admin api: make all handlers impls of a single trait

5 files changed, 761 insertions, 502 deletions

diff --git a/src/api/admin/api.rs b/src/api/admin/api.rs
index a2dc95c2..a5dbdfbe 100644
--- a/src/api/admin/api.rs
+++ b/src/api/admin/api.rs
@@ -1,7 +1,13 @@
 use std::net::SocketAddr;
+use std::sync::Arc;
 
+use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
 
+use garage_model::garage::Garage;
+
+use crate::admin::error::Error;
+use crate::admin::EndpointHandler;
 use crate::helpers::is_default;
 
 pub enum AdminApiRequest {
@@ -13,8 +19,35 @@ pub enum AdminApiRequest {
 	UpdateClusterLayout(UpdateClusterLayoutRequest),
 	ApplyClusterLayout(ApplyClusterLayoutRequest),
 	RevertClusterLayout(RevertClusterLayoutRequest),
+
+	// Access key operations
+	ListKeys(ListKeysRequest),
+	GetKeyInfo(GetKeyInfoRequest),
+	CreateKey(CreateKeyRequest),
+	ImportKey(ImportKeyRequest),
+	UpdateKey(UpdateKeyRequest),
+	DeleteKey(DeleteKeyRequest),
+
+	// Bucket operations
+	ListBuckets(ListBucketsRequest),
+	GetBucketInfo(GetBucketInfoRequest),
+	CreateBucket(CreateBucketRequest),
+	UpdateBucket(UpdateBucketRequest),
+	DeleteBucket(DeleteBucketRequest),
+
+	// Operations on permissions for keys on buckets
+	BucketAllowKey(BucketAllowKeyRequest),
+	BucketDenyKey(BucketDenyKeyRequest),
+
+	// Operations on bucket aliases
+	GlobalAliasBucket(GlobalAliasBucketRequest),
+	GlobalUnaliasBucket(GlobalUnaliasBucketRequest),
+	LocalAliasBucket(LocalAliasBucketRequest),
+	LocalUnaliasBucket(LocalUnaliasBucketRequest),
 }
 
+#[derive(Serialize)]
+#[serde(untagged)]
 pub enum AdminApiResponse {
 	// Cluster operations
 	GetClusterStatus(GetClusterStatusResponse),
@@ -24,6 +57,98 @@ pub enum AdminApiResponse {
 	UpdateClusterLayout(UpdateClusterLayoutResponse),
 	ApplyClusterLayout(ApplyClusterLayoutResponse),
 	RevertClusterLayout(RevertClusterLayoutResponse),
+
+	// Access key operations
+	ListKeys(ListKeysResponse),
+	GetKeyInfo(GetKeyInfoResponse),
+	CreateKey(CreateKeyResponse),
+	ImportKey(ImportKeyResponse),
+	UpdateKey(UpdateKeyResponse),
+	DeleteKey(DeleteKeyResponse),
+
+	// Bucket operations
+	ListBuckets(ListBucketsResponse),
+	GetBucketInfo(GetBucketInfoResponse),
+	CreateBucket(CreateBucketResponse),
+	UpdateBucket(UpdateBucketResponse),
+	DeleteBucket(DeleteBucketResponse),
+
+	// Operations on permissions for keys on buckets
+	BucketAllowKey(BucketAllowKeyResponse),
+	BucketDenyKey(BucketDenyKeyResponse),
+
+	// Operations on bucket aliases
+	GlobalAliasBucket(GlobalAliasBucketResponse),
+	GlobalUnaliasBucket(GlobalUnaliasBucketResponse),
+	LocalAliasBucket(LocalAliasBucketResponse),
+	LocalUnaliasBucket(LocalUnaliasBucketResponse),
+}
+
+#[async_trait]
+impl EndpointHandler for AdminApiRequest {
+	type Response = AdminApiResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<AdminApiResponse, Error> {
+		Ok(match self {
+			// Cluster operations
+			Self::GetClusterStatus(req) => {
+				AdminApiResponse::GetClusterStatus(req.handle(garage).await?)
+			}
+			Self::GetClusterHealth(req) => {
+				AdminApiResponse::GetClusterHealth(req.handle(garage).await?)
+			}
+			Self::ConnectClusterNodes(req) => {
+				AdminApiResponse::ConnectClusterNodes(req.handle(garage).await?)
+			}
+			Self::GetClusterLayout(req) => {
+				AdminApiResponse::GetClusterLayout(req.handle(garage).await?)
+			}
+			Self::UpdateClusterLayout(req) => {
+				AdminApiResponse::UpdateClusterLayout(req.handle(garage).await?)
+			}
+			Self::ApplyClusterLayout(req) => {
+				AdminApiResponse::ApplyClusterLayout(req.handle(garage).await?)
+			}
+			Self::RevertClusterLayout(req) => {
+				AdminApiResponse::RevertClusterLayout(req.handle(garage).await?)
+			}
+
+			// Access key operations
+			Self::ListKeys(req) => AdminApiResponse::ListKeys(req.handle(garage).await?),
+			Self::GetKeyInfo(req) => AdminApiResponse::GetKeyInfo(req.handle(garage).await?),
+			Self::CreateKey(req) => AdminApiResponse::CreateKey(req.handle(garage).await?),
+			Self::ImportKey(req) => AdminApiResponse::ImportKey(req.handle(garage).await?),
+			Self::UpdateKey(req) => AdminApiResponse::UpdateKey(req.handle(garage).await?),
+			Self::DeleteKey(req) => AdminApiResponse::DeleteKey(req.handle(garage).await?),
+
+			// Bucket operations
+			Self::ListBuckets(req) => AdminApiResponse::ListBuckets(req.handle(garage).await?),
+			Self::GetBucketInfo(req) => AdminApiResponse::GetBucketInfo(req.handle(garage).await?),
+			Self::CreateBucket(req) => AdminApiResponse::CreateBucket(req.handle(garage).await?),
+			Self::UpdateBucket(req) => AdminApiResponse::UpdateBucket(req.handle(garage).await?),
+			Self::DeleteBucket(req) => AdminApiResponse::DeleteBucket(req.handle(garage).await?),
+
+			// Operations on permissions for keys on buckets
+			Self::BucketAllowKey(req) => {
+				AdminApiResponse::BucketAllowKey(req.handle(garage).await?)
+			}
+			Self::BucketDenyKey(req) => AdminApiResponse::BucketDenyKey(req.handle(garage).await?),
+
+			// Operations on bucket aliases
+			Self::GlobalAliasBucket(req) => {
+				AdminApiResponse::GlobalAliasBucket(req.handle(garage).await?)
+			}
+			Self::GlobalUnaliasBucket(req) => {
+				AdminApiResponse::GlobalUnaliasBucket(req.handle(garage).await?)
+			}
+			Self::LocalAliasBucket(req) => {
+				AdminApiResponse::LocalAliasBucket(req.handle(garage).await?)
+			}
+			Self::LocalUnaliasBucket(req) => {
+				AdminApiResponse::LocalUnaliasBucket(req.handle(garage).await?)
+			}
+		})
+	}
 }
 
 // **********************************************
@@ -277,24 +402,30 @@ pub struct ImportKeyResponse(pub GetKeyInfoResponse);
 
 // ---- UpdateKey ----
 
+pub struct UpdateKeyRequest {
+	pub id: String,
+	pub params: UpdateKeyRequestParams,
+}
+
+#[derive(Serialize)]
+pub struct UpdateKeyResponse(pub GetKeyInfoResponse);
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UpdateKeyRequest {
+pub struct UpdateKeyRequestParams {
 	// TODO: id (get parameter) goes here
 	pub name: Option<String>,
 	pub allow: Option<KeyPerm>,
 	pub deny: Option<KeyPerm>,
 }
 
-#[derive(Serialize)]
-pub struct UpdateKeyResponse(pub GetKeyInfoResponse);
-
 // ---- DeleteKey ----
 
 pub struct DeleteKeyRequest {
 	pub id: String,
 }
 
+#[derive(Serialize)]
 pub struct DeleteKeyResponse;
 
 // **********************************************
@@ -305,6 +436,7 @@ pub struct DeleteKeyResponse;
 
 pub struct ListBucketsRequest;
 
+#[derive(Serialize)]
 pub struct ListBucketsResponse(pub Vec<ListBucketsResponseItem>);
 
 #[derive(Serialize)]
@@ -380,7 +512,7 @@ pub struct CreateBucketRequest {
 }
 
 #[derive(Serialize)]
-pub struct CreateBucketResponse(GetBucketInfoResponse);
+pub struct CreateBucketResponse(pub GetBucketInfoResponse);
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -393,16 +525,21 @@ pub struct CreateBucketLocalAlias {
 
 // ---- UpdateBucket ----
 
+pub struct UpdateBucketRequest {
+	pub id: String,
+	pub params: UpdateBucketRequestParams,
+}
+
+#[derive(Serialize)]
+pub struct UpdateBucketResponse(pub GetBucketInfoResponse);
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UpdateBucketRequest {
+pub struct UpdateBucketRequestParams {
 	pub website_access: Option<UpdateBucketWebsiteAccess>,
 	pub quotas: Option<ApiBucketQuotas>,
 }
 
-#[derive(Serialize)]
-pub struct UpdateBucketResponse(GetBucketInfoResponse);
-
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UpdateBucketWebsiteAccess {
@@ -417,6 +554,7 @@ pub struct DeleteBucketRequest {
 	pub id: String,
 }
 
+#[derive(Serialize)]
 pub struct DeleteBucketResponse;
 
 // **********************************************
@@ -427,7 +565,8 @@ pub struct DeleteBucketResponse;
 
 pub struct BucketAllowKeyRequest(pub BucketKeyPermChangeRequest);
 
-pub struct BucketAllowKeyResponse;
+#[derive(Serialize)]
+pub struct BucketAllowKeyResponse(pub GetBucketInfoResponse);
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -441,7 +580,8 @@ pub struct BucketKeyPermChangeRequest {
 
 pub struct BucketDenyKeyRequest(pub BucketKeyPermChangeRequest);
 
-pub struct BucketDenyKeyResponse;
+#[derive(Serialize)]
+pub struct BucketDenyKeyResponse(pub GetBucketInfoResponse);
 
 // **********************************************
 //      Operations on bucket aliases
@@ -454,7 +594,8 @@ pub struct GlobalAliasBucketRequest {
 	pub alias: String,
 }
 
-pub struct GlobalAliasBucketReponse;
+#[derive(Serialize)]
+pub struct GlobalAliasBucketResponse(pub GetBucketInfoResponse);
 
 // ---- GlobalUnaliasBucket ----
 
@@ -463,7 +604,8 @@ pub struct GlobalUnaliasBucketRequest {
 	pub alias: String,
 }
 
-pub struct GlobalUnaliasBucketReponse;
+#[derive(Serialize)]
+pub struct GlobalUnaliasBucketResponse(pub GetBucketInfoResponse);
 
 // ---- LocalAliasBucket ----
 
@@ -473,7 +615,8 @@ pub struct LocalAliasBucketRequest {
 	pub alias: String,
 }
 
-pub struct LocalAliasBucketReponse;
+#[derive(Serialize)]
+pub struct LocalAliasBucketResponse(pub GetBucketInfoResponse);
 
 // ---- LocalUnaliasBucket ----
 
@@ -483,4 +626,5 @@ pub struct LocalUnaliasBucketRequest {
 	pub alias: String,
 }
 
-pub struct LocalUnaliasBucketReponse;
+#[derive(Serialize)]
+pub struct LocalUnaliasBucketResponse(pub GetBucketInfoResponse);
diff --git a/src/api/admin/api_server.rs b/src/api/admin/api_server.rs
index 9715292c..c6b7661c 100644
--- a/src/api/admin/api_server.rs
+++ b/src/api/admin/api_server.rs
@@ -23,10 +23,7 @@ use garage_util::socket_address::UnixOrTCPSocketAddress;
 use crate::generic_server::*;
 
 use crate::admin::api::*;
-use crate::admin::bucket::*;
-use crate::admin::cluster::*;
 use crate::admin::error::*;
-use crate::admin::key::*;
 use crate::admin::router_v0;
 use crate::admin::router_v1::{Authorization, Endpoint};
 use crate::admin::EndpointHandler;
@@ -271,67 +268,134 @@ impl ApiHandler for AdminApiServer {
 			Endpoint::CheckDomain => self.handle_check_domain(req).await,
 			Endpoint::Health => self.handle_health(),
 			Endpoint::Metrics => self.handle_metrics(),
-			Endpoint::GetClusterStatus => GetClusterStatusRequest
-				.handle(&self.garage)
-				.await
-				.and_then(|x| json_ok_response(&x)),
-			Endpoint::GetClusterHealth => GetClusterHealthRequest
-				.handle(&self.garage)
+			e => {
+				async {
+					let body = parse_request_body(e, req).await?;
+					let res = body.handle(&self.garage).await?;
+					json_ok_response(&res)
+				}
 				.await
-				.and_then(|x| json_ok_response(&x)),
-			Endpoint::ConnectClusterNodes => handle_connect_cluster_nodes(&self.garage, req).await,
-			// Layout
-			Endpoint::GetClusterLayout => handle_get_cluster_layout(&self.garage).await,
-			Endpoint::UpdateClusterLayout => handle_update_cluster_layout(&self.garage, req).await,
-			Endpoint::ApplyClusterLayout => handle_apply_cluster_layout(&self.garage, req).await,
-			Endpoint::RevertClusterLayout => handle_revert_cluster_layout(&self.garage).await,
-			// Keys
-			Endpoint::ListKeys => handle_list_keys(&self.garage).await,
-			Endpoint::GetKeyInfo {
+			}
+		}
+	}
+}
+
+async fn parse_request_body(
+	endpoint: Endpoint,
+	req: Request<IncomingBody>,
+) -> Result<AdminApiRequest, Error> {
+	match endpoint {
+		Endpoint::GetClusterStatus => {
+			Ok(AdminApiRequest::GetClusterStatus(GetClusterStatusRequest))
+		}
+		Endpoint::GetClusterHealth => {
+			Ok(AdminApiRequest::GetClusterHealth(GetClusterHealthRequest))
+		}
+		Endpoint::ConnectClusterNodes => {
+			let req = parse_json_body::<ConnectClusterNodesRequest, _, Error>(req).await?;
+			Ok(AdminApiRequest::ConnectClusterNodes(req))
+		}
+		// Layout
+		Endpoint::GetClusterLayout => {
+			Ok(AdminApiRequest::GetClusterLayout(GetClusterLayoutRequest))
+		}
+		Endpoint::UpdateClusterLayout => {
+			let updates = parse_json_body::<UpdateClusterLayoutRequest, _, Error>(req).await?;
+			Ok(AdminApiRequest::UpdateClusterLayout(updates))
+		}
+		Endpoint::ApplyClusterLayout => {
+			let param = parse_json_body::<ApplyClusterLayoutRequest, _, Error>(req).await?;
+			Ok(AdminApiRequest::ApplyClusterLayout(param))
+		}
+		Endpoint::RevertClusterLayout => Ok(AdminApiRequest::RevertClusterLayout(
+			RevertClusterLayoutRequest,
+		)),
+		// Keys
+		Endpoint::ListKeys => Ok(AdminApiRequest::ListKeys(ListKeysRequest)),
+		Endpoint::GetKeyInfo {
+			id,
+			search,
+			show_secret_key,
+		} => {
+			let show_secret_key = show_secret_key.map(|x| x == "true").unwrap_or(false);
+			Ok(AdminApiRequest::GetKeyInfo(GetKeyInfoRequest {
 				id,
 				search,
 				show_secret_key,
-			} => {
-				let show_secret_key = show_secret_key.map(|x| x == "true").unwrap_or(false);
-				handle_get_key_info(&self.garage, id, search, show_secret_key).await
-			}
-			Endpoint::CreateKey => handle_create_key(&self.garage, req).await,
-			Endpoint::ImportKey => handle_import_key(&self.garage, req).await,
-			Endpoint::UpdateKey { id } => handle_update_key(&self.garage, id, req).await,
-			Endpoint::DeleteKey { id } => handle_delete_key(&self.garage, id).await,
-			// Buckets
-			Endpoint::ListBuckets => handle_list_buckets(&self.garage).await,
-			Endpoint::GetBucketInfo { id, global_alias } => {
-				handle_get_bucket_info(&self.garage, id, global_alias).await
-			}
-			Endpoint::CreateBucket => handle_create_bucket(&self.garage, req).await,
-			Endpoint::DeleteBucket { id } => handle_delete_bucket(&self.garage, id).await,
-			Endpoint::UpdateBucket { id } => handle_update_bucket(&self.garage, id, req).await,
-			// Bucket-key permissions
-			Endpoint::BucketAllowKey => {
-				handle_bucket_change_key_perm(&self.garage, req, true).await
-			}
-			Endpoint::BucketDenyKey => {
-				handle_bucket_change_key_perm(&self.garage, req, false).await
-			}
-			// Bucket aliasing
-			Endpoint::GlobalAliasBucket { id, alias } => {
-				handle_global_alias_bucket(&self.garage, id, alias).await
-			}
-			Endpoint::GlobalUnaliasBucket { id, alias } => {
-				handle_global_unalias_bucket(&self.garage, id, alias).await
-			}
-			Endpoint::LocalAliasBucket {
+			}))
+		}
+		Endpoint::CreateKey => {
+			let req = parse_json_body::<CreateKeyRequest, _, Error>(req).await?;
+			Ok(AdminApiRequest::CreateKey(req))
+		}
+		Endpoint::ImportKey => {
+			let req = parse_json_body::<ImportKeyRequest, _, Error>(req).await?;
+			Ok(AdminApiRequest::ImportKey(req))
+		}
+		Endpoint::UpdateKey { id } => {
+			let params = parse_json_body::<UpdateKeyRequestParams, _, Error>(req).await?;
+			Ok(AdminApiRequest::UpdateKey(UpdateKeyRequest { id, params }))
+		}
+		Endpoint::DeleteKey { id } => Ok(AdminApiRequest::DeleteKey(DeleteKeyRequest { id })),
+		// Buckets
+		Endpoint::ListBuckets => Ok(AdminApiRequest::ListBuckets(ListBucketsRequest)),
+		Endpoint::GetBucketInfo { id, global_alias } => {
+			Ok(AdminApiRequest::GetBucketInfo(GetBucketInfoRequest {
 				id,
-				access_key_id,
-				alias,
-			} => handle_local_alias_bucket(&self.garage, id, access_key_id, alias).await,
-			Endpoint::LocalUnaliasBucket {
+				global_alias,
+			}))
+		}
+		Endpoint::CreateBucket => {
+			let req = parse_json_body::<CreateBucketRequest, _, Error>(req).await?;
+			Ok(AdminApiRequest::CreateBucket(req))
+		}
+		Endpoint::DeleteBucket { id } => {
+			Ok(AdminApiRequest::DeleteBucket(DeleteBucketRequest { id }))
+		}
+		Endpoint::UpdateBucket { id } => {
+			let params = parse_json_body::<UpdateBucketRequestParams, _, Error>(req).await?;
+			Ok(AdminApiRequest::UpdateBucket(UpdateBucketRequest {
 				id,
+				params,
+			}))
+		}
+		// Bucket-key permissions
+		Endpoint::BucketAllowKey => {
+			let req = parse_json_body::<BucketKeyPermChangeRequest, _, Error>(req).await?;
+			Ok(AdminApiRequest::BucketAllowKey(BucketAllowKeyRequest(req)))
+		}
+		Endpoint::BucketDenyKey => {
+			let req = parse_json_body::<BucketKeyPermChangeRequest, _, Error>(req).await?;
+			Ok(AdminApiRequest::BucketDenyKey(BucketDenyKeyRequest(req)))
+		}
+		// Bucket aliasing
+		Endpoint::GlobalAliasBucket { id, alias } => Ok(AdminApiRequest::GlobalAliasBucket(
+			GlobalAliasBucketRequest { id, alias },
+		)),
+		Endpoint::GlobalUnaliasBucket { id, alias } => Ok(AdminApiRequest::GlobalUnaliasBucket(
+			GlobalUnaliasBucketRequest { id, alias },
+		)),
+		Endpoint::LocalAliasBucket {
+			id,
+			access_key_id,
+			alias,
+		} => Ok(AdminApiRequest::LocalAliasBucket(LocalAliasBucketRequest {
+			access_key_id,
+			id,
+			alias,
+		})),
+		Endpoint::LocalUnaliasBucket {
+			id,
+			access_key_id,
+			alias,
+		} => Ok(AdminApiRequest::LocalUnaliasBucket(
+			LocalUnaliasBucketRequest {
 				access_key_id,
+				id,
 				alias,
-			} => handle_local_unalias_bucket(&self.garage, id, access_key_id, alias).await,
-		}
+			},
+		)),
+		_ => unreachable!(),
 	}
 }
 
diff --git a/src/api/admin/bucket.rs b/src/api/admin/bucket.rs
index 593848f0..d62bfa54 100644
--- a/src/api/admin/bucket.rs
+++ b/src/api/admin/bucket.rs
@@ -1,7 +1,7 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 
-use hyper::{body::Incoming as IncomingBody, Request, Response, StatusCode};
+use async_trait::async_trait;
 
 use garage_util::crdt::*;
 use garage_util::data::*;
@@ -18,83 +18,93 @@ use garage_model::s3::object_table::*;
 
 use crate::admin::api::ApiBucketKeyPerm;
 use crate::admin::api::{
-	ApiBucketQuotas, BucketKeyPermChangeRequest, BucketLocalAlias, CreateBucketRequest,
-	GetBucketInfoKey, GetBucketInfoResponse, GetBucketInfoWebsiteResponse, ListBucketsResponseItem,
-	UpdateBucketRequest,
+	ApiBucketQuotas, BucketAllowKeyRequest, BucketAllowKeyResponse, BucketDenyKeyRequest,
+	BucketDenyKeyResponse, BucketKeyPermChangeRequest, BucketLocalAlias, CreateBucketRequest,
+	CreateBucketResponse, DeleteBucketRequest, DeleteBucketResponse, GetBucketInfoKey,
+	GetBucketInfoRequest, GetBucketInfoResponse, GetBucketInfoWebsiteResponse,
+	GlobalAliasBucketRequest, GlobalAliasBucketResponse, GlobalUnaliasBucketRequest,
+	GlobalUnaliasBucketResponse, ListBucketsRequest, ListBucketsResponse, ListBucketsResponseItem,
+	LocalAliasBucketRequest, LocalAliasBucketResponse, LocalUnaliasBucketRequest,
+	LocalUnaliasBucketResponse, UpdateBucketRequest, UpdateBucketResponse,
 };
-use crate::admin::api_server::ResBody;
 use crate::admin::error::*;
+use crate::admin::EndpointHandler;
 use crate::common_error::CommonError;
-use crate::helpers::*;
-
-pub async fn handle_list_buckets(garage: &Arc<Garage>) -> Result<Response<ResBody>, Error> {
-	let buckets = garage
-		.bucket_table
-		.get_range(
-			&EmptyKey,
-			None,
-			Some(DeletedFilter::NotDeleted),
-			10000,
-			EnumerationOrder::Forward,
-		)
-		.await?;
 
-	let res = buckets
-		.into_iter()
-		.map(|b| {
-			let state = b.state.as_option().unwrap();
-			ListBucketsResponseItem {
-				id: hex::encode(b.id),
-				global_aliases: state
-					.aliases
-					.items()
-					.iter()
-					.filter(|(_, _, a)| *a)
-					.map(|(n, _, _)| n.to_string())
-					.collect::<Vec<_>>(),
-				local_aliases: state
-					.local_aliases
-					.items()
-					.iter()
-					.filter(|(_, _, a)| *a)
-					.map(|((k, n), _, _)| BucketLocalAlias {
-						access_key_id: k.to_string(),
-						alias: n.to_string(),
-					})
-					.collect::<Vec<_>>(),
-			}
-		})
-		.collect::<Vec<_>>();
+#[async_trait]
+impl EndpointHandler for ListBucketsRequest {
+	type Response = ListBucketsResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<ListBucketsResponse, Error> {
+		let buckets = garage
+			.bucket_table
+			.get_range(
+				&EmptyKey,
+				None,
+				Some(DeletedFilter::NotDeleted),
+				10000,
+				EnumerationOrder::Forward,
+			)
+			.await?;
+
+		let res = buckets
+			.into_iter()
+			.map(|b| {
+				let state = b.state.as_option().unwrap();
+				ListBucketsResponseItem {
+					id: hex::encode(b.id),
+					global_aliases: state
+						.aliases
+						.items()
+						.iter()
+						.filter(|(_, _, a)| *a)
+						.map(|(n, _, _)| n.to_string())
+						.collect::<Vec<_>>(),
+					local_aliases: state
+						.local_aliases
+						.items()
+						.iter()
+						.filter(|(_, _, a)| *a)
+						.map(|((k, n), _, _)| BucketLocalAlias {
+							access_key_id: k.to_string(),
+							alias: n.to_string(),
+						})
+						.collect::<Vec<_>>(),
+				}
+			})
+			.collect::<Vec<_>>();
 
-	Ok(json_ok_response(&res)?)
+		Ok(ListBucketsResponse(res))
+	}
 }
 
-pub async fn handle_get_bucket_info(
-	garage: &Arc<Garage>,
-	id: Option<String>,
-	global_alias: Option<String>,
-) -> Result<Response<ResBody>, Error> {
-	let bucket_id = match (id, global_alias) {
-		(Some(id), None) => parse_bucket_id(&id)?,
-		(None, Some(ga)) => garage
-			.bucket_helper()
-			.resolve_global_bucket_name(&ga)
-			.await?
-			.ok_or_else(|| HelperError::NoSuchBucket(ga.to_string()))?,
-		_ => {
-			return Err(Error::bad_request(
-				"Either id or globalAlias must be provided (but not both)",
-			));
-		}
-	};
+#[async_trait]
+impl EndpointHandler for GetBucketInfoRequest {
+	type Response = GetBucketInfoResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<GetBucketInfoResponse, Error> {
+		let bucket_id = match (self.id, self.global_alias) {
+			(Some(id), None) => parse_bucket_id(&id)?,
+			(None, Some(ga)) => garage
+				.bucket_helper()
+				.resolve_global_bucket_name(&ga)
+				.await?
+				.ok_or_else(|| HelperError::NoSuchBucket(ga.to_string()))?,
+			_ => {
+				return Err(Error::bad_request(
+					"Either id or globalAlias must be provided (but not both)",
+				));
+			}
+		};
 
-	bucket_info_results(garage, bucket_id).await
+		bucket_info_results(garage, bucket_id).await
+	}
 }
 
 async fn bucket_info_results(
 	garage: &Arc<Garage>,
 	bucket_id: Uuid,
-) -> Result<Response<ResBody>, Error> {
+) -> Result<GetBucketInfoResponse, Error> {
 	let bucket = garage
 		.bucket_helper()
 		.get_existing_bucket(bucket_id)
@@ -211,181 +221,203 @@ async fn bucket_info_results(
 		},
 	};
 
-	Ok(json_ok_response(&res)?)
+	Ok(res)
 }
 
-pub async fn handle_create_bucket(
-	garage: &Arc<Garage>,
-	req: Request<IncomingBody>,
-) -> Result<Response<ResBody>, Error> {
-	let req = parse_json_body::<CreateBucketRequest, _, Error>(req).await?;
+#[async_trait]
+impl EndpointHandler for CreateBucketRequest {
+	type Response = CreateBucketResponse;
 
-	let helper = garage.locked_helper().await;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<CreateBucketResponse, Error> {
+		let helper = garage.locked_helper().await;
 
-	if let Some(ga) = &req.global_alias {
-		if !is_valid_bucket_name(ga) {
-			return Err(Error::bad_request(format!(
-				"{}: {}",
-				ga, INVALID_BUCKET_NAME_MESSAGE
-			)));
-		}
+		if let Some(ga) = &self.global_alias {
+			if !is_valid_bucket_name(ga) {
+				return Err(Error::bad_request(format!(
+					"{}: {}",
+					ga, INVALID_BUCKET_NAME_MESSAGE
+				)));
+			}
 
-		if let Some(alias) = garage.bucket_alias_table.get(&EmptyKey, ga).await? {
-			if alias.state.get().is_some() {
-				return Err(CommonError::BucketAlreadyExists.into());
+			if let Some(alias) = garage.bucket_alias_table.get(&EmptyKey, ga).await? {
+				if alias.state.get().is_some() {
+					return Err(CommonError::BucketAlreadyExists.into());
+				}
 			}
 		}
-	}
 
-	if let Some(la) = &req.local_alias {
-		if !is_valid_bucket_name(&la.alias) {
-			return Err(Error::bad_request(format!(
-				"{}: {}",
-				la.alias, INVALID_BUCKET_NAME_MESSAGE
-			)));
-		}
+		if let Some(la) = &self.local_alias {
+			if !is_valid_bucket_name(&la.alias) {
+				return Err(Error::bad_request(format!(
+					"{}: {}",
+					la.alias, INVALID_BUCKET_NAME_MESSAGE
+				)));
+			}
 
-		let key = helper.key().get_existing_key(&la.access_key_id).await?;
-		let state = key.state.as_option().unwrap();
-		if matches!(state.local_aliases.get(&la.alias), Some(_)) {
-			return Err(Error::bad_request("Local alias already exists"));
+			let key = helper.key().get_existing_key(&la.access_key_id).await?;
+			let state = key.state.as_option().unwrap();
+			if matches!(state.local_aliases.get(&la.alias), Some(_)) {
+				return Err(Error::bad_request("Local alias already exists"));
+			}
 		}
-	}
-
-	let bucket = Bucket::new();
-	garage.bucket_table.insert(&bucket).await?;
 
-	if let Some(ga) = &req.global_alias {
-		helper.set_global_bucket_alias(bucket.id, ga).await?;
-	}
+		let bucket = Bucket::new();
+		garage.bucket_table.insert(&bucket).await?;
 
-	if let Some(la) = &req.local_alias {
-		helper
-			.set_local_bucket_alias(bucket.id, &la.access_key_id, &la.alias)
-			.await?;
+		if let Some(ga) = &self.global_alias {
+			helper.set_global_bucket_alias(bucket.id, ga).await?;
+		}
 
-		if la.allow.read || la.allow.write || la.allow.owner {
+		if let Some(la) = &self.local_alias {
 			helper
-				.set_bucket_key_permissions(
-					bucket.id,
-					&la.access_key_id,
-					BucketKeyPerm {
-						timestamp: now_msec(),
-						allow_read: la.allow.read,
-						allow_write: la.allow.write,
-						allow_owner: la.allow.owner,
-					},
-				)
+				.set_local_bucket_alias(bucket.id, &la.access_key_id, &la.alias)
 				.await?;
+
+			if la.allow.read || la.allow.write || la.allow.owner {
+				helper
+					.set_bucket_key_permissions(
+						bucket.id,
+						&la.access_key_id,
+						BucketKeyPerm {
+							timestamp: now_msec(),
+							allow_read: la.allow.read,
+							allow_write: la.allow.write,
+							allow_owner: la.allow.owner,
+						},
+					)
+					.await?;
+			}
 		}
-	}
 
-	bucket_info_results(garage, bucket.id).await
+		Ok(CreateBucketResponse(
+			bucket_info_results(garage, bucket.id).await?,
+		))
+	}
 }
 
-pub async fn handle_delete_bucket(
-	garage: &Arc<Garage>,
-	id: String,
-) -> Result<Response<ResBody>, Error> {
-	let helper = garage.locked_helper().await;
+#[async_trait]
+impl EndpointHandler for DeleteBucketRequest {
+	type Response = DeleteBucketResponse;
 
-	let bucket_id = parse_bucket_id(&id)?;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<DeleteBucketResponse, Error> {
+		let helper = garage.locked_helper().await;
 
-	let mut bucket = helper.bucket().get_existing_bucket(bucket_id).await?;
-	let state = bucket.state.as_option().unwrap();
+		let bucket_id = parse_bucket_id(&self.id)?;
 
-	// Check bucket is empty
-	if !helper.bucket().is_bucket_empty(bucket_id).await? {
-		return Err(CommonError::BucketNotEmpty.into());
-	}
+		let mut bucket = helper.bucket().get_existing_bucket(bucket_id).await?;
+		let state = bucket.state.as_option().unwrap();
 
-	// --- done checking, now commit ---
-	// 1. delete authorization from keys that had access
-	for (key_id, perm) in bucket.authorized_keys() {
-		if perm.is_any() {
-			helper
-				.set_bucket_key_permissions(bucket.id, key_id, BucketKeyPerm::NO_PERMISSIONS)
-				.await?;
+		// Check bucket is empty
+		if !helper.bucket().is_bucket_empty(bucket_id).await? {
+			return Err(CommonError::BucketNotEmpty.into());
 		}
-	}
-	// 2. delete all local aliases
-	for ((key_id, alias), _, active) in state.local_aliases.items().iter() {
-		if *active {
-			helper
-				.unset_local_bucket_alias(bucket.id, key_id, alias)
-				.await?;
+
+		// --- done checking, now commit ---
+		// 1. delete authorization from keys that had access
+		for (key_id, perm) in bucket.authorized_keys() {
+			if perm.is_any() {
+				helper
+					.set_bucket_key_permissions(bucket.id, key_id, BucketKeyPerm::NO_PERMISSIONS)
+					.await?;
+			}
 		}
-	}
-	// 3. delete all global aliases
-	for (alias, _, active) in state.aliases.items().iter() {
-		if *active {
-			helper.purge_global_bucket_alias(bucket.id, alias).await?;
+		// 2. delete all local aliases
+		for ((key_id, alias), _, active) in state.local_aliases.items().iter() {
+			if *active {
+				helper
+					.unset_local_bucket_alias(bucket.id, key_id, alias)
+					.await?;
+			}
+		}
+		// 3. delete all global aliases
+		for (alias, _, active) in state.aliases.items().iter() {
+			if *active {
+				helper.purge_global_bucket_alias(bucket.id, alias).await?;
+			}
 		}
-	}
 
-	// 4. delete bucket
-	bucket.state = Deletable::delete();
-	garage.bucket_table.insert(&bucket).await?;
+		// 4. delete bucket
+		bucket.state = Deletable::delete();
+		garage.bucket_table.insert(&bucket).await?;
 
-	Ok(Response::builder()
-		.status(StatusCode::NO_CONTENT)
-		.body(empty_body())?)
+		Ok(DeleteBucketResponse)
+	}
 }
 
-pub async fn handle_update_bucket(
-	garage: &Arc<Garage>,
-	id: String,
-	req: Request<IncomingBody>,
-) -> Result<Response<ResBody>, Error> {
-	let req = parse_json_body::<UpdateBucketRequest, _, Error>(req).await?;
-	let bucket_id = parse_bucket_id(&id)?;
+#[async_trait]
+impl EndpointHandler for UpdateBucketRequest {
+	type Response = UpdateBucketResponse;
 
-	let mut bucket = garage
-		.bucket_helper()
-		.get_existing_bucket(bucket_id)
-		.await?;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<UpdateBucketResponse, Error> {
+		let bucket_id = parse_bucket_id(&self.id)?;
 
-	let state = bucket.state.as_option_mut().unwrap();
-
-	if let Some(wa) = req.website_access {
-		if wa.enabled {
-			state.website_config.update(Some(WebsiteConfig {
-				index_document: wa.index_document.ok_or_bad_request(
-					"Please specify indexDocument when enabling website access.",
-				)?,
-				error_document: wa.error_document,
-			}));
-		} else {
-			if wa.index_document.is_some() || wa.error_document.is_some() {
-				return Err(Error::bad_request(
-					"Cannot specify indexDocument or errorDocument when disabling website access.",
-				));
+		let mut bucket = garage
+			.bucket_helper()
+			.get_existing_bucket(bucket_id)
+			.await?;
+
+		let state = bucket.state.as_option_mut().unwrap();
+
+		if let Some(wa) = self.params.website_access {
+			if wa.enabled {
+				state.website_config.update(Some(WebsiteConfig {
+					index_document: wa.index_document.ok_or_bad_request(
+						"Please specify indexDocument when enabling website access.",
+					)?,
+					error_document: wa.error_document,
+				}));
+			} else {
+				if wa.index_document.is_some() || wa.error_document.is_some() {
+					return Err(Error::bad_request(
+                        "Cannot specify indexDocument or errorDocument when disabling website access.",
+                    ));
+				}
+				state.website_config.update(None);
 			}
-			state.website_config.update(None);
 		}
-	}
 
-	if let Some(q) = req.quotas {
-		state.quotas.update(BucketQuotas {
-			max_size: q.max_size,
-			max_objects: q.max_objects,
-		});
-	}
+		if let Some(q) = self.params.quotas {
+			state.quotas.update(BucketQuotas {
+				max_size: q.max_size,
+				max_objects: q.max_objects,
+			});
+		}
 
-	garage.bucket_table.insert(&bucket).await?;
+		garage.bucket_table.insert(&bucket).await?;
 
-	bucket_info_results(garage, bucket_id).await
+		Ok(UpdateBucketResponse(
+			bucket_info_results(garage, bucket_id).await?,
+		))
+	}
 }
 
 // ---- BUCKET/KEY PERMISSIONS ----
 
+#[async_trait]
+impl EndpointHandler for BucketAllowKeyRequest {
+	type Response = BucketAllowKeyResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<BucketAllowKeyResponse, Error> {
+		let res = handle_bucket_change_key_perm(garage, self.0, true).await?;
+		Ok(BucketAllowKeyResponse(res))
+	}
+}
+
+#[async_trait]
+impl EndpointHandler for BucketDenyKeyRequest {
+	type Response = BucketDenyKeyResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<BucketDenyKeyResponse, Error> {
+		let res = handle_bucket_change_key_perm(garage, self.0, false).await?;
+		Ok(BucketDenyKeyResponse(res))
+	}
+}
+
 pub async fn handle_bucket_change_key_perm(
 	garage: &Arc<Garage>,
-	req: Request<IncomingBody>,
+	req: BucketKeyPermChangeRequest,
 	new_perm_flag: bool,
-) -> Result<Response<ResBody>, Error> {
-	let req = parse_json_body::<BucketKeyPermChangeRequest, _, Error>(req).await?;
-
+) -> Result<GetBucketInfoResponse, Error> {
 	let helper = garage.locked_helper().await;
 
 	let bucket_id = parse_bucket_id(&req.bucket_id)?;
@@ -420,66 +452,80 @@ pub async fn handle_bucket_change_key_perm(
 
 // ---- BUCKET ALIASES ----
 
-pub async fn handle_global_alias_bucket(
-	garage: &Arc<Garage>,
-	bucket_id: String,
-	alias: String,
-) -> Result<Response<ResBody>, Error> {
-	let bucket_id = parse_bucket_id(&bucket_id)?;
+#[async_trait]
+impl EndpointHandler for GlobalAliasBucketRequest {
+	type Response = GlobalAliasBucketResponse;
 
-	let helper = garage.locked_helper().await;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<GlobalAliasBucketResponse, Error> {
+		let bucket_id = parse_bucket_id(&self.id)?;
 
-	helper.set_global_bucket_alias(bucket_id, &alias).await?;
+		let helper = garage.locked_helper().await;
 
-	bucket_info_results(garage, bucket_id).await
+		helper
+			.set_global_bucket_alias(bucket_id, &self.alias)
+			.await?;
+
+		Ok(GlobalAliasBucketResponse(
+			bucket_info_results(garage, bucket_id).await?,
+		))
+	}
 }
 
-pub async fn handle_global_unalias_bucket(
-	garage: &Arc<Garage>,
-	bucket_id: String,
-	alias: String,
-) -> Result<Response<ResBody>, Error> {
-	let bucket_id = parse_bucket_id(&bucket_id)?;
+#[async_trait]
+impl EndpointHandler for GlobalUnaliasBucketRequest {
+	type Response = GlobalUnaliasBucketResponse;
 
-	let helper = garage.locked_helper().await;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<GlobalUnaliasBucketResponse, Error> {
+		let bucket_id = parse_bucket_id(&self.id)?;
+
+		let helper = garage.locked_helper().await;
 
-	helper.unset_global_bucket_alias(bucket_id, &alias).await?;
+		helper
+			.unset_global_bucket_alias(bucket_id, &self.alias)
+			.await?;
 
-	bucket_info_results(garage, bucket_id).await
+		Ok(GlobalUnaliasBucketResponse(
+			bucket_info_results(garage, bucket_id).await?,
+		))
+	}
 }
 
-pub async fn handle_local_alias_bucket(
-	garage: &Arc<Garage>,
-	bucket_id: String,
-	access_key_id: String,
-	alias: String,
-) -> Result<Response<ResBody>, Error> {
-	let bucket_id = parse_bucket_id(&bucket_id)?;
+#[async_trait]
+impl EndpointHandler for LocalAliasBucketRequest {
+	type Response = LocalAliasBucketResponse;
 
-	let helper = garage.locked_helper().await;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<LocalAliasBucketResponse, Error> {
+		let bucket_id = parse_bucket_id(&self.id)?;
 
-	helper
-		.set_local_bucket_alias(bucket_id, &access_key_id, &alias)
-		.await?;
+		let helper = garage.locked_helper().await;
 
-	bucket_info_results(garage, bucket_id).await
+		helper
+			.set_local_bucket_alias(bucket_id, &self.access_key_id, &self.alias)
+			.await?;
+
+		Ok(LocalAliasBucketResponse(
+			bucket_info_results(garage, bucket_id).await?,
+		))
+	}
 }
 
-pub async fn handle_local_unalias_bucket(
-	garage: &Arc<Garage>,
-	bucket_id: String,
-	access_key_id: String,
-	alias: String,
-) -> Result<Response<ResBody>, Error> {
-	let bucket_id = parse_bucket_id(&bucket_id)?;
+#[async_trait]
+impl EndpointHandler for LocalUnaliasBucketRequest {
+	type Response = LocalUnaliasBucketResponse;
 
-	let helper = garage.locked_helper().await;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<LocalUnaliasBucketResponse, Error> {
+		let bucket_id = parse_bucket_id(&self.id)?;
 
-	helper
-		.unset_local_bucket_alias(bucket_id, &access_key_id, &alias)
-		.await?;
+		let helper = garage.locked_helper().await;
 
-	bucket_info_results(garage, bucket_id).await
+		helper
+			.unset_local_bucket_alias(bucket_id, &self.access_key_id, &self.alias)
+			.await?;
+
+		Ok(LocalUnaliasBucketResponse(
+			bucket_info_results(garage, bucket_id).await?,
+		))
+	}
 }
 
 // ---- HELPER ----
diff --git a/src/api/admin/cluster.rs b/src/api/admin/cluster.rs
index 11753509..c7eb7e7d 100644
--- a/src/api/admin/cluster.rs
+++ b/src/api/admin/cluster.rs
@@ -2,7 +2,6 @@ use std::collections::HashMap;
 use std::sync::Arc;
 
 use async_trait::async_trait;
-use hyper::{body::Incoming as IncomingBody, Request, Response};
 
 use garage_util::crdt::*;
 use garage_util::data::*;
@@ -14,14 +13,13 @@ use garage_model::garage::Garage;
 use crate::admin::api::{
 	ApplyClusterLayoutRequest, ApplyClusterLayoutResponse, ConnectClusterNodeResponse,
 	ConnectClusterNodesRequest, ConnectClusterNodesResponse, FreeSpaceResp,
-	GetClusterHealthRequest, GetClusterHealthResponse, GetClusterLayoutResponse,
-	GetClusterStatusRequest, GetClusterStatusResponse, NodeResp, NodeRoleChange,
-	NodeRoleChangeEnum, NodeRoleResp, UpdateClusterLayoutRequest,
+	GetClusterHealthRequest, GetClusterHealthResponse, GetClusterLayoutRequest,
+	GetClusterLayoutResponse, GetClusterStatusRequest, GetClusterStatusResponse, NodeResp,
+	NodeRoleChange, NodeRoleChangeEnum, NodeRoleResp, RevertClusterLayoutRequest,
+	RevertClusterLayoutResponse, UpdateClusterLayoutRequest, UpdateClusterLayoutResponse,
 };
-use crate::admin::api_server::ResBody;
 use crate::admin::error::*;
 use crate::admin::EndpointHandler;
-use crate::helpers::{json_ok_response, parse_json_body};
 
 #[async_trait]
 impl EndpointHandler for GetClusterStatusRequest {
@@ -149,17 +147,6 @@ impl EndpointHandler for GetClusterHealthRequest {
 	}
 }
 
-pub async fn handle_connect_cluster_nodes(
-	garage: &Arc<Garage>,
-	req: Request<IncomingBody>,
-) -> Result<Response<ResBody>, Error> {
-	let req = parse_json_body::<ConnectClusterNodesRequest, _, Error>(req).await?;
-
-	let res = req.handle(garage).await?;
-
-	Ok(json_ok_response(&res)?)
-}
-
 #[async_trait]
 impl EndpointHandler for ConnectClusterNodesRequest {
 	type Response = ConnectClusterNodesResponse;
@@ -183,10 +170,15 @@ impl EndpointHandler for ConnectClusterNodesRequest {
 	}
 }
 
-pub async fn handle_get_cluster_layout(garage: &Arc<Garage>) -> Result<Response<ResBody>, Error> {
-	let res = format_cluster_layout(garage.system.cluster_layout().inner());
+#[async_trait]
+impl EndpointHandler for GetClusterLayoutRequest {
+	type Response = GetClusterLayoutResponse;
 
-	Ok(json_ok_response(&res)?)
+	async fn handle(self, garage: &Arc<Garage>) -> Result<GetClusterLayoutResponse, Error> {
+		Ok(format_cluster_layout(
+			garage.system.cluster_layout().inner(),
+		))
+	}
 }
 
 fn format_cluster_layout(layout: &layout::LayoutHistory) -> GetClusterLayoutResponse {
@@ -238,85 +230,87 @@ fn format_cluster_layout(layout: &layout::LayoutHistory) -> GetClusterLayoutResp
 
 // ---- update functions ----
 
-pub async fn handle_update_cluster_layout(
-	garage: &Arc<Garage>,
-	req: Request<IncomingBody>,
-) -> Result<Response<ResBody>, Error> {
-	let updates = parse_json_body::<UpdateClusterLayoutRequest, _, Error>(req).await?;
-
-	let mut layout = garage.system.cluster_layout().inner().clone();
-
-	let mut roles = layout.current().roles.clone();
-	roles.merge(&layout.staging.get().roles);
-
-	for change in updates.0 {
-		let node = hex::decode(&change.id).ok_or_bad_request("Invalid node identifier")?;
-		let node = Uuid::try_from(&node).ok_or_bad_request("Invalid node identifier")?;
-
-		let new_role = match change.action {
-			NodeRoleChangeEnum::Remove { remove: true } => None,
-			NodeRoleChangeEnum::Update {
-				zone,
-				capacity,
-				tags,
-			} => Some(layout::NodeRole {
-				zone,
-				capacity,
-				tags,
-			}),
-			_ => return Err(Error::bad_request("Invalid layout change")),
-		};
+#[async_trait]
+impl EndpointHandler for UpdateClusterLayoutRequest {
+	type Response = UpdateClusterLayoutResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<UpdateClusterLayoutResponse, Error> {
+		let mut layout = garage.system.cluster_layout().inner().clone();
+
+		let mut roles = layout.current().roles.clone();
+		roles.merge(&layout.staging.get().roles);
+
+		for change in self.0 {
+			let node = hex::decode(&change.id).ok_or_bad_request("Invalid node identifier")?;
+			let node = Uuid::try_from(&node).ok_or_bad_request("Invalid node identifier")?;
+
+			let new_role = match change.action {
+				NodeRoleChangeEnum::Remove { remove: true } => None,
+				NodeRoleChangeEnum::Update {
+					zone,
+					capacity,
+					tags,
+				} => Some(layout::NodeRole {
+					zone,
+					capacity,
+					tags,
+				}),
+				_ => return Err(Error::bad_request("Invalid layout change")),
+			};
+
+			layout
+				.staging
+				.get_mut()
+				.roles
+				.merge(&roles.update_mutator(node, layout::NodeRoleV(new_role)));
+		}
 
-		layout
-			.staging
-			.get_mut()
-			.roles
-			.merge(&roles.update_mutator(node, layout::NodeRoleV(new_role)));
+		garage
+			.system
+			.layout_manager
+			.update_cluster_layout(&layout)
+			.await?;
+
+		let res = format_cluster_layout(&layout);
+		Ok(UpdateClusterLayoutResponse(res))
 	}
+}
 
-	garage
-		.system
-		.layout_manager
-		.update_cluster_layout(&layout)
-		.await?;
+#[async_trait]
+impl EndpointHandler for ApplyClusterLayoutRequest {
+	type Response = ApplyClusterLayoutResponse;
 
-	let res = format_cluster_layout(&layout);
-	Ok(json_ok_response(&res)?)
-}
+	async fn handle(self, garage: &Arc<Garage>) -> Result<ApplyClusterLayoutResponse, Error> {
+		let layout = garage.system.cluster_layout().inner().clone();
+		let (layout, msg) = layout.apply_staged_changes(Some(self.version))?;
+
+		garage
+			.system
+			.layout_manager
+			.update_cluster_layout(&layout)
+			.await?;
 
-pub async fn handle_apply_cluster_layout(
-	garage: &Arc<Garage>,
-	req: Request<IncomingBody>,
-) -> Result<Response<ResBody>, Error> {
-	let param = parse_json_body::<ApplyClusterLayoutRequest, _, Error>(req).await?;
-
-	let layout = garage.system.cluster_layout().inner().clone();
-	let (layout, msg) = layout.apply_staged_changes(Some(param.version))?;
-
-	garage
-		.system
-		.layout_manager
-		.update_cluster_layout(&layout)
-		.await?;
-
-	let res = ApplyClusterLayoutResponse {
-		message: msg,
-		layout: format_cluster_layout(&layout),
-	};
-	Ok(json_ok_response(&res)?)
+		Ok(ApplyClusterLayoutResponse {
+			message: msg,
+			layout: format_cluster_layout(&layout),
+		})
+	}
 }
 
-pub async fn handle_revert_cluster_layout(
-	garage: &Arc<Garage>,
-) -> Result<Response<ResBody>, Error> {
-	let layout = garage.system.cluster_layout().inner().clone();
-	let layout = layout.revert_staged_changes()?;
-	garage
-		.system
-		.layout_manager
-		.update_cluster_layout(&layout)
-		.await?;
-
-	let res = format_cluster_layout(&layout);
-	Ok(json_ok_response(&res)?)
+#[async_trait]
+impl EndpointHandler for RevertClusterLayoutRequest {
+	type Response = RevertClusterLayoutResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<RevertClusterLayoutResponse, Error> {
+		let layout = garage.system.cluster_layout().inner().clone();
+		let layout = layout.revert_staged_changes()?;
+		garage
+			.system
+			.layout_manager
+			.update_cluster_layout(&layout)
+			.await?;
+
+		let res = format_cluster_layout(&layout);
+		Ok(RevertClusterLayoutResponse(res))
+	}
 }
diff --git a/src/api/admin/key.rs b/src/api/admin/key.rs
index 96ce3518..8161672f 100644
--- a/src/api/admin/key.rs
+++ b/src/api/admin/key.rs
@@ -1,7 +1,7 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 
-use hyper::{body::Incoming as IncomingBody, Request, Response, StatusCode};
+use async_trait::async_trait;
 
 use garage_table::*;
 
@@ -9,138 +9,149 @@ use garage_model::garage::Garage;
 use garage_model::key_table::*;
 
 use crate::admin::api::{
-	ApiBucketKeyPerm, CreateKeyRequest, GetKeyInfoResponse, ImportKeyRequest,
-	KeyInfoBucketResponse, KeyPerm, ListKeysResponseItem, UpdateKeyRequest,
+	ApiBucketKeyPerm, CreateKeyRequest, CreateKeyResponse, DeleteKeyRequest, DeleteKeyResponse,
+	GetKeyInfoRequest, GetKeyInfoResponse, ImportKeyRequest, ImportKeyResponse,
+	KeyInfoBucketResponse, KeyPerm, ListKeysRequest, ListKeysResponse, ListKeysResponseItem,
+	UpdateKeyRequest, UpdateKeyResponse,
 };
-use crate::admin::api_server::ResBody;
 use crate::admin::error::*;
-use crate::helpers::*;
-
-pub async fn handle_list_keys(garage: &Arc<Garage>) -> Result<Response<ResBody>, Error> {
-	let res = garage
-		.key_table
-		.get_range(
-			&EmptyKey,
-			None,
-			Some(KeyFilter::Deleted(DeletedFilter::NotDeleted)),
-			10000,
-			EnumerationOrder::Forward,
-		)
-		.await?
-		.iter()
-		.map(|k| ListKeysResponseItem {
-			id: k.key_id.to_string(),
-			name: k.params().unwrap().name.get().clone(),
-		})
-		.collect::<Vec<_>>();
+use crate::admin::EndpointHandler;
+
+#[async_trait]
+impl EndpointHandler for ListKeysRequest {
+	type Response = ListKeysResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<ListKeysResponse, Error> {
+		let res = garage
+			.key_table
+			.get_range(
+				&EmptyKey,
+				None,
+				Some(KeyFilter::Deleted(DeletedFilter::NotDeleted)),
+				10000,
+				EnumerationOrder::Forward,
+			)
+			.await?
+			.iter()
+			.map(|k| ListKeysResponseItem {
+				id: k.key_id.to_string(),
+				name: k.params().unwrap().name.get().clone(),
+			})
+			.collect::<Vec<_>>();
 
-	Ok(json_ok_response(&res)?)
+		Ok(ListKeysResponse(res))
+	}
 }
 
-pub async fn handle_get_key_info(
-	garage: &Arc<Garage>,
-	id: Option<String>,
-	search: Option<String>,
-	show_secret_key: bool,
-) -> Result<Response<ResBody>, Error> {
-	let key = if let Some(id) = id {
-		garage.key_helper().get_existing_key(&id).await?
-	} else if let Some(search) = search {
-		garage
-			.key_helper()
-			.get_existing_matching_key(&search)
-			.await?
-	} else {
-		unreachable!();
-	};
+#[async_trait]
+impl EndpointHandler for GetKeyInfoRequest {
+	type Response = GetKeyInfoResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<GetKeyInfoResponse, Error> {
+		let key = if let Some(id) = self.id {
+			garage.key_helper().get_existing_key(&id).await?
+		} else if let Some(search) = self.search {
+			garage
+				.key_helper()
+				.get_existing_matching_key(&search)
+				.await?
+		} else {
+			unreachable!();
+		};
 
-	key_info_results(garage, key, show_secret_key).await
+		Ok(key_info_results(garage, key, self.show_secret_key).await?)
+	}
 }
 
-pub async fn handle_create_key(
-	garage: &Arc<Garage>,
-	req: Request<IncomingBody>,
-) -> Result<Response<ResBody>, Error> {
-	let req = parse_json_body::<CreateKeyRequest, _, Error>(req).await?;
+#[async_trait]
+impl EndpointHandler for CreateKeyRequest {
+	type Response = CreateKeyResponse;
 
-	let key = Key::new(req.name.as_deref().unwrap_or("Unnamed key"));
-	garage.key_table.insert(&key).await?;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<CreateKeyResponse, Error> {
+		let key = Key::new(self.name.as_deref().unwrap_or("Unnamed key"));
+		garage.key_table.insert(&key).await?;
 
-	key_info_results(garage, key, true).await
+		Ok(CreateKeyResponse(
+			key_info_results(garage, key, true).await?,
+		))
+	}
 }
 
-pub async fn handle_import_key(
-	garage: &Arc<Garage>,
-	req: Request<IncomingBody>,
-) -> Result<Response<ResBody>, Error> {
-	let req = parse_json_body::<ImportKeyRequest, _, Error>(req).await?;
+#[async_trait]
+impl EndpointHandler for ImportKeyRequest {
+	type Response = ImportKeyResponse;
 
-	let prev_key = garage.key_table.get(&EmptyKey, &req.access_key_id).await?;
-	if prev_key.is_some() {
-		return Err(Error::KeyAlreadyExists(req.access_key_id.to_string()));
-	}
+	async fn handle(self, garage: &Arc<Garage>) -> Result<ImportKeyResponse, Error> {
+		let prev_key = garage.key_table.get(&EmptyKey, &self.access_key_id).await?;
+		if prev_key.is_some() {
+			return Err(Error::KeyAlreadyExists(self.access_key_id.to_string()));
+		}
 
-	let imported_key = Key::import(
-		&req.access_key_id,
-		&req.secret_access_key,
-		req.name.as_deref().unwrap_or("Imported key"),
-	)
-	.ok_or_bad_request("Invalid key format")?;
-	garage.key_table.insert(&imported_key).await?;
+		let imported_key = Key::import(
+			&self.access_key_id,
+			&self.secret_access_key,
+			self.name.as_deref().unwrap_or("Imported key"),
+		)
+		.ok_or_bad_request("Invalid key format")?;
+		garage.key_table.insert(&imported_key).await?;
 
-	key_info_results(garage, imported_key, false).await
+		Ok(ImportKeyResponse(
+			key_info_results(garage, imported_key, false).await?,
+		))
+	}
 }
 
-pub async fn handle_update_key(
-	garage: &Arc<Garage>,
-	id: String,
-	req: Request<IncomingBody>,
-) -> Result<Response<ResBody>, Error> {
-	let req = parse_json_body::<UpdateKeyRequest, _, Error>(req).await?;
+#[async_trait]
+impl EndpointHandler for UpdateKeyRequest {
+	type Response = UpdateKeyResponse;
 
-	let mut key = garage.key_helper().get_existing_key(&id).await?;
+	async fn handle(self, garage: &Arc<Garage>) -> Result<UpdateKeyResponse, Error> {
+		let mut key = garage.key_helper().get_existing_key(&self.id).await?;
 
-	let key_state = key.state.as_option_mut().unwrap();
+		let key_state = key.state.as_option_mut().unwrap();
 
-	if let Some(new_name) = req.name {
-		key_state.name.update(new_name);
-	}
-	if let Some(allow) = req.allow {
-		if allow.create_bucket {
-			key_state.allow_create_bucket.update(true);
+		if let Some(new_name) = self.params.name {
+			key_state.name.update(new_name);
 		}
-	}
-	if let Some(deny) = req.deny {
-		if deny.create_bucket {
-			key_state.allow_create_bucket.update(false);
+		if let Some(allow) = self.params.allow {
+			if allow.create_bucket {
+				key_state.allow_create_bucket.update(true);
+			}
+		}
+		if let Some(deny) = self.params.deny {
+			if deny.create_bucket {
+				key_state.allow_create_bucket.update(false);
+			}
 		}
-	}
 
-	garage.key_table.insert(&key).await?;
+		garage.key_table.insert(&key).await?;
 
-	key_info_results(garage, key, false).await
+		Ok(UpdateKeyResponse(
+			key_info_results(garage, key, false).await?,
+		))
+	}
 }
 
-pub async fn handle_delete_key(
-	garage: &Arc<Garage>,
-	id: String,
-) -> Result<Response<ResBody>, Error> {
-	let helper = garage.locked_helper().await;
+#[async_trait]
+impl EndpointHandler for DeleteKeyRequest {
+	type Response = DeleteKeyResponse;
+
+	async fn handle(self, garage: &Arc<Garage>) -> Result<DeleteKeyResponse, Error> {
+		let helper = garage.locked_helper().await;
 
-	let mut key = helper.key().get_existing_key(&id).await?;
+		let mut key = helper.key().get_existing_key(&self.id).await?;
 
-	helper.delete_key(&mut key).await?;
+		helper.delete_key(&mut key).await?;
 
-	Ok(Response::builder()
-		.status(StatusCode::NO_CONTENT)
-		.body(empty_body())?)
+		Ok(DeleteKeyResponse)
+	}
 }
 
 async fn key_info_results(
 	garage: &Arc<Garage>,
 	key: Key,
 	show_secret: bool,
-) -> Result<Response<ResBody>, Error> {
+) -> Result<GetKeyInfoResponse, Error> {
 	let mut relevant_buckets = HashMap::new();
 
 	let key_state = key.state.as_option().unwrap();
@@ -211,5 +222,5 @@ async fn key_info_results(
 			.collect::<Vec<_>>(),
 	};
 
-	Ok(json_ok_response(&res)?)
+	Ok(res)
 }