diff --git a/src/main/java/de/ids_mannheim/korap/config/BeanInjectable.java b/src/main/java/de/ids_mannheim/korap/config/BeanInjectable.java
new file mode 100644
index 0000000..54f432e
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/config/BeanInjectable.java
@@ -0,0 +1,10 @@
+package de.ids_mannheim.korap.config;
+
+/**
+ * @author hanl
+ * @date 26/02/2016
+ */
+public interface BeanInjectable {
+
+    <T extends ContextHolder> void insertBeans (T beans);
+}
diff --git a/src/main/java/de/ids_mannheim/korap/config/ExceptionBuilder.java b/src/main/java/de/ids_mannheim/korap/config/ExceptionBuilder.java
new file mode 100644
index 0000000..4eb2725
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/config/ExceptionBuilder.java
@@ -0,0 +1,11 @@
+package de.ids_mannheim.korap.config;
+
+/**
+ * @author hanl
+ * @date 10/02/2016
+ */
+// run simple queries to determine the exception cause (e.g. policy could not be created because resource doesnt exist, etc.)
+public class ExceptionBuilder {
+    // use sqlbuilder to build the respective query (one instance per dao interface)
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/config/KustvaktContext.java b/src/main/java/de/ids_mannheim/korap/config/KustvaktContext.java
new file mode 100644
index 0000000..ed3b5dc
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/config/KustvaktContext.java
@@ -0,0 +1,14 @@
+package de.ids_mannheim.korap.config;
+
+/**
+ * @author hanl
+ * @date 14/03/2016
+ */
+public class KustvaktContext {
+
+
+    private KustvaktContext context;
+
+
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/config/UserClientInfo.java b/src/main/java/de/ids_mannheim/korap/config/UserClientInfo.java
new file mode 100644
index 0000000..c76d6b3
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/config/UserClientInfo.java
@@ -0,0 +1,30 @@
+package de.ids_mannheim.korap.config;
+
+import lombok.Data;
+
+/**
+ * @author hanl
+ * @date 22/01/2014
+ */
+@Data
+public class UserClientInfo {
+
+
+    private String OSName;
+    private String userAgent;
+    private String clientIP;
+
+
+    public UserClientInfo () {
+        this.clientIP = "";
+        this.userAgent = "";
+        this.OSName = "";
+    }
+
+
+    public UserClientInfo (String os, String ua, String ip) {
+        this.OSName = os;
+        this.userAgent = ua;
+        this.clientIP = ip;
+    }
+}
diff --git a/src/main/java/de/ids_mannheim/korap/managers/ManagerInterface.java b/src/main/java/de/ids_mannheim/korap/managers/ManagerInterface.java
new file mode 100644
index 0000000..946dfc2
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/managers/ManagerInterface.java
@@ -0,0 +1,61 @@
+package de.ids_mannheim.korap.managers;
+
+import java.util.Set;
+
+/**
+ * @author hanl
+ * @date 17/02/2016
+ */
+public interface ManagerInterface {
+
+    String name ();
+
+
+    Set<Function> getFunctions ();
+
+
+    Result process ();
+
+    class Result {
+
+    }
+
+    class Function {
+
+        private String name;
+        private String[] args;
+
+
+        @Override
+        public boolean equals (Object o) {
+            if (this == o)
+                return true;
+            if (o == null || getClass() != o.getClass())
+                return false;
+
+            Function function = (Function) o;
+
+            return name != null ? name.equals(function.name)
+                    : function.name == null;
+
+        }
+
+
+        @Override
+        public int hashCode () {
+            return name != null ? name.hashCode() : 0;
+        }
+
+
+        public void setName (String name) {
+            this.name = name;
+        }
+
+
+        public void setArgs (String ... args) {
+            this.args = args;
+        }
+
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionCleanupFilter.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionCleanupFilter.java
index 46c39f9..3f9ce89 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionCleanupFilter.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionCleanupFilter.java
@@ -19,7 +19,7 @@
     @Override
     public JsonNode preProcess (KoralNode node, KustvaktConfiguration config,
             User user) {
-        return process(node.rawNode());
+        return node.rawNode();
     }
 
 
@@ -59,7 +59,7 @@
 
     @Override
     public JsonNode postProcess (KoralNode node) {
-        return null;
+        return process(node.rawNode());
     }
 
 
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
index 13e6196..05b6168 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
@@ -2,8 +2,6 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.BeanInjectable;
-import de.ids_mannheim.korap.config.ContextHolder;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.resources.Corpus;
@@ -15,16 +13,18 @@
  * @author hanl
  * @date 03/07/2015
  */
-public class CollectionConstraint implements RewriteTask.IterableRewriteAt {
+public class CollectionConstraint implements RewriteTask.IterableRewritePath {
+
+
+
 
     @Override
     public JsonNode preProcess (KoralNode node, KustvaktConfiguration config,
             User user) {
         if (node.get("@type").equals("koral:doc")) {
-            if (node.get("key").equals(Attributes.CORPUS_SIGLE) && !check(node, user)) {
+            if (node.get("key").equals(Attributes.CORPUS_SIGLE)
+                    && !check(node, user))
                 node.removeNode();
-                // todo: add message that node was removed!
-            }
         }
         return node.rawNode();
     }
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/DocMatchRewrite.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/DocMatchRewrite.java
index fb4ba86..796592a 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/DocMatchRewrite.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/DocMatchRewrite.java
@@ -18,7 +18,7 @@
  * @date 12/11/2015
  */
 //todo : test
-public class DocMatchRewrite implements RewriteTask.IterableRewriteAt,
+public class DocMatchRewrite implements RewriteTask.IterableRewritePath,
         BeanInjectable {
 
     private DocumentDao docDao;
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/FoundryInject.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/FoundryInject.java
index 19d4145..486ae25 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/FoundryInject.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/FoundryInject.java
@@ -8,7 +8,6 @@
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.interfaces.db.UserDataDbIface;
 import de.ids_mannheim.korap.resource.LayerMapper;
-import de.ids_mannheim.korap.resources.Foundry;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.user.UserSettings;
 import edu.emory.mathcs.backport.java.util.Collections;
@@ -19,7 +18,7 @@
  * @author hanl
  * @date 30/06/2015
  */
-public class FoundryInject implements RewriteTask.IterableRewriteAt,
+public class FoundryInject implements RewriteTask.IterableRewritePath,
         BeanInjectable {
 
     private Collection userdaos;
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/KoralNode.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/KoralNode.java
index 16debc8..8df544e 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/KoralNode.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/KoralNode.java
@@ -5,10 +5,7 @@
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import de.ids_mannheim.korap.utils.JsonUtils;
 
-import java.util.LinkedHashMap;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
 
 /**
  * @author hanl
@@ -16,13 +13,13 @@
  */
 public abstract class KoralNode {
     private JsonNode node;
-    private KoralRewriteBuilder builder;
+    private KoralRewriteBuilder rewrites;
     private boolean remove;
 
 
     private KoralNode (JsonNode node) {
         this.node = node;
-        this.builder = new KoralRewriteBuilder();
+        this.rewrites = new KoralRewriteBuilder();
         this.remove = false;
     }
 
@@ -32,6 +29,12 @@
     }
 
 
+    public void buildRewrites() {
+        System.out.println("LIST REWRITES "+ this.rewrites.rewrites);
+        this.rewrites.build(this.node);
+
+    }
+
     @Override
     public String toString () {
         return this.node.toString();
@@ -39,7 +42,6 @@
 
 
     public void put (String name, Object value) {
-
         if (this.node.isObject() && this.node.path(name).isMissingNode()) {
             ObjectNode node = (ObjectNode) this.node;
             if (value instanceof String)
@@ -48,8 +50,7 @@
                 node.put(name, (Integer) value);
             else if (value instanceof JsonNode)
                 node.put(name, (JsonNode) value);
-            builder.setOperation("injection");
-            builder.build(this.node);
+            this.rewrites.add("injection", name);
         }
         else
             throw new UnsupportedOperationException(
@@ -70,8 +71,7 @@
             set = true;
         }
         if (set) {
-            builder.setOperation("deletion");
-            builder.build(this.node);
+            this.rewrites.add("deletion", identifier);
         }
     }
 
@@ -85,12 +85,11 @@
                 n.put(name, (Integer) value);
             else if (value instanceof JsonNode)
                 n.put(name, (JsonNode) value);
-            builder.setOperation("override");
-            builder.build(this.node);
+            this.rewrites.add("override", name);
         }
     }
 
-    public void set (String name, Object value) {
+    public void set (String name, Object value, String attrIdent) {
         if (this.node.isObject()) {
             ObjectNode n = (ObjectNode) this.node;
             if (value instanceof String)
@@ -99,12 +98,10 @@
                 n.put(name, (Integer) value);
             else if (value instanceof JsonNode)
                 n.put(name, (JsonNode) value);
-            builder.setOperation("insertion");
-            builder.build(this.node);
+            this.rewrites.add("insertion", attrIdent);
         }
     }
 
-
     public String get (String name) {
         if (this.node.isObject())
             return this.node.path(name).asText();
@@ -113,7 +110,8 @@
 
 
     public KoralNode at (String name) {
-        return KoralNode.wrapNode(this.node.at(name));
+        this.node = this.node.at(name);
+        return this;
     }
 
 
@@ -132,6 +130,7 @@
 
 
     public void removeNode () {
+        this.rewrites.add("deletion", this.node);
         this.remove = true;
     }
 
@@ -141,20 +140,61 @@
     }
 
 
-    //todo: 21.10.15 -- redo with better return policies!
     public static class KoralRewriteBuilder {
 
+       private List<KoralRewrite> rewrites;
+
+        public KoralRewriteBuilder() {
+            this.rewrites = new ArrayList<>();
+        }
+
+
+        public KoralRewriteBuilder add(String op, Object scope) {
+            KoralRewrite rewrite = new KoralRewrite();
+            rewrite.setOperation(op);
+            rewrite.setScope(scope.toString());
+            this.rewrites.add(rewrite);
+            return this;
+        }
+
+
+        public JsonNode build (JsonNode node) {
+            for (KoralRewrite rewrite : this.rewrites) {
+                if (rewrite.map.get("operation") == null)
+                    throw new UnsupportedOperationException(
+                            "operation not set properly");
+
+                if (node.has("rewrites")) {
+                    ArrayNode n = (ArrayNode) node.path("rewrites");
+                    n.add(JsonUtils.valueToTree(rewrite.map));
+                } else {
+                    ObjectNode n = (ObjectNode) node;
+                    List l = new LinkedList<>();
+                    l.add(JsonUtils.valueToTree(rewrite.map));
+                    n.put("rewrites", JsonUtils.valueToTree(l));
+                }
+            }
+            this.rewrites.clear();
+            return node;
+        }
+
+    }
+
+
+
+
+    private static class KoralRewrite {
+
         private Map<String, String> map;
 
-
-        public KoralRewriteBuilder () {
+        private KoralRewrite () {
             this.map = new LinkedHashMap<>();
             this.map.put("@type", "koral:rewrite");
             this.map.put("src", "Kustvakt");
         }
 
 
-        public KoralRewriteBuilder setOperation (String op) {
+        public KoralRewrite setOperation (String op) {
             if (!op.startsWith("operation:"))
                 op = "operation:" + op;
             this.map.put("operation", op);
@@ -162,29 +202,10 @@
         }
 
 
-        public KoralRewriteBuilder setScope (String scope) {
+        public KoralRewrite setScope (String scope) {
             this.map.put("scope", scope);
             return this;
         }
 
-
-        public JsonNode build (JsonNode node) {
-            if (this.map.get("operation") == null)
-                throw new UnsupportedOperationException(
-                        "operation not set properly");
-
-            if (node.has("rewrites")) {
-                ArrayNode n = (ArrayNode) node.path("rewrites");
-                n.add(JsonUtils.valueToTree(this.map));
-            }
-            else {
-                ObjectNode n = (ObjectNode) node;
-                List l = new LinkedList<>();
-                l.add(JsonUtils.valueToTree(this.map));
-                n.put("rewrites", JsonUtils.valueToTree(l));
-            }
-            return node;
-        }
-
     }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
index a8efce3..114c35a 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
@@ -11,8 +11,10 @@
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.KoralCollectionQueryBuilder;
 import de.ids_mannheim.korap.utils.JsonUtils;
+import org.w3c.dom.Attr;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Set;
 
 /**
@@ -43,7 +45,7 @@
                 ArrayList<KustvaktResource> list = new ArrayList(resources);
 
                 if (list.isEmpty())
-                    throw new KustvaktException(StatusCodes.REQUEST_INVALID,
+                    throw new KustvaktException(StatusCodes.PERMISSION_DENIED,
                             "No resources found for user", user.getUsername());
 
                 for (int i = 0; i < list.size(); i++) {
@@ -52,7 +54,8 @@
                     b.with(Attributes.CORPUS_SIGLE+"=" + list.get(i).getPersistentID());
                 }
                 JsonNode rewritten = JsonUtils.readTree(b.toJSON());
-                node.set("collection", rewritten.at("/collection"));
+                node.set("collection", rewritten.at("/collection"), Attributes.CORPUS_SIGLE);
+                node.at("/collection");
             }
             catch (KustvaktException e) {
                 e.printStackTrace();
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
index 746c3a0..fb98864 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
@@ -7,7 +7,6 @@
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.utils.JsonUtils;
-import org.apache.xpath.SourceTree;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -24,7 +23,7 @@
 public class RewriteHandler implements BeanInjectable {
 
     private static Logger jlog = LoggerFactory.getLogger(RewriteHandler.class);
-    private Collection<RewriteTask.IterableRewriteAt> node_processors;
+    private Collection<RewriteTask.IterableRewritePath> node_processors;
     private Collection<RewriteTask.RewriteKoralToken> token_node_processors;
     private Collection<RewriteTask> query_processors;
 
@@ -66,9 +65,9 @@
         if (rewriter instanceof RewriteTask.RewriteKoralToken)
             return this.token_node_processors
                     .add((RewriteTask.RewriteKoralToken) rewriter);
-        else if (rewriter instanceof RewriteTask.IterableRewriteAt)
+        else if (rewriter instanceof RewriteTask.IterableRewritePath)
             return this.node_processors
-                    .add((RewriteTask.IterableRewriteAt) rewriter);
+                    .add((RewriteTask.IterableRewritePath) rewriter);
         else if (rewriter instanceof RewriteTask.RewriteBefore
                 | rewriter instanceof RewriteTask.RewriteAfter)
             return this.query_processors.add(rewriter);
@@ -122,25 +121,25 @@
     }
 
 
-    private boolean process (String name, JsonNode root, User user, boolean post) {
+    private boolean processNode (String name, JsonNode root, User user, boolean post) {
         if (root.isObject()) {
             if (root.has("operands")) {
                 JsonNode ops = root.at("/operands");
                 Iterator<JsonNode> it = ops.elements();
                 while (it.hasNext()) {
                     JsonNode next = it.next();
-                    if (process(name, next, user, post))
+                    if (processNode(name, next, user, post))
                         it.remove();
                 }
             }
             else if (root.path("@type").asText().equals("koral:token")) {
                 // todo: koral:token nodes cannot be flagged for deletion --> creates the possibility for empty koral:token nodes
-                processNode(name, KoralNode.wrapNode(root), user,
+                rewrite(name, KoralNode.wrapNode(root), user,
                         this.token_node_processors, post);
-                return process(name, root.path("wrap"), user, post);
+                return processNode(name, root.path("wrap"), user, post);
             }
             else {
-                return processNode(name, KoralNode.wrapNode(root), user,
+                return rewrite(name, KoralNode.wrapNode(root), user,
                         this.node_processors, post);
             }
         }
@@ -148,7 +147,7 @@
             Iterator<JsonNode> it = root.elements();
             while (it.hasNext()) {
                 JsonNode next = it.next();
-                if (process(name, next, user, post))
+                if (processNode(name, next, user, post))
                     it.remove();
             }
         }
@@ -156,13 +155,13 @@
     }
 
 
-    private JsonNode process (JsonNode root, User user, boolean post) {
+    private JsonNode iterate (JsonNode root, User user, boolean post) {
         jlog.debug("Running rewrite process on query {}", root);
         if (root != null) {
             Iterator<Map.Entry<String, JsonNode>> it = root.fields();
             while (it.hasNext()) {
                 Map.Entry<String, JsonNode> next = it.next();
-                process(next.getKey(), next.getValue(), user, post);
+                processNode(next.getKey(), next.getValue(), user, post);
             }
             processFixedNode(root, user, this.query_processors, post);
         }
@@ -170,24 +169,14 @@
     }
 
 
-    public JsonNode preProcess (JsonNode root, User user) {
-        return process(root, user, false);
+    public JsonNode process(JsonNode root, User user) {
+        JsonNode pre = iterate(root, user, false);
+        return iterate(pre, user, true);
     }
 
 
-    // fixme: redo with first, second iteration and push clean up filters into second run
-    public String preProcess (String json, User user) {
-        return JsonUtils.toJSON(preProcess(JsonUtils.readTree(json), user));
-    }
-
-
-    public JsonNode postProcess (JsonNode root, User user) {
-        return process(root, user, true);
-    }
-
-
-    public String postProcess (String json, User user) {
-        return JsonUtils.toJSON(postProcess(JsonUtils.readTree(json), user));
+    public String process(String json, User user) {
+        return JsonUtils.toJSON(process(JsonUtils.readTree(json), user));
     }
 
 
@@ -198,8 +187,7 @@
      * @return boolean true if node is to be removed from parent! Only
      *         applies if parent is an array node
      */
-    // todo: integrate notifications into system!
-    private boolean processNode (String rootNode, KoralNode node, User user,
+    private boolean rewrite (String rootNode, KoralNode node, User user,
             Collection<? extends RewriteTask> tasks, boolean post) {
         if (this.config == null)
             throw new RuntimeException("KustvaktConfiguration must be set!");
@@ -211,8 +199,8 @@
             if (this.beans != null && task instanceof BeanInjectable)
                 ((BeanInjectable) task).insertBeans(this.beans);
 
-            if (task instanceof RewriteTask.IterableRewriteAt) {
-                RewriteTask.IterableRewriteAt rw = (RewriteTask.IterableRewriteAt) task;
+            if (task instanceof RewriteTask.IterableRewritePath) {
+                RewriteTask.IterableRewritePath rw = (RewriteTask.IterableRewritePath) task;
                 if (rw.path() != null && !rw.path().equals(rootNode)) {
                     jlog.debug("skipping node: " + node);
                     continue;
@@ -226,6 +214,7 @@
                 else if (task instanceof RewriteTask.RewriteAfter) {
                     ((RewriteTask.RewriteAfter) task).postProcess(node);
                 }
+                node.buildRewrites();
             }
             catch (KustvaktException e) {
                 jlog.error("Error in rewrite processor {} for node {}", task
@@ -242,20 +231,20 @@
     private void processFixedNode (JsonNode node, User user,
             Collection<RewriteTask> tasks, boolean post) {
         for (RewriteTask task : tasks) {
-            JsonNode next = node;
+            KoralNode next = KoralNode.wrapNode(node);
             if (task instanceof RewriteTask.RewriteNodeAt) {
                 RewriteTask.RewriteNodeAt rwa = (RewriteTask.RewriteNodeAt) task;
                 if ((rwa.at() != null && !node.at(rwa.at()).isMissingNode()))
-                    next = node.at(rwa.at());
+                    next = next.at(rwa.at());
             }
 
             try {
                 if (!post & task instanceof RewriteTask.RewriteBefore)
-                    ((RewriteTask.RewriteBefore) task).preProcess(
-                            KoralNode.wrapNode(next), this.config, user);
+                    ((RewriteTask.RewriteBefore) task).preProcess(next,
+                            this.config, user);
                 else if (task instanceof RewriteTask.RewriteAfter)
-                    ((RewriteTask.RewriteAfter) task).postProcess(KoralNode
-                            .wrapNode(next));
+                    ((RewriteTask.RewriteAfter) task).postProcess(next);
+                next.buildRewrites();
             }
             catch (KustvaktException e) {
                 jlog.error("Error in rewrite processor {} for node {}", task
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteTask.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteTask.java
index 2c7fa06..fcc43aa 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteTask.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteTask.java
@@ -38,7 +38,7 @@
      * {@link de.ids_mannheim.korap.resource.rewrite.RewriteTask.RewriteAfter}
      * queries will run
      * after
-     * {@link de.ids_mannheim.korap.resource.rewrite.RewriteTask.IterableRewriteAt}
+     * {@link IterableRewritePath}
      * have been processed
      */
     interface RewriteAfter extends RewriteTask {
@@ -61,7 +61,7 @@
      * iteration
      * (both object and array node iteration supported)
      */
-    interface IterableRewriteAt extends RewriteBefore, RewriteAfter {
+    interface IterableRewritePath extends RewriteBefore, RewriteAfter {
         String path ();
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/ConditionManager.java b/src/main/java/de/ids_mannheim/korap/security/ac/ConditionManager.java
new file mode 100644
index 0000000..ba984d6
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/ConditionManager.java
@@ -0,0 +1,111 @@
+package de.ids_mannheim.korap.security.ac;
+
+import de.ids_mannheim.korap.config.BeansFactory;
+import de.ids_mannheim.korap.exceptions.EmptyResultException;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.NotAuthorizedException;
+import de.ids_mannheim.korap.interfaces.db.PolicyHandlerIface;
+import de.ids_mannheim.korap.resources.KustvaktResource;
+import de.ids_mannheim.korap.resources.Permissions;
+import de.ids_mannheim.korap.security.PolicyCondition;
+import de.ids_mannheim.korap.user.User;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.*;
+
+/**
+ * @author hanl
+ * @date 04/03/2014
+ */
+public class ConditionManager {
+
+    private static final Logger jlog = LoggerFactory
+            .getLogger(ConditionManager.class);
+    private User user;
+    private PolicyHandlerIface policydao;
+
+
+    public ConditionManager (User user) {
+        this.user = user;
+        this.policydao = BeansFactory.getKustvaktContext()
+                .getPolicyDbProvider();
+    }
+
+
+    /**
+     * adds a user to an existing group
+     * 
+     * @param usernames
+     * @param condition
+     * @param admin
+     */
+    // todo: conflict resolution
+    // fixme: not applicable to korap system roles
+    // only works if there is a policy with that condition and permission set, if not, create one!
+    public void addUser (List<String> usernames, PolicyCondition condition,
+            boolean admin) throws NotAuthorizedException, KustvaktException {
+        if (policydao.matchCondition(this.user, condition.getSpecifier(), true) == 1) {
+            policydao.addToCondition(usernames, condition, admin);
+        }
+        else
+            jlog.error("Users '{}' could not be added to condition '{}'",
+                    usernames, condition.getSpecifier());
+    }
+
+
+    public void addUser (String username, PolicyCondition condition,
+            boolean admin) throws NotAuthorizedException, KustvaktException {
+        addUser(Arrays.asList(username), condition, admin);
+    }
+
+
+    public void removeUser (List<String> users, PolicyCondition condition)
+            throws KustvaktException {
+        if (policydao.matchCondition(this.user, condition.getSpecifier(), true) == 1) {
+            policydao.removeFromCondition(users, condition);
+        }
+    }
+
+
+    public Set<String> getMembers (PolicyCondition condition) {
+        try {
+            if (policydao.matchCondition(this.user, condition.getSpecifier(),
+                    true) == 1) {
+                return new HashSet<>(policydao.getUsersFromCondition(condition));
+            }
+        }
+        catch (KustvaktException e) {
+            return Collections.emptySet();
+        }
+        return Collections.emptySet();
+    }
+
+
+    @Deprecated
+    public void addUser (KustvaktResource resource, String user,
+            Permissions.Permission ... pps) throws NotAuthorizedException,
+            KustvaktException, EmptyResultException {
+        addUser(resource, Arrays.asList(user), pps);
+    }
+
+
+    @Deprecated
+    public void addUser (KustvaktResource resource, List<String> users,
+            Permissions.Permission ... pps) throws NotAuthorizedException,
+            KustvaktException, EmptyResultException {
+        SecurityManager policies = SecurityManager.findbyId(resource.getId(),
+                this.user);
+        PolicyCondition c = policies.getExtensional(pps);
+        if (c != null)
+            this.addUser(users, c, false);
+        else {
+            PolicyCondition ex = new PolicyCondition();
+            new PolicyBuilder(this.user).setResources(resource)
+                    .addCondition(ex.getSpecifier()).setPermissions(pps)
+                    .create();
+            this.addUser(users, ex, false);
+        }
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManagerFactory.java b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManagerFactory.java
new file mode 100644
index 0000000..b129373
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManagerFactory.java
@@ -0,0 +1,15 @@
+package de.ids_mannheim.korap.security.ac;
+
+/**
+ * @author hanl
+ * @date 22/11/2015
+ */
+public class SecurityManagerFactory {
+
+    // make security manager and policydao transferable and exchangable
+    // resource finder
+    // resource handler
+
+
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
index 97e67af..00a6e17 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
@@ -756,12 +756,12 @@
                 data = dao.get(user);
 
             if (data == null)
-                throw new WrappedException(user.getId(),
-                        StatusCodes.EMPTY_RESULTS, clazz.getSimpleName());
+                throw new KustvaktException(user.getId(),
+                        StatusCodes.EMPTY_RESULTS, "No data found!", clazz.getSimpleName());
             return data;
         }
         catch (KustvaktException e) {
-            jlog.error("Error ", e);
+            jlog.error("Error during user data retrieval!", e.getEntity());
             throw new WrappedException(e, StatusCodes.GET_ACCOUNT_FAILED);
         }
     }
@@ -780,32 +780,11 @@
                 dao.update(data);
         }
         catch (KustvaktException e) {
-            jlog.error("Error ", e);
+            jlog.error("Error during update of user data!", e.getEntity());
             throw new WrappedException(e, StatusCodes.UPDATE_ACCOUNT_FAILED);
         }
     }
 
-
-    //    public UserDetails getUserDetails(User user) throws KustvaktException {
-    //        try {
-    //            if (user.getDetails() == null)
-    //                user.setDetails(entHandler.getUserDetails(user.getId()));
-    //        }catch (KustvaktException e) {
-    //            throw new WrappedException(e, StatusCodes.GET_ACCOUNT_FAILED);
-    //        }
-    //        return user.getDetails();
-    //    }
-    //
-    //    public UserSettings getUserSettings(User user) throws KustvaktException {
-    //        try {
-    //            if (user.getSettings() == null)
-    //                user.setSettings(entHandler.getUserSettings(user.getId()));
-    //        }catch (KustvaktException e) {
-    //            throw new WrappedException(e, StatusCodes.GET_ACCOUNT_FAILED);
-    //        }
-    //        return user.getSettings();
-    //    }
-
     private String cache_key (String input) throws KustvaktException {
         try {
             return crypto.hash(KEY + "@" + input);
diff --git a/src/main/java/de/ids_mannheim/korap/utils/NamingUtils.java b/src/main/java/de/ids_mannheim/korap/utils/NamingUtils.java
new file mode 100644
index 0000000..52f8663
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/utils/NamingUtils.java
@@ -0,0 +1,71 @@
+package de.ids_mannheim.korap.utils;
+
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * Created by hanl on 14.05.16.
+ */
+public class NamingUtils {
+
+    private static final String SLASH = "/";
+
+
+    private NamingUtils () {}
+
+
+    public static Collection<String> joinStringSet (Collection<String> source,
+            String other) {
+        Set<String> set = new HashSet<>(source);
+        set.add(other);
+        return set;
+    }
+
+
+    public static Collection<UUID> joinUUIDSet (Collection<UUID> source,
+            UUID other) {
+        Set<UUID> set = new HashSet<>(source);
+        set.add(other);
+        return set;
+    }
+
+
+    public static String joinResources (String first, String second) {
+        String res;
+        if (first != null && !first.isEmpty())
+            res = first + SLASH + second;
+        else
+            res = second;
+        return res.replaceAll("\\s", "");
+    }
+
+
+    public static String[] splitAnnotations (String joined) {
+        String[] spl = joined.split(SLASH);
+        if (spl.length == 2)
+            return spl;
+        else
+            return null;
+    }
+
+
+    public static String stripTokenType (String token) {
+        int idx = token.lastIndexOf(" ");
+        if (idx == -1)
+            return token;
+        return token.substring(idx).replaceAll("\\s", "");
+    }
+
+
+    public static String getTokenType (String token) {
+        if (token.contains(" "))
+            return token.substring(0, token.lastIndexOf(" "))
+                    .replaceAll("\\s", "").toLowerCase();
+        else
+            return null;
+    }
+
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/utils/ServiceInfo.java b/src/main/java/de/ids_mannheim/korap/utils/ServiceInfo.java
new file mode 100644
index 0000000..a30c8be
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/utils/ServiceInfo.java
@@ -0,0 +1,59 @@
+package de.ids_mannheim.korap.utils;
+
+import lombok.Getter;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Properties;
+
+/**
+ * @author hanl
+ * @date 23/01/2014
+ */
+public class ServiceInfo {
+
+    private static final ServiceInfo info = new ServiceInfo();
+
+    private static String UNKNOWN = "UNKNOWN";
+
+    @Getter
+    private String name;
+    @Getter
+    private String version;
+
+
+    private ServiceInfo () {
+        load();
+    }
+
+
+    private void load () {
+        Properties props = new Properties();
+        try {
+            InputStream stream = getStream();
+            props.load(stream);
+            stream.close();
+            this.version = (String) props.get("kustvakt.version");
+            this.name = (String) props.get("kustvakt.name");
+        }
+        catch (IOException e) {
+            this.version = UNKNOWN;
+            this.name = UNKNOWN;
+        }
+    }
+
+
+    private static InputStream getStream () throws IOException {
+        String path = "/kustvakt.info";
+        InputStream stream = ServiceInfo.class.getResourceAsStream(path);
+        if (stream == null)
+            throw new IOException("stream for resource " + path
+                    + " could not be found...");
+        return stream;
+    }
+
+
+    public static ServiceInfo getInfo () {
+        return info;
+    }
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/Arg.java b/src/main/java/de/ids_mannheim/korap/web/Arg.java
new file mode 100644
index 0000000..1fe8bf3
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/Arg.java
@@ -0,0 +1,124 @@
+package de.ids_mannheim.korap.web;
+
+import de.ids_mannheim.korap.config.KustvaktClassLoader;
+import lombok.Getter;
+
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author hanl
+ * @date 11/02/2016
+ */
+public abstract class Arg<T> {
+
+    @Getter
+    protected T value;
+
+
+    protected Arg () {}
+
+
+    public abstract void setValue (String value);
+
+
+    public String toString () {
+        return "--" + getName();
+    }
+
+
+    public abstract String getName ();
+
+
+    public abstract void run ();
+
+
+    public static Set<Arg> loadArgs (String[] args) {
+        Set<Arg> argSet = new HashSet<>();
+        Set<Class<? extends Arg>> set = KustvaktClassLoader
+                .loadSubTypes(Arg.class);
+
+        for (int idx = 0; idx < args.length; idx++) {
+            for (Class aClass : new HashSet<>(set)) {
+                if (!argSet.contains(aClass)) {
+                    Arg arg;
+                    try {
+                        arg = (Arg) aClass.newInstance();
+                    }
+                    catch (InstantiationException | IllegalAccessException e) {
+                        continue;
+                    }
+                    if (arg.toString().equals(args[idx])) {
+                        int i = args.length - 1;
+                        if (i > idx + 1)
+                            i = idx + 1;
+                        arg.setValue(args[i]);
+                        arg.run();
+                        argSet.add(arg);
+                        set.remove(aClass);
+                    }
+                }
+            }
+        }
+        return argSet;
+    }
+
+    public static class ConfigArg extends Arg<String> {
+
+        @Override
+        public void setValue (String value) {
+            this.value = value;
+        }
+
+
+        @Override
+        public String getName () {
+            return "config";
+        }
+
+
+        @Override
+        public void run () {
+
+        }
+    }
+
+    public static class InitArg extends Arg<Boolean> {
+
+        @Override
+        public void setValue (String value) {
+            this.value = true;
+        }
+
+
+        @Override
+        public String getName () {
+            return "init";
+        }
+
+
+        @Override
+        public void run () {
+
+        }
+    }
+
+    public static class PortArg extends Arg<Integer> {
+
+        @Override
+        public void setValue (String value) {
+            this.value = Integer.valueOf(value);
+        }
+
+
+        @Override
+        public String getName () {
+            return "port";
+        }
+
+
+        @Override
+        public void run () {}
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java b/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java
new file mode 100644
index 0000000..29763fa
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/filter/AdminFilter.java
@@ -0,0 +1,60 @@
+package de.ids_mannheim.korap.web.filter;
+
+import com.sun.jersey.spi.container.ContainerRequest;
+import com.sun.jersey.spi.container.ContainerRequestFilter;
+import com.sun.jersey.spi.container.ContainerResponseFilter;
+import com.sun.jersey.spi.container.ResourceFilter;
+import de.ids_mannheim.korap.config.BeansFactory;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.utils.NamingUtils;
+import de.ids_mannheim.korap.utils.StringUtils;
+import de.ids_mannheim.korap.web.utils.KorAPContext;
+import de.ids_mannheim.korap.web.utils.KustvaktResponseHandler;
+
+import javax.ws.rs.ext.Provider;
+
+/**
+ * @author hanl
+ * @date 17/06/2014
+ */
+@Provider
+public class AdminFilter implements ContainerRequestFilter, ResourceFilter {
+
+    // check over ssl!
+    @Override
+    public ContainerRequest filter (ContainerRequest cr) {
+        // todo:
+        String host = cr.getHeaderValue(ContainerRequest.HOST);
+        String ua = cr.getHeaderValue(ContainerRequest.USER_AGENT);
+
+        String authentication = cr
+                .getHeaderValue(ContainerRequest.AUTHORIZATION);
+
+        if (authentication != null
+                && authentication.endsWith(BeansFactory.getKustvaktContext()
+                        .getConfiguration().getAdminToken())) {
+            TokenContext c = new TokenContext();
+            c.setUsername(User.ADMINISTRATOR_NAME);
+            c.setTokenType(NamingUtils.getTokenType(authentication));
+            c.setToken(NamingUtils.stripTokenType(authentication));
+            cr.setSecurityContext(new KorAPContext(c));
+        }
+        else
+            throw KustvaktResponseHandler.throwAuthenticationException();
+
+        return cr;
+    }
+
+
+    @Override
+    public ContainerRequestFilter getRequestFilter () {
+        return this;
+    }
+
+
+    @Override
+    public ContainerResponseFilter getResponseFilter () {
+        return null;
+    }
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java b/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
new file mode 100644
index 0000000..ff77428
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
@@ -0,0 +1,58 @@
+package de.ids_mannheim.korap.web.filter;
+
+import com.sun.jersey.spi.container.ContainerRequest;
+import com.sun.jersey.spi.container.ContainerRequestFilter;
+import com.sun.jersey.spi.container.ContainerResponseFilter;
+import com.sun.jersey.spi.container.ResourceFilter;
+import de.ids_mannheim.korap.security.auth.BasicHttpAuth;
+import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.web.utils.KorAPContext;
+
+import javax.ws.rs.core.SecurityContext;
+import javax.ws.rs.ext.Provider;
+
+/**
+ * @author hanl
+ * @date 08/02/2016
+ */
+@Provider
+public class DemoFilter implements ContainerRequestFilter, ResourceFilter {
+
+    @Override
+    public ContainerRequest filter (ContainerRequest request) {
+        String authentication = request
+                .getHeaderValue(ContainerRequest.AUTHORIZATION);
+        if (authentication == null || authentication.isEmpty()) {
+            try {
+                request.getUserPrincipal();
+            }
+            catch (UnsupportedOperationException e) {
+                request.setSecurityContext(createContext());
+            }
+        }
+        return request;
+    }
+
+
+    private SecurityContext createContext () {
+        TokenContext context = new TokenContext();
+        String token = BasicHttpAuth.encode("demo", "demo2015");
+        context.setToken(token);
+        context.setTokenType(Attributes.BASIC_AUTHENTICATION);
+        context.setUsername("demo");
+        return new KorAPContext(context);
+    }
+
+
+    @Override
+    public ContainerRequestFilter getRequestFilter () {
+        return this;
+    }
+
+
+    @Override
+    public ContainerResponseFilter getResponseFilter () {
+        return null;
+    }
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/BootableBeanInterface.java b/src/main/java/de/ids_mannheim/korap/web/service/BootableBeanInterface.java
new file mode 100644
index 0000000..c600aaa
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/BootableBeanInterface.java
@@ -0,0 +1,17 @@
+package de.ids_mannheim.korap.web.service;
+
+import de.ids_mannheim.korap.config.ContextHolder;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+
+/**
+ * @author hanl
+ * @date 12/01/2016
+ */
+public interface BootableBeanInterface {
+
+    void load (ContextHolder beans) throws KustvaktException;
+
+
+    Class<? extends BootableBeanInterface>[] getDependencies ();
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/full/AdminService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/AdminService.java
new file mode 100644
index 0000000..08fd322
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/AdminService.java
@@ -0,0 +1,153 @@
+package de.ids_mannheim.korap.web.service.full;
+
+import com.sun.jersey.spi.container.ResourceFilters;
+import de.ids_mannheim.korap.auditing.AuditRecord;
+import de.ids_mannheim.korap.config.BeansFactory;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.handlers.DocumentDao;
+import de.ids_mannheim.korap.interfaces.db.AuditingIface;
+import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
+import de.ids_mannheim.korap.resources.Document;
+import de.ids_mannheim.korap.resources.KustvaktResource;
+import de.ids_mannheim.korap.resources.Permissions;
+import de.ids_mannheim.korap.resources.ResourceFactory;
+import de.ids_mannheim.korap.security.PolicyCondition;
+import de.ids_mannheim.korap.security.ac.PolicyBuilder;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.utils.JsonUtils;
+import de.ids_mannheim.korap.utils.KustvaktLogger;
+import de.ids_mannheim.korap.utils.TimeUtils;
+import de.ids_mannheim.korap.web.KustvaktServer;
+import de.ids_mannheim.korap.web.filter.AdminFilter;
+import de.ids_mannheim.korap.web.filter.PiwikFilter;
+import de.ids_mannheim.korap.web.utils.KustvaktResponseHandler;
+import org.joda.time.DateTime;
+import org.joda.time.format.DateTimeFormat;
+import org.joda.time.format.DateTimeFormatter;
+import org.slf4j.Logger;
+
+import javax.ws.rs.*;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.util.List;
+import java.util.Locale;
+
+/**
+ * Created by hanl on 6/11/14.
+ */
+@Path(KustvaktServer.API_VERSION + "/admin")
+@ResourceFilters({ AdminFilter.class, PiwikFilter.class })
+@Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
+public class AdminService {
+
+    private static Logger jlog = KustvaktLogger.getLogger(AdminService.class);
+    // todo: map in timeutils
+    private static DateTimeFormatter dtf = DateTimeFormat
+            .forPattern("dd/MM/yyyy");
+    //    private AdminQueryController adminController;
+    private AuthenticationManagerIface controller;
+    private AuditingIface auditingController;
+    private DocumentDao documentDao;
+
+
+    public AdminService () {
+        this.auditingController = BeansFactory.getKustvaktContext()
+                .getAuditingProvider();
+        this.controller = BeansFactory.getKustvaktContext()
+                .getAuthenticationManager();
+        this.documentDao = new DocumentDao(BeansFactory.getKustvaktContext()
+                .getPersistenceClient());
+    }
+
+
+    @GET
+    @Path("audit/{type}")
+    public Response getAudits (@PathParam("type") String type,
+            @QueryParam("from") String from, @QueryParam("until") String until,
+            @QueryParam("day") Boolean day, @QueryParam("limit") String limit,
+            @Context Locale locale) {
+        DateTime from_date, until_date;
+
+        if (from == null)
+            from_date = new DateTime();
+        else
+            from_date = DateTime.parse(from, dtf);
+        if (until == null)
+            until_date = new DateTime();
+        else
+            until_date = DateTime.parse(until, dtf);
+
+        int integer_limit;
+        boolean dayOnly = Boolean.valueOf(day);
+        try {
+            integer_limit = Integer.valueOf(limit);
+        }
+        catch (NumberFormatException | NullPointerException e) {
+            throw KustvaktResponseHandler.throwit(StatusCodes.ILLEGAL_ARGUMENT);
+        }
+        String result = JsonUtils.toJSON(auditingController.retrieveRecords(
+                AuditRecord.CATEGORY.valueOf(type.toUpperCase()), from_date,
+                until_date, dayOnly, integer_limit));
+        // limit number of records to return
+        return Response.ok(result).build();
+    }
+
+
+    @POST
+    @Path("createPolicies/{id}")
+    public Response addResourcePolicy (@PathParam("id") String persistentid,
+            @QueryParam("type") String type, @QueryParam("name") String name,
+            @QueryParam("description") String description,
+            @QueryParam("group") String group,
+            @QueryParam("perm") List<String> permissions,
+            @QueryParam("loc") String loc, @QueryParam("expire") String duration) {
+
+        KustvaktResource resource = ResourceFactory.getResource(type);
+        resource.setPersistentID(persistentid);
+        resource.setDescription(description);
+        resource.setName(name);
+
+        Permissions.Permission[] p = new Permissions.Permission[permissions
+                .size()];
+        for (int idx = 0; idx < permissions.size(); idx++)
+            p[idx] = Permissions.Permission.valueOf(permissions.get(idx)
+                    .toUpperCase());
+
+        try {
+            PolicyBuilder cr = new PolicyBuilder(User.UserFactory.getAdmin())
+                    .setConditions(new PolicyCondition(group)).setResources(
+                            resource);
+            if (loc != null && !loc.isEmpty())
+                cr.setLocation(loc);
+
+            if (duration != null && duration.isEmpty())
+                cr.setContext(TimeUtils.getNow().getMillis(),
+                        TimeUtils.convertTimeToSeconds(duration));
+
+            cr.setPermissions(p).create();
+        }
+        catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+
+        return Response.ok().build();
+    }
+
+
+    //fixme: documentservice?!
+    @POST
+    @Path("doc/{id}/add")
+    public Response addDocument (@PathParam("id") String id) {
+        Document document = new Document(id);
+        try {
+            this.documentDao.storeResource(document, null);
+        }
+        catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        return Response.ok().build();
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/full/DocumentService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/DocumentService.java
new file mode 100644
index 0000000..e1648d2
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/DocumentService.java
@@ -0,0 +1,78 @@
+package de.ids_mannheim.korap.web.service.full;
+
+import com.sun.jersey.spi.container.ResourceFilters;
+import de.ids_mannheim.korap.config.BeansFactory;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.handlers.DocumentDao;
+import de.ids_mannheim.korap.resources.Document;
+import de.ids_mannheim.korap.utils.JsonUtils;
+import de.ids_mannheim.korap.utils.KustvaktLogger;
+import de.ids_mannheim.korap.web.KustvaktServer;
+import de.ids_mannheim.korap.web.filter.AdminFilter;
+import de.ids_mannheim.korap.web.utils.KustvaktResponseHandler;
+import org.slf4j.Logger;
+
+import javax.ws.rs.*;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.util.List;
+
+/**
+ * @author hanl
+ * @date 19/11/2014
+ */
+@Path(KustvaktServer.API_VERSION + "/doc")
+@ResourceFilters({ AdminFilter.class })
+@Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
+public class DocumentService {
+
+    private static Logger jlog = KustvaktLogger
+            .getLogger(DocumentService.class);
+    private DocumentDao documentDao;
+
+
+    // todo: error handling
+    public DocumentService () {
+        this.documentDao = new DocumentDao(BeansFactory.getKustvaktContext()
+                .getPersistenceClient());
+    }
+
+
+    @POST
+    @Path("{doc}")
+    public Response store (@PathParam("doc") String docid,
+            @QueryParam("disabled") Boolean disabled) {
+        Document doc = new Document(docid);
+        doc.setDisabled(disabled);
+        try {
+            this.documentDao.storeResource(doc, null);
+        }
+        catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+        return Response.ok().build();
+    }
+
+
+    //todo: pipe add document to index endpoint
+
+    @GET
+    @Path("{corpus}")
+    public Response get (@PathParam("corpus") String corpus,
+            @QueryParam("index") Integer index,
+            @QueryParam("offset") Integer length) {
+        if (index == null)
+            index = 1;
+        if (length == null)
+            length = 25;
+        try {
+            List docs = this.documentDao.findbyCorpus(corpus, length, index);
+            //todo: serialize to document json
+            return Response.ok(JsonUtils.toJSON(docs)).build();
+        }
+        catch (KustvaktException e) {
+            throw KustvaktResponseHandler.throwit(e);
+        }
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/full/KustvaktService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/KustvaktService.java
new file mode 100644
index 0000000..c4db1b8
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/KustvaktService.java
@@ -0,0 +1,35 @@
+package de.ids_mannheim.korap.web.service.full;
+
+import de.ids_mannheim.korap.utils.JsonUtils;
+import de.ids_mannheim.korap.utils.ServiceInfo;
+import de.ids_mannheim.korap.web.KustvaktServer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Created by hanl on 29.04.16.
+ */
+@Path("kustvakt")
+@Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
+public class KustvaktService {
+
+    private static Logger jlog = LoggerFactory.getLogger(UserService.class);
+
+
+    @Path("info")
+    public Response getInfo () {
+        Map m = new HashMap();
+        m.put("version", ServiceInfo.getInfo().getVersion());
+        m.put("recent_api_version", KustvaktServer.API_VERSION);
+        m.put("service_name", ServiceInfo.getInfo().getName());
+        return Response.ok(JsonUtils.toJSON(m)).build();
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java b/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
index 0bfab1e..17f8595 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/full/ResourceService.java
@@ -312,7 +312,7 @@
 
         ss.setMeta(meta);
 
-        String query = this.processor.preProcess(ss.toJSON(), user);
+        String query = this.processor.process(ss.toJSON(), user);
         return Response.ok(query).build();
     }
 
@@ -408,7 +408,7 @@
         // todo: should be possible to add the meta part to the query serialization
         try {
             User user = controller.getUser(ctx.getUsername());
-            jsonld = this.processor.preProcess(jsonld, user);
+            jsonld = this.processor.process(jsonld, user);
         }
         catch (KustvaktException e) {
             throw KustvaktResponseHandler.throwit(e);
@@ -467,7 +467,7 @@
         serializer.setMeta(meta.raw());
 
         //fixme: policy rewrite!
-        String query = this.processor.preProcess(serializer.toJSON(), user);
+        String query = this.processor.process(serializer.toJSON(), user);
 
         jlog.info("the serialized query {}", query);
 
@@ -576,7 +576,7 @@
             try {
 
                 // rewrite process
-                query = this.processor.preProcess(query, user);
+                query = this.processor.process(query, user);
 
                 if (eng.equals(KustvaktConfiguration.BACKENDS.NEO4J)) {
                     if (raw)
@@ -668,14 +668,10 @@
                 query.setBaseQuery(resource.getData());
             }
             else if (resource instanceof Corpus) {
-                query.with("corpusID=" + resource.getName());
+                query.with(Attributes.CORPUS_SIGLE+"=" + resource.getName());
             }
-
             String res = query.toJSON();
-            jlog.info("BEFORE REWRITE " + res);
-            // rewrite process
-            String qstr = processor.preProcess(res, user);
-            jlog.info("AFTER REWRITE " + qstr);
+            String qstr = processor.process(res, user);
             return Response.ok(searchKrill.getStatistics(qstr)).build();
         }
         catch (KustvaktException e) {
@@ -710,7 +706,7 @@
         if (tmp == null) {
             KoralCollectionQueryBuilder cquery = new KoralCollectionQueryBuilder()
                     .setBaseQuery((String) cache.getData());
-            String query = this.processor.preProcess((String) cache.getData(),
+            String query = this.processor.process((String) cache.getData(),
                     user);
             String stats = searchKrill.getStatistics(query);
             cache.setStats(JsonUtils.readSimple(stats, Map.class));
diff --git a/src/main/java/de/ids_mannheim/korap/web/service/light/LightService.java b/src/main/java/de/ids_mannheim/korap/web/service/light/LightService.java
index 9c5a74a..d07b912 100644
--- a/src/main/java/de/ids_mannheim/korap/web/service/light/LightService.java
+++ b/src/main/java/de/ids_mannheim/korap/web/service/light/LightService.java
@@ -102,14 +102,14 @@
         ss.setMeta(meta);
         if (cq != null)
             ss.setCollection(cq);
-        return Response.ok(processor.preProcess(ss.toJSON(), null)).build();
+        return Response.ok(processor.process(ss.toJSON(), null)).build();
     }
 
 
     @POST
     @Path("search")
     public Response queryRaw (@QueryParam("engine") String engine, String jsonld) {
-        jsonld = processor.preProcess(jsonld, null);
+        jsonld = processor.process(jsonld, null);
         // todo: should be possible to add the meta part to the query serialization
         jlog.info("Serialized search: {}", jsonld);
 
@@ -143,7 +143,7 @@
         if (cq != null)
             serializer.setCollection(cq);
 
-        String query = processor.preProcess(serializer.toJSON(), null);
+        String query = processor.process(serializer.toJSON(), null);
         jlog.info("the serialized query {}", query);
 
         // This may not work with the the KoralQuery
@@ -214,7 +214,7 @@
             //                meta.addEntry("itemsPerResource", 1);
             QuerySerializer s = new QuerySerializer().setQuery(query, ql, v)
                     .setMeta(meta);
-            query = processor.preProcess(s.toJSON(), null);
+            query = processor.process(s.toJSON(), null);
         }
         String result;
         try {
diff --git a/src/main/java/de/ids_mannheim/korap/web/utils/KustvaktResponseBuilder.java b/src/main/java/de/ids_mannheim/korap/web/utils/KustvaktResponseBuilder.java
new file mode 100644
index 0000000..b43adf8
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/utils/KustvaktResponseBuilder.java
@@ -0,0 +1,33 @@
+package de.ids_mannheim.korap.web.utils;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author hanl
+ * @date 20/01/2016
+ */
+public class KustvaktResponseBuilder {
+    Map<String, Object> _values;
+
+
+    public KustvaktResponseBuilder () {
+        this._values = new HashMap<>();
+    }
+
+
+    public KustvaktResponseBuilder addEntity (Object o) {
+        if (o instanceof Map && !((Map) o).isEmpty())
+            this._values.putAll((Map<? extends String, ?>) o);
+
+
+        return this;
+    }
+
+
+    @Override
+    public String toString () {
+        return "";
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/utils/ShutdownHook.java b/src/main/java/de/ids_mannheim/korap/web/utils/ShutdownHook.java
new file mode 100644
index 0000000..de34e38
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/utils/ShutdownHook.java
@@ -0,0 +1,29 @@
+package de.ids_mannheim.korap.web.utils;
+
+/**
+ * @author hanl
+ * @date 18/02/2014
+ */
+public class ShutdownHook extends Thread {
+
+    @Override
+    public void run () {
+        //        Properties config = ExtensionBeans.getInstance().getConfiguration()
+        //                .getMailProperties();
+
+        //                Email e = new SimpleEmail();
+        //                try {
+        //                    e.setHostName(config.getProperty("mail.host"));
+        //                    e.setSmtpPort(587);
+        //                    e.setSubject("KorAP Rest service shutdown Notification");
+        //                    e.setFrom(config.getProperty("mail.from"));
+        //                    e.addTo("hanl@ids-mannheim.de");
+        //                    e.setMsg("The KorAP - REST application shut down unexpectedly!!");
+        //                    e.send();
+        //                } catch (EmailException e1) {
+        //                    e1.printStackTrace();
+        //                }
+
+    }
+
+}
diff --git a/src/main/resources/db/mysql/V1.3__triggers.sql b/src/main/resources/db/mysql/V1.3__triggers.sql
new file mode 100644
index 0000000..687a10a
--- /dev/null
+++ b/src/main/resources/db/mysql/V1.3__triggers.sql
@@ -0,0 +1,15 @@
+-- indices
+DELIMITER $$
+create trigger delete_policy after delete on resource_store
+for each row begin
+    delete from policy_store where target_id=OLD.id;
+end; $$
+
+CREATE TRIGGER tree_entry_insert AFTER INSERT ON resource_store FOR EACH ROW BEGIN
+	INSERT INTO resource_tree (parent_id, child_id, depth, name_path)
+	VALUES (NEW.id, NEW.id, 0, NEW.name);
+	INSERT INTO resource_tree (parent_id, child_id, depth, name_path)
+	SELECT parent_id, NEW.id, depth + 1, concat(name_path,"/",NEW.name) FROM resource_tree WHERE child_id = NEW.parent_id;
+END; $$
+
+DELIMITER ;
\ No newline at end of file
diff --git a/src/main/resources/db/mysql/V1.4__indices.sql b/src/main/resources/db/mysql/V1.4__indices.sql
new file mode 100644
index 0000000..32a0211
--- /dev/null
+++ b/src/main/resources/db/mysql/V1.4__indices.sql
@@ -0,0 +1,5 @@
+-- todo: are this automatically adapted when refactoring?
+CREATE INDEX group_index ON group_users(user_id, group_id);
+CREATE INDEX policy_index ON group_ref(policy_id);
+CREATE UNIQUE INDEX resource_tree_index ON resource_tree (parent_id, depth, child_id);
+CREATE UNIQUE INDEX param_unique ON param_store (p_key, p_value);
diff --git a/src/main/resources/index-goe-lucene5/_0.cfe b/src/main/resources/index-goe-lucene5/_0.cfe
new file mode 100644
index 0000000..72246bc
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_0.cfe
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_0.cfs b/src/main/resources/index-goe-lucene5/_0.cfs
new file mode 100644
index 0000000..d15185a
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_0.cfs
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_0.si b/src/main/resources/index-goe-lucene5/_0.si
new file mode 100644
index 0000000..d66ea34
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_0.si
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_1.cfe b/src/main/resources/index-goe-lucene5/_1.cfe
new file mode 100644
index 0000000..221e372
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_1.cfe
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_1.cfs b/src/main/resources/index-goe-lucene5/_1.cfs
new file mode 100644
index 0000000..6b998a4
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_1.cfs
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_1.si b/src/main/resources/index-goe-lucene5/_1.si
new file mode 100644
index 0000000..18b647a
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_1.si
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_2.cfe b/src/main/resources/index-goe-lucene5/_2.cfe
new file mode 100644
index 0000000..0b8386b
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_2.cfe
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_2.cfs b/src/main/resources/index-goe-lucene5/_2.cfs
new file mode 100644
index 0000000..f9828fd
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_2.cfs
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_2.si b/src/main/resources/index-goe-lucene5/_2.si
new file mode 100644
index 0000000..ddcd167
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_2.si
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_3.cfe b/src/main/resources/index-goe-lucene5/_3.cfe
new file mode 100644
index 0000000..2eaa97b
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_3.cfe
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_3.cfs b/src/main/resources/index-goe-lucene5/_3.cfs
new file mode 100644
index 0000000..f2ec38e
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_3.cfs
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_3.si b/src/main/resources/index-goe-lucene5/_3.si
new file mode 100644
index 0000000..c1fbcdf
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_3.si
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_4.cfe b/src/main/resources/index-goe-lucene5/_4.cfe
new file mode 100644
index 0000000..34cda7d
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_4.cfe
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_4.cfs b/src/main/resources/index-goe-lucene5/_4.cfs
new file mode 100644
index 0000000..224beae
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_4.cfs
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/_4.si b/src/main/resources/index-goe-lucene5/_4.si
new file mode 100644
index 0000000..84a3366
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/_4.si
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/segments_1 b/src/main/resources/index-goe-lucene5/segments_1
new file mode 100644
index 0000000..1cb809a
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/segments_1
Binary files differ
diff --git a/src/main/resources/index-goe-lucene5/write.lock b/src/main/resources/index-goe-lucene5/write.lock
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/src/main/resources/index-goe-lucene5/write.lock
diff --git a/src/main/resources/index-kustvakt-example.zip b/src/main/resources/index-kustvakt-example.zip
new file mode 100644
index 0000000..33c4b5c
--- /dev/null
+++ b/src/main/resources/index-kustvakt-example.zip
Binary files differ
diff --git a/src/main/resources/kustvakt.info b/src/main/resources/kustvakt.info
new file mode 100644
index 0000000..32b65d1
--- /dev/null
+++ b/src/main/resources/kustvakt.info
@@ -0,0 +1,2 @@
+kustvakt.version=${project.version}
+kustvakt.name=${project.name}