// <param name="dataTypeService">Service for managing data types.</param>
+    /// <param name="mapper">The mapper used to convert between domain and API models.</param>
     public SearchDataTypeItemController(IEntitySearchService entitySearchService, IDataTypeService dataTypeService, IUmbracoMapper mapper)
     {
         _entitySearchService = entitySearchService;
@@ -23,6 +32,14 @@ public class SearchDataTypeItemController : DatatypeItemControllerBase
         _mapper = mapper;
     }
 
+    /// <summary>
+    /// Searches for data type items matching the specified query, with support for pagination.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="query">The search query used to filter data type items.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return in the result set (used for pagination).</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a <see cref="PagedModel{DataTypeItemResponseModel}"/> containing the search results.</returns>
     [HttpGet("search")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedModel<DataTypeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/MoveDataTypeController.cs

@@ -12,6 +12,9 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// Controller responsible for moving data types within the system.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class MoveDataTypeController : DataTypeControllerBase
@@ -19,12 +22,25 @@ public class MoveDataTypeController : DataTypeControllerBase
     private readonly IDataTypeService _dataTypeService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="MoveDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage data types.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
     public MoveDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
         _dataTypeService = dataTypeService;
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    /// <summary>
+    /// Moves an existing data type identified by the specified <paramref name="id"/> to a different container.
+    /// The target container Id must be provided in the <paramref name="moveDataTypeRequestModel"/>.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
+    /// <param name="id">The unique identifier of the data type to move.</param>
+    /// <param name="moveDataTypeRequestModel">The request model containing the target container information.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the move operation.</returns>
     [HttpPut("{id:guid}/move")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/References/ReferencedByDataTypeController.cs

@@ -9,12 +9,20 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.References;
 
+/// <summary>
+/// Controller responsible for managing and retrieving information about where specific data types are referenced within the system.
+/// </summary>
 [ApiVersion("1.0")]
 public class ReferencedByDataTypeController : DataTypeControllerBase
 {
     private readonly IDataTypeService _dataTypeService;
     private readonly IRelationTypePresentationFactory _relationTypePresentationFactory;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ReferencedByDataTypeController"/> class, which handles API requests related to data types referenced by other entities.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage and retrieve data type information.</param>
+    /// <param name="relationTypePresentationFactory">Factory for creating presentation models for relation types.</param>
     public ReferencedByDataTypeController(IDataTypeService dataTypeService, IRelationTypePresentationFactory relationTypePresentationFactory)
     {
         _dataTypeService = dataTypeService;
@@ -22,8 +30,15 @@ public class ReferencedByDataTypeController : DataTypeControllerBase
     }
 
     /// <summary>
-    ///     Gets a paged list of references for the current data type, so you can see where it is being used.
+    /// Gets a paged list of entities that reference the specified data type, allowing you to see where it is being used.
     /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to find references for.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for paging).</param>
+    /// <param name="take">The maximum number of items to return (used for paging).</param>
+    /// <returns>
+    /// A task representing the asynchronous operation. The result contains an <see cref="ActionResult{T}"/> with a <see cref="PagedViewModel{IReferenceResponseModel}"/> listing entities that reference the specified data type.
+    /// </returns>
     [HttpGet("{id:guid}/referenced-by")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/SchemaDataTypeController.cs

@@ -0,0 +1,54 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels.DataType;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType;
+
+/// <summary>
+/// Controller for retrieving data type value schemas.
+/// </summary>
+[ApiVersion("1.0")]
+public class SchemaDataTypeController : DataTypeControllerBase
+{
+    private readonly IPropertyEditorSchemaService _schemaService;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SchemaDataTypeController"/> class.
+    /// </summary>
+    /// <param name="schemaService">The property editor schema service.</param>
+    public SchemaDataTypeController(IPropertyEditorSchemaService schemaService)
+        => _schemaService = schemaService;
+
+    /// <summary>
+    /// Gets the value schema for a data type.
+    /// </summary>
+    /// <param name="id">The unique identifier of the data type.</param>
+    /// <returns>The schema information for the data type's values.</returns>
+    /// <remarks>
+    /// Returns schema information for property editors that implement <c>IValueSchemaProvider</c>.
+    /// Returns 404 if the data type is not found or doesn't support schema information.
+    /// </remarks>
+    [HttpGet("{id:guid}/schema")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(DataTypeSchemaResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Schema(Guid id)
+    {
+        Attempt<PropertyValueSchema, PropertyEditorSchemaOperationStatus> attempt = await _schemaService.GetSchemaAsync(id);
+        if (attempt.Success is false)
+        {
+            return PropertyEditorSchemaOperationStatusResult(attempt.Status);
+        }
+
+        PropertyValueSchema result = attempt.Result;
+        return Ok(new DataTypeSchemaResponseModel
+        {
+            ValueTypeName = result.ValueType?.FullName,
+            JsonSchema = result.JsonSchema,
+        });
+    }
+}

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/AncestorsDataTypeTreeController.cs

@@ -8,15 +8,29 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 
+/// <summary>
+/// Controller responsible for handling operations related to the ancestors tree structure of data types.
+/// </summary>
 [ApiVersion("1.0")]
 public class AncestorsDataTypeTreeController : DataTypeTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="AncestorsDataTypeTreeController"/> class, which provides API endpoints for retrieving ancestor data types in the tree structure.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the API.</param>
+    /// <param name="dataTypeService">Service used for data type management and retrieval.</param>
     [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
         : base(entityService, dataTypeService)
     {
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="AncestorsDataTypeTreeController"/> class, which manages operations related to ancestor data type trees in the Umbraco CMS.
+    /// </summary>
+    /// <param name="entityService">Service used for entity-related operations.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for tree nodes.</param>
+    /// <param name="dataTypeService">Service used for data type management operations.</param>
     [ActivatorUtilitiesConstructor]
     public AncestorsDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
     : base(entityService, flagProviders, dataTypeService)

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/ChildrenDataTypeTreeController.cs

@@ -9,21 +9,44 @@ using Umbraco.Cms.Api.Management.Services.Flags;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 
+/// <summary>
+/// Controller responsible for handling operations related to the child nodes of the data type tree in the management API.
+/// </summary>
 [ApiVersion("1.0")]
 public class ChildrenDataTypeTreeController : DataTypeTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ChildrenDataTypeTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within the system.</param>
+    /// <param name="dataTypeService">Service used for managing and retrieving data types.</param>
     [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
         : base(entityService, dataTypeService)
     {
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ChildrenDataTypeTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within the system.</param>
+    /// <param name="flagProviders">A collection of providers that supply additional flags or metadata for entities.</param>
+    /// <param name="dataTypeService">Service responsible for operations related to data types.</param>
     [ActivatorUtilitiesConstructor]
     public ChildrenDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
         : base(entityService, flagProviders, dataTypeService)
     {
     }
 
+    /// <summary>
+    /// Retrieves a paginated collection of data type tree items that are children of the specified parent ID.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="parentId">The unique identifier of the parent data type tree item whose children are to be retrieved.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return (used for pagination).</param>
+    /// <param name="foldersOnly">If set to <c>true</c>, only folder items will be included in the results.</param>
+    /// <returns>A <see cref="PagedViewModel{T}"/> containing <see cref="DataTypeTreeItemResponseModel"/> instances representing the child items.</returns>
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/DataTypeTreeControllerBase.cs

@@ -15,6 +15,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 
+/// <summary>
+/// Serves as the base controller for handling operations related to data type trees in the Umbraco CMS Management API.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Tree}/{Constants.UdiEntityType.DataType}")]
 [ApiExplorerSettings(GroupName = "Data Type")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
@@ -22,6 +25,11 @@ public class DataTypeTreeControllerBase : FolderTreeControllerBase<DataTypeTreeI
 {
     private readonly IDataTypeService _dataTypeService;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DataTypeTreeControllerBase"/> class.
+    /// </summary>
+    /// <param name="entityService">Service for managing Umbraco entities.</param>
+    /// <param name="dataTypeService">Service for managing data types within Umbraco.</param>
     [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public DataTypeTreeControllerBase(IEntityService entityService, IDataTypeService dataTypeService)
         : this(
@@ -31,8 +39,30 @@ public class DataTypeTreeControllerBase : FolderTreeControllerBase<DataTypeTreeI
     {
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DataTypeTreeControllerBase"/> class with the specified services.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the data type tree.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for entities.</param>
+    /// <param name="dataTypeService">Service used for managing data types.</param>
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 19.")]
     public DataTypeTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
-        : base(entityService, flagProviders) =>
+        : this(
+            entityService,
+            flagProviders,
+            StaticServiceProvider.Instance.GetRequiredService<IEntitySearchService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IIdKeyMap>(),
+            dataTypeService)
+    {
+    }
+
+    public DataTypeTreeControllerBase(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IEntitySearchService entitySearchService,
+        IIdKeyMap idKeyMap,
+        IDataTypeService dataTypeService)
+        : base(entityService, flagProviders, entitySearchService, idKeyMap) =>
         _dataTypeService = dataTypeService;
 
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.DataType;

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/RootDataTypeTreeController.cs

@@ -9,21 +9,43 @@ using Umbraco.Cms.Api.Management.Services.Flags;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 
+/// <summary>
+/// API controller responsible for handling operations related to the root of the data type tree in Umbraco.
+/// </summary>
 [ApiVersion("1.0")]
 public class RootDataTypeTreeController : DataTypeTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RootDataTypeTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within Umbraco.</param>
+    /// <param name="dataTypeService">Service used for managing data types in Umbraco.</param>
     [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
         : base(entityService, dataTypeService)
     {
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RootDataTypeTreeController"/> class, which manages the root of the data type tree in the Umbraco management API.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the tree.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for tree nodes.</param>
+    /// <param name="dataTypeService">Service used for data type management and retrieval.</param>
     [ActivatorUtilitiesConstructor]
     public RootDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
     : base(entityService, flagProviders, dataTypeService)
     {
     }
 
+    /// <summary>
+    /// Retrieves a paginated list of data type items from the root of the tree, with optional folder-only filtering.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set.</param>
+    /// <param name="take">The maximum number of items to return.</param>
+    /// <param name="foldersOnly">If true, only folders are included in the results.</param>
+    /// <returns>A paged view model containing data type tree item response models.</returns>
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/SearchDataTypeTreeController.cs

@@ -0,0 +1,30 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
+
+[ApiVersion("1.0")]
+public class SearchDataTypeTreeController : DataTypeTreeControllerBase
+{
+    public SearchDataTypeTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IEntitySearchService entitySearchService,
+        IIdKeyMap idKeyMap,
+        IDataTypeService dataTypeService)
+        : base(entityService, flagProviders, entitySearchService, idKeyMap, dataTypeService)
+    {
+    }
+
+    [HttpGet("search")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedViewModel<DataTypeTreeItemResponseModel>>> Search(CancellationToken cancellationToken, string? query, int skip = 0, int take = 100, TreeItemKind itemKind = TreeItemKind.All)
+        => await SearchTreeEntities(query, skip, take, itemKind);
+}

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/SiblingsDataTypeTreeController.cs

@@ -8,20 +8,43 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 
+/// <summary>
+/// Provides API endpoints for managing sibling data types in the Umbraco CMS tree.
+/// </summary>
 public class SiblingsDataTypeTreeController : DataTypeTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SiblingsDataTypeTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within Umbraco.</param>
+    /// <param name="dataTypeService">Service used for managing data types in Umbraco.</param>
     [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public SiblingsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
         : base(entityService, dataTypeService)
     {
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SiblingsDataTypeTreeController"/> class, which manages operations related to sibling data type trees in the Umbraco CMS.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the CMS.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for tree nodes.</param>
+    /// <param name="dataTypeService">Service used for managing data types.</param>
     [ActivatorUtilitiesConstructor]
     public SiblingsDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
         : base(entityService, flagProviders, dataTypeService)
     {
     }
 
+    /// <summary>
+    /// Gets a paged collection of data type tree items that are siblings of the specified data type identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="target">The unique identifier of the data type whose siblings are to be retrieved.</param>
+    /// <param name="before">The number of sibling items to retrieve before the target item.</param>
+    /// <param name="after">The number of sibling items to retrieve after the target item.</param>
+    /// <param name="foldersOnly">If set to <c>true</c>, only folders will be included in the results; otherwise, both folders and data types are returned.</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="ActionResult{T}"/> with a <see cref="SubsetViewModel{T}"/> of <see cref="DataTypeTreeItemResponseModel"/> representing the sibling items.</returns>
     [HttpGet("siblings")]
     [ProducesResponseType(typeof(SubsetViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
     [EndpointSummary("Gets a collection of data type tree sibling items.")]

src/Umbraco.Cms.Api.Management/Controllers/DataType/UpdateDataTypeController.cs

@@ -13,6 +13,9 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType;
 
+/// <summary>
+/// API controller responsible for handling requests to update data types in the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class UpdateDataTypeController : DataTypeControllerBase
@@ -21,6 +24,12 @@ public class UpdateDataTypeController : DataTypeControllerBase
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
     private IDataTypePresentationFactory _dataTypePresentationFactory;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="UpdateDataTypeController"/> class, responsible for handling data type update operations in the management API.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage data types.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    /// <param name="dataTypePresentationFactory">Factory for creating data type presentation models.</param>
     public UpdateDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor, IDataTypePresentationFactory dataTypePresentationFactory)
     {
         _dataTypeService = dataTypeService;
@@ -28,6 +37,13 @@ public class UpdateDataTypeController : DataTypeControllerBase
         _dataTypePresentationFactory = dataTypePresentationFactory;
     }
 
+    /// <summary>
+    /// Updates the data type with the specified ID using the provided request model.
+    /// </summary>
+    /// <param name="cancellationToken">Token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to update.</param>
+    /// <param name="updateDataTypeViewModel">The model containing the updated data type details.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the update operation.</returns>
     [HttpPut("{id:guid}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/AllDictionaryController.cs

@@ -10,18 +10,34 @@ using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// API controller responsible for retrieving and managing all dictionary items within the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class AllDictionaryController : DictionaryControllerBase
 {
     private readonly IDictionaryItemService _dictionaryItemService;
     private readonly IUmbracoMapper _umbracoMapper;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="AllDictionaryController"/> class.
+    /// </summary>
+    /// <param name="dictionaryItemService">An instance of <see cref="IDictionaryItemService"/> used to manage dictionary items.</param>
+    /// <param name="umbracoMapper">An instance of <see cref="IUmbracoMapper"/> used for mapping between models.</param>
     public AllDictionaryController(IDictionaryItemService dictionaryItemService, IUmbracoMapper umbracoMapper)
     {
         _dictionaryItemService = dictionaryItemService;
         _umbracoMapper = umbracoMapper;
     }
 
+    /// <summary>
+    /// Retrieves a paginated list of dictionary items, optionally filtered by name.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="filter">An optional string to filter dictionary items by name.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set.</param>
+    /// <param name="take">The maximum number of items to return.</param>
+    /// <returns>A paginated view model containing dictionary overview response models.</returns>
     [HttpGet]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DictionaryOverviewResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/ByKeyDictionaryController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Factories;
@@ -8,18 +8,36 @@ using Umbraco.Cms.Api.Management.ViewModels.Dictionary;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// API controller for managing Umbraco dictionary items by their unique key.
+/// Provides endpoints for retrieving, updating, and deleting dictionary entries identified by key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDictionaryController : DictionaryControllerBase
 {
     private readonly IDictionaryItemService _dictionaryItemService;
     private readonly IDictionaryPresentationFactory _dictionaryPresentationFactory;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ByKeyDictionaryController"/> class, which manages dictionary items by key.
+    /// </summary>
+    /// <param name="dictionaryItemService">The <see cref="IDictionaryItemService"/> used to manage dictionary items.</param>
+    /// <param name="dictionaryPresentationFactory">The <see cref="IDictionaryPresentationFactory"/> used to create dictionary item presentations.</param>
     public ByKeyDictionaryController(IDictionaryItemService dictionaryItemService, IDictionaryPresentationFactory dictionaryPresentationFactory)
     {
         _dictionaryItemService = dictionaryItemService;
         _dictionaryPresentationFactory = dictionaryPresentationFactory;
     }
 
+    /// <summary>
+    /// Retrieves a dictionary item by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the dictionary item to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing the <see cref="DictionaryItemResponseModel"/> if the item is found;
+    /// otherwise, a 404 Not Found response.
+    /// </returns>
     [HttpGet($"{{{nameof(id)}:guid}}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(DictionaryItemResponseModel), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/CreateDictionaryController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -15,6 +15,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// API controller responsible for handling requests to create new dictionary items in Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class CreateDictionaryController : DictionaryControllerBase
 {
@@ -23,6 +26,14 @@ public class CreateDictionaryController : DictionaryControllerBase
     private readonly IDictionaryPresentationFactory _dictionaryPresentationFactory;
     private readonly IAuthorizationService _authorizationService;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.Dictionary.CreateDictionaryController"/> class,
+    /// providing dependencies required for managing dictionary items in the Umbraco back office API.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service for managing dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    /// <param name="dictionaryPresentationFactory">Factory for creating dictionary presentation models.</param>
+    /// <param name="authorizationService">Service for handling authorization checks.</param>
     public CreateDictionaryController(
         IDictionaryItemService dictionaryItemService,
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
@@ -35,6 +46,12 @@ public class CreateDictionaryController : DictionaryControllerBase
         _authorizationService = authorizationService;
     }
 
+    /// <summary>
+    /// Creates a new dictionary item using the details provided in the request model.
+    /// </summary>
+    /// <param name="cancellationToken">Token to monitor for cancellation requests.</param>
+    /// <param name="createDictionaryItemRequestModel">The model containing the details of the dictionary item to create, including translations.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the create operation, including possible status codes for success or failure.</returns>
     [HttpPost]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status201Created)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/DeleteDictionaryController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core;
@@ -9,12 +9,20 @@ using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// Controller responsible for handling requests to delete dictionary items in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class DeleteDictionaryController : DictionaryControllerBase
 {
     private readonly IDictionaryItemService _dictionaryItemService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeleteDictionaryController"/> class, used for handling requests to delete dictionary items in the Umbraco CMS.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service for managing dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
     public DeleteDictionaryController(IDictionaryItemService dictionaryItemService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
         _dictionaryItemService = dictionaryItemService;

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/DictionaryControllerBase.cs

@@ -8,6 +8,9 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// Serves as the base controller for API endpoints that manage dictionary-related operations in the Umbraco CMS.
+/// </summary>
 [VersionedApiBackOfficeRoute("dictionary")]
 [ApiExplorerSettings(GroupName = "Dictionary")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDictionary)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/ExportDictionaryController.cs

@@ -1,4 +1,4 @@
-using System.Net.Mime;
+using System.Net.Mime;
 using System.Text;
 using System.Xml.Linq;
 using Asp.Versioning;
@@ -10,18 +10,36 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// API controller responsible for exporting dictionary entries from the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ExportDictionaryController : DictionaryControllerBase
 {
     private readonly IDictionaryItemService _dictionaryItemService;
     private readonly IEntityXmlSerializer _entityXmlSerializer;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ExportDictionaryController"/> class, providing services for dictionary item management and XML serialization.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service used to manage dictionary items.</param>
+    /// <param name="entityXmlSerializer">Service used to serialize entities to XML.</param>
     public ExportDictionaryController(IDictionaryItemService dictionaryItemService, IEntityXmlSerializer entityXmlSerializer)
     {
         _dictionaryItemService = dictionaryItemService;
         _entityXmlSerializer = entityXmlSerializer;
     }
 
+    /// <summary>
+    /// Exports the dictionary item identified by the provided <paramref name="id"/> as a downloadable file.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the dictionary item to export.</param>
+    /// <param name="includeChildren">If <c>true</c>, child dictionary items will also be included in the export; otherwise, only the specified item is exported.</param>
+    /// <returns>
+    /// A <see cref="FileContentResult"/> containing the exported dictionary data as a file if the dictionary item is found;
+    /// otherwise, a <see cref="NotFoundResult"/> if the item does not exist.
+    /// </returns>
     [HttpGet("{id:guid}/export")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(FileContentResult), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/ImportDictionaryController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.Builders;
@@ -11,12 +11,20 @@ using Umbraco.Cms.Core.Security;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// Provides API endpoints for importing dictionary items into the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ImportDictionaryController : DictionaryControllerBase
 {
     private readonly IDictionaryItemImportService _dictionaryItemImportService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ImportDictionaryController"/> class, which handles dictionary item import operations in the Umbraco backoffice API.
+    /// </summary>
+    /// <param name="dictionaryItemImportService">Service used to import dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
     public ImportDictionaryController(
         IDictionaryItemImportService dictionaryItemImportService,
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
@@ -25,6 +33,15 @@ public class ImportDictionaryController : DictionaryControllerBase
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    /// <summary>
+    /// Imports a dictionary from a provided UDT file upload.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token that can be used to cancel the import operation.</param>
+    /// <param name="importDictionaryRequestModel">The model containing the uploaded UDT file and optional parent dictionary item information.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the result of the import operation:
+    /// returns <c>201 Created</c> on success, <c>400 Bad Request</c> for invalid file types or content, and <c>404 Not Found</c> if the parent or file is missing.
+    /// </returns>
     [HttpPost("import")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status201Created)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Item/DictionaryItemControllerBase.cs

@@ -1,9 +1,13 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Item;
 
+/// <summary>
+/// Serves as the base controller for managing dictionary items in the Umbraco CMS Management API.
+/// Provides common functionality and endpoints for derived controllers handling dictionary item operations.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Item}/dictionary")]
 [ApiExplorerSettings(GroupName = "Dictionary")]
 public class DictionaryItemControllerBase : ManagementApiControllerBase

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Item/ItemDictionaryItemController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.ViewModels.Dictionary.Item;
@@ -8,18 +8,32 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Item;
 
+/// <summary>
+/// Provides API endpoints for managing individual dictionary items within the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ItemDictionaryItemController : DictionaryItemControllerBase
 {
     private readonly IDictionaryItemService _dictionaryItemService;
     private readonly IUmbracoMapper _mapper;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ItemDictionaryItemController"/> class with the specified services.
+    /// </summary>
+    /// <param name="dictionaryItemService">An instance of <see cref="IDictionaryItemService"/> used to manage dictionary items.</param>
+    /// <param name="mapper">An instance of <see cref="IUmbracoMapper"/> used for mapping objects.</param>
     public ItemDictionaryItemController(IDictionaryItemService dictionaryItemService, IUmbracoMapper mapper)
     {
         _dictionaryItemService = dictionaryItemService;
         _mapper = mapper;
     }
 
+    /// <summary>
+    /// Retrieves a collection of dictionary items matching the specified IDs.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="ids">A set of dictionary item IDs to retrieve.</param>
+    /// <returns>A task representing the asynchronous operation. The result contains an <see cref="IActionResult"/> with the collection of dictionary items.</returns>
     [HttpGet]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<DictionaryItemItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/MoveDictionaryController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.ViewModels.Dictionary;
@@ -10,12 +10,20 @@ using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// Provides API endpoints for moving dictionary items within the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 public class MoveDictionaryController : DictionaryControllerBase
 {
     private readonly IDictionaryItemService _dictionaryItemService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="MoveDictionaryController"/> class, responsible for handling dictionary item move operations in the management API.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service used to manage dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
     public MoveDictionaryController(IDictionaryItemService dictionaryItemService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
         _dictionaryItemService = dictionaryItemService;

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Tree/AncestorsDictionaryTreeController.cs

@@ -8,21 +8,41 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 
+/// <summary>
+/// Controller responsible for managing and exposing operations related to the ancestors of dictionary items in the dictionary tree.
+/// </summary>
 [ApiVersion("1.0")]
 public class AncestorsDictionaryTreeController : DictionaryTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="AncestorsDictionaryTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within Umbraco.</param>
+    /// <param name="dictionaryItemService">Service used for managing dictionary items in the Umbraco dictionary tree.</param>
     [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsDictionaryTreeController(IEntityService entityService, IDictionaryItemService dictionaryItemService)
         : base(entityService, dictionaryItemService)
     {
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="AncestorsDictionaryTreeController"/> class, which handles operations related to retrieving ancestor dictionary tree items.
+    /// </summary>
+    /// <param name="entityService">The service used for entity operations.</param>
+    /// <param name="flagProviders">A collection of providers for entity flags.</param>
+    /// <param name="dictionaryItemService">The service used for dictionary item operations.</param>
     [ActivatorUtilitiesConstructor]
     public AncestorsDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
         : base(entityService, flagProviders, dictionaryItemService)
     {
     }
 
+    /// <summary>
+    /// Retrieves all ancestor dictionary items for the specified descendant item.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="descendantId">The unique identifier of the descendant dictionary item whose ancestors are to be retrieved.</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="ActionResult{T}"/> with a collection of ancestor <see cref="NamedEntityTreeItemResponseModel"/> items.</returns>
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Tree/ChildrenDictionaryTreeController.cs

@@ -10,21 +10,43 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 
+/// <summary>
+/// API controller responsible for managing and retrieving the child nodes of dictionary items in the Umbraco dictionary tree.
+/// </summary>
 [ApiVersion("1.0")]
 public class ChildrenDictionaryTreeController : DictionaryTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ChildrenDictionaryTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within the system.</param>
+    /// <param name="dictionaryItemService">Service used for managing dictionary items.</param>
     [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenDictionaryTreeController(IEntityService entityService, IDictionaryItemService dictionaryItemService)
         : base(entityService, dictionaryItemService)
     {
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ChildrenDictionaryTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service for managing and retrieving entities within Umbraco.</param>
+    /// <param name="flagProviders">A collection of providers that supply additional flags or metadata for entities.</param>
+    /// <param name="dictionaryItemService">Service for managing dictionary items used for localization.</param>
     [ActivatorUtilitiesConstructor]
     public ChildrenDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
         : base(entityService, flagProviders, dictionaryItemService)
     {
     }
 
+    /// <summary>
+    /// Retrieves a paginated list of dictionary tree items that are direct children of the specified parent dictionary item.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="parentId">The unique identifier of the parent dictionary item whose children are to be retrieved.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return (used for pagination).</param>
+    /// <returns>A paged view model containing the child dictionary tree items.</returns>
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Tree/DictionaryTreeControllerBase.cs

@@ -14,6 +14,10 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 
+/// <summary>
+/// Serves as the base controller for operations related to dictionary tree structures in the Umbraco CMS Management API.
+/// Provides common functionality for derived controllers managing dictionary items in a hierarchical format.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Tree}/dictionary")]
 [ApiExplorerSettings(GroupName = "Dictionary")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDictionaryOrTemplates)]
@@ -21,6 +25,11 @@ namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 // tree controller base. We'll keep it though, in the hope that we can mend EntityService.
 public class DictionaryTreeControllerBase : NamedEntityTreeControllerBase<NamedEntityTreeItemResponseModel>
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DictionaryTreeControllerBase"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within the Umbraco system.</param>
+    /// <param name="dictionaryItemService">Service used for managing and retrieving dictionary items for localization.</param>
     [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public DictionaryTreeControllerBase(IEntityService entityService, IDictionaryItemService dictionaryItemService)
         : this(
@@ -30,7 +39,16 @@ public class DictionaryTreeControllerBase : NamedEntityTreeControllerBase<NamedE
     {
     }
 
-    public DictionaryTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DictionaryTreeControllerBase"/> class.
+    /// </summary>
+    /// <param name="entityService">Service for managing entities within the system.</param>
+    /// <param name="flagProviders">A collection of providers for entity flags.</param>
+    /// <param name="dictionaryItemService">Service for managing dictionary items.</param>
+    public DictionaryTreeControllerBase(
+        IEntityService entityService, 
+        FlagProviderCollection flagProviders, 
+        IDictionaryItemService dictionaryItemService)
         : base(entityService, flagProviders) =>
         DictionaryItemService = dictionaryItemService;
 

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Tree/RootDictionaryTreeController.cs

@@ -10,20 +10,44 @@ using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 
+/// <summary>
+/// Controller for managing the root of the dictionary tree in the Umbraco CMS Management API.
+/// </summary>
 [ApiVersion("1.0")]
 public class RootDictionaryTreeController : DictionaryTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RootDictionaryTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the dictionary tree.</param>
+    /// <param name="dictionaryItemService">Service used for managing dictionary items.</param>
     public RootDictionaryTreeController(IEntityService entityService, IDictionaryItemService dictionaryItemService)
         : base(entityService, dictionaryItemService)
     {
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RootDictionaryTreeController"/> class, which manages the root nodes of the dictionary tree in the Umbraco management API.
+    /// </summary>
+    /// <param name="entityService">Service for managing entities within Umbraco.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for entities.</param>
+    /// <param name="dictionaryItemService">Service for managing dictionary items.</param>
     [ActivatorUtilitiesConstructor]
     public RootDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
         : base(entityService, flagProviders, dictionaryItemService)
     {
     }
 
+    /// <summary>
+    /// Retrieves a paginated collection of dictionary items from the root of the dictionary tree.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="skip">The number of items to skip for pagination. Defaults to 0.</param>
+    /// <param name="take">The maximum number of items to return for pagination. Defaults to 100.</param>
+    /// <returns>
+    /// An <see cref="ActionResult{T}"/> containing a <see cref="PagedViewModel{NamedEntityTreeItemResponseModel}"/>,
+    /// which represents the paginated dictionary items from the root of the tree.
+    /// </returns>
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/UpdateDictionaryController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -16,6 +16,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
 
+/// <summary>
+/// API controller responsible for handling requests to update dictionary items in the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 public class UpdateDictionaryController : DictionaryControllerBase
 {
@@ -24,6 +27,13 @@ public class UpdateDictionaryController : DictionaryControllerBase
     private readonly IDictionaryPresentationFactory _dictionaryPresentationFactory;
     private readonly IAuthorizationService _authorizationService;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="UpdateDictionaryController"/> class, which handles API requests for updating dictionary items in Umbraco.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service for managing dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    /// <param name="dictionaryPresentationFactory">Factory for creating dictionary item presentation models.</param>
+    /// <param name="authorizationService">Service for handling authorization checks.</param>
     public UpdateDictionaryController(
         IDictionaryItemService dictionaryItemService,
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
@@ -36,6 +46,13 @@ public class UpdateDictionaryController : DictionaryControllerBase
         _authorizationService = authorizationService;
     }
 
+    /// <summary>
+    /// Updates an existing dictionary item with the specified identifier using the provided details.
+    /// </summary>
+    /// <param name="cancellationToken">The token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the dictionary item to update.</param>
+    /// <param name="updateDictionaryItemRequestModel">The model containing the updated dictionary item details.</param>
+    /// <returns>An <see cref="IActionResult"/> representing the result of the update operation.</returns>
     [HttpPut($"{{{nameof(id)}:guid}}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/AvailableSegmentsController.cs

@@ -16,6 +16,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// Provides API endpoints for retrieving and managing available segments associated with documents.
+/// </summary>
 [Obsolete("This controller is temporary. A more permanent solution will follow. Scheduled for removal in Umbraco 20.")]
 [ApiVersion("1.0")]
 public class AvailableSegmentsController : DocumentControllerBase
@@ -24,6 +27,12 @@ public class AvailableSegmentsController : DocumentControllerBase
     private readonly ISegmentService _segmentService;
     private readonly IUmbracoMapper _umbracoMapper;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="AvailableSegmentsController"/> class, which manages API endpoints for retrieving available document segments in Umbraco.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize access to controller actions.</param>
+    /// <param name="segmentService">Service for retrieving and managing document segments.</param>
+    /// <param name="umbracoMapper">The mapper used to convert between Umbraco domain models and API models.</param>
     public AvailableSegmentsController(
         IAuthorizationService authorizationService,
         ISegmentService segmentService,
@@ -34,6 +43,14 @@ public class AvailableSegmentsController : DocumentControllerBase
         _umbracoMapper = umbracoMapper;
     }
 
+    /// <summary>
+    /// Retrieves a paged collection of available content segments for a specified document.
+    /// </summary>
+    /// <param name="id">The unique identifier of the document for which to retrieve available segments.</param>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="skip">The number of segments to skip before starting to collect the result set (used for paging).</param>
+    /// <param name="take">The maximum number of segments to return (used for paging).</param>
+    /// <returns>A task that represents the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a <see cref="PagedViewModel{SegmentResponseModel}"/> representing the paged collection of available segments.</returns>
     [HttpGet("{id:guid}/available-segment-options")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<SegmentResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/ByKeyDocumentController.cs

@@ -12,6 +12,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// Controller for managing documents in Umbraco that are identified by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDocumentController : DocumentControllerBase
 {
@@ -19,6 +22,12 @@ public class ByKeyDocumentController : DocumentControllerBase
     private readonly IDocumentPresentationFactory _documentPresentationFactory;
     private readonly IContentQueryService _contentQueryService;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.Document.ByKeyDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize access to document resources.</param>
+    /// <param name="documentPresentationFactory">Factory responsible for creating document presentation models.</param>
+    /// <param name="contentQueryService">Service for querying content data within the CMS.</param>
     public ByKeyDocumentController(
         IAuthorizationService authorizationService,
         IDocumentPresentationFactory documentPresentationFactory,
@@ -29,6 +38,15 @@ public class ByKeyDocumentController : DocumentControllerBase
         _contentQueryService = contentQueryService;
     }
 
+    /// <summary>
+    /// Retrieves a document by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique <see cref="Guid"/> of the document to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing a <see cref="DocumentResponseModel"/> if the document is found;
+    /// otherwise, a 404 Not Found or 403 Forbidden error response.
+    /// </returns>
     [HttpGet("{id:guid}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(DocumentResponseModel), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/ByKeyPublishedDocumentController.cs

@@ -13,6 +13,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// Provides API endpoints for managing published documents identified by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyPublishedDocumentController : DocumentControllerBase
 {
@@ -20,6 +23,12 @@ public class ByKeyPublishedDocumentController : DocumentControllerBase
     private readonly IContentEditingService _contentEditingService;
     private readonly IDocumentPresentationFactory _documentPresentationFactory;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ByKeyPublishedDocumentController"/> class, which handles published document operations by key.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize access to document operations.</param>
+    /// <param name="contentEditingService">Service used for editing content.</param>
+    /// <param name="documentPresentationFactory">Factory for creating document presentation models.</param>
     public ByKeyPublishedDocumentController(
         IAuthorizationService authorizationService,
         IContentEditingService contentEditingService,
@@ -30,6 +39,15 @@ public class ByKeyPublishedDocumentController : DocumentControllerBase
         _documentPresentationFactory = documentPresentationFactory;
     }
 
+    /// <summary>
+    /// Retrieves a published document identified by the specified unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the document to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing the <see cref="PublishedDocumentResponseModel"/> if the published document is found;
+    /// otherwise, returns <c>404 Not Found</c> if the document does not exist or is not published, or <c>403 Forbidden</c> if the user is not authorized.
+    /// </returns>
     [HttpGet("{id:guid}/published")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PublishedDocumentResponseModel), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/Collection/ByKeyDocumentCollectionController.cs

@@ -16,6 +16,9 @@ using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document.Collection;
 
+/// <summary>
+/// Controller responsible for managing collections of documents identified by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDocumentCollectionController : DocumentCollectionControllerBase
 {
@@ -23,6 +26,15 @@ public class ByKeyDocumentCollectionController : DocumentCollectionControllerBas
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
     private readonly IDocumentCollectionPresentationFactory _documentCollectionPresentationFactory;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.Document.Collection.ByKeyDocumentCollectionController"/> class,
+    /// which handles document collection operations by document key.
+    /// </summary>
+    /// <param name="contentListViewService">Service for retrieving and managing content list views.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    /// <param name="mapper">The Umbraco object mapper used for mapping between models.</param>
+    /// <param name="documentCollectionPresentationFactory">Factory for creating document collection presentation models.</param>
+    /// <param name="flagProviders">A collection of providers for document collection flags.</param>
     [ActivatorUtilitiesConstructor]
     public ByKeyDocumentCollectionController(
         IContentListViewService contentListViewService,
@@ -37,6 +49,13 @@ public class ByKeyDocumentCollectionController : DocumentCollectionControllerBas
         _documentCollectionPresentationFactory = documentCollectionPresentationFactory;
     }
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.Document.Collection.ByKeyDocumentCollectionController"/> class.
+    /// </summary>
+    /// <param name="contentListViewService">Service for managing content list views.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security operations.</param>
+    /// <param name="mapper">Maps Umbraco objects to API models.</param>
+    /// <param name="documentCollectionPresentationFactory">Factory for creating document collection presentation models.</param>
     [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 18.")]
     public ByKeyDocumentCollectionController(
         IContentListViewService contentListViewService,
@@ -52,6 +71,19 @@ public class ByKeyDocumentCollectionController : DocumentCollectionControllerBas
     {
     }
 
+    /// <summary>
+    /// Retrieves a paged collection of documents identified by the provided unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (key) of the document collection.</param>
+    /// <param name="dataTypeId">An optional data type identifier to filter the collection.</param>
+    /// <param name="orderBy">The field by which to order the collection. Defaults to <c>"updateDate"</c>.</param>
+    /// <param name="orderCulture">An optional culture code to use for ordering.</param>
+    /// <param name="orderDirection">The direction to order the collection. Defaults to <see cref="Direction.Ascending"/>.</param>
+    /// <param name="filter">An optional filter string to filter the collection.</param>
+    /// <param name="skip">The number of items to skip for paging. Defaults to 0.</param>
+    /// <param name="take">The number of items to take for paging. Defaults to 100.</param>
+    /// <returns>A <see cref="Task"/> that represents the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a paged list of <see cref="DocumentCollectionResponseModel"/>.</returns>
     [HttpGet("{id:guid}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DocumentCollectionResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/Collection/DocumentCollectionControllerBase.cs

@@ -13,6 +13,9 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document.Collection;
 
+/// <summary>
+/// Serves as the base controller for handling operations related to document collections within the Umbraco CMS Management API.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Collection}/{Constants.UdiEntityType.Document}")]
 [ApiExplorerSettings(GroupName = nameof(Constants.UdiEntityType.Document))]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocuments)]

src/Umbraco.Cms.Api.Management/Controllers/Document/ConfigurationDocumentController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Factories;
@@ -6,15 +6,27 @@ using Umbraco.Cms.Api.Management.ViewModels.Document;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// API controller responsible for handling operations related to configuration documents within the Umbraco CMS management area.
+/// </summary>
 [ApiVersion("1.0")]
 public class ConfigurationDocumentController : DocumentControllerBase
 {
     private readonly IConfigurationPresentationFactory _configurationPresentationFactory;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigurationDocumentController"/> class, responsible for managing configuration documents.
+    /// </summary>
+    /// <param name="configurationPresentationFactory">Factory used to create configuration presentation models for documents.</param>
     public ConfigurationDocumentController(
         IConfigurationPresentationFactory configurationPresentationFactory) =>
         _configurationPresentationFactory = configurationPresentationFactory;
 
+    /// <summary>
+    /// Retrieves the configuration settings for documents.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> that can be used to cancel the operation.</param>
+    /// <returns>An <see cref="IActionResult"/> containing a <see cref="DocumentConfigurationResponseModel"/> with the document configuration settings.</returns>
     [HttpGet("configuration")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(DocumentConfigurationResponseModel), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/CopyDocumentController.cs

@@ -16,6 +16,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// API controller for handling copy operations on documents in Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class CopyDocumentController : DocumentControllerBase
 {
@@ -23,6 +26,12 @@ public class CopyDocumentController : DocumentControllerBase
     private readonly IContentEditingService _contentEditingService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.Document.CopyDocumentController"/> class, which handles document copy operations in the management API.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="contentEditingService">Service for editing and managing content.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
     public CopyDocumentController(
         IAuthorizationService authorizationService,
         IContentEditingService contentEditingService,
@@ -33,6 +42,13 @@ public class CopyDocumentController : DocumentControllerBase
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    /// <summary>
+    /// Creates a copy of an existing document identified by the specified <paramref name="id"/>.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the document to copy.</param>
+    /// <param name="copyDocumentRequestModel">The request model containing details about the copy operation, such as the target location and copy options.</param>
+    /// <returns>An <see cref="IActionResult"/> representing the result of the copy operation.</returns>
     [HttpPost("{id:guid}/copy")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status201Created)]

src/Umbraco.Cms.Api.Management/Controllers/Document/CreateDocumentController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -12,6 +12,9 @@ using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// API controller responsible for handling operations related to the creation of content documents in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class CreateDocumentController : CreateDocumentControllerBase
 {
@@ -19,6 +22,13 @@ public class CreateDocumentController : CreateDocumentControllerBase
     private readonly IContentEditingService _contentEditingService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize access to document creation operations.</param>
+    /// <param name="documentEditingPresentationFactory">Factory for creating document editing presentation models.</param>
+    /// <param name="contentEditingService">Service responsible for content editing functionality.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
     public CreateDocumentController(
         IAuthorizationService authorizationService,
         IDocumentEditingPresentationFactory documentEditingPresentationFactory,
@@ -31,6 +41,12 @@ public class CreateDocumentController : CreateDocumentControllerBase
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    /// <summary>
+    /// Creates a new document using the specified request model.
+    /// </summary>
+    /// <param name="cancellationToken">Token to monitor for cancellation requests.</param>
+    /// <param name="requestModel">The details of the document to create.</param>
+    /// <returns>An <see cref="IActionResult"/> representing the result of the operation.</returns>
     [HttpPost]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status201Created)]

src/Umbraco.Cms.Api.Management/Controllers/Document/CreateDocumentControllerBase.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Security.Authorization.Content;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
@@ -9,6 +9,10 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// Serves as the base controller for document creation endpoints in the Umbraco CMS Management API.
+/// Provides shared functionality for creating documents.
+/// </summary>
 public abstract class CreateDocumentControllerBase : DocumentControllerBase
 {
     private readonly IAuthorizationService _authorizationService;

src/Umbraco.Cms.Api.Management/Controllers/Document/CreatePublicAccessDocumentController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -16,6 +16,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// API controller responsible for handling requests to create documents with public access permissions in Umbraco.
+/// </summary>
 [ApiVersion("1.0")]
 public class CreatePublicAccessDocumentController : DocumentControllerBase
 {
@@ -23,6 +26,12 @@ public class CreatePublicAccessDocumentController : DocumentControllerBase
     private readonly IPublicAccessPresentationFactory _publicAccessPresentationFactory;
     private readonly IPublicAccessService _publicAccessService;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreatePublicAccessDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to perform permission checks.</param>
+    /// <param name="publicAccessPresentationFactory">Factory for creating public access presentation models.</param>
+    /// <param name="publicAccessService">Service for managing public access settings.</param>
     public CreatePublicAccessDocumentController(
         IAuthorizationService authorizationService,
         IPublicAccessPresentationFactory publicAccessPresentationFactory,
@@ -33,6 +42,19 @@ public class CreatePublicAccessDocumentController : DocumentControllerBase
         _publicAccessService = publicAccessService;
     }
 
+    /// <summary>
+    /// Creates public access rules for the specified document, restricting or allowing access based on the provided access details.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the document to protect.</param>
+    /// <param name="publicAccessRequestModel">The model containing the public access configuration for the document.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the result of the operation:
+    /// <list type="bullet">
+    /// <item><description><c>201 Created</c> if the public access rules were successfully created.</description></item>
+    /// <item><description><c>404 Not Found</c> if the document does not exist.</description></item>
+    /// </list>
+    /// </returns>
     [MapToApiVersion("1.0")]
     [HttpPost("{id:guid}/public-access")]
     [ProducesResponseType(StatusCodes.Status201Created)]

src/Umbraco.Cms.Api.Management/Controllers/Document/DeleteDocumentController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -15,6 +15,9 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// API controller responsible for handling requests to delete documents in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class DeleteDocumentController : DocumentControllerBase
 {
@@ -22,6 +25,12 @@ public class DeleteDocumentController : DocumentControllerBase
     private readonly IContentEditingService _contentEditingService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeleteDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">An <see cref="IAuthorizationService"/> used to authorize document deletion requests.</param>
+    /// <param name="contentEditingService">An <see cref="IContentEditingService"/> used to perform content editing operations.</param>
+    /// <param name="backOfficeSecurityAccessor">An <see cref="IBackOfficeSecurityAccessor"/> providing access to back office security information.</param>
     public DeleteDocumentController(
         IAuthorizationService authorizationService,
         IContentEditingService contentEditingService,
@@ -32,6 +41,12 @@ public class DeleteDocumentController : DocumentControllerBase
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    /// <summary>
+    /// Deletes the document with the specified unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the document to delete.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the outcome of the delete operation.</returns>
     [HttpDelete("{id:guid}")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/DeletePublicAccessDocumentController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -13,18 +13,35 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// Controller for deleting public access settings from documents.
+/// </summary>
 [ApiVersion("1.0")]
 public class DeletePublicAccessDocumentController : DocumentControllerBase
 {
     private readonly IAuthorizationService _authorizationService;
     private readonly IPublicAccessService _publicAccessService;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeletePublicAccessDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize access to document operations.</param>
+    /// <param name="publicAccessService">Service used to manage public access settings for documents.</param>
     public DeletePublicAccessDocumentController(IAuthorizationService authorizationService, IPublicAccessService publicAccessService)
     {
         _authorizationService = authorizationService;
         _publicAccessService = publicAccessService;
     }
 
+    /// <summary>
+    /// Removes public access protection and rules from the specified document.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the document from which to remove public access.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the result of the operation:
+    /// returns <c>200 OK</c> if successful, or <c>404 Not Found</c> if the document or public access settings do not exist.
+    /// </returns>
     [MapToApiVersion("1.0")]
     [HttpDelete("{id:guid}/public-access")]
     [ProducesResponseType(StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/DocumentControllerBase.cs

@@ -12,6 +12,10 @@ using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
+/// <summary>
+/// Serves as the base controller for implementing document management operations within the Umbraco CMS Management API.
+/// Provides shared functionality for derived document controllers.
+/// </summary>
 [VersionedApiBackOfficeRoute(Constants.UdiEntityType.Document)]
 [ApiExplorerSettings(GroupName = nameof(Constants.UdiEntityType.Document))]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocuments)]