diff --git a/pom.xml b/pom.xml
index 66f41f79..95085a59 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
 
     <groupId>com.uid2</groupId>
     <artifactId>uid2-admin</artifactId>
-    <version>6.14.0</version>
+    <version>6.14.1-alpha-251-SNAPSHOT</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -16,7 +16,7 @@
         <!-- check micrometer.version vertx-micrometer-metrics consumes before bumping up -->
         <micrometer.version>1.12.2</micrometer.version>
         <junit-jupiter.version>5.11.2</junit-jupiter.version>
-        <uid2-shared.version>11.5.0</uid2-shared.version>
+        <uid2-shared.version>11.5.1-alpha-354-SNAPSHOT</uid2-shared.version>
         <okta-jwt.version>0.5.10</okta-jwt.version>
         <netty.version>4.1.135.Final</netty.version>
         <image.version>${project.version}</image.version>
diff --git a/src/main/java/com/uid2/admin/auth/OktaCustomScope.java b/src/main/java/com/uid2/admin/auth/OktaCustomScope.java
index d47c0d5a..6c36c6d4 100644
--- a/src/main/java/com/uid2/admin/auth/OktaCustomScope.java
+++ b/src/main/java/com/uid2/admin/auth/OktaCustomScope.java
@@ -14,6 +14,7 @@ public enum OktaCustomScope {
     METRICS_EXPORT("uid2.admin.metrics-export", Role.METRICS_EXPORT),
     ENCLAVE_REGISTRAR("uid2.admin.enclave-registrar", Role.ENCLAVE_REGISTRAR),
     READ_ONLY("uid2.admin.read-only", Role.READ_ONLY),
+    CREATE("uid2.admin.create", Role.CREATE),
     INVALID("invalid", Role.UNKNOWN);
     private final String name;
     private final Role role;
diff --git a/src/main/java/com/uid2/admin/vertx/service/ClientKeyService.java b/src/main/java/com/uid2/admin/vertx/service/ClientKeyService.java
index 5b530873..ff33a25d 100644
--- a/src/main/java/com/uid2/admin/vertx/service/ClientKeyService.java
+++ b/src/main/java/com/uid2/admin/vertx/service/ClientKeyService.java
@@ -95,7 +95,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleClientAdd(ctx);
             }
-        }, new AuditParams(List.of("name", "roles", "site_id"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL));
+        }, new AuditParams(List.of("name", "roles", "site_id"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL, Role.CREATE));
 
         router.post(API_CLIENT_DEL.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
diff --git a/src/main/java/com/uid2/admin/vertx/service/ClientSideKeypairService.java b/src/main/java/com/uid2/admin/vertx/service/ClientSideKeypairService.java
index d686a5b5..7de0d4e8 100644
--- a/src/main/java/com/uid2/admin/vertx/service/ClientSideKeypairService.java
+++ b/src/main/java/com/uid2/admin/vertx/service/ClientSideKeypairService.java
@@ -70,7 +70,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleAddKeypair(ctx);
             }
-        }, new AuditParams(Collections.emptyList(), List.of("site_id", "name", "contact", "disabled")), Role.MAINTAINER, Role.SHARING_PORTAL));
+        }, new AuditParams(Collections.emptyList(), List.of("site_id", "name", "contact", "disabled")), Role.MAINTAINER, Role.SHARING_PORTAL, Role.CREATE));
         router.post(API_CLIENT_SIDE_KEYPAIRS_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
                 this.handleUpdateKeypair(ctx);
diff --git a/src/main/java/com/uid2/admin/vertx/service/OperatorKeyService.java b/src/main/java/com/uid2/admin/vertx/service/OperatorKeyService.java
index 3b5b1122..094ad9a2 100644
--- a/src/main/java/com/uid2/admin/vertx/service/OperatorKeyService.java
+++ b/src/main/java/com/uid2/admin/vertx/service/OperatorKeyService.java
@@ -85,7 +85,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleOperatorAdd(ctx);
             }
-        }, new AuditParams(List.of("name", "protocol", "site_id", "operator_type", "roles"), Collections.emptyList()), Role.MAINTAINER));
+        }, new AuditParams(List.of("name", "protocol", "site_id", "operator_type", "roles"), Collections.emptyList()), Role.MAINTAINER, Role.CREATE));
 
         router.post(API_OPERATOR_DEL.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
diff --git a/src/main/java/com/uid2/admin/vertx/service/PartnerConfigService.java b/src/main/java/com/uid2/admin/vertx/service/PartnerConfigService.java
index 6a58f313..bcba7e88 100644
--- a/src/main/java/com/uid2/admin/vertx/service/PartnerConfigService.java
+++ b/src/main/java/com/uid2/admin/vertx/service/PartnerConfigService.java
@@ -52,7 +52,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handlePartnerConfigAdd(ctx);
             }
-        }, new AuditParams(Collections.emptyList(), List.of("name")), Role.MAINTAINER));
+        }, new AuditParams(Collections.emptyList(), List.of("name")), Role.MAINTAINER, Role.CREATE));
         router.put(API_PARTNER_CONFIG_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
                 this.handlePartnerConfigUpdate(ctx);
diff --git a/src/main/java/com/uid2/admin/vertx/service/ServiceLinkService.java b/src/main/java/com/uid2/admin/vertx/service/ServiceLinkService.java
index 90ff53f5..93829bcb 100644
--- a/src/main/java/com/uid2/admin/vertx/service/ServiceLinkService.java
+++ b/src/main/java/com/uid2/admin/vertx/service/ServiceLinkService.java
@@ -55,7 +55,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleServiceLinkAdd(ctx);
             }
-        }, new AuditParams(Collections.emptyList(), List.of("link_id", "service_id", "site_id", "name", "roles")), Role.MAINTAINER));
+        }, new AuditParams(Collections.emptyList(), List.of("link_id", "service_id", "site_id", "name", "roles")), Role.MAINTAINER, Role.CREATE));
         router.post(API_SERVICE_LINK_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
                 this.handleServiceLinkUpdate(ctx);
diff --git a/src/main/java/com/uid2/admin/vertx/service/SiteService.java b/src/main/java/com/uid2/admin/vertx/service/SiteService.java
index d2f47b0b..fbe28e99 100644
--- a/src/main/java/com/uid2/admin/vertx/service/SiteService.java
+++ b/src/main/java/com/uid2/admin/vertx/service/SiteService.java
@@ -69,7 +69,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleSiteAdd(ctx);
             }
-        }, new AuditParams(List.of("name", "enable", "types", "description"), List.of("domain_names", "app_names")), Role.MAINTAINER, Role.SHARING_PORTAL));
+        }, new AuditParams(List.of("name", "enable", "types", "description"), List.of("domain_names", "app_names")), Role.MAINTAINER, Role.SHARING_PORTAL, Role.CREATE));
         router.post(API_SITE_ENABLE.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
                 this.handleSiteEnable(ctx);