diff --git a/Controllers/Applications/ApplicationsController+ApiKey.cs b/Controllers/Applications/ApplicationsController+ApiKey.cs
index 9159553..8c70a74 100644
--- a/Controllers/Applications/ApplicationsController+ApiKey.cs
+++ b/Controllers/Applications/ApplicationsController+ApiKey.cs
@@ -1,9 +1,253 @@
+using System;
+using System.Linq;
+using xModels.Dtos;
+using System.Threading;
+using xIdentityHelper;
+using xCommons.Attributes;
+using xCommons.Extensions;
+using xIdentityModels.Dtos;
+using xExceptions.Constants;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+using System.Collections.Generic;
+using xIdentityModels.Extensions;
+using Microsoft.AspNetCore.Authorization;
+using static IdentityServer4.IdentityServerConstants;
+
 namespace xIds.Controllers
 {
     public partial class ApplicationsController
     {
         //
         #region ApiKey ...
+        /// <summary>
+        /// Get Specified ApiKey ...
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpGet("Applications/ApiKeys/{id}")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XApiKeyDto>> GetApiKey(
+            [FromRoute] Guid id,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (id.IsDefaultGuid())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.GetApiKeyAsync(
+                    id: id,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Remove Specified ApiKey ... 
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpDelete("Applications/ApiKeys/{id}")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XApiKeyDto>> RemoveApiKey(
+            [FromRoute] Guid id,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (id.IsDefaultGuid())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.RemoveApiKeyAsync(
+                    id: id,
+                    softDelete: false,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Update Specified ApiKey ...
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="item"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpPut("Applications/ApiKeys/{id}")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XApiKeyDto>> UpdateApiKey(
+            [FromRoute] Guid id,
+            [FromBody] XApiKeyDto item,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (
+                    id.IsDefaultGuid() ||
+                    !item.IsValidForAdd()
+                )
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.UpdateApiKeyAsync(
+                    id: id,
+                    item: item,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Get All Specified ApiKeys ...
+        /// </summary>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpGet("Applications/ApiKeys")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<IEnumerable<XApiKeyDto>>> GetAllApiKeys(
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.GetAllApiKeyAsync(
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken,
+                    orderBuilder: x => x.OrderBy(y => y.CreatedOn)
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Query ApiKeys ...
+        /// </summary>
+        /// <param name="query"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpGet("Applications/ApiKeys/Query")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XQueryResult<XApiKeyDto>>> QueryApiKeys(
+            [FromRoute] XQuery query,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.QueryApiKeyAsync(
+                    query: query,
+                    predicate: null,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken,
+                    orderBuilder: x => x.OrderBy(y => y.CreatedOn)
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
         #endregion                
     }
 }
\ No newline at end of file
diff --git a/Controllers/Applications/ApplicationsController+ApiKeyUsage.cs b/Controllers/Applications/ApplicationsController+ApiKeyUsage.cs
index cf6079e..dd16669 100644
--- a/Controllers/Applications/ApplicationsController+ApiKeyUsage.cs
+++ b/Controllers/Applications/ApplicationsController+ApiKeyUsage.cs
@@ -1,9 +1,299 @@
+using System;
+using System.Linq;
+using xModels.Dtos;
+using xIdentityHelper;
+using System.Threading;
+using xCommons.Attributes;
+using xCommons.Extensions;
+using xIdentityModels.Dtos;
+using xExceptions.Constants;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+using System.Collections.Generic;
+using xIdentityModels.Extensions;
+using Microsoft.AspNetCore.Authorization;
+using static IdentityServer4.IdentityServerConstants;
+
 namespace xIds.Controllers
 {
     public partial class ApplicationsController
     {
         //
         #region ApiKeyUsage ...
+        /// <summary>
+        /// Add Api Key Usage ...
+        /// </summary>
+        /// <param name="item"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpPost("Applications/ApiKeys/Usages")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XApiKeyUsageDto>> AddApiKeyUsage(
+            [FromBody] XApiKeyUsageDto item,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (item.IsValidForAdd())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.AddApiKeyUsageAsync(
+                    item: item,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Get Specified Api Key Usage ...
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpGet("Applications/ApiKeys/Usages/{id}")]
+        public async Task<ActionResult<XApiKeyUsageDto>> GetApiKeyUsage(
+            [FromRoute] long id,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (id <= 0)
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.GetApiKeyUsageAsync(
+                    id: id,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Remove Specified Api Key Usage ...
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpDelete("Applications/ApiKeys/Usages/{id}")]
+        public async Task<ActionResult<XApiKeyUsageDto>> RemoveApiKeyUsage(
+            [FromRoute] long id,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (id <= 0)
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.RemoveApiKeyUsageAsync(
+                    id: id,
+                    softDelete: false,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Update Specified Api Key Usage ...
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="item"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpPut("Applications/ApiKeys/Usages/{id}")]
+        public async Task<ActionResult<XApiKeyUsageDto>> UpdateApiKeyUsage(
+            [FromRoute] long id,
+            [FromBody] XApiKeyUsageDto item,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (
+                    id <= 0 ||
+                    !item.IsValidForAdd()
+                )
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.UpdateApiKeyUsageAsync(
+                    id: id,
+                    item: item,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Get All Api Key Usages ...
+        /// </summary>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpGet("Applications/ApiKeys/Usages")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<IEnumerable<XApiKeyUsageDto>>> GetAllApiKeyUsages(
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.GetAllApiKeyUsageAsync(
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken,
+                    orderBuilder: x => x.OrderBy(y => y.RequestedOn)
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+        
+        /// <summary>
+        /// Query Api Key Usages ...
+        /// </summary>
+        /// <param name="query"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpGet("Applications/ApiKeys/Usages/Query")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XQueryResult<XApiKeyUsageDto>>> QueryApiKeyUsages(
+            [FromRoute] XQuery query,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.QueryApiKeyUsageAsync(
+                    query: query,
+                    predicate: null,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken,
+                    orderBuilder: x => x.OrderBy(y => y.RequestedOn)
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
         #endregion        
     }
 }
\ No newline at end of file
diff --git a/Controllers/Applications/ApplicationsController+Application.cs b/Controllers/Applications/ApplicationsController+Application.cs
index a1436d7..3f2c525 100644
--- a/Controllers/Applications/ApplicationsController+Application.cs
+++ b/Controllers/Applications/ApplicationsController+Application.cs
@@ -1,10 +1,16 @@
 using System;
+using System.Linq;
+using xModels.Dtos;
 using xIdentityHelper;
 using System.Threading;
 using xCommons.Attributes;
+using xCommons.Extensions;
 using xIdentityModels.Dtos;
+using xExceptions.Constants;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Mvc;
+using xIdentityModels.Extensions;
+using System.Collections.Generic;
 using Microsoft.AspNetCore.Authorization;
 using static IdentityServer4.IdentityServerConstants;
 
@@ -14,17 +20,295 @@ namespace xIds.Controllers
     {
         //
         #region Application ...
-        [HttpPost]
+        /// <summary>
+        /// Create Application ...
+        /// </summary>
+        /// <remarks>
+        /// Sample request:
+        /// 
+        ///     {
+        ///         "type": 0,
+        ///         "name": "string",
+        ///         "description": "string",
+        ///     }        
+        /// 
+        /// </remarks>        
+        /// <param name="item"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
         [RequireXPowered]
+        [HttpPost("Applications")]
         [Authorize(LocalApi.PolicyName)]
         [Authorize(Policy = XPolicies.EnabledUser)]
         public async Task<ActionResult<XApplicationDto>> CreateApplication(
-            [FromBody] XApplicationDto request,
+            [FromBody] XApplicationDto item,
             CancellationToken cancellationToken = default
         )
         {
             //
-            throw new NotImplementedException("");
+            try
+            {
+                //
+                // Validate ...
+                if (!item.IsValidForAdd())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.AddApplicationAsync(
+                    item: item,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// Update Specified Application ...
+        /// </summary>
+        /// <remarks>
+        /// Sample request:
+        /// 
+        ///     {
+        ///         "id": 0,
+        ///         "type": 0,
+        ///         "name": "string",
+        ///         "description": "string",
+        ///     }
+        /// 
+        /// </remarks>        
+        /// <param name="item"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [HttpPut("Applications")]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XApplicationDto>> UpdateApplication(
+            [FromBody] XApplicationDto item,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (!item.IsValidForAdd())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.UpdateApplicationAsync(
+                    item: item,
+                    id: item.Id,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+        
+        /// <summary>
+        /// Remove Specified Application ...
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpDelete("Applications/{id}")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XApplicationDto>> RemoveApplication(
+            [FromRoute] int id,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (!id.IsValidIntId())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.RemoveApplicationAsync(
+                    id: id,
+                    softDelete: false,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }            
+        }
+        
+        /// <summary>
+        /// Get Specified Application ...
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpGet("Applications/{id}")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XApplicationDto>> GetApplication(
+            [FromRoute] int id,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (!id.IsValidIntId())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.GetApplicationAsync(
+                    id: id,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }            
+        }
+        
+        /// <summary>
+        /// Get All Application ...
+        /// </summary>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpGet("Applications")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<IEnumerable<XApplicationDto>>> GetAllApplications(
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.GetAllApplicationAsync(
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken,
+                    orderBuilder: x => x.OrderBy(y => y.Id)
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }            
+        }
+        
+        /// <summary>
+        /// Query Applications ...
+        /// </summary>
+        /// <param name="query"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpGet("Applications/Query")]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        public async Task<ActionResult<XQueryResult<XApplicationDto>>> QueryApplications(
+            [FromRoute] XQuery query,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                var result = await provider.QueryApplicationAsync(
+                    query: query,
+                    predicate: null,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true,
+                    cancellationToken: cancellationToken,
+                    orderBuilder: x => x.OrderBy(y => y.Id)
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }            
         }
         #endregion
     }
diff --git a/Controllers/Applications/ApplicationsController+Custom.cs b/Controllers/Applications/ApplicationsController+Custom.cs
new file mode 100644
index 0000000..ddbe141
--- /dev/null
+++ b/Controllers/Applications/ApplicationsController+Custom.cs
@@ -0,0 +1,265 @@
+using System;
+using xIdentityHelper;
+using System.Threading;
+using xCommons.Attributes;
+using xCommons.Extensions;
+using xIdentityModels.Dtos;
+using xExceptions.Constants;
+using xIdentityModels.Models;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+using System.Collections.Generic;
+using xIdentityModels.Extensions;
+using Microsoft.AspNetCore.Authorization;
+using static IdentityServer4.IdentityServerConstants;
+
+namespace xIds.Controllers
+{
+    public partial class ApplicationsController
+    {
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpPost("Applications/{applicationId}/ApiKeys/Create")]
+        public async Task<ActionResult<XApiKeyDto>> CreateApiKey(
+            [FromRoute] int applicationId,
+            [FromBody] XCreateApiKeyRequest request,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (
+                    !request.IsValid() ||
+                    !applicationId.IsValidIntId())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                // Retrieve Application for Validating ...
+                var application = await provider.GetApplicationAsync(
+                    id: applicationId,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true
+                );
+                if (application.IsNullOrDefault())
+                {
+                    XException.NotFound.Throw();
+                }
+
+                //
+                // Create Specified Api Key ...
+                var result = await provider.CreateApiKey(
+                    userInfo: userInfo,
+                    scopes: request.Scopes,
+                    applicationId: applicationId,
+                    rateLimit: request.RateLimit,
+                    allowedIPs: request.AllowedIPs,
+                    expiration: request.Expiration,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpDelete("Applications/{applicationId}/ApiKeys/{apiKeyId}")]
+        public async Task<ActionResult<XApiKeyDto>> RemoveApiKey(
+            [FromRoute] Guid apiKeyId,
+            [FromRoute] int applicationId,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (
+                    apiKeyId.IsDefaultGuid() ||
+                    !applicationId.IsValidIntId())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                // Retrieve Application for Validating ...
+                var application = await provider.GetApplicationAsync(
+                    id: applicationId,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true
+                );
+                if (application.IsNullOrDefault())
+                {
+                    XException.NotFound.Throw();
+                }
+
+                //
+                // Create Specified Api Key ...
+                var result = await provider.RemoveApiKeyAsync(
+                    id: apiKeyId,
+                    softDelete: false,
+                    userInfo: userInfo,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpPost("Applications/{applicationId}/ApiKeys/{apiKeyId}")]
+        public async Task<ActionResult<XApiKeyDto>> RotateApiKey(
+            [FromRoute] Guid apiKeyId,
+            [FromRoute] int applicationId,
+            [FromBody] XRotateApiKeyRequest request,
+            CancellationToken cancellationToken = default
+        )
+        {
+            //
+            try
+            {
+                //
+                // Validate ...
+                if (
+                    apiKeyId.IsDefaultGuid() ||
+                    !applicationId.IsValidIntId())
+                {
+                    XException.InvalidArgs.Throw();
+                }
+
+                //
+                // Normalize ...
+                if (
+                    request.IsNullOrDefault() ||
+                    request.NewExpiration.IsNull() ||
+                    !request.NewExpiration.HasValue
+                )
+                {
+                    //
+                    var timeSpan = TimeSpan.FromMinutes(apiKeyConfiguration.DefaultExpirationMinutes);
+                    request = new XRotateApiKeyRequest
+                    {
+                        NewExpiration = timeSpan
+                    };
+                }
+
+                //
+                var userInfo = await GetUserInfo();
+
+                //
+                // Retrieve Application for Validating ...
+                var application = await provider.GetApplicationAsync(
+                    id: applicationId,
+                    userInfo: userInfo,
+                    includeBuilder: null,
+                    ignoreSoftDeleteds: true
+                );
+                if (application.IsNullOrDefault())
+                {
+                    XException.NotFound.Throw();
+                }
+
+                //
+                // Create Specified Api Key ...
+                var result = await provider.RotateApiKey(
+                    apiKeyId: apiKeyId,
+                    userInfo: userInfo,
+                    newExpiration: request.NewExpiration,
+                    cancellationToken: cancellationToken
+                );
+
+                //
+                return Ok(result.ToDynamicObject());
+            }
+            catch (Exception ex)
+            {
+                //
+                var result = GetExceptionActionResult(ex);
+                return result;
+            }
+        }
+
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpPost("Applications/{applicationId}/ApiKeys/{apiKeyId}/Revoke")]
+        public async Task<ActionResult<XApiKeyDto>> RevokeApiKey(
+            [FromRoute] Guid apiKeyId,
+            [FromRoute] int applicationId,
+            CancellationToken cancellationToken = default
+        )
+        {
+            throw new NotImplementedException();            
+        }
+
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpPost("Applications/{applicationId}/ApiKeys")]
+        public async Task<ActionResult<IEnumerable<XApiKeyDto>>> GetApiKeys(
+            [FromRoute] int applicationId,
+            CancellationToken cancellationToken = default
+        )
+        {
+            throw new NotImplementedException();            
+        }
+
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [Authorize(Policy = XPolicies.EnabledUser)]
+        [HttpPost("Applications/{applicationId}/ApiKeys/{apiKeyId}/Usages")]
+        public async Task<ActionResult<XApiKeyDto>> GetApiKeyUsages(
+            [FromRoute] Guid apiKeyId,
+            [FromRoute] int applicationId,
+            CancellationToken cancellationToken = default
+        )
+        {
+            throw new NotImplementedException();            
+        }
+    
+        [RequireXPowered]
+        [Authorize(LocalApi.PolicyName)]
+        [HttpPost("Applications/{applicationId}/ApiKeys/{apiKeyId}/Validate")]
+        public async Task<ActionResult<XApiKeyDto>> ValidateApiKey(
+            [FromRoute] Guid apiKeyId,
+            [FromRoute] int applicationId,
+            CancellationToken cancellationToken = default
+        )
+        {
+            throw new NotImplementedException();            
+        }
+
+    }
+}
\ No newline at end of file
diff --git a/Controllers/ApplicationsController.cs b/Controllers/ApplicationsController.cs
index 2febbed..e3ca40d 100644
--- a/Controllers/ApplicationsController.cs
+++ b/Controllers/ApplicationsController.cs
@@ -1,5 +1,6 @@
 using xIds.Interfaces;
 using xCommons.Providers;
+using xIds.Configurations;
 using xIds.Controllers.Base;
 using xCommons.Configurations;
 using Microsoft.AspNetCore.Mvc;
@@ -13,17 +14,25 @@ namespace xIds.Controllers
     [ApiController]
     public partial class ApplicationsController : XIBaseController
     {
+        private readonly IXApplicationProvider provider;
+        private readonly XApiKeyConfiguration apiKeyConfiguration;
+
         public ApplicationsController(
-            ILogger<ApplicationsController> logger,
-            XAppConfiguration appConfiguration,
+            IXApplicationProvider provider,
             IXIdentityManager identityManager,
-            XValidationProvider validationProvider
+            XAppConfiguration appConfiguration,
+            ILogger<ApplicationsController> logger,
+            XValidationProvider validationProvider,
+            XApiKeyConfiguration apiKeyConfiguration
         ) : base(
             logger,
             appConfiguration,
             identityManager,
             validationProvider
         )
-        { }
+        {
+            this.provider = provider;
+            this.apiKeyConfiguration = apiKeyConfiguration;
+        }
     }
 }
\ No newline at end of file
diff --git a/Providers/XApplicationProvider/XApplicationProvider+ApiKey.cs b/Providers/XApplicationProvider/XApplicationProvider+ApiKey.cs
index 65f9b1d..becf3f9 100644
--- a/Providers/XApplicationProvider/XApplicationProvider+ApiKey.cs
+++ b/Providers/XApplicationProvider/XApplicationProvider+ApiKey.cs
@@ -170,7 +170,14 @@ namespace xIds.Providers
             exists = exists.UpdateData(
                 updateWith: item,
                 propertyWhiteList: [],
-                propertyBlackList: []
+                propertyBlackList: [
+                    nameof(XApiKey.Id),
+                    nameof(XApiKey.KeyHash),
+                    nameof(XApiKey.KeyPrefix),
+                    nameof(XApiKey.CreatedOn),
+                    nameof(XApiKey.Application),
+                    nameof(XApiKey.ApplicationId),
+                ]
             );
 
             //
diff --git a/Providers/XApplicationProvider/XApplicationProvider+ApiKeyUsage.cs b/Providers/XApplicationProvider/XApplicationProvider+ApiKeyUsage.cs
index 4af4c7c..d99bd2b 100644
--- a/Providers/XApplicationProvider/XApplicationProvider+ApiKeyUsage.cs
+++ b/Providers/XApplicationProvider/XApplicationProvider+ApiKeyUsage.cs
@@ -123,6 +123,8 @@ namespace xIds.Providers
                 updateWith: item,
                 propertyWhiteList: [],
                 propertyBlackList: [
+                    nameof(XApiKeyUsage.Id),
+                    nameof(XApiKeyUsage.ApiKeyId),
                     nameof(XApiKeyUsage.ResponseTimeMs),
                 ]
             );
diff --git a/Providers/XApplicationProvider/XApplicationProvider+Application.cs b/Providers/XApplicationProvider/XApplicationProvider+Application.cs
index 64456a5..2a7d2cb 100644
--- a/Providers/XApplicationProvider/XApplicationProvider+Application.cs
+++ b/Providers/XApplicationProvider/XApplicationProvider+Application.cs
@@ -138,7 +138,9 @@ namespace xIds.Providers
                 updateWith: item,
                 propertyWhiteList: [],
                 propertyBlackList: [
+                    nameof(XApiKey.Id),
                     nameof(XApplication.ApiKeys),
+                    nameof(XApplication.CreatedOn),
                 ]
             );