Repository: radius-project/radius

Issue:
Async operation support in UCP for Resource Group and Planes
## Overview of feature request

UCP currently handles all operations synchronously. We need to add support for async operation support. Delete Resource group operation could be converted to async once it adds cascaded deletes.

The code should reuse as much as possible from the CoreRP.

Specifically, this will be integrating the flow that we use in CoreRP https://github.com/project-radius/radius/blob/489ea3b83b12f67ddb802d384dd1be1f08793d26/pkg/armrpc/frontend/controller/operation.go#L166. This flow will be added to AWS, Resource Groups, Planes, and potentially Credentials.

## Acceptance criteria

- Resource Group CreateOrUpdate and Delete are handled asynchronously and does the right thing with async worker.
- Plane CreateOrUpdate and Delete are handled asynchronously and does the right thing with async worker.

## Additional context

<!--Add any other context about the problem here-->

[AB#5028](https://dev.azure.com/azure-octo/e61041b4-555f-47ae-95b2-4f8ab480ea57/_workitems/edit/5028)

Hints from issue comments:
@nicolejms: very old so closing

Solution patch:
diff --git a/build/generate.mk b/build/generate.mk
index d245b8bae..7afb27240 100644
--- a/build/generate.mk
+++ b/build/generate.mk
@@ -5,19 +5,28 @@
 
 ##@ Generate (Code and Schema Generation)
 
+GOOS ?= $(shell go env GOOS)
+
+ifeq ($(GOOS),windows)
+   CMD_EXT = .cmd
+endif
+
 .PHONY: generate
 generate: generate-genericcliclient generate-rad-corerp-client generate-rad-linkrp-client generate-rad-ucp-client generate-go generate-bicep-types generate-ucp-crd ## Generates all targets.
 	
 .PHONY: generate-cadl-installed
 generate-cadl-installed:
 	@echo "$(ARROW) Detecting cadl..."
-	cd cadl/Applications.Link && npx -q cadl --help > /dev/null || { echo "cadl is a required dependency"; exit 1; }
+	cd cadl/Applications.Link && npx$(CMD_EXT) -q cadl --help > /dev/null || { echo "cadl is a required dependency"; exit 1; }
 	@echo "$(ARROW) OK"
 
+
 .PHONY: generate-openapi-spec
 generate-openapi-spec:
-	@echo  "Generating openapi specs for link resources from cadl models."
-	cd cadl/Applications.Link && npx cadl compile .
+	@echo  "Generating openapi specs from cadl models."
+	cd cadl/Applications.Link && npx$(CMD_EXT) cadl compile .
+	cd cadl/UCP && npx$(CMD_EXT) cadl compile . 
+
 .PHONY: generate-node-installed
 generate-node-installed:
 	@echo "$(ARROW) Detecting node..."
diff --git a/build/test.mk b/build/test.mk
index 3d72ca477..c5c858b92 100644
--- a/build/test.mk
+++ b/build/test.mk
@@ -47,9 +47,10 @@ oav-installed:
 	@which oav > /dev/null || { echo "run 'npm install -g oav' to install oav"; exit 1; }
 	@echo "$(ARROW) OK"
 
+# TODO re-enable https://github.com/project-radius/radius/issues/5091
 .PHONY: test-ucp-spec-examples 
 test-ucp-spec-examples: oav-installed ## Validates UCP examples conform to UCP OpenAPI Spec
-	@echo "$(ARROW) Testing x-ms-examples conform to ucp spec..."
-	oav validate-example swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/ucp.json
+	# @echo "$(ARROW) Testing x-ms-examples conform to ucp spec..."
+	# oav validate-example swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/openapi.json
 
 
diff --git a/cadl/UCP/cadl-project.yaml b/cadl/UCP/cadl-project.yaml
new file mode 100644
index 000000000..fd9795489
--- /dev/null
+++ b/cadl/UCP/cadl-project.yaml
@@ -0,0 +1,5 @@
+emit:
+  - "@azure-tools/cadl-autorest"
+options:
+  "@azure-tools/cadl-autorest":
+    emitter-output-dir: "{project-root}/../../swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/"
\ No newline at end of file
diff --git a/cadl/UCP/customPlaneScope.cadl b/cadl/UCP/customPlaneScope.cadl
new file mode 100644
index 000000000..5d722dd65
--- /dev/null
+++ b/cadl/UCP/customPlaneScope.cadl
@@ -0,0 +1,127 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+// Currently, our spec is not approved by ARM so this is a workaround that the CADL team gave us
+// so that we can preface our paths with {rootScope}
+// To generate {rootScope} in the path, use the tag --import "./aksrootscope.cadl" while compiling
+
+import "@cadl-lang/openapi";
+import "@cadl-lang/rest";
+import "@azure-tools/cadl-autorest";
+import "@azure-tools/cadl-azure-resource-manager";
+import "@azure-tools/cadl-azure-core";
+
+namespace Azure.ResourceManager.Radius;
+
+using Cadl.Http;
+using Cadl.Rest;
+using OpenAPI;
+using Autorest;
+using Azure.Core;
+using Azure.ResourceManager.Foundations;
+
+// Skip generation of ListBySubscription
+interface PlaneResourceListBySubscription<TResource> {}
+
+model CommonParameters<TResource> {
+  ...ApiVersionParameter;
+}
+
+model PlaneParentScope<TResource, TRootParams> {
+  ...CommonParameters<TResource>;
+  ...ParentKeysOf<TResource>;
+}
+
+model ResourceParentScope<TResource, TRootParams> {
+  ...CommonParameters<TResource>;
+  ...ParentKeysOf<TResource>;
+  ...TRootParams;
+}
+
+model PlaneInstanceParameters<TResource, TRootParams> {
+  ...CommonParameters<TResource>;
+  ...KeysOf<TResource>;
+  ...TRootParams;
+}
+
+model ResourceGroupInstanceParameters<TResource, TRootParams> {
+  ...CommonParameters<TResource>;
+  ...TRootParams;
+  ...KeysOf<TResource>;
+}
+
+interface CommonResourceOperations<
+  TResource extends ArmResource,
+  TProperties extends object,
+  TRootParams
+>
+  extends Azure.ResourceManager.Radius.ResourceRead<
+      TResource,
+      ResourceGroupInstanceParameters<TResource, TRootParams>
+    >,
+    Azure.ResourceManager.Radius.ResourceCreate<
+      TResource,
+      ResourceGroupInstanceParameters<TResource, TRootParams>
+    >,
+    Azure.ResourceManager.Radius.ResourceDelete<
+      TResource,
+      ResourceGroupInstanceParameters<TResource, TRootParams>
+    >,
+    ListByParent<TResource, TRootParams> {}
+
+interface PlaneResourceOperations<
+  TResource extends ArmResource,
+  TProperties extends object,
+  TRootParams
+>
+  extends Azure.ResourceManager.Radius.ResourceRead<
+      TResource,
+      PlaneInstanceParameters<TResource, TRootParams>
+    >,
+    Azure.ResourceManager.Radius.ResourceCreate<
+      TResource,
+      PlaneInstanceParameters<TResource, TRootParams>
+    >,
+    Azure.ResourceManager.Radius.ResourceDelete<
+      TResource,
+      PlaneInstanceParameters<TResource, TRootParams>
+    >,
+    PlaneListByParent<TResource, TRootParams> {}
+
+interface PlaneTypeOperations<
+  TResource extends ArmResource,
+  TProperties extends object,
+  TRootParams
+>
+  extends Azure.ResourceManager.Radius.ResourceRead<
+      TResource,
+      PlaneInstanceParameters<TResource, TRootParams>
+    > {}
+
+interface ListByParent<TResource extends ArmResource, TRootParams> {
+  @get
+  //@pageable
+  @doc("Lists information about all {name}", TResource)
+  @autoRoute
+  @list(TResource)
+  @segmentOf(TResource)
+  @armResourceList(TResource)
+  ListByRootScope(
+    ...ResourceParentScope<TResource, TRootParams>
+  ): ArmResponse<ResourceListResult<TResource>> | ErrorResponse;
+}
+
+interface PlaneListByParent<TResource extends ArmResource, TRootParams> {
+  @get
+  //@pageable
+  @doc("Lists information about all {name}s in the given plane", TResource)
+  @autoRoute
+  @list(TResource)
+  @segmentOf(TResource)
+  @armResourceList(TResource)
+  ListByRootScope(
+    ...PlaneParentScope<TResource, TRootParams>
+  ): ArmResponse<ResourceListResult<TResource>> | ErrorResponse;
+}
diff --git a/cadl/UCP/main.cadl b/cadl/UCP/main.cadl
new file mode 100644
index 000000000..34bbb43f6
--- /dev/null
+++ b/cadl/UCP/main.cadl
@@ -0,0 +1,9 @@
+import "@cadl-lang/rest";
+import "@cadl-lang/openapi";
+import "@azure-tools/cadl-autorest";
+import "@azure-tools/cadl-azure-core";
+import "@azure-tools/cadl-azure-resource-manager";
+
+import "./ucp.cadl";
+import "./customPlaneScope.cadl";
+
diff --git a/cadl/UCP/ucp.cadl b/cadl/UCP/ucp.cadl
new file mode 100644
index 000000000..ea61b5238
--- /dev/null
+++ b/cadl/UCP/ucp.cadl
@@ -0,0 +1,273 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+import "@cadl-lang/rest";
+import "@cadl-lang/versioning";
+import "@azure-tools/cadl-azure-core";
+import "@azure-tools/cadl-azure-resource-manager";
+import "@azure-tools/cadl-providerhub";
+
+import "@cadl-lang/openapi";
+
+import "../aksrootscope.cadl";
+import "../customRootScope.cadl";
+
+using Cadl.Http;
+using Cadl.Rest;
+using Cadl.Versioning;
+using Azure.ResourceManager;
+using Azure.ResourceManager.Radius;
+using Azure.ResourceManager.Foundations;
+using OpenAPI;
+
+// Don't need operation APIs.
+#suppress "@azure-tools/cadl-azure-resource-manager/missing-operations-endpoint"
+@armProviderNamespace
+@service({
+    title: "UCP Management APIs",
+    version: "2022-09-01-privatepreview",
+})
+@doc("REST APIs for UCP")
+@versionedDependency(Azure.ResourceManager.Versions.v1_0_Preview_1)
+namespace Ucp;
+
+@doc("UCP ResourceGroup.")
+model ResourceGroupResource is TrackedResource<BasicResourceProperties> {
+    @doc("UCP resourcegroup name")
+    @maxLength(63)
+    @pattern("^[A-Za-z]([-A-Za-z0-9]*[A-Za-z0-9])?$")
+    @key("resourceGroupName")
+    @path
+    @segment("resourcegroups")
+    @extension("x-ms-parameter-location", "method")
+    name: string;
+}
+
+@doc("Basic properties of a UCP resource.")
+model BasicResourceProperties {
+    @doc("Provisioning state of the resource at the time the operation was called")
+    @visibility("read")
+    provisioningState?: ProvisioningState;
+}
+
+@doc("UCP PlaneResource.")
+model PlaneResource is TrackedResource<PlaneResourceProperties> {
+    @key("planeType")
+    @doc("The plane type.")
+    @segment("planes")
+    @path
+    name: string;
+}
+
+@doc("Plane kinds supported.")
+enum PlaneKind {
+    UCPNative,
+    Azure,
+    AWS,
+}
+
+@doc("Credential store kinds supported.")
+enum CredentialStorageKind {
+    Internal,
+}
+
+@doc("AWS credential kinds supported.")
+enum AWSCredentialKind {
+    AccessKey,
+}
+
+@doc("Azure credential kinds supported.")
+enum AzureCredentialKind {
+    ServicePrincipal,
+}
+
+@doc("Plane properties.")
+model PlaneResourceProperties extends BasicResourceProperties {
+    @doc("The kind of plane")
+    kind: PlaneKind;
+
+    @doc("URL to forward requests to for non UCP Native Plane")
+    url?: string;
+    // TODO try record here
+
+    @doc("Resource Providers for UCP Native Plane")
+    resourceProviders?: Record<string>;
+}
+
+@discriminator("kind")
+@doc("Azure Credential properties")
+model AzureCredentialProperties extends BasicResourceProperties {}
+
+@doc("Service Principal credential storage properties")
+model AzureServicePrincipalProperties extends AzureCredentialProperties {
+    @doc("Service principal kind")
+    kind: "ServicePrincipal";
+
+    @doc("clientId for ServicePrincipal")
+    clientId: string;
+
+    @doc("secret for ServicePrincipal")
+    @extension("x-ms-secret", true)
+    clientSecret: string;
+
+    @doc("tenantId for ServicePrincipal")
+    tenantId: string;
+
+    @doc("The storage properties")
+    storage: CredentialStorageProperties;
+}
+
+#suppress "@azure-tools/cadl-azure-core/casing-style" "The names of Interface types must use PascalCaseCadl()"
+@discriminator("kind")
+@doc("AWS Credential properties")
+model AWSCredentialProperties extends BasicResourceProperties {}
+
+#suppress "@azure-tools/cadl-azure-core/casing-style" "The names of Interface types must use PascalCaseCadl()"
+@doc("AWS credential storage properties")
+model AWSAccessKeyCredentialProperties extends AWSCredentialProperties {
+    @doc("Access Key kind")
+    kind: "AccessKey";
+
+    @doc("Access key ID for AWS identity")
+    @extension("x-ms-secret", true)
+    accessKeyId: string;
+
+    @doc("Secret Access Key for AWS identity")
+    @extension("x-ms-secret", true)
+    secretAccessKey: string;
+
+    @doc("The storage properties")
+    storage: CredentialStorageProperties;
+}
+
+#suppress "@azure-tools/cadl-azure-core/casing-style" "The names of Interface types must use PascalCaseCadl()"
+#suppress "@azure-tools/cadl-azure-resource-manager/arm-resource-path-segment-invalid-chars"
+model AWSCredentialResource is TrackedResource<AWSCredentialProperties> {
+    @key("credentialName")
+    @doc("The AWS credential name.")
+    @path
+    @segment("providers/System.AWS/credentials")
+    @pattern("^[a-z]([-a-z0-9]*[a-z0-9])?$")
+    @maxLength(63)
+    name: string;
+}
+
+#suppress "@azure-tools/cadl-azure-resource-manager/arm-resource-path-segment-invalid-chars"
+model AzureCredentialResource is TrackedResource<AzureCredentialProperties> {
+    @key("credentialName")
+    @doc("The Azure credential name.")
+    @path
+    @segment("providers/System.Azure/credentials")
+    @pattern("^[a-z]([-a-z0-9]*[a-z0-9])?$")
+    @maxLength(63)
+    name: string;
+}
+
+@doc("Credential storage properties")
+@discriminator("kind")
+model CredentialStorageProperties {}
+
+@doc("Internal credential storage properties")
+model InternalCredentialStorageProperties extends CredentialStorageProperties {
+    @doc("Internal kind")
+    kind: "Internal";
+
+    @doc("The name of secret stored.")
+    @visibility("read")
+    secretName: string;
+}
+
+@doc("Custom root scope")
+model PlaneNameParameter {
+    @doc("The name of the plane")
+    @maxLength(63)
+    @path
+    @pattern("^[a-z]([-a-z0-9]*[a-z0-9])?$")
+    @extension("x-ms-skip-url-encoding", true)
+    @extension("x-ms-parameter-location", "method")
+    planeName: string;
+}
+
+@doc("Provisioning state of the link at the time the operation was called")
+enum ProvisioningState {
+    Succeeded,
+    Failed,
+    Canceled,
+    Provisioning,
+    Updating,
+    Deleting,
+    Accepted,
+}
+
+#suppress "@azure-tools/cadl-azure-core/casing-style" "The names of Interface types must use PascalCaseCadl()"
+@doc("Custom root scope")
+model AWSPlaneNameParameter {
+    @doc("The name of the plane")
+    @maxLength(63)
+    @path
+    @pattern("^[a-z]([-a-z0-9]*[a-z0-9])?$")
+    @segment("planes/aws")
+    @extension("x-ms-skip-url-encoding", true)
+    @extension("x-ms-parameter-location", "method")
+    planeName: string;
+}
+
+@doc("Custom root scope")
+model AzurePlaneNameParameter {
+    @doc("The name of the plane")
+    @maxLength(63)
+    @path
+    @pattern("^[a-z]([-a-z0-9]*[a-z0-9])?$")
+    @segment("planes/azure")
+    @extension("x-ms-skip-url-encoding", true)
+    @extension("x-ms-parameter-location", "method")
+    planeName: string;
+}
+
+@armResourceOperations
+interface Planes
+    extends Radius.PlaneResourceOperations<
+            PlaneResource,
+            PlaneResourceProperties,
+            PlaneNameParameter
+        > {}
+
+@armResourceOperations
+interface PlaneTypes
+    extends Radius.PlaneTypeOperations<
+            PlaneResource,
+            PlaneResourceProperties,
+            {}
+        > {}
+
+model Root<PlaneResource> {
+    ...KeysOf<PlaneResource>;
+    ...PlaneNameParameter;
+}
+
+@armResourceOperations
+interface ResourceGroups
+    extends CommonResourceOperations<
+            ResourceGroupResource,
+            BasicResourceProperties,
+            Root<PlaneResource>
+        > {}
+
+@armResourceOperations
+interface AzureCredential
+    extends CommonResourceOperations<
+            AzureCredentialResource,
+            AzureCredentialProperties,
+            AzurePlaneNameParameter
+        > {}
+
+#suppress "@azure-tools/cadl-azure-core/casing-style" "The names of Interface types must use PascalCaseCadl()"
+@armResourceOperations
+interface AWSCredential
+    extends CommonResourceOperations<
+            AWSCredentialResource,
+            AWSCredentialProperties,
+            AWSPlaneNameParameter
+        > {}
diff --git a/cmd/rad/cmd/appDelete.go b/cmd/rad/cmd/appDelete.go
deleted file mode 100644
index d577a30f5..000000000
--- a/cmd/rad/cmd/appDelete.go
+++ /dev/null
@@ -1,92 +0,0 @@
-// ------------------------------------------------------------
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-// ------------------------------------------------------------
-
-package cmd
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/project-radius/radius/pkg/cli"
-	"github.com/project-radius/radius/pkg/cli/connections"
-	"github.com/project-radius/radius/pkg/cli/output"
-	"github.com/project-radius/radius/pkg/cli/prompt"
-	"github.com/project-radius/radius/pkg/cli/workspaces"
-	"github.com/spf13/cobra"
-)
-
-// appDeleteCmd command to delete an application
-var appDeleteCmd = &cobra.Command{
-	Use:   "delete",
-	Short: "Delete RAD application",
-	Long:  "Delete the specified RAD application deployed in the default environment",
-	RunE:  deleteApplication,
-}
-
-func init() {
-	applicationCmd.AddCommand(appDeleteCmd)
-
-	appDeleteCmd.Flags().BoolP("yes", "y", false, "Use this flag to prevent prompt for confirmation")
-}
-
-func deleteApplication(cmd *cobra.Command, args []string) error {
-	yes, err := cmd.Flags().GetBool("yes")
-	if err != nil {
-		return err
-	}
-
-	workspace, err := cli.RequireWorkspace(cmd, ConfigFromContext(cmd.Context()), DirectoryConfigFromContext(cmd.Context()))
-	if err != nil {
-		return err
-	}
-
-	// TODO: support fallback workspace
-	if !workspace.IsNamedWorkspace() {
-		return workspaces.ErrNamedWorkspaceRequired
-	}
-
-	applicationName, err := cli.RequireApplicationArgs(cmd, args, *workspace)
-	if err != nil {
-		return err
-	}
-
-	// Prompt user to confirm deletion
-	if !yes {
-		confirmed, err := prompt.ConfirmWithDefault(fmt.Sprintf("Are you sure you want to delete '%v' from '%v' [y/N]?", applicationName, workspace.Name), prompt.No)
-		if err != nil {
-			return err
-		}
-		if !confirmed {
-			return nil
-		}
-	}
-
-	err = DeleteApplication(cmd.Context(), *workspace, applicationName)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func DeleteApplication(ctx context.Context, workspace workspaces.Workspace, applicationName string) error {
-	client, err := connections.DefaultFactory.CreateApplicationsManagementClient(ctx, workspace)
-	if err != nil {
-		return err
-	}
-
-	deleted, err := client.DeleteApplication(ctx, applicationName)
-	if err != nil {
-		return err
-	}
-
-	if deleted {
-		output.LogInfo("Application deleted")
-	} else {
-		output.LogInfo("Application '%s' does not exist or has already been deleted.", applicationName)
-	}
-
-	return nil
-}
diff --git a/cmd/rad/cmd/appList.go b/cmd/rad/cmd/appList.go
deleted file mode 100644
index 6f69bf661..000000000
--- a/cmd/rad/cmd/appList.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// ------------------------------------------------------------
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-// ------------------------------------------------------------
-
-package cmd
-
-import (
-	"github.com/project-radius/radius/pkg/cli"
-	"github.com/project-radius/radius/pkg/cli/connections"
-	"github.com/project-radius/radius/pkg/cli/objectformats"
-	"github.com/project-radius/radius/pkg/cli/output"
-	"github.com/project-radius/radius/pkg/cli/workspaces"
-	"github.com/spf13/cobra"
-)
-
-// appListCmd command to list  applications deployed in the resource group
-var appListCmd = &cobra.Command{
-	Use:   "list",
-	Short: "Lists RAD applications",
-	Long:  "Lists RAD applications deployed in the resource group associated with the default environment",
-	Args:  cobra.ExactArgs(0),
-	RunE:  listApplications,
-}
-
-func init() {
-	applicationCmd.AddCommand(appListCmd)
-}
-
-func listApplications(cmd *cobra.Command, args []string) error {
-	workspace, err := cli.RequireWorkspace(cmd, ConfigFromContext(cmd.Context()), DirectoryConfigFromContext(cmd.Context()))
-	if err != nil {
-		return err
-	}
-
-	// TODO: support fallback workspace
-	if !workspace.IsNamedWorkspace() {
-		return workspaces.ErrNamedWorkspaceRequired
-	}
-
-	client, err := connections.DefaultFactory.CreateApplicationsManagementClient(cmd.Context(), *workspace)
-	if err != nil {
-		return err
-	}
-	applicationList, err := client.ListApplications(cmd.Context())
-	if err != nil {
-		return err
-	}
-
-	return printOutput(cmd, applicationList, false)
-}
-
-func printOutput(cmd *cobra.Command, obj any, isLegacy bool) error {
-	format, err := cli.RequireOutput(cmd)
-	if err != nil {
-		return err
-	}
-
-	err = output.Write(format, obj, cmd.OutOrStdout(), objectformats.GetResourceTableFormat())
-	if err != nil {
-		return err
-	}
-	return nil
-}
diff --git a/cmd/rad/cmd/appShow.go b/cmd/rad/cmd/appShow.go
deleted file mode 100644
index a68ecaa4f..000000000
--- a/cmd/rad/cmd/appShow.go
+++ /dev/null
@@ -1,66 +0,0 @@
-// ------------------------------------------------------------
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-// ------------------------------------------------------------
-
-package cmd
-
-import (
-	"github.com/project-radius/radius/pkg/cli"
-	"github.com/project-radius/radius/pkg/cli/connections"
-	"github.com/project-radius/radius/pkg/cli/workspaces"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-)
-
-// appShowCmd command to show properties of a  application
-var appShowCmd = &cobra.Command{
-	Use:   "show",
-	Short: "Show RAD application details",
-	Long:  "Show RAD application details",
-	RunE:  showApplication,
-}
-
-func init() {
-	applicationCmd.AddCommand(appShowCmd)
-}
-
-func showApplication(cmd *cobra.Command, args []string) error {
-	config := ConfigFromContext(cmd.Context())
-	workspace, err := cli.RequireWorkspace(cmd, config, DirectoryConfigFromContext(cmd.Context()))
-	if err != nil {
-		return err
-	}
-
-	// TODO: support fallback workspace
-	if !workspace.IsNamedWorkspace() {
-		return workspaces.ErrNamedWorkspaceRequired
-	}
-
-	applicationName, err := cli.RequireApplicationArgs(cmd, args, *workspace)
-	if err != nil {
-		return err
-	}
-
-	err = ShowApplication(cmd, args, *workspace, applicationName, config)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func ShowApplication(cmd *cobra.Command, args []string, workspace workspaces.Workspace, applicationName string, config *viper.Viper) error {
-	client, err := connections.DefaultFactory.CreateApplicationsManagementClient(cmd.Context(), workspace)
-	if err != nil {
-		return err
-	}
-
-	applicationResource, err := client.ShowApplication(cmd.Context(), applicationName)
-	if err != nil {
-		return err
-	}
-
-	return printOutput(cmd, applicationResource, false)
-
-}
diff --git a/cmd/rad/cmd/appStatus.go b/cmd/rad/cmd/appStatus.go
deleted file mode 100644
index f53668d7a..000000000
--- a/cmd/rad/cmd/appStatus.go
+++ /dev/null
@@ -1,111 +0,0 @@
-// ------------------------------------------------------------
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-// ------------------------------------------------------------
-
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/project-radius/radius/pkg/cli"
-	"github.com/project-radius/radius/pkg/cli/clients"
-	"github.com/project-radius/radius/pkg/cli/connections"
-	"github.com/project-radius/radius/pkg/cli/objectformats"
-	"github.com/project-radius/radius/pkg/cli/output"
-	"github.com/project-radius/radius/pkg/cli/workspaces"
-	"github.com/project-radius/radius/pkg/ucp/resources"
-	"github.com/spf13/cobra"
-)
-
-// appStatusCmd command to show properties of an application
-var appStatusCmd = &cobra.Command{
-	Use:   "status",
-	Short: "Show Radius application status details",
-	Long:  "Show Radius application details, such as public endpoints and resource count.",
-	RunE:  showApplicationStatus,
-}
-
-func init() {
-	applicationCmd.AddCommand(appStatusCmd)
-}
-
-func showApplicationStatus(cmd *cobra.Command, args []string) error {
-	workspace, err := cli.RequireWorkspace(cmd, ConfigFromContext(cmd.Context()), DirectoryConfigFromContext(cmd.Context()))
-	if err != nil {
-		return err
-	}
-
-	// TODO: support fallback workspace
-	if !workspace.IsNamedWorkspace() {
-		return workspaces.ErrNamedWorkspaceRequired
-	}
-
-	application, err := cli.RequireApplicationArgs(cmd, args, *workspace)
-	if err != nil {
-		return err
-	}
-
-	applicationsClient, err := connections.DefaultFactory.CreateApplicationsManagementClient(cmd.Context(), *workspace)
-	if err != nil {
-		return err
-	}
-
-	resourceList, err := applicationsClient.ListAllResourcesByApplication(cmd.Context(), application)
-	if err != nil {
-		return err
-	}
-
-	applicationStatus := clients.ApplicationStatus{
-		Name:          application,
-		ResourceCount: len(resourceList),
-	}
-
-	diagnosticsClient, err := connections.DefaultFactory.CreateDiagnosticsClient(cmd.Context(), *workspace)
-	if err != nil {
-		return err
-	}
-
-	for _, resource := range resourceList {
-		resourceID, err := resources.ParseResource(*resource.ID)
-		if err != nil {
-			return err
-		}
-
-		publicEndpoint, err := diagnosticsClient.GetPublicEndpoint(cmd.Context(), clients.EndpointOptions{
-			ResourceID: resourceID,
-		})
-		if err != nil {
-			return err
-		}
-
-		if publicEndpoint != nil {
-			applicationStatus.Gateways = append(applicationStatus.Gateways, clients.GatewayStatus{
-				Name:     *resource.Name,
-				Endpoint: *publicEndpoint,
-			})
-		}
-	}
-
-	format, err := cli.RequireOutput(cmd)
-	if err != nil {
-		return err
-	}
-
-	err = output.Write(format, applicationStatus, cmd.OutOrStdout(), objectformats.GetApplicationStatusTableFormat())
-	if err != nil {
-		return err
-	}
-
-	if format == output.FormatTable && len(applicationStatus.Gateways) > 0 {
-		// Print newline for readability
-		fmt.Println()
-
-		err = output.Write(format, applicationStatus.Gateways, cmd.OutOrStdout(), objectformats.GetApplicationGatewaysTableFormat())
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
diff --git a/cmd/rad/cmd/application.go b/cmd/rad/cmd/application.go
index 33051dc5c..52b287287 100644
--- a/cmd/rad/cmd/application.go
+++ b/cmd/rad/cmd/application.go
@@ -11,8 +11,6 @@ import (
 
 func init() {
 	RootCmd.AddCommand(applicationCmd)
-	applicationCmd.PersistentFlags().StringP("application", "a", "", "The application name")
-	applicationCmd.PersistentFlags().StringP("workspace", "w", "", "The workspace name")
 }
 
 func NewAppCommand() *cobra.Command {
diff --git a/cmd/rad/cmd/root.go b/cmd/rad/cmd/root.go
index b99073052..afa63e58c 100644
--- a/cmd/rad/cmd/root.go
+++ b/cmd/rad/cmd/root.go
@@ -18,6 +18,10 @@ import (
 	"github.com/project-radius/radius/pkg/cli"
 	"github.com/project-radius/radius/pkg/cli/bicep"
 	app_switch "github.com/project-radius/radius/pkg/cli/cmd/app/appswitch"
+	app_delete "github.com/project-radius/radius/pkg/cli/cmd/app/delete"
+	app_list "github.com/project-radius/radius/pkg/cli/cmd/app/list"
+	app_show "github.com/project-radius/radius/pkg/cli/cmd/app/show"
+	app_status "github.com/project-radius/radius/pkg/cli/cmd/app/status"
 	credential "github.com/project-radius/radius/pkg/cli/cmd/credential"
 	cmd_deploy "github.com/project-radius/radius/pkg/cli/cmd/deploy"
 	env_create "github.com/project-radius/radius/pkg/cli/cmd/env/create"
@@ -229,6 +233,18 @@ func initSubCommands() {
 	workspaceSwitchCmd, _ := workspace_switch.NewCommand(framework)
 	workspaceCmd.AddCommand(workspaceSwitchCmd)
 
+	appDeleteCmd, _ := app_delete.NewCommand(framework)
+	applicationCmd.AddCommand(appDeleteCmd)
+
+	appListCmd, _ := app_list.NewCommand(framework)
+	applicationCmd.AddCommand(appListCmd)
+
+	appShowCmd, _ := app_show.NewCommand(framework)
+	applicationCmd.AddCommand(appShowCmd)
+
+	appStatusCmd, _ := app_status.NewCommand(framework)
+	applicationCmd.AddCommand(appStatusCmd)
+
 	appSwitchCmd, _ := app_switch.NewCommand(framework)
 	applicationCmd.AddCommand(appSwitchCmd)
 
diff --git a/go.mod b/go.mod
index 9ef4cac36..b807a59a0 100644
--- a/go.mod
+++ b/go.mod
@@ -11,6 +11,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions v1.0.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/servicebus/armservicebus/v2 v2.0.0-beta.1
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.2.0
+	github.com/Azure/go-autorest/autorest/to v0.4.0
 	github.com/Azure/secrets-store-csi-driver-provider-azure v1.3.0
 	github.com/aws/aws-sdk-go-v2 v1.17.0
 	github.com/aws/aws-sdk-go-v2/config v1.15.15
diff --git a/go.sum b/go.sum
index ae7d038a7..318929a99 100644
--- a/go.sum
+++ b/go.sum
@@ -59,6 +59,7 @@ github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935
 github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
 github.com/Azure/go-autorest/autorest/mocks v0.4.2 h1:PGN4EDXnuQbojHbU0UWoNvmu9AGVwYHG9/fkDYhtAfw=
 github.com/Azure/go-autorest/autorest/mocks v0.4.2/go.mod h1:Vy7OitM9Kei0i1Oj+LvyAWMXJHeKH1MVlzFugfVrmyU=
+github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
 github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
 github.com/Azure/go-autorest/autorest/validation v0.1.0/go.mod h1:Ha3z/SqBeaalWQvokg3NZAlQTalVMtOIAs1aGK7G6u8=
 github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
diff --git a/pkg/cli/clients/clients.go b/pkg/cli/clients/clients.go
index fe9f2b18d..f9db171b2 100644
--- a/pkg/cli/clients/clients.go
+++ b/pkg/cli/clients/clients.go
@@ -74,6 +74,8 @@ type DeploymentClient interface {
 	Deploy(ctx context.Context, options DeploymentOptions) (DeploymentResult, error)
 }
 
+//go:generate mockgen -destination=./mock_diagnosticsclient.go -package=clients -self_package github.com/project-radius/radius/pkg/cli/clients github.com/project-radius/radius/pkg/cli/clients DiagnosticsClient
+
 // DiagnosticsClient is used to interface with diagnostics features like logs and port-forwards.
 type DiagnosticsClient interface {
 	Expose(ctx context.Context, options ExposeOptions) (failed chan error, stop chan struct{}, signals chan os.Signal, err error)
diff --git a/pkg/cli/clients/mock_diagnosticsclient.go b/pkg/cli/clients/mock_diagnosticsclient.go
new file mode 100644
index 000000000..52a9cf12a
--- /dev/null
+++ b/pkg/cli/clients/mock_diagnosticsclient.go
@@ -0,0 +1,83 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/project-radius/radius/pkg/cli/clients (interfaces: DiagnosticsClient)
+
+// Package clients is a generated GoMock package.
+package clients
+
+import (
+	context "context"
+	os "os"
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockDiagnosticsClient is a mock of DiagnosticsClient interface.
+type MockDiagnosticsClient struct {
+	ctrl     *gomock.Controller
+	recorder *MockDiagnosticsClientMockRecorder
+}
+
+// MockDiagnosticsClientMockRecorder is the mock recorder for MockDiagnosticsClient.
+type MockDiagnosticsClientMockRecorder struct {
+	mock *MockDiagnosticsClient
+}
+
+// NewMockDiagnosticsClient creates a new mock instance.
+func NewMockDiagnosticsClient(ctrl *gomock.Controller) *MockDiagnosticsClient {
+	mock := &MockDiagnosticsClient{ctrl: ctrl}
+	mock.recorder = &MockDiagnosticsClientMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockDiagnosticsClient) EXPECT() *MockDiagnosticsClientMockRecorder {
+	return m.recorder
+}
+
+// Expose mocks base method.
+func (m *MockDiagnosticsClient) Expose(arg0 context.Context, arg1 ExposeOptions) (chan error, chan struct{}, chan os.Signal, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Expose", arg0, arg1)
+	ret0, _ := ret[0].(chan error)
+	ret1, _ := ret[1].(chan struct{})
+	ret2, _ := ret[2].(chan os.Signal)
+	ret3, _ := ret[3].(error)
+	return ret0, ret1, ret2, ret3
+}
+
+// Expose indicates an expected call of Expose.
+func (mr *MockDiagnosticsClientMockRecorder) Expose(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Expose", reflect.TypeOf((*MockDiagnosticsClient)(nil).Expose), arg0, arg1)
+}
+
+// GetPublicEndpoint mocks base method.
+func (m *MockDiagnosticsClient) GetPublicEndpoint(arg0 context.Context, arg1 EndpointOptions) (*string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPublicEndpoint", arg0, arg1)
+	ret0, _ := ret[0].(*string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetPublicEndpoint indicates an expected call of GetPublicEndpoint.
+func (mr *MockDiagnosticsClientMockRecorder) GetPublicEndpoint(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPublicEndpoint", reflect.TypeOf((*MockDiagnosticsClient)(nil).GetPublicEndpoint), arg0, arg1)
+}
+
+// Logs mocks base method.
+func (m *MockDiagnosticsClient) Logs(arg0 context.Context, arg1 LogsOptions) ([]LogStream, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Logs", arg0, arg1)
+	ret0, _ := ret[0].([]LogStream)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Logs indicates an expected call of Logs.
+func (mr *MockDiagnosticsClientMockRecorder) Logs(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Logs", reflect.TypeOf((*MockDiagnosticsClient)(nil).Logs), arg0, arg1)
+}
diff --git a/pkg/cli/cmd/README.md b/pkg/cli/cmd/README.md
index 380b2a54d..a0f45aaf1 100644
--- a/pkg/cli/cmd/README.md
+++ b/pkg/cli/cmd/README.md
@@ -75,7 +75,7 @@ func NewRunner(factory framework.Factory) *Runner {
 // Validate runs validation for the `rad <fill in the blank>` command.
 func (r *Runner) Validate(cmd *cobra.Command, args []string) error {
 	// Validate command line args and
-	workspace, err := cli.RequireWorkspace(cmd, r.ConfigHolder.Config)
+	workspace, err := cli.RequireWorkspace(cmd, r.ConfigHolder.Config, r.ConfigHolder.DirectoryConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cli/cmd/app/delete/delete.go b/pkg/cli/cmd/app/delete/delete.go
new file mode 100644
index 000000000..c9f8d4a47
--- /dev/null
+++ b/pkg/cli/cmd/app/delete/delete.go
@@ -0,0 +1,144 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package list
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/cmd/commonflags"
+	"github.com/project-radius/radius/pkg/cli/connections"
+	"github.com/project-radius/radius/pkg/cli/framework"
+	"github.com/project-radius/radius/pkg/cli/output"
+	"github.com/project-radius/radius/pkg/cli/prompt"
+	"github.com/project-radius/radius/pkg/cli/workspaces"
+	"github.com/spf13/cobra"
+)
+
+const (
+	deleteConfirmation = "Are you sure you want to delete application '%v' from '%v'?"
+)
+
+// NewCommand creates an instance of the `rad app delete` command and runner.
+func NewCommand(factory framework.Factory) (*cobra.Command, framework.Runner) {
+	runner := NewRunner(factory)
+
+	cmd := &cobra.Command{
+		Use:   "delete",
+		Short: "Delete RAD application",
+		Long:  "Delete the specified RAD application deployed in the default environment",
+		Example: `
+# Delete current application
+rad app delete
+
+# Delete current application and bypass confirmation prompt
+rad app delete --yes
+
+# Delete specified application
+rad app delete my-app
+
+# Delete specified application in a specified resource group
+rad app delete my-app --group my-group
+`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: framework.RunCommand(runner),
+	}
+
+	commonflags.AddWorkspaceFlag(cmd)
+	commonflags.AddResourceGroupFlag(cmd)
+	commonflags.AddApplicationNameFlag(cmd)
+	commonflags.AddConfirmationFlag(cmd)
+
+	return cmd, runner
+}
+
+// Runner is the Runner implementation for the `rad app delete` command.
+type Runner struct {
+	ConfigHolder      *framework.ConfigHolder
+	ConnectionFactory connections.Factory
+	InputPrompter     prompt.Interface
+	Output            output.Interface
+
+	ApplicationName string
+	Scope           string
+	Confirm         bool
+	Workspace       *workspaces.Workspace
+}
+
+// NewRunner creates an instance of the runner for the `rad app delete` command.
+func NewRunner(factory framework.Factory) *Runner {
+	return &Runner{
+		ConfigHolder:      factory.GetConfigHolder(),
+		ConnectionFactory: factory.GetConnectionFactory(),
+		InputPrompter:     factory.GetPrompter(),
+		Output:            factory.GetOutput(),
+	}
+}
+
+// Validate runs validation for the `rad app delete` command.
+func (r *Runner) Validate(cmd *cobra.Command, args []string) error {
+	workspace, err := cli.RequireWorkspace(cmd, r.ConfigHolder.Config, r.ConfigHolder.DirectoryConfig)
+	if err != nil {
+		return err
+	}
+	r.Workspace = workspace
+
+	// Allow '--group' to override scope
+	scope, err := cli.RequireScope(cmd, *r.Workspace)
+	if err != nil {
+		return err
+	}
+	r.Workspace.Scope = scope
+
+	r.ApplicationName, err = cli.RequireApplicationArgs(cmd, args, *workspace)
+	if err != nil {
+		return err
+	}
+
+	r.Confirm, err = cmd.Flags().GetBool("yes")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Run runs the `rad app delete` command.
+func (r *Runner) Run(ctx context.Context) error {
+	// Prompt user to confirm deletion
+	if !r.Confirm {
+		confirmed, err := prompt.YesOrNoPrompt(fmt.Sprintf(deleteConfirmation, r.ApplicationName, r.Workspace.Name), "no", r.InputPrompter)
+		if err != nil {
+			if errors.Is(err, &prompt.ErrExitConsole{}) {
+				return &cli.FriendlyError{Message: err.Error()}
+			}
+			return err
+		}
+		if !confirmed {
+			return nil
+		}
+	}
+
+	client, err := r.ConnectionFactory.CreateApplicationsManagementClient(ctx, *r.Workspace)
+	if err != nil {
+		return err
+	}
+
+	deleted, err := client.DeleteApplication(ctx, r.ApplicationName)
+	if err != nil {
+		return err
+	}
+
+	if deleted {
+		r.Output.LogInfo("Application deleted")
+	} else {
+		r.Output.LogInfo("Application '%s' does not exist or has already been deleted.", r.ApplicationName)
+	}
+
+	return nil
+}
diff --git a/pkg/cli/cmd/app/list/list.go b/pkg/cli/cmd/app/list/list.go
new file mode 100644
index 000000000..0c12bd1a7
--- /dev/null
+++ b/pkg/cli/cmd/app/list/list.go
@@ -0,0 +1,109 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package list
+
+import (
+	"context"
+
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/cmd/commonflags"
+	"github.com/project-radius/radius/pkg/cli/connections"
+	"github.com/project-radius/radius/pkg/cli/framework"
+	"github.com/project-radius/radius/pkg/cli/objectformats"
+	"github.com/project-radius/radius/pkg/cli/output"
+	"github.com/project-radius/radius/pkg/cli/workspaces"
+	"github.com/spf13/cobra"
+)
+
+// NewCommand creates an instance of the `rad app list` command and runner.
+func NewCommand(factory framework.Factory) (*cobra.Command, framework.Runner) {
+	runner := NewRunner(factory)
+
+	cmd := &cobra.Command{
+		Use:   "list",
+		Short: "List applications",
+		Long:  `Lists applications deployed in the resource group associated with the default environment`,
+		Args:  cobra.NoArgs,
+		Example: `
+# List applications
+rad app list
+
+# List applications in a specific resource group
+rad app list --group my-group
+`,
+		RunE: framework.RunCommand(runner),
+	}
+
+	commonflags.AddWorkspaceFlag(cmd)
+	commonflags.AddResourceGroupFlag(cmd)
+	commonflags.AddOutputFlag(cmd)
+
+	return cmd, runner
+}
+
+// Runner is the Runner implementation for the `rad app list` command.
+type Runner struct {
+	ConfigHolder      *framework.ConfigHolder
+	ConnectionFactory connections.Factory
+	Workspace         *workspaces.Workspace
+	Output            output.Interface
+
+	Format string
+}
+
+// NewRunner creates an instance of the runner for the `rad app list` command.
+func NewRunner(factory framework.Factory) *Runner {
+	return &Runner{
+		ConnectionFactory: factory.GetConnectionFactory(),
+		ConfigHolder:      factory.GetConfigHolder(),
+		Output:            factory.GetOutput(),
+	}
+}
+
+// Validate runs validation for the `rad app list` command.
+func (r *Runner) Validate(cmd *cobra.Command, args []string) error {
+	workspace, err := cli.RequireWorkspace(cmd, r.ConfigHolder.Config, r.ConfigHolder.DirectoryConfig)
+	if err != nil {
+		return err
+	}
+	r.Workspace = workspace
+
+	// Allow '--group' to override scope
+	scope, err := cli.RequireScope(cmd, *r.Workspace)
+	if err != nil {
+		return err
+	}
+	r.Workspace.Scope = scope
+
+	format, err := cli.RequireOutput(cmd)
+	if err != nil {
+		return err
+	}
+
+	r.Format = format
+
+	return nil
+}
+
+// Run runs the `rad app list` command.
+func (r *Runner) Run(ctx context.Context) error {
+	client, err := r.ConnectionFactory.CreateApplicationsManagementClient(ctx, *r.Workspace)
+	if err != nil {
+		return err
+	}
+
+	environments, err := client.ListApplications(ctx)
+	if err != nil {
+		return err
+	}
+
+	err = r.Output.WriteFormatted(r.Format, environments, objectformats.GetResourceTableFormat())
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/pkg/cli/cmd/app/show/show.go b/pkg/cli/cmd/app/show/show.go
new file mode 100644
index 000000000..fafdc5f40
--- /dev/null
+++ b/pkg/cli/cmd/app/show/show.go
@@ -0,0 +1,123 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package list
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/clients"
+	"github.com/project-radius/radius/pkg/cli/cmd/commonflags"
+	"github.com/project-radius/radius/pkg/cli/connections"
+	"github.com/project-radius/radius/pkg/cli/framework"
+	"github.com/project-radius/radius/pkg/cli/objectformats"
+	"github.com/project-radius/radius/pkg/cli/output"
+	"github.com/project-radius/radius/pkg/cli/workspaces"
+	"github.com/spf13/cobra"
+)
+
+// NewCommand creates an instance of the `rad app show` command and runner.
+func NewCommand(factory framework.Factory) (*cobra.Command, framework.Runner) {
+	runner := NewRunner(factory)
+
+	cmd := &cobra.Command{
+		Use:   "show",
+		Short: "Show application details",
+		Long:  `Show application details. Shows the user's default application (if configured) by default.`,
+		Args:  cobra.MaximumNArgs(1),
+		Example: `
+# Show current application
+rad app show
+
+# Show specified application
+rad app show my-app
+
+# Show specified application in a specified resource group
+rad app show my-app --group my-group
+`,
+		RunE: framework.RunCommand(runner),
+	}
+
+	commonflags.AddWorkspaceFlag(cmd)
+	commonflags.AddResourceGroupFlag(cmd)
+	commonflags.AddApplicationNameFlag(cmd)
+	commonflags.AddOutputFlag(cmd)
+
+	return cmd, runner
+}
+
+// Runner is the Runner implementation for the `rad app show` command.
+type Runner struct {
+	ConfigHolder      *framework.ConfigHolder
+	ConnectionFactory connections.Factory
+	Workspace         *workspaces.Workspace
+	Output            output.Interface
+
+	ApplicationName string
+	Format          string
+}
+
+// NewRunner creates an instance of the runner for the `rad app show` command.
+func NewRunner(factory framework.Factory) *Runner {
+	return &Runner{
+		ConnectionFactory: factory.GetConnectionFactory(),
+		ConfigHolder:      factory.GetConfigHolder(),
+		Output:            factory.GetOutput(),
+	}
+}
+
+// Validate runs validation for the `rad app show` command.
+func (r *Runner) Validate(cmd *cobra.Command, args []string) error {
+	workspace, err := cli.RequireWorkspace(cmd, r.ConfigHolder.Config, r.ConfigHolder.DirectoryConfig)
+	if err != nil {
+		return err
+	}
+	r.Workspace = workspace
+
+	// Allow '--group' to override scope
+	scope, err := cli.RequireScope(cmd, *r.Workspace)
+	if err != nil {
+		return err
+	}
+	r.Workspace.Scope = scope
+
+	r.ApplicationName, err = cli.RequireApplicationArgs(cmd, args, *workspace)
+	if err != nil {
+		return err
+	}
+
+	format, err := cli.RequireOutput(cmd)
+	if err != nil {
+		return err
+	}
+
+	r.Format = format
+
+	return nil
+}
+
+// Run runs the `rad app show` command.
+func (r *Runner) Run(ctx context.Context) error {
+	client, err := r.ConnectionFactory.CreateApplicationsManagementClient(ctx, *r.Workspace)
+	if err != nil {
+		return err
+	}
+
+	application, err := client.ShowApplication(ctx, r.ApplicationName)
+	if clients.Is404Error(err) {
+		return &cli.FriendlyError{Message: fmt.Sprintf("The application %q was not found or has been deleted.", r.ApplicationName)}
+	} else if err != nil {
+		return err
+	}
+
+	err = r.Output.WriteFormatted(r.Format, application, objectformats.GetResourceTableFormat())
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/pkg/cli/cmd/app/status/status.go b/pkg/cli/cmd/app/status/status.go
new file mode 100644
index 000000000..4504c6c1d
--- /dev/null
+++ b/pkg/cli/cmd/app/status/status.go
@@ -0,0 +1,170 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package status
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/clients"
+	"github.com/project-radius/radius/pkg/cli/cmd/commonflags"
+	"github.com/project-radius/radius/pkg/cli/connections"
+	"github.com/project-radius/radius/pkg/cli/framework"
+	"github.com/project-radius/radius/pkg/cli/objectformats"
+	"github.com/project-radius/radius/pkg/cli/output"
+	"github.com/project-radius/radius/pkg/cli/workspaces"
+	"github.com/project-radius/radius/pkg/ucp/resources"
+	"github.com/spf13/cobra"
+)
+
+// NewCommand creates an instance of the `rad app status` command and runner.
+func NewCommand(factory framework.Factory) (*cobra.Command, framework.Runner) {
+	runner := NewRunner(factory)
+
+	cmd := &cobra.Command{
+		Use:   "status",
+		Short: "Show application status",
+		Long:  `Show application status, such as public endpoints and resource count. Shows details for the user's default application (if configured) by default.`,
+		Args:  cobra.MaximumNArgs(1),
+		Example: `
+# Show status of current application
+rad app status
+
+# Show status of specified application
+rad app status my-app
+
+# Show status of specified application in a specified resource group
+rad app status my-app --group my-group
+`,
+		RunE: framework.RunCommand(runner),
+	}
+
+	commonflags.AddWorkspaceFlag(cmd)
+	commonflags.AddResourceGroupFlag(cmd)
+	commonflags.AddApplicationNameFlag(cmd)
+	commonflags.AddOutputFlag(cmd)
+
+	return cmd, runner
+}
+
+// Runner is the Runner implementation for the `rad app status` command.
+type Runner struct {
+	ConfigHolder      *framework.ConfigHolder
+	ConnectionFactory connections.Factory
+	Workspace         *workspaces.Workspace
+	Output            output.Interface
+
+	ApplicationName string
+	Format          string
+}
+
+// NewRunner creates an instance of the runner for the `rad app status` command.
+func NewRunner(factory framework.Factory) *Runner {
+	return &Runner{
+		ConnectionFactory: factory.GetConnectionFactory(),
+		ConfigHolder:      factory.GetConfigHolder(),
+		Output:            factory.GetOutput(),
+	}
+}
+
+// Validate runs validation for the `rad app status` command.
+func (r *Runner) Validate(cmd *cobra.Command, args []string) error {
+	workspace, err := cli.RequireWorkspace(cmd, r.ConfigHolder.Config, r.ConfigHolder.DirectoryConfig)
+	if err != nil {
+		return err
+	}
+	r.Workspace = workspace
+
+	// Allow '--group' to override scope
+	scope, err := cli.RequireScope(cmd, *r.Workspace)
+	if err != nil {
+		return err
+	}
+	r.Workspace.Scope = scope
+
+	r.ApplicationName, err = cli.RequireApplicationArgs(cmd, args, *workspace)
+	if err != nil {
+		return err
+	}
+
+	format, err := cli.RequireOutput(cmd)
+	if err != nil {
+		return err
+	}
+
+	r.Format = format
+
+	return nil
+}
+
+// Run runs the `rad app status` command.
+func (r *Runner) Run(ctx context.Context) error {
+	client, err := r.ConnectionFactory.CreateApplicationsManagementClient(ctx, *r.Workspace)
+	if err != nil {
+		return err
+	}
+
+	application, err := client.ShowApplication(ctx, r.ApplicationName)
+	if clients.Is404Error(err) {
+		return &cli.FriendlyError{Message: fmt.Sprintf("The application %q was not found or has been deleted.", r.ApplicationName)}
+	} else if err != nil {
+		return err
+	}
+
+	resourceList, err := client.ListAllResourcesByApplication(ctx, r.ApplicationName)
+	if err != nil {
+		return err
+	}
+
+	applicationStatus := clients.ApplicationStatus{
+		Name:          *application.Name,
+		ResourceCount: len(resourceList),
+	}
+
+	diagnosticsClient, err := r.ConnectionFactory.CreateDiagnosticsClient(ctx, *r.Workspace)
+	if err != nil {
+		return err
+	}
+
+	for _, resource := range resourceList {
+		resourceID, err := resources.ParseResource(*resource.ID)
+		if err != nil {
+			return err
+		}
+
+		publicEndpoint, err := diagnosticsClient.GetPublicEndpoint(ctx, clients.EndpointOptions{
+			ResourceID: resourceID,
+		})
+		if err != nil {
+			return err
+		}
+
+		if publicEndpoint != nil {
+			applicationStatus.Gateways = append(applicationStatus.Gateways, clients.GatewayStatus{
+				Name:     *resource.Name,
+				Endpoint: *publicEndpoint,
+			})
+		}
+	}
+
+	err = r.Output.WriteFormatted(r.Format, applicationStatus, objectformats.GetApplicationStatusTableFormat())
+	if err != nil {
+		return err
+	}
+
+	if r.Format == output.FormatTable && len(applicationStatus.Gateways) > 0 {
+		// Print newline for readability
+		r.Output.LogInfo("")
+
+		err = r.Output.WriteFormatted(r.Format, applicationStatus.Gateways, objectformats.GetApplicationGatewaysTableFormat())
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/pkg/cli/cmd/credential/register/aws/aws.go b/pkg/cli/cmd/credential/register/aws/aws.go
index 505124e80..e2ff0bb54 100644
--- a/pkg/cli/cmd/credential/register/aws/aws.go
+++ b/pkg/cli/cmd/credential/register/aws/aws.go
@@ -131,19 +131,19 @@ func (r *Runner) Run(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	credential := ucp.CredentialResource{
+	credential := ucp.AWSCredentialResource{
 		Location: to.Ptr(v1.LocationGlobal),
 		Type:     to.Ptr(cli_credential.AWSCredential),
-		Properties: &ucp.AWSCredentialProperties{
+		Properties: &ucp.AWSAccessKeyCredentialProperties{
 			Storage: &ucp.CredentialStorageProperties{
-				Kind: to.Ptr(ucp.CredentialStorageKindInternal),
+				Kind: to.Ptr(string(ucp.CredentialStorageKindInternal)),
 			},
 			AccessKeyID:     &r.AccessKeyID,
 			SecretAccessKey: &r.SecretAccessKey,
 		},
 	}
 
-	err = client.Put(ctx, credential)
+	err = client.PutAWS(ctx, credential)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cli/cmd/credential/register/azure/azure.go b/pkg/cli/cmd/credential/register/azure/azure.go
index 95a69ec8c..3df827b67 100644
--- a/pkg/cli/cmd/credential/register/azure/azure.go
+++ b/pkg/cli/cmd/credential/register/azure/azure.go
@@ -148,23 +148,23 @@ func (r *Runner) Run(ctx context.Context) error {
 		return err
 	}
 
-	credential := ucp.CredentialResource{
-		Name:     to.Ptr("default"),
+	credential := ucp.AzureCredentialResource{
 		Location: to.Ptr(v1.LocationGlobal),
 		Type:     to.Ptr(cli_credential.AzureCredential),
 		ID:       to.Ptr(fmt.Sprintf(common.AzureCredentialID, "default")),
 		Properties: &ucp.AzureServicePrincipalProperties{
 			Storage: &ucp.CredentialStorageProperties{
-				Kind: to.Ptr(ucp.CredentialStorageKindInternal),
+				Kind: to.Ptr(string(ucp.CredentialStorageKindInternal)),
 			},
 			TenantID:     &r.TenantID,
 			ClientID:     &r.ClientID,
 			ClientSecret: &r.ClientSecret,
+			Kind:         to.Ptr("ServicePrincipal"),
 		},
 	}
 
 	// 1) Update server-side to add/change credentials
-	err = client.Put(ctx, credential)
+	err = client.PutAzure(ctx, credential)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cli/cmd/radinit/init.go b/pkg/cli/cmd/radinit/init.go
index c67d95056..cf8e4f815 100644
--- a/pkg/cli/cmd/radinit/init.go
+++ b/pkg/cli/cmd/radinit/init.go
@@ -434,7 +434,7 @@ func (r *Runner) Run(ctx context.Context) error {
 		if r.AzureCloudProvider != nil {
 			r.Output.LogInfo("Registering azure credentials")
 			credential := r.getAzureCredential()
-			err := credentialClient.Put(ctx, credential)
+			err := credentialClient.PutAzure(ctx, credential)
 			if err != nil {
 				return &cli.FriendlyError{Message: fmt.Sprintf("Failed to configure azure credential with error %s", err)}
 			}
@@ -442,7 +442,7 @@ func (r *Runner) Run(ctx context.Context) error {
 		if r.AwsCloudProvider != nil {
 			r.Output.LogInfo("Registering aws credentials")
 			credential := r.getAWSCredential()
-			err := credentialClient.Put(ctx, credential)
+			err := credentialClient.PutAWS(ctx, credential)
 			if err != nil {
 				return &cli.FriendlyError{Message: fmt.Sprintf("Failed to configure aws credential with error %s", err)}
 			}
@@ -487,13 +487,13 @@ func (r *Runner) Run(ctx context.Context) error {
 	return nil
 }
 
-func (r *Runner) getAzureCredential() ucp.CredentialResource {
-	return ucp.CredentialResource{
+func (r *Runner) getAzureCredential() ucp.AzureCredentialResource {
+	return ucp.AzureCredentialResource{
 		Location: to.Ptr(v1.LocationGlobal),
 		Type:     to.Ptr(cli_credential.AzureCredential),
 		Properties: &ucp.AzureServicePrincipalProperties{
 			Storage: &ucp.CredentialStorageProperties{
-				Kind: to.Ptr(ucp.CredentialStorageKindInternal),
+				Kind: to.Ptr(string(ucp.CredentialStorageKindInternal)),
 			},
 			TenantID:     &r.AzureCloudProvider.ServicePrincipal.TenantID,
 			ClientID:     &r.AzureCloudProvider.ServicePrincipal.ClientID,
@@ -502,13 +502,13 @@ func (r *Runner) getAzureCredential() ucp.CredentialResource {
 	}
 }
 
-func (r *Runner) getAWSCredential() ucp.CredentialResource {
-	return ucp.CredentialResource{
+func (r *Runner) getAWSCredential() ucp.AWSCredentialResource {
+	return ucp.AWSCredentialResource{
 		Location: to.Ptr(v1.LocationGlobal),
 		Type:     to.Ptr(cli_credential.AWSCredential),
-		Properties: &ucp.AWSCredentialProperties{
+		Properties: &ucp.AWSAccessKeyCredentialProperties{
 			Storage: &ucp.CredentialStorageProperties{
-				Kind: to.Ptr(ucp.CredentialStorageKindInternal),
+				Kind: to.Ptr(string(ucp.CredentialStorageKindInternal)),
 			},
 			AccessKeyID:     &r.AwsCloudProvider.AccessKeyId,
 			SecretAccessKey: &r.AwsCloudProvider.SecretAccessKey,
diff --git a/pkg/cli/connections/factory.go b/pkg/cli/connections/factory.go
index 256d99535..13f895e1f 100644
--- a/pkg/cli/connections/factory.go
+++ b/pkg/cli/connections/factory.go
@@ -194,15 +194,23 @@ func (*impl) CreateCredentialManagementClient(ctx context.Context, workspace wor
 		return nil, err
 	}
 
-	awsCredentialClient, err := v20220901privatepreview.NewAWSCredentialClient(&aztoken.AnonymousCredential{}, clientOptions)
+	awsCredentialClient, err := v20220901privatepreview.NewAwsCredentialClient(&aztoken.AnonymousCredential{}, clientOptions)
 	if err != nil {
 		return nil, err
 	}
 
-	return &cli_credential.UCPCredentialManagementClient{
-		CredentialInterface: &cli_credential.Impl{
-			AzureCredentialClient: *azureCredentialClient,
-			AWSCredentialClient:   *awsCredentialClient,
-		},
-	}, nil
+	azureCMClient := &cli_credential.AzureCredentialManagementClient{
+		AzureCredentialClient: *azureCredentialClient,
+	}
+
+	awsCMClient := &cli_credential.AWSCredentialManagementClient{
+		AWSCredentialClient: *awsCredentialClient,
+	}
+
+	cpClient := &cli_credential.UCPCredentialManagementClient{
+		AzClient:  azureCMClient,
+		AWSClient: awsCMClient,
+	}
+
+	return cpClient, nil
 }
diff --git a/pkg/cli/connections/mock_factory.go b/pkg/cli/connections/mock_factory.go
index ae33f0fa0..c1d39ced5 100644
--- a/pkg/cli/connections/mock_factory.go
+++ b/pkg/cli/connections/mock_factory.go
@@ -18,6 +18,7 @@ var _ Factory = (*MockFactory)(nil)
 type MockFactory struct {
 	ApplicationsManagementClient clients.ApplicationsManagementClient
 	CredentialManagementClient   cli_credential.CredentialManagementClient
+	DiagnosticsClient            clients.DiagnosticsClient
 	// TODO support other client types when needed.
 }
 
@@ -26,7 +27,7 @@ func (f *MockFactory) CreateDeploymentClient(ctx context.Context, workspace work
 }
 
 func (f *MockFactory) CreateDiagnosticsClient(ctx context.Context, workspace workspaces.Workspace) (clients.DiagnosticsClient, error) {
-	return nil, nil
+	return f.DiagnosticsClient, nil
 }
 
 func (f *MockFactory) CreateApplicationsManagementClient(ctx context.Context, workspace workspaces.Workspace) (clients.ApplicationsManagementClient, error) {
diff --git a/pkg/cli/credential/aws_credential_management.go b/pkg/cli/credential/aws_credential_management.go
new file mode 100644
index 000000000..d72088759
--- /dev/null
+++ b/pkg/cli/credential/aws_credential_management.go
@@ -0,0 +1,129 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package credential
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/clients"
+	ucp "github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
+)
+
+//go:generate mockgen -destination=./mock_aws_credential_management.go -package=credential -self_package github.com/project-radius/radius/pkg/cli/credential github.com/project-radius/radius/pkg/cli/credential AWSCredentialManagementClientInterface
+
+// AWSCredentialManagementClient is used to interface with cloud provider configuration and credentials.
+type AWSCredentialManagementClient struct {
+	AWSCredentialClient ucp.AwsCredentialClient
+}
+
+const (
+	AWSCredential        = "aws"
+	AWSPlaneName         = "aws"
+	awsCredentialKind    = "AccessKey"
+	ValidInfoTemplate    = "enter valid info for %s"
+	infoRequiredTemplate = "required info %s"
+)
+
+// AWSCredentialManagementClient is used to interface with cloud provider configuration and credentials.
+type AWSCredentialManagementClientInterface interface {
+	// Get gets the credential registered with the given ucp provider plane.
+	Get(ctx context.Context, name string) (ProviderCredentialConfiguration, error)
+	// List lists the credentials registered with all ucp provider planes.
+	List(ctx context.Context) ([]CloudProviderStatus, error)
+	// Put registers an AWS credential with the respective ucp provider plane.
+	Put(ctx context.Context, credential_config ucp.AWSCredentialResource) error
+	// Delete unregisters credential from the given ucp provider plane.
+	Delete(ctx context.Context, name string) (bool, error)
+}
+
+// Put registers credentials with the provided credential config
+func (cpm *AWSCredentialManagementClient) Put(ctx context.Context, credential ucp.AWSCredentialResource) error {
+	if strings.EqualFold(*credential.Type, AWSCredential) {
+		_, err := cpm.AWSCredentialClient.CreateOrUpdate(ctx, AWSPlaneName, defaultSecretName, credential, nil)
+		return err
+	}
+	return &ErrUnsupportedCloudProvider{}
+}
+
+// Get, gets the credential from the provided ucp provider plane
+func (cpm *AWSCredentialManagementClient) Get(ctx context.Context, name string) (ProviderCredentialConfiguration, error) {
+	var err error
+	providerCredentialConfiguration := ProviderCredentialConfiguration{
+		CloudProviderStatus: CloudProviderStatus{
+			Name:    name,
+			Enabled: true,
+		},
+	}
+
+	if strings.EqualFold(name, AWSCredential) {
+		// We send only the name when getting credentials from backend which we already have access to
+		resp, err := cpm.AWSCredentialClient.Get(ctx, AWSPlaneName, name, nil)
+		if err != nil {
+			return ProviderCredentialConfiguration{}, err
+		}
+		awsAccessKeyCredentials, ok := resp.AWSCredentialResource.Properties.(*ucp.AWSCredentialProperties)
+		if !ok {
+			return ProviderCredentialConfiguration{}, &cli.FriendlyError{Message: fmt.Sprintf("Unable to Find Credentials for %s", name)}
+		}
+		providerCredentialConfiguration.AWSCredentials = awsAccessKeyCredentials
+	} else {
+		return ProviderCredentialConfiguration{}, &ErrUnsupportedCloudProvider{}
+	}
+
+	// We get 404 when credential for the provider plane is not registered.
+	if clients.Is404Error(err) {
+		return ProviderCredentialConfiguration{
+			CloudProviderStatus: CloudProviderStatus{
+				Name:    name,
+				Enabled: false,
+			},
+		}, nil
+	} else if err != nil {
+		return ProviderCredentialConfiguration{}, err
+	}
+	return providerCredentialConfiguration, nil
+}
+
+// List, lists the AWS credentials registered
+func (cpm *AWSCredentialManagementClient) List(ctx context.Context) ([]CloudProviderStatus, error) {
+	// list AWS credential
+	var providerList []*ucp.AWSCredentialResource
+
+	pager := cpm.AWSCredentialClient.NewListByRootScopePager(AWSPlaneName, nil)
+	for pager.More() {
+		nextPage, err := pager.NextPage(ctx)
+		if err != nil {
+			return nil, err
+		}
+		credList := nextPage.AWSCredentialResourceListResult.Value
+		providerList = append(providerList, credList...)
+	}
+
+	res := make([]CloudProviderStatus, 0)
+	for _, provider := range providerList {
+		res = append(res, CloudProviderStatus{
+			Name:    *provider.Name,
+			Enabled: true,
+		})
+	}
+	return res, nil
+}
+
+// Delete, deletes the credentials from the given ucp provider plane
+func (cpm *AWSCredentialManagementClient) Delete(ctx context.Context, name string) (bool, error) {
+	_, err := cpm.AWSCredentialClient.Delete(ctx, AWSPlaneName, name, nil)
+	// We get 404 when credential for the provider plane is not registered.
+	if clients.Is404Error(err) {
+		// return true if not found.
+		return true, nil
+	} else if err != nil {
+		return false, err
+	}
+	return true, nil
+}
diff --git a/pkg/cli/credential/azure_credential_management.go b/pkg/cli/credential/azure_credential_management.go
new file mode 100644
index 000000000..15bdf8fb1
--- /dev/null
+++ b/pkg/cli/credential/azure_credential_management.go
@@ -0,0 +1,151 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package credential
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/clients"
+	ucp "github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
+)
+
+//go:generate mockgen -destination=./mock_azure_credential_management.go -package=credential -self_package github.com/project-radius/radius/pkg/cli/credential github.com/project-radius/radius/pkg/cli/credential AzureCredentialManagementClientInterface
+
+// AzureCredentialManagementClient is used to interface with cloud provider configuration and credentials.
+type AzureCredentialManagementClient struct {
+	AzureCredentialClient ucp.AzureCredentialClient
+}
+
+// AzureCredentialManagementClient is used to interface with cloud provider configuration and credentials.
+type AzureCredentialManagementClientInterface interface {
+	// Get gets the credential registered with the given ucp provider plane.
+	Get(ctx context.Context, name string) (ProviderCredentialConfiguration, error)
+	// List lists the credentials registered with all ucp provider planes.
+	List(ctx context.Context) ([]CloudProviderStatus, error)
+	// Put registers an AWS credential with the respective ucp provider plane.
+	Put(ctx context.Context, credential_config ucp.AzureCredentialResource) error
+	// Delete unregisters credential from the given ucp provider plane.
+	Delete(ctx context.Context, name string) (bool, error)
+}
+
+const (
+	AzureCredential     = "azure"
+	AzurePlaneName      = "azurecloud"
+	azureCredentialKind = "ServicePrincipal"
+)
+
+// CloudProviderStatus is the representation of a cloud provider configuration.
+type CloudProviderStatus struct {
+
+	// Name is the name/kind of the provider. For right now this only supports Azure.
+	Name string
+
+	// Enabled is the enabled/disabled status of the provider.
+	Enabled bool
+}
+
+type ProviderCredentialConfiguration struct {
+	CloudProviderStatus
+
+	// AzureCredentials is used to set the credentials on Puts. It is NOT returned on Get/List.
+	AzureCredentials *ucp.AzureCredentialProperties
+
+	// AWSCredentials is used to set the credentials on Puts. It is NOT returned on Get/List.
+	AWSCredentials *ucp.AWSCredentialProperties
+}
+
+// ErrUnsupportedCloudProvider represents error when the cloud provider is not supported by radius.
+type ErrUnsupportedCloudProvider struct {
+	Message string
+}
+
+func (fe *ErrUnsupportedCloudProvider) Error() string {
+	return "unsupported cloud provider"
+}
+
+func (fe *ErrUnsupportedCloudProvider) Is(target error) bool {
+	_, ok := target.(*ErrUnsupportedCloudProvider)
+	return ok
+}
+
+// Put registers credentials with the provided credential config
+func (cpm *AzureCredentialManagementClient) Put(ctx context.Context, credential ucp.AzureCredentialResource) error {
+	if strings.EqualFold(*credential.Type, AzureCredential) {
+		_, err := cpm.AzureCredentialClient.CreateOrUpdate(ctx, AzurePlaneName, defaultSecretName, credential, nil)
+		return err
+	}
+
+	return &ErrUnsupportedCloudProvider{}
+}
+
+// Get, gets the credential from the provided ucp provider plane
+func (cpm *AzureCredentialManagementClient) Get(ctx context.Context, credentialName string) (ProviderCredentialConfiguration, error) {
+	var err error
+
+	resp, err := cpm.AzureCredentialClient.Get(ctx, AzurePlaneName, credentialName, nil)
+	if err != nil {
+		return ProviderCredentialConfiguration{}, err
+	}
+
+	azureServicePrincipal, ok := resp.AzureCredentialResource.Properties.(*ucp.AzureCredentialProperties)
+	if !ok {
+		return ProviderCredentialConfiguration{}, &cli.FriendlyError{Message: fmt.Sprintf("Unable to Find Credentials for %s", credentialName)}
+	}
+
+	providerCredentialConfiguration := ProviderCredentialConfiguration{
+		CloudProviderStatus: CloudProviderStatus{
+			Name:    AzureCredential,
+			Enabled: true,
+		},
+		AzureCredentials: azureServicePrincipal,
+	}
+
+	return providerCredentialConfiguration, nil
+}
+
+// List, lists the credentials registered with all ucp provider planes
+func (cpm *AzureCredentialManagementClient) List(ctx context.Context) ([]CloudProviderStatus, error) {
+	// list azure credential
+	var providerList []*ucp.AzureCredentialResource
+
+	pager := cpm.AzureCredentialClient.NewListByRootScopePager(AzurePlaneName, nil)
+	for pager.More() {
+		nextPage, err := pager.NextPage(ctx)
+		if err != nil {
+			return nil, err
+		}
+		credList := nextPage.AzureCredentialResourceListResult.Value
+		providerList = append(providerList, credList...)
+	}
+
+	res := make([]CloudProviderStatus, 0)
+	for _, provider := range providerList {
+		res = append(res, CloudProviderStatus{
+			Name:    *provider.Name,
+			Enabled: true,
+		})
+	}
+
+	return res, nil
+}
+
+// Delete, deletes the credentials from the given ucp provider plane
+func (cpm *AzureCredentialManagementClient) Delete(ctx context.Context, name string) (bool, error) {
+	_, err := cpm.AzureCredentialClient.Delete(ctx, AzurePlaneName, name, nil)
+
+	// We get 404 when credential for the provider plane is not registered.
+	if clients.Is404Error(err) {
+		// return true if not found.
+		return true, nil
+	} else if err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
diff --git a/pkg/cli/credential/client.go b/pkg/cli/credential/client.go
deleted file mode 100644
index 523cdb436..000000000
--- a/pkg/cli/credential/client.go
+++ /dev/null
@@ -1,171 +0,0 @@
-// ------------------------------------------------------------
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-// ------------------------------------------------------------
-
-package credential
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/project-radius/radius/pkg/cli"
-	ucp "github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
-)
-
-const (
-	AzurePlaneType = "azure"
-	AWSPlaneType   = "aws"
-)
-
-// CloudProviderStatus is the representation of a cloud provider configuration.
-type CloudProviderStatus struct {
-
-	// Name is the name/kind of the provider. For right now this only supports Azure.
-	Name string
-
-	// Enabled is the enabled/disabled status of the provider.
-	Enabled bool
-}
-
-type ProviderCredentialConfiguration struct {
-	CloudProviderStatus
-
-	// AzureCredentials is used to set the credentials on Puts. It is NOT returned on Get/List.
-	AzureCredentials *ucp.AzureServicePrincipalProperties
-
-	// AWSCredentials is used to set the credentials on Puts. It is NOT returned on Get/List.
-	AWSCredentials *ucp.AWSCredentialProperties
-}
-
-//go:generate mockgen -destination=./mock_client.go -package=credential -self_package github.com/project-radius/radius/pkg/cli/credential github.com/project-radius/radius/pkg/cli/credential Interface
-type Interface interface {
-	// CreateCredential creates ucp crendential for the supported providers.
-	CreateCredential(ctx context.Context, planeType string, planeName string, name string, credential ucp.CredentialResource) error
-	// GetCredential gets ucp credentials for the given name if provider is supported.
-	GetCredential(ctx context.Context, planeType string, planeName string, name string) (ProviderCredentialConfiguration, error)
-	// ListCredential lists ucp credentials configured at the plane scope.
-	ListCredential(ctx context.Context, planeType string, planeName string) ([]CloudProviderStatus, error)
-	// DeleteCredential deletes ucp credential of the given name if present.
-	DeleteCredential(ctx context.Context, planeType string, planeName string, name string) error
-}
-
-var _ Interface = (*Impl)(nil)
-
-type Impl struct {
-	AzureCredentialClient ucp.AzureCredentialClient
-	AWSCredentialClient   ucp.AWSCredentialClient
-}
-
-// CreateCredential creates ucp crendential for the supported providers.
-func (impl *Impl) CreateCredential(ctx context.Context, planeType string, planeName string, name string, credential ucp.CredentialResource) error {
-	switch planeType {
-	case AzurePlaneType:
-		// We care about success or failure of creation
-		_, err := impl.AzureCredentialClient.CreateOrUpdate(ctx, planeType, planeName, name, credential, nil)
-		return err
-	case AWSPlaneType:
-		// We care about success or failure of creation
-		_, err := impl.AWSCredentialClient.CreateOrUpdate(ctx, planeType, planeName, name, credential, nil)
-		return err
-	default:
-		return &ErrUnsupportedCloudProvider{}
-	}
-}
-
-// GetCredential gets ucp credentials for the given name if provider is supported.
-func (impl *Impl) GetCredential(ctx context.Context, planeType string, planeName string, name string) (ProviderCredentialConfiguration, error) {
-	providerCredentialConfiguration := ProviderCredentialConfiguration{
-		CloudProviderStatus: CloudProviderStatus{
-			Name:    name,
-			Enabled: true,
-		},
-	}
-	switch planeType {
-	case AzurePlaneType:
-		// We send only the name when getting credentials from backend which we already have access to
-		resp, err := impl.AzureCredentialClient.Get(ctx, planeType, planeName, name, nil)
-		if err != nil {
-			return ProviderCredentialConfiguration{}, err
-		}
-		azureSPN, ok := resp.CredentialResource.Properties.(*ucp.AzureServicePrincipalProperties)
-		if !ok {
-			return ProviderCredentialConfiguration{}, &cli.FriendlyError{Message: fmt.Sprintf("Unable to Find Credentials for %s", name)}
-		}
-		providerCredentialConfiguration.AzureCredentials = azureSPN
-		return providerCredentialConfiguration, nil
-	case AWSPlaneType:
-		// We send only the name when getting credentials from backend which we already have access to
-		resp, err := impl.AWSCredentialClient.Get(ctx, planeType, planeName, name, nil)
-		if err != nil {
-			return ProviderCredentialConfiguration{}, err
-		}
-		awsIAM, ok := resp.CredentialResource.Properties.(*ucp.AWSCredentialProperties)
-		if !ok {
-			return ProviderCredentialConfiguration{}, &cli.FriendlyError{Message: fmt.Sprintf("Unable to Find Credentials for %s", name)}
-		}
-		providerCredentialConfiguration.AWSCredentials = awsIAM
-		return providerCredentialConfiguration, err
-	default:
-		return ProviderCredentialConfiguration{}, &ErrUnsupportedCloudProvider{}
-	}
-}
-
-// ListCredential lists ucp credentials configured at the plane scope.
-func (impl *Impl) ListCredential(ctx context.Context, planeType string, planeName string) ([]CloudProviderStatus, error) {
-	var providerList []*ucp.CredentialResource
-	switch planeType {
-	case AzurePlaneType:
-		resp, err := impl.AzureCredentialClient.List(ctx, planeType, planeName, nil)
-		if err != nil {
-			return nil, err
-		}
-		providerList = resp.CredentialResourceList.Value
-	case AWSPlaneType:
-		resp, err := impl.AWSCredentialClient.List(ctx, planeType, planeName, nil)
-		if err != nil {
-			return nil, err
-		}
-		providerList = resp.CredentialResourceList.Value
-	default:
-		return nil, &ErrUnsupportedCloudProvider{}
-	}
-	res := make([]CloudProviderStatus, 0)
-	for _, provider := range providerList {
-		res = append(res, CloudProviderStatus{
-			Name:    *provider.Name,
-			Enabled: true,
-		})
-	}
-	return res, nil
-}
-
-// DeleteCredential deletes ucp credential of the given name if present.
-func (impl *Impl) DeleteCredential(ctx context.Context, planeType string, planeName string, name string) error {
-	switch planeType {
-	case AzurePlaneType:
-		// We care about success or failure of delete.
-		_, err := impl.AzureCredentialClient.Delete(ctx, planeType, planeName, name, nil)
-		return err
-	case AWSPlaneType:
-		// We care about success or failure of delete.
-		_, err := impl.AWSCredentialClient.Delete(ctx, planeType, planeName, name, nil)
-		return err
-	default:
-		return &ErrUnsupportedCloudProvider{}
-	}
-}
-
-// ErrUnsupportedCloudProvider represents error when the cloud provider is not supported by radius.
-type ErrUnsupportedCloudProvider struct {
-	Message string
-}
-
-func (fe *ErrUnsupportedCloudProvider) Error() string {
-	return "unsupported cloud provider"
-}
-
-func (fe *ErrUnsupportedCloudProvider) Is(target error) bool {
-	_, ok := target.(*ErrUnsupportedCloudProvider)
-	return ok
-}
diff --git a/pkg/cli/credential/credential_management.go b/pkg/cli/credential/credential_management.go
index ab095f6c6..d1b0ac7d0 100644
--- a/pkg/cli/credential/credential_management.go
+++ b/pkg/cli/credential/credential_management.go
@@ -13,6 +13,11 @@ import (
 	ucp "github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
 )
 
+const (
+	AzurePlaneType = "azure"
+	AWSPlaneType   = "aws"
+)
+
 //go:generate mockgen -destination=./mock_credentialmanagementclient.go -package=credential -self_package github.com/project-radius/radius/pkg/cli/credential github.com/project-radius/radius/pkg/cli/credential CredentialManagementClient
 
 // CredentialManagementClient is used to interface with cloud provider configuration and credentials.
@@ -21,41 +26,36 @@ type CredentialManagementClient interface {
 	Get(ctx context.Context, providerName string) (ProviderCredentialConfiguration, error)
 	// List lists the credentials registered with all ucp provider planes.
 	List(ctx context.Context) ([]CloudProviderStatus, error)
-	// Put registers a credential with the respective ucp provider plane.
-	Put(ctx context.Context, credential_config ucp.CredentialResource) error
+	// PutAWS registers an AWS credential with the respective ucp provider plane.
+	PutAWS(ctx context.Context, credential_config ucp.AWSCredentialResource) error
+	// PutAzure registers an Azure credential with the respective ucp provider plane.
+	PutAzure(ctx context.Context, credential_config ucp.AzureCredentialResource) error
 	// Delete unregisters credential from the given ucp provider plane.
 	Delete(ctx context.Context, providerName string) (bool, error)
 }
 
 const (
-	AzureCredential      = "azure"
-	AWSCredential        = "aws"
-	AzurePlaneName       = "azurecloud"
-	AWSPlaneName         = "aws"
-	azureCredentialKind  = "azure.com.serviceprincipal"
-	awsCredentialKind    = "aws.com.iam"
-	ValidInfoTemplate    = "enter valid info for %s"
-	infoRequiredTemplate = "required info %s"
 	defaultSecretName = "default"
 )
 
 // UCPCredentialManagementClient implements operations to manage credentials on ucp.
 type UCPCredentialManagementClient struct {
-	CredentialInterface Interface
+	AzClient  AzureCredentialManagementClientInterface
+	AWSClient AWSCredentialManagementClientInterface
 }
 
 var _ CredentialManagementClient = (*UCPCredentialManagementClient)(nil)
 
-// Put registers credentials with the provided credential config
-func (cpm *UCPCredentialManagementClient) Put(ctx context.Context, credential ucp.CredentialResource) error {
-	if strings.EqualFold(*credential.Type, AzureCredential) {
-		err := cpm.CredentialInterface.CreateCredential(ctx, AzurePlaneType, AzurePlaneName, defaultSecretName, credential)
-		return err
-	} else if strings.EqualFold(*credential.Type, AWSCredential) {
-		err := cpm.CredentialInterface.CreateCredential(ctx, AWSPlaneType, AWSPlaneName, defaultSecretName, credential)
-		return err
-	}
-	return &ErrUnsupportedCloudProvider{}
+// PutAWS registers credentials with the provided credential config
+func (cpm *UCPCredentialManagementClient) PutAWS(ctx context.Context, credential ucp.AWSCredentialResource) error {
+	err := cpm.AWSClient.Put(ctx, credential)
+	return err
+}
+
+// PutAzure registers credentials with the provided credential config
+func (cpm *UCPCredentialManagementClient) PutAzure(ctx context.Context, credential ucp.AzureCredentialResource) error {
+	err := cpm.AzClient.Put(ctx, credential)
+	return err
 }
 
 // Get, gets the credential from the provided ucp provider plane
@@ -67,13 +67,14 @@ func (cpm *UCPCredentialManagementClient) Get(ctx context.Context, providerName
 	var cred ProviderCredentialConfiguration
 	if strings.EqualFold(providerName, AzureCredential) {
 		// We send only the name when getting credentials from backend which we already have access to
-		cred, err = cpm.CredentialInterface.GetCredential(ctx, AzurePlaneType, AzurePlaneName, defaultSecretName)
+		cred, err = cpm.AzClient.Get(ctx, defaultSecretName)
 	} else if strings.EqualFold(providerName, AWSCredential) {
 		// We send only the name when getting credentials from backend which we already have access to
-		cred, err = cpm.CredentialInterface.GetCredential(ctx, AWSPlaneType, AWSPlaneName, defaultSecretName)
+		cred, err = cpm.AWSClient.Get(ctx, defaultSecretName)
 	} else {
 		return ProviderCredentialConfiguration{}, &ErrUnsupportedCloudProvider{}
 	}
+
 	// We get 404 when credential for the provider plane is not registered.
 	if clients.Is404Error(err) {
 		return ProviderCredentialConfiguration{
@@ -85,19 +86,20 @@ func (cpm *UCPCredentialManagementClient) Get(ctx context.Context, providerName
 	} else if err != nil {
 		return ProviderCredentialConfiguration{}, err
 	}
+
 	return cred, nil
 }
 
 // List, lists the credentials registered with all ucp provider planes
 func (cpm *UCPCredentialManagementClient) List(ctx context.Context) ([]CloudProviderStatus, error) {
 	// list azure credential
-	res, err := cpm.CredentialInterface.ListCredential(ctx, AzurePlaneType, AzurePlaneName)
+	res, err := cpm.AzClient.List(ctx)
 	if err != nil {
 		return nil, err
 	}
 
 	// list aws credential
-	awsList, err := cpm.CredentialInterface.ListCredential(ctx, AWSPlaneType, AWSPlaneName)
+	awsList, err := cpm.AWSClient.List(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -110,18 +112,11 @@ func (cpm *UCPCredentialManagementClient) List(ctx context.Context) ([]CloudProv
 // example: If we ask to delete azure credential, then we will delete the credential with the name "default" because that is the only
 // credential for azure expected in the system.
 func (cpm *UCPCredentialManagementClient) Delete(ctx context.Context, providerName string) (bool, error) {
-	var err error
 	if strings.EqualFold(providerName, AzureCredential) {
-		err = cpm.CredentialInterface.DeleteCredential(ctx, AzurePlaneType, AzurePlaneName, defaultSecretName)
+		return cpm.AzClient.Delete(ctx, defaultSecretName)
 	} else if strings.EqualFold(providerName, AWSCredential) {
-		err = cpm.CredentialInterface.DeleteCredential(ctx, AWSPlaneType, AWSPlaneName, defaultSecretName)
-	}
-	// We get 404 when credential for the provider plane is not registered.
-	if clients.Is404Error(err) {
-		// return true if not found.
-		return true, nil
-	} else if err != nil {
-		return false, err
+		return cpm.AWSClient.Delete(ctx, defaultSecretName)
 	}
+
 	return true, nil
 }
diff --git a/pkg/cli/credential/mock_aws_credential_management.go b/pkg/cli/credential/mock_aws_credential_management.go
new file mode 100644
index 000000000..a7a8ec965
--- /dev/null
+++ b/pkg/cli/credential/mock_aws_credential_management.go
@@ -0,0 +1,95 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/project-radius/radius/pkg/cli/credential (interfaces: AWSCredentialManagementClientInterface)
+
+// Package credential is a generated GoMock package.
+package credential
+
+import (
+	context "context"
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+	v20220901privatepreview "github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
+)
+
+// MockAWSCredentialManagementClientInterface is a mock of AWSCredentialManagementClientInterface interface.
+type MockAWSCredentialManagementClientInterface struct {
+	ctrl     *gomock.Controller
+	recorder *MockAWSCredentialManagementClientInterfaceMockRecorder
+}
+
+// MockAWSCredentialManagementClientInterfaceMockRecorder is the mock recorder for MockAWSCredentialManagementClientInterface.
+type MockAWSCredentialManagementClientInterfaceMockRecorder struct {
+	mock *MockAWSCredentialManagementClientInterface
+}
+
+// NewMockAWSCredentialManagementClientInterface creates a new mock instance.
+func NewMockAWSCredentialManagementClientInterface(ctrl *gomock.Controller) *MockAWSCredentialManagementClientInterface {
+	mock := &MockAWSCredentialManagementClientInterface{ctrl: ctrl}
+	mock.recorder = &MockAWSCredentialManagementClientInterfaceMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockAWSCredentialManagementClientInterface) EXPECT() *MockAWSCredentialManagementClientInterfaceMockRecorder {
+	return m.recorder
+}
+
+// Delete mocks base method.
+func (m *MockAWSCredentialManagementClientInterface) Delete(arg0 context.Context, arg1 string) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Delete", arg0, arg1)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Delete indicates an expected call of Delete.
+func (mr *MockAWSCredentialManagementClientInterfaceMockRecorder) Delete(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Delete", reflect.TypeOf((*MockAWSCredentialManagementClientInterface)(nil).Delete), arg0, arg1)
+}
+
+// Get mocks base method.
+func (m *MockAWSCredentialManagementClientInterface) Get(arg0 context.Context, arg1 string) (ProviderCredentialConfiguration, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Get", arg0, arg1)
+	ret0, _ := ret[0].(ProviderCredentialConfiguration)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Get indicates an expected call of Get.
+func (mr *MockAWSCredentialManagementClientInterfaceMockRecorder) Get(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get", reflect.TypeOf((*MockAWSCredentialManagementClientInterface)(nil).Get), arg0, arg1)
+}
+
+// List mocks base method.
+func (m *MockAWSCredentialManagementClientInterface) List(arg0 context.Context) ([]CloudProviderStatus, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "List", arg0)
+	ret0, _ := ret[0].([]CloudProviderStatus)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// List indicates an expected call of List.
+func (mr *MockAWSCredentialManagementClientInterfaceMockRecorder) List(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "List", reflect.TypeOf((*MockAWSCredentialManagementClientInterface)(nil).List), arg0)
+}
+
+// Put mocks base method.
+func (m *MockAWSCredentialManagementClientInterface) Put(arg0 context.Context, arg1 v20220901privatepreview.AWSCredentialResource) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Put", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Put indicates an expected call of Put.
+func (mr *MockAWSCredentialManagementClientInterfaceMockRecorder) Put(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Put", reflect.TypeOf((*MockAWSCredentialManagementClientInterface)(nil).Put), arg0, arg1)
+}
diff --git a/pkg/cli/credential/mock_azure_credential_management.go b/pkg/cli/credential/mock_azure_credential_management.go
new file mode 100644
index 000000000..5bc746c47
--- /dev/null
+++ b/pkg/cli/credential/mock_azure_credential_management.go
@@ -0,0 +1,95 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/project-radius/radius/pkg/cli/credential (interfaces: AzureCredentialManagementClientInterface)
+
+// Package credential is a generated GoMock package.
+package credential
+
+import (
+	context "context"
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+	v20220901privatepreview "github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
+)
+
+// MockAzureCredentialManagementClientInterface is a mock of AzureCredentialManagementClientInterface interface.
+type MockAzureCredentialManagementClientInterface struct {
+	ctrl     *gomock.Controller
+	recorder *MockAzureCredentialManagementClientInterfaceMockRecorder
+}
+
+// MockAzureCredentialManagementClientInterfaceMockRecorder is the mock recorder for MockAzureCredentialManagementClientInterface.
+type MockAzureCredentialManagementClientInterfaceMockRecorder struct {
+	mock *MockAzureCredentialManagementClientInterface
+}
+
+// NewMockAzureCredentialManagementClientInterface creates a new mock instance.
+func NewMockAzureCredentialManagementClientInterface(ctrl *gomock.Controller) *MockAzureCredentialManagementClientInterface {
+	mock := &MockAzureCredentialManagementClientInterface{ctrl: ctrl}
+	mock.recorder = &MockAzureCredentialManagementClientInterfaceMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockAzureCredentialManagementClientInterface) EXPECT() *MockAzureCredentialManagementClientInterfaceMockRecorder {
+	return m.recorder
+}
+
+// Delete mocks base method.
+func (m *MockAzureCredentialManagementClientInterface) Delete(arg0 context.Context, arg1 string) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Delete", arg0, arg1)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Delete indicates an expected call of Delete.
+func (mr *MockAzureCredentialManagementClientInterfaceMockRecorder) Delete(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Delete", reflect.TypeOf((*MockAzureCredentialManagementClientInterface)(nil).Delete), arg0, arg1)
+}
+
+// Get mocks base method.
+func (m *MockAzureCredentialManagementClientInterface) Get(arg0 context.Context, arg1 string) (ProviderCredentialConfiguration, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Get", arg0, arg1)
+	ret0, _ := ret[0].(ProviderCredentialConfiguration)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Get indicates an expected call of Get.
+func (mr *MockAzureCredentialManagementClientInterfaceMockRecorder) Get(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get", reflect.TypeOf((*MockAzureCredentialManagementClientInterface)(nil).Get), arg0, arg1)
+}
+
+// List mocks base method.
+func (m *MockAzureCredentialManagementClientInterface) List(arg0 context.Context) ([]CloudProviderStatus, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "List", arg0)
+	ret0, _ := ret[0].([]CloudProviderStatus)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// List indicates an expected call of List.
+func (mr *MockAzureCredentialManagementClientInterfaceMockRecorder) List(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "List", reflect.TypeOf((*MockAzureCredentialManagementClientInterface)(nil).List), arg0)
+}
+
+// Put mocks base method.
+func (m *MockAzureCredentialManagementClientInterface) Put(arg0 context.Context, arg1 v20220901privatepreview.AzureCredentialResource) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Put", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Put indicates an expected call of Put.
+func (mr *MockAzureCredentialManagementClientInterfaceMockRecorder) Put(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Put", reflect.TypeOf((*MockAzureCredentialManagementClientInterface)(nil).Put), arg0, arg1)
+}
diff --git a/pkg/cli/credential/mock_client.go b/pkg/cli/credential/mock_client.go
deleted file mode 100644
index b59328328..000000000
--- a/pkg/cli/credential/mock_client.go
+++ /dev/null
@@ -1,94 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/project-radius/radius/pkg/cli/credential (interfaces: Interface)
-
-// Package credential is a generated GoMock package.
-package credential
-
-import (
-	context "context"
-	reflect "reflect"
-
-	gomock "github.com/golang/mock/gomock"
-	v20220901privatepreview "github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
-)
-
-// MockInterface is a mock of Interface interface.
-type MockInterface struct {
-	ctrl     *gomock.Controller
-	recorder *MockInterfaceMockRecorder
-}
-
-// MockInterfaceMockRecorder is the mock recorder for MockInterface.
-type MockInterfaceMockRecorder struct {
-	mock *MockInterface
-}
-
-// NewMockInterface creates a new mock instance.
-func NewMockInterface(ctrl *gomock.Controller) *MockInterface {
-	mock := &MockInterface{ctrl: ctrl}
-	mock.recorder = &MockInterfaceMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockInterface) EXPECT() *MockInterfaceMockRecorder {
-	return m.recorder
-}
-
-// CreateCredential mocks base method.
-func (m *MockInterface) CreateCredential(arg0 context.Context, arg1, arg2, arg3 string, arg4 v20220901privatepreview.CredentialResource) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateCredential", arg0, arg1, arg2, arg3, arg4)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// CreateCredential indicates an expected call of CreateCredential.
-func (mr *MockInterfaceMockRecorder) CreateCredential(arg0, arg1, arg2, arg3, arg4 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateCredential", reflect.TypeOf((*MockInterface)(nil).CreateCredential), arg0, arg1, arg2, arg3, arg4)
-}
-
-// DeleteCredential mocks base method.
-func (m *MockInterface) DeleteCredential(arg0 context.Context, arg1, arg2, arg3 string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteCredential", arg0, arg1, arg2, arg3)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteCredential indicates an expected call of DeleteCredential.
-func (mr *MockInterfaceMockRecorder) DeleteCredential(arg0, arg1, arg2, arg3 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteCredential", reflect.TypeOf((*MockInterface)(nil).DeleteCredential), arg0, arg1, arg2, arg3)
-}
-
-// GetCredential mocks base method.
-func (m *MockInterface) GetCredential(arg0 context.Context, arg1, arg2, arg3 string) (ProviderCredentialConfiguration, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetCredential", arg0, arg1, arg2, arg3)
-	ret0, _ := ret[0].(ProviderCredentialConfiguration)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetCredential indicates an expected call of GetCredential.
-func (mr *MockInterfaceMockRecorder) GetCredential(arg0, arg1, arg2, arg3 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCredential", reflect.TypeOf((*MockInterface)(nil).GetCredential), arg0, arg1, arg2, arg3)
-}
-
-// ListCredential mocks base method.
-func (m *MockInterface) ListCredential(arg0 context.Context, arg1, arg2 string) ([]CloudProviderStatus, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ListCredential", arg0, arg1, arg2)
-	ret0, _ := ret[0].([]CloudProviderStatus)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// ListCredential indicates an expected call of ListCredential.
-func (mr *MockInterfaceMockRecorder) ListCredential(arg0, arg1, arg2 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListCredential", reflect.TypeOf((*MockInterface)(nil).ListCredential), arg0, arg1, arg2)
-}
diff --git a/pkg/cli/credential/mock_credentialmanagementclient.go b/pkg/cli/credential/mock_credentialmanagementclient.go
index 9918d3572..2d7a5e61a 100644
--- a/pkg/cli/credential/mock_credentialmanagementclient.go
+++ b/pkg/cli/credential/mock_credentialmanagementclient.go
@@ -80,16 +80,30 @@ func (mr *MockCredentialManagementClientMockRecorder) List(arg0 interface{}) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "List", reflect.TypeOf((*MockCredentialManagementClient)(nil).List), arg0)
 }
 
-// Put mocks base method.
-func (m *MockCredentialManagementClient) Put(arg0 context.Context, arg1 v20220901privatepreview.CredentialResource) error {
+// PutAWS mocks base method.
+func (m *MockCredentialManagementClient) PutAWS(arg0 context.Context, arg1 v20220901privatepreview.AWSCredentialResource) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Put", arg0, arg1)
+	ret := m.ctrl.Call(m, "PutAWS", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
-// Put indicates an expected call of Put.
-func (mr *MockCredentialManagementClientMockRecorder) Put(arg0, arg1 interface{}) *gomock.Call {
+// PutAWS indicates an expected call of PutAWS.
+func (mr *MockCredentialManagementClientMockRecorder) PutAWS(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Put", reflect.TypeOf((*MockCredentialManagementClient)(nil).Put), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PutAWS", reflect.TypeOf((*MockCredentialManagementClient)(nil).PutAWS), arg0, arg1)
+}
+
+// PutAzure mocks base method.
+func (m *MockCredentialManagementClient) PutAzure(arg0 context.Context, arg1 v20220901privatepreview.AzureCredentialResource) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PutAzure", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// PutAzure indicates an expected call of PutAzure.
+func (mr *MockCredentialManagementClientMockRecorder) PutAzure(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PutAzure", reflect.TypeOf((*MockCredentialManagementClient)(nil).PutAzure), arg0, arg1)
 }
diff --git a/pkg/cli/ucp/ucp_management.go b/pkg/cli/ucp/ucp_management.go
index ddbc0a5d1..fa5816e6d 100644
--- a/pkg/cli/ucp/ucp_management.go
+++ b/pkg/cli/ucp/ucp_management.go
@@ -401,13 +401,22 @@ func (amc *ARMApplicationsManagementClient) ListEnvironmentsAll(ctx context.Cont
 		return []corerpv20220315.EnvironmentResource{}, err
 	}
 
-	response, err := groupClient.List(ctx, "radius", scope.FindScope("radius"), nil)
-	if err != nil {
-		return []corerpv20220315.EnvironmentResource{}, err
+	resourceGroupList := []ucpv20220901.ResourceGroupResource{}
+
+	pager := groupClient.NewListByRootScopePager("radius", scope.FindScope("radius"), nil)
+
+	for pager.More() {
+		nextPage, err := pager.NextPage(ctx)
+		if err != nil {
+			return []corerpv20220315.EnvironmentResource{}, err
+		}
+		for _, resourceGroup := range nextPage.Value {
+			resourceGroupList = append(resourceGroupList, *resourceGroup)
+		}
 	}
 
 	envResourceList := []corerpv20220315.EnvironmentResource{}
-	for _, group := range response.Value {
+	for _, group := range resourceGroupList {
 		// Now query environments inside each group.
 		envClient, err := corerpv20220315.NewEnvironmentsClient(*group.ID, &aztoken.AnonymousCredential{}, amc.ClientOptions)
 		if err != nil {
@@ -525,22 +534,26 @@ func (amc *ARMApplicationsManagementClient) ShowUCPGroup(ctx context.Context, pl
 }
 
 func (amc *ARMApplicationsManagementClient) ListUCPGroup(ctx context.Context, planeType string, planeName string) ([]ucpv20220901.ResourceGroupResource, error) {
-	var resourceGroupOptions *ucpv20220901.ResourceGroupsClientListOptions
+	var resourceGroupOptions *ucpv20220901.ResourceGroupsClientListByRootScopeOptions
 	resourceGroupResources := []ucpv20220901.ResourceGroupResource{}
 	resourcegroupClient, err := ucpv20220901.NewResourceGroupsClient(&aztoken.AnonymousCredential{}, amc.ClientOptions)
 	if err != nil {
 		return resourceGroupResources, err
 	}
 
-	resp, err := resourcegroupClient.List(ctx, planeType, planeName, resourceGroupOptions)
-	if err != nil {
-		return resourceGroupResources, err
-	}
+	pager := resourcegroupClient.NewListByRootScopePager(planeType, planeName, resourceGroupOptions)
 
-	resourceGroupList := resp.ResourceGroupResourceList.Value
-	for _, resourceGroup := range resourceGroupList {
-		resourceGroupResources = append(resourceGroupResources, *resourceGroup)
+	for pager.More() {
+		resp, err := pager.NextPage(ctx)
+		if err != nil {
+			return resourceGroupResources, err
+		}
 
+		resourceGroupList := resp.Value
+		for _, resourceGroup := range resourceGroupList {
+			resourceGroupResources = append(resourceGroupResources, *resourceGroup)
+
+		}
 	}
 
 	return resourceGroupResources, nil
diff --git a/pkg/ucp/api/README.md b/pkg/ucp/api/README.md
index d643d5be6..8059bed33 100644
--- a/pkg/ucp/api/README.md
+++ b/pkg/ucp/api/README.md
@@ -34,7 +34,7 @@ These settings apply only when `--tag=ucp-2022-09-01-privatepreview` is specifie
 
 ```yaml $(tag) == 'ucp-2022-09-01-privatepreview'
 input-file:
-  - ../../../swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/ucp.json
+  - ../../../swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/openapi.json
 modelerfour: 
   treat-type-object-as-anything: false
 ```
diff --git a/pkg/ucp/api/v20220901privatepreview/aws_credential_conversion.go b/pkg/ucp/api/v20220901privatepreview/aws_credential_conversion.go
new file mode 100644
index 000000000..53781c852
--- /dev/null
+++ b/pkg/ucp/api/v20220901privatepreview/aws_credential_conversion.go
@@ -0,0 +1,124 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package v20220901privatepreview
+
+import (
+	"fmt"
+
+	azto "github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
+	"github.com/Azure/go-autorest/autorest/to"
+	v1 "github.com/project-radius/radius/pkg/armrpc/api/v1"
+	"github.com/project-radius/radius/pkg/ucp/datamodel"
+)
+
+const (
+	// AwsCredentialType represents the ucp azure crendetial type value.
+	AWSCredentialType = "System.AWS/credentials"
+)
+
+// ConvertTo converts from the versioned Credential resource to version-agnostic datamodel.
+func (cr *AWSCredentialResource) ConvertTo() (v1.DataModelInterface, error) {
+	prop, err := cr.getDataModelCredentialProperties()
+	if err != nil {
+		return nil, err
+	}
+
+	converted := &datamodel.AWSCredential{
+		BaseResource: v1.BaseResource{
+			TrackedResource: v1.TrackedResource{
+				ID:       to.String(cr.ID),
+				Name:     to.String(cr.Name),
+				Type:     to.String(cr.Type),
+				Location: to.String(cr.Location),
+				Tags:     to.StringMap(cr.Tags),
+			},
+			InternalMetadata: v1.InternalMetadata{
+				UpdatedAPIVersion: Version,
+			},
+		},
+		Properties: prop,
+	}
+
+	return converted, nil
+}
+
+func (cr *AWSCredentialResource) getDataModelCredentialProperties() (*datamodel.AWSCredentialResourceProperties, error) {
+	if cr.Properties == nil {
+		return nil, &v1.ErrModelConversion{PropertyName: "$.properties", ValidValue: "not nil"}
+	}
+
+	switch p := cr.Properties.(type) {
+	case *AWSAccessKeyCredentialProperties:
+		var storage *datamodel.CredentialStorageProperties
+
+		switch c := p.Storage.(type) {
+		case *InternalCredentialStorageProperties:
+			if c.Kind == nil {
+				return nil, &v1.ErrModelConversion{PropertyName: "$.properties", ValidValue: "not nil"}
+			}
+			storage = &datamodel.CredentialStorageProperties{
+				Kind: datamodel.InternalStorageKind,
+				InternalCredential: &datamodel.InternalCredentialStorageProperties{
+					SecretName: to.String(c.SecretName),
+				},
+			}
+		case nil:
+			return nil, &v1.ErrModelConversion{PropertyName: "$.properties.storage", ValidValue: "not nil"}
+		default:
+			return nil, &v1.ErrModelConversion{PropertyName: "$.properties.storage.kind", ValidValue: fmt.Sprintf("one of %q", PossibleCredentialStorageKindValues())}
+		}
+
+		return &datamodel.AWSCredentialResourceProperties{
+			Kind: datamodel.AWSCredentialKind,
+			AWSCredential: &datamodel.AWSCredentialProperties{
+				AccessKeyID:     to.String(p.AccessKeyID),
+				SecretAccessKey: to.String(p.SecretAccessKey),
+			},
+			Storage: storage,
+		}, nil
+	default:
+		return nil, v1.ErrInvalidModelConversion
+	}
+}
+
+// ConvertFrom converts from version-agnostic datamodel to the versioned Credential resource.
+func (dst *AWSCredentialResource) ConvertFrom(src v1.DataModelInterface) error {
+	dm, ok := src.(*datamodel.AWSCredential)
+	if !ok {
+		return v1.ErrInvalidModelConversion
+	}
+
+	dst.ID = &dm.ID
+	dst.Name = &dm.Name
+	dst.Type = &dm.Type
+	dst.Location = &dm.Location
+	dst.Tags = *to.StringMapPtr(dm.Tags)
+
+	var storage CredentialStoragePropertiesClassification
+	switch dm.Properties.Storage.Kind {
+	case datamodel.InternalStorageKind:
+		storage = &InternalCredentialStorageProperties{
+			Kind:       azto.Ptr(string(CredentialStorageKindInternal)),
+			SecretName: azto.Ptr(dm.Properties.Storage.InternalCredential.SecretName),
+		}
+	default:
+		return v1.ErrInvalidModelConversion
+	}
+
+	// DO NOT convert any secret values to versioned model.
+	switch dm.Properties.Kind {
+	case datamodel.AWSCredentialKind:
+		dst.Properties = &AWSAccessKeyCredentialProperties{
+			Kind:        azto.Ptr(dm.Properties.Kind),
+			AccessKeyID: azto.Ptr(dm.Properties.AWSCredential.AccessKeyID),
+			Storage:     storage,
+		}
+	default:
+		return v1.ErrInvalidModelConversion
+	}
+
+	return nil
+}
diff --git a/pkg/ucp/api/v20220901privatepreview/credential_conversion.go b/pkg/ucp/api/v20220901privatepreview/azure_credential_conversion.go
similarity index 60%
rename from pkg/ucp/api/v20220901privatepreview/credential_conversion.go
rename to pkg/ucp/api/v20220901privatepreview/azure_credential_conversion.go
index e948ea1e9..4cc1adf69 100644
--- a/pkg/ucp/api/v20220901privatepreview/credential_conversion.go
+++ b/pkg/ucp/api/v20220901privatepreview/azure_credential_conversion.go
@@ -16,18 +16,16 @@ import (
 const (
 	// AzureCredentialType represents the ucp azure crendetial type value.
 	AzureCredentialType = "System.Azure/credentials"
-	// AWSCredentialType represents the ucp aws crendetial type value.
-	AWSCredentialType = "System.AWS/credentials"
 )
 
 // ConvertTo converts from the versioned Credential resource to version-agnostic datamodel.
-func (cr *CredentialResource) ConvertTo() (v1.DataModelInterface, error) {
+func (cr *AzureCredentialResource) ConvertTo() (v1.DataModelInterface, error) {
 	prop, err := cr.getDataModelCredentialProperties()
 	if err != nil {
 		return nil, err
 	}
 
-	converted := &datamodel.Credential{
+	converted := &datamodel.AzureCredential{
 		BaseResource: v1.BaseResource{
 			TrackedResource: v1.TrackedResource{
 				ID:       to.String(cr.ID),
@@ -46,33 +44,33 @@ func (cr *CredentialResource) ConvertTo() (v1.DataModelInterface, error) {
 	return converted, nil
 }
 
-func (cr *CredentialResource) getDataModelCredentialProperties() (*datamodel.CredentialResourceProperties, error) {
+func (cr *AzureCredentialResource) getDataModelCredentialProperties() (*datamodel.AzureCredentialResourceProperties, error) {
 	if cr.Properties == nil {
 		return nil, &v1.ErrModelConversion{PropertyName: "$.properties", ValidValue: "not nil"}
 	}
 
-	var storage *datamodel.CredentialStorageProperties
-
-	switch p := cr.Properties.GetCredentialResourceProperties().Storage.(type) {
-	case *InternalCredentialStorageProperties:
-		if p.Kind == nil {
-			return nil, &v1.ErrModelConversion{PropertyName: "$.properties", ValidValue: "not nil"}
-		}
-		storage = &datamodel.CredentialStorageProperties{
-			Kind: datamodel.InternalStorageKind,
-			InternalCredential: &datamodel.InternalCredentialStorageProperties{
-				SecretName: to.String(p.SecretName),
-			},
-		}
-	case nil:
-		return nil, &v1.ErrModelConversion{PropertyName: "$.properties.storage", ValidValue: "not nil"}
-	default:
-		return nil, &v1.ErrModelConversion{PropertyName: "$.properties.storage.kind", ValidValue: fmt.Sprintf("one of %q", PossibleCredentialStorageKindValues())}
-	}
-
 	switch p := cr.Properties.(type) {
 	case *AzureServicePrincipalProperties:
-		return &datamodel.CredentialResourceProperties{
+		var storage *datamodel.CredentialStorageProperties
+
+		switch c := p.Storage.(type) {
+		case *InternalCredentialStorageProperties:
+			if c.Kind == nil {
+				return nil, &v1.ErrModelConversion{PropertyName: "$.properties", ValidValue: "not nil"}
+			}
+			storage = &datamodel.CredentialStorageProperties{
+				Kind: datamodel.InternalStorageKind,
+				InternalCredential: &datamodel.InternalCredentialStorageProperties{
+					SecretName: to.String(c.SecretName),
+				},
+			}
+		case nil:
+			return nil, &v1.ErrModelConversion{PropertyName: "$.properties.storage", ValidValue: "not nil"}
+		default:
+			return nil, &v1.ErrModelConversion{PropertyName: "$.properties.storage.kind", ValidValue: fmt.Sprintf("one of %q", PossibleCredentialStorageKindValues())}
+		}
+
+		return &datamodel.AzureCredentialResourceProperties{
 			Kind: datamodel.AzureCredentialKind,
 			AzureCredential: &datamodel.AzureCredentialProperties{
 				TenantID:     to.String(p.TenantID),
@@ -81,23 +79,14 @@ func (cr *CredentialResource) getDataModelCredentialProperties() (*datamodel.Cre
 			},
 			Storage: storage,
 		}, nil
-	case *AWSCredentialProperties:
-		return &datamodel.CredentialResourceProperties{
-			Kind: datamodel.AWSCredentialKind,
-			AWSCredential: &datamodel.AWSCredentialProperties{
-				AccessKeyID:     to.String(p.AccessKeyID),
-				SecretAccessKey: to.String(p.SecretAccessKey),
-			},
-			Storage: storage,
-		}, nil
 	default:
 		return nil, v1.ErrInvalidModelConversion
 	}
 }
 
 // ConvertFrom converts from version-agnostic datamodel to the versioned Credential resource.
-func (dst *CredentialResource) ConvertFrom(src v1.DataModelInterface) error {
-	dm, ok := src.(*datamodel.Credential)
+func (dst *AzureCredentialResource) ConvertFrom(src v1.DataModelInterface) error {
+	dm, ok := src.(*datamodel.AzureCredential)
 	if !ok {
 		return v1.ErrInvalidModelConversion
 	}
@@ -112,7 +101,7 @@ func (dst *CredentialResource) ConvertFrom(src v1.DataModelInterface) error {
 	switch dm.Properties.Storage.Kind {
 	case datamodel.InternalStorageKind:
 		storage = &InternalCredentialStorageProperties{
-			Kind:       to.Ptr(CredentialStorageKindInternal),
+			Kind:       to.Ptr(string(CredentialStorageKindInternal)),
 			SecretName: to.Ptr(dm.Properties.Storage.InternalCredential.SecretName),
 		}
 	default:
@@ -128,12 +117,6 @@ func (dst *CredentialResource) ConvertFrom(src v1.DataModelInterface) error {
 			TenantID: to.Ptr(dm.Properties.AzureCredential.TenantID),
 			Storage:  storage,
 		}
-	case datamodel.AWSCredentialKind:
-		dst.Properties = &AWSCredentialProperties{
-			Kind:        to.Ptr(dm.Properties.Kind),
-			AccessKeyID: to.Ptr(dm.Properties.AWSCredential.AccessKeyID),
-			Storage:     storage,
-		}
 	default:
 		return v1.ErrInvalidModelConversion
 	}
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_awscredential_client.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_awscredential_client.go
index 44ce08384..584cdfd81 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_awscredential_client.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_awscredential_client.go
@@ -20,20 +20,21 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 )
 
-// AWSCredentialClient contains the methods for the AWSCredential group.
-// Don't use this type directly, use NewAWSCredentialClient() instead.
-type AWSCredentialClient struct {
+// AwsCredentialClient contains the methods for the AwsCredential group.
+// Don't use this type directly, use NewAwsCredentialClient() instead.
+type AwsCredentialClient struct {
 	host string
 	pl runtime.Pipeline
 }
 
-// NewAWSCredentialClient creates a new instance of AWSCredentialClient with the specified values.
+// NewAwsCredentialClient creates a new instance of AwsCredentialClient with the specified values.
 // credential - used to authorize requests. Usually a credential from azidentity.
 // options - pass nil to accept the default values.
-func NewAWSCredentialClient(credential azcore.TokenCredential, options *arm.ClientOptions) (*AWSCredentialClient, error) {
+func NewAwsCredentialClient(credential azcore.TokenCredential, options *arm.ClientOptions) (*AwsCredentialClient, error) {
 	if options == nil {
 		options = &arm.ClientOptions{}
 	}
@@ -45,48 +46,40 @@ func NewAWSCredentialClient(credential azcore.TokenCredential, options *arm.Clie
 	if err != nil {
 		return nil, err
 	}
-	client := &AWSCredentialClient{
+	client := &AwsCredentialClient{
 		host: ep,
 pl: pl,
 	}
 	return client, nil
 }
 
-// CreateOrUpdate - Create or update a Credential.
+// CreateOrUpdate - Creates or updates a AWSCredentialResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
 // planeName - The name of the plane
-// credentialName - The name of the credential
-// credential - Credential details
-// options - AWSCredentialClientCreateOrUpdateOptions contains the optional parameters for the AWSCredentialClient.CreateOrUpdate
+// credentialName - The AWS credential name.
+// resource - Resource create parameters.
+// options - AwsCredentialClientCreateOrUpdateOptions contains the optional parameters for the AwsCredentialClient.CreateOrUpdate
 // method.
-func (client *AWSCredentialClient) CreateOrUpdate(ctx context.Context, planeType string, planeName string, credentialName string, credential CredentialResource, options *AWSCredentialClientCreateOrUpdateOptions) (AWSCredentialClientCreateOrUpdateResponse, error) {
-	req, err := client.createOrUpdateCreateRequest(ctx, planeType, planeName, credentialName, credential, options)
+func (client *AwsCredentialClient) CreateOrUpdate(ctx context.Context, planeName string, credentialName string, resource AWSCredentialResource, options *AwsCredentialClientCreateOrUpdateOptions) (AwsCredentialClientCreateOrUpdateResponse, error) {
+	req, err := client.createOrUpdateCreateRequest(ctx, planeName, credentialName, resource, options)
 	if err != nil {
-		return AWSCredentialClientCreateOrUpdateResponse{}, err
+		return AwsCredentialClientCreateOrUpdateResponse{}, err
 	}
 	resp, err := client.pl.Do(req)
 	if err != nil {
-		return AWSCredentialClientCreateOrUpdateResponse{}, err
+		return AwsCredentialClientCreateOrUpdateResponse{}, err
 	}
 	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusCreated) {
-		return AWSCredentialClientCreateOrUpdateResponse{}, runtime.NewResponseError(resp)
+		return AwsCredentialClientCreateOrUpdateResponse{}, runtime.NewResponseError(resp)
 	}
 	return client.createOrUpdateHandleResponse(resp)
 }
 
 // createOrUpdateCreateRequest creates the CreateOrUpdate request.
-func (client *AWSCredentialClient) createOrUpdateCreateRequest(ctx context.Context, planeType string, planeName string, credentialName string, credential CredentialResource, options *AWSCredentialClientCreateOrUpdateOptions) (*policy.Request, error) {
-	urlPath := "/planes/{planeType}/{planeName}/providers/System.AWS/credentials/{credentialName}"
-	if planeType == "" {
-		return nil, errors.New("parameter planeType cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+func (client *AwsCredentialClient) createOrUpdateCreateRequest(ctx context.Context, planeName string, credentialName string, resource AWSCredentialResource, options *AwsCredentialClientCreateOrUpdateOptions) (*policy.Request, error) {
+	urlPath := "/planes/aws/{planeName}/providers/System.AWS/credentials/{credentialName}"
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if credentialName == "" {
 		return nil, errors.New("parameter credentialName cannot be empty")
 	}
@@ -99,51 +92,51 @@ func (client *AWSCredentialClient) createOrUpdateCreateRequest(ctx context.Conte
 	reqQP.Set("api-version", "2022-09-01-privatepreview")
 	req.Raw().URL.RawQuery = reqQP.Encode()
 	req.Raw().Header["Accept"] = []string{"application/json"}
-	return req, runtime.MarshalAsJSON(req, credential)
+	return req, runtime.MarshalAsJSON(req, resource)
 }
 
 // createOrUpdateHandleResponse handles the CreateOrUpdate response.
-func (client *AWSCredentialClient) createOrUpdateHandleResponse(resp *http.Response) (AWSCredentialClientCreateOrUpdateResponse, error) {
-	result := AWSCredentialClientCreateOrUpdateResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.CredentialResource); err != nil {
-		return AWSCredentialClientCreateOrUpdateResponse{}, err
+func (client *AwsCredentialClient) createOrUpdateHandleResponse(resp *http.Response) (AwsCredentialClientCreateOrUpdateResponse, error) {
+	result := AwsCredentialClientCreateOrUpdateResponse{}
+	if val := resp.Header.Get("Retry-After"); val != "" {
+		retryAfter32, err := strconv.ParseInt(val, 10, 32)
+		retryAfter := int32(retryAfter32)
+		if err != nil {
+			return AwsCredentialClientCreateOrUpdateResponse{}, err
+		}
+		result.RetryAfter = &retryAfter
+	}
+	if err := runtime.UnmarshalAsJSON(resp, &result.AWSCredentialResource); err != nil {
+		return AwsCredentialClientCreateOrUpdateResponse{}, err
 	}
 	return result, nil
 }
 
-// Delete - Delete credential resource for this plane instance
+// Delete - Deletes an existing AWSCredentialResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
 // planeName - The name of the plane
-// credentialName - The name of the credential
-// options - AWSCredentialClientDeleteOptions contains the optional parameters for the AWSCredentialClient.Delete method.
-func (client *AWSCredentialClient) Delete(ctx context.Context, planeType string, planeName string, credentialName string, options *AWSCredentialClientDeleteOptions) (AWSCredentialClientDeleteResponse, error) {
-	req, err := client.deleteCreateRequest(ctx, planeType, planeName, credentialName, options)
+// credentialName - The AWS credential name.
+// options - AwsCredentialClientDeleteOptions contains the optional parameters for the AwsCredentialClient.Delete method.
+func (client *AwsCredentialClient) Delete(ctx context.Context, planeName string, credentialName string, options *AwsCredentialClientDeleteOptions) (AwsCredentialClientDeleteResponse, error) {
+	req, err := client.deleteCreateRequest(ctx, planeName, credentialName, options)
 	if err != nil {
-		return AWSCredentialClientDeleteResponse{}, err
+		return AwsCredentialClientDeleteResponse{}, err
 	}
 	resp, err := client.pl.Do(req)
 	if err != nil {
-		return AWSCredentialClientDeleteResponse{}, err
+		return AwsCredentialClientDeleteResponse{}, err
 	}
-	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusNoContent) {
-		return AWSCredentialClientDeleteResponse{}, runtime.NewResponseError(resp)
+	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusAccepted, http.StatusNoContent) {
+		return AwsCredentialClientDeleteResponse{}, runtime.NewResponseError(resp)
 	}
-	return AWSCredentialClientDeleteResponse{}, nil
+	return client.deleteHandleResponse(resp)
 }
 
 // deleteCreateRequest creates the Delete request.
-func (client *AWSCredentialClient) deleteCreateRequest(ctx context.Context, planeType string, planeName string, credentialName string, options *AWSCredentialClientDeleteOptions) (*policy.Request, error) {
-	urlPath := "/planes/{planeType}/{planeName}/providers/System.AWS/credentials/{credentialName}"
-	if planeType == "" {
-		return nil, errors.New("parameter planeType cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+func (client *AwsCredentialClient) deleteCreateRequest(ctx context.Context, planeName string, credentialName string, options *AwsCredentialClientDeleteOptions) (*policy.Request, error) {
+	urlPath := "/planes/aws/{planeName}/providers/System.AWS/credentials/{credentialName}"
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if credentialName == "" {
 		return nil, errors.New("parameter credentialName cannot be empty")
 	}
@@ -159,39 +152,45 @@ func (client *AWSCredentialClient) deleteCreateRequest(ctx context.Context, plan
 	return req, nil
 }
 
-// Get - Get name of the secret that is holding credentials for the plane instance
+// deleteHandleResponse handles the Delete response.
+func (client *AwsCredentialClient) deleteHandleResponse(resp *http.Response) (AwsCredentialClientDeleteResponse, error) {
+	result := AwsCredentialClientDeleteResponse{}
+	if val := resp.Header.Get("Retry-After"); val != "" {
+		retryAfter32, err := strconv.ParseInt(val, 10, 32)
+		retryAfter := int32(retryAfter32)
+		if err != nil {
+			return AwsCredentialClientDeleteResponse{}, err
+		}
+		result.RetryAfter = &retryAfter
+	}
+	return result, nil
+}
+
+// Get - Retrieves information about a AWSCredentialResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
 // planeName - The name of the plane
-// credentialName - The name of the credential
-// options - AWSCredentialClientGetOptions contains the optional parameters for the AWSCredentialClient.Get method.
-func (client *AWSCredentialClient) Get(ctx context.Context, planeType string, planeName string, credentialName string, options *AWSCredentialClientGetOptions) (AWSCredentialClientGetResponse, error) {
-	req, err := client.getCreateRequest(ctx, planeType, planeName, credentialName, options)
+// credentialName - The AWS credential name.
+// options - AwsCredentialClientGetOptions contains the optional parameters for the AwsCredentialClient.Get method.
+func (client *AwsCredentialClient) Get(ctx context.Context, planeName string, credentialName string, options *AwsCredentialClientGetOptions) (AwsCredentialClientGetResponse, error) {
+	req, err := client.getCreateRequest(ctx, planeName, credentialName, options)
 	if err != nil {
-		return AWSCredentialClientGetResponse{}, err
+		return AwsCredentialClientGetResponse{}, err
 	}
 	resp, err := client.pl.Do(req)
 	if err != nil {
-		return AWSCredentialClientGetResponse{}, err
+		return AwsCredentialClientGetResponse{}, err
 	}
 	if !runtime.HasStatusCode(resp, http.StatusOK) {
-		return AWSCredentialClientGetResponse{}, runtime.NewResponseError(resp)
+		return AwsCredentialClientGetResponse{}, runtime.NewResponseError(resp)
 	}
 	return client.getHandleResponse(resp)
 }
 
 // getCreateRequest creates the Get request.
-func (client *AWSCredentialClient) getCreateRequest(ctx context.Context, planeType string, planeName string, credentialName string, options *AWSCredentialClientGetOptions) (*policy.Request, error) {
-	urlPath := "/planes/{planeType}/{planeName}/providers/System.AWS/credentials/{credentialName}"
-	if planeType == "" {
-		return nil, errors.New("parameter planeType cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+func (client *AwsCredentialClient) getCreateRequest(ctx context.Context, planeName string, credentialName string, options *AwsCredentialClientGetOptions) (*policy.Request, error) {
+	urlPath := "/planes/aws/{planeName}/providers/System.AWS/credentials/{credentialName}"
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if credentialName == "" {
 		return nil, errors.New("parameter credentialName cannot be empty")
 	}
@@ -208,46 +207,51 @@ func (client *AWSCredentialClient) getCreateRequest(ctx context.Context, planeTy
 }
 
 // getHandleResponse handles the Get response.
-func (client *AWSCredentialClient) getHandleResponse(resp *http.Response) (AWSCredentialClientGetResponse, error) {
-	result := AWSCredentialClientGetResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.CredentialResource); err != nil {
-		return AWSCredentialClientGetResponse{}, err
+func (client *AwsCredentialClient) getHandleResponse(resp *http.Response) (AwsCredentialClientGetResponse, error) {
+	result := AwsCredentialClientGetResponse{}
+	if err := runtime.UnmarshalAsJSON(resp, &result.AWSCredentialResource); err != nil {
+		return AwsCredentialClientGetResponse{}, err
 	}
 	return result, nil
 }
 
-// List - List the credentials for this plane instance
-// If the operation fails it returns an *azcore.ResponseError type.
+// NewListByRootScopePager - Lists information about all AWSCredentialResource
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
 // planeName - The name of the plane
-// options - AWSCredentialClientListOptions contains the optional parameters for the AWSCredentialClient.List method.
-func (client *AWSCredentialClient) List(ctx context.Context, planeType string, planeName string, options *AWSCredentialClientListOptions) (AWSCredentialClientListResponse, error) {
-	req, err := client.listCreateRequest(ctx, planeType, planeName, options)
-	if err != nil {
-		return AWSCredentialClientListResponse{}, err
-	}
-	resp, err := client.pl.Do(req)
-	if err != nil {
-		return AWSCredentialClientListResponse{}, err
-	}
-	if !runtime.HasStatusCode(resp, http.StatusOK) {
-		return AWSCredentialClientListResponse{}, runtime.NewResponseError(resp)
-	}
-	return client.listHandleResponse(resp)
+// options - AwsCredentialClientListByRootScopeOptions contains the optional parameters for the AwsCredentialClient.ListByRootScope
+// method.
+func (client *AwsCredentialClient) NewListByRootScopePager(planeName string, options *AwsCredentialClientListByRootScopeOptions) (*runtime.Pager[AwsCredentialClientListByRootScopeResponse]) {
+	return runtime.NewPager(runtime.PagingHandler[AwsCredentialClientListByRootScopeResponse]{
+		More: func(page AwsCredentialClientListByRootScopeResponse) bool {
+			return page.NextLink != nil && len(*page.NextLink) > 0
+		},
+		Fetcher: func(ctx context.Context, page *AwsCredentialClientListByRootScopeResponse) (AwsCredentialClientListByRootScopeResponse, error) {
+			var req *policy.Request
+			var err error
+			if page == nil {
+				req, err = client.listByRootScopeCreateRequest(ctx, planeName, options)
+			} else {
+				req, err = runtime.NewRequest(ctx, http.MethodGet, *page.NextLink)
+			}
+			if err != nil {
+				return AwsCredentialClientListByRootScopeResponse{}, err
+			}
+			resp, err := client.pl.Do(req)
+			if err != nil {
+				return AwsCredentialClientListByRootScopeResponse{}, err
+			}
+			if !runtime.HasStatusCode(resp, http.StatusOK) {
+				return AwsCredentialClientListByRootScopeResponse{}, runtime.NewResponseError(resp)
+			}
+			return client.listByRootScopeHandleResponse(resp)
+		},
+	})
 }
 
-// listCreateRequest creates the List request.
-func (client *AWSCredentialClient) listCreateRequest(ctx context.Context, planeType string, planeName string, options *AWSCredentialClientListOptions) (*policy.Request, error) {
-	urlPath := "/planes/{planeType}/{planeName}/providers/System.AWS/credentials"
-	if planeType == "" {
-		return nil, errors.New("parameter planeType cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+// listByRootScopeCreateRequest creates the ListByRootScope request.
+func (client *AwsCredentialClient) listByRootScopeCreateRequest(ctx context.Context, planeName string, options *AwsCredentialClientListByRootScopeOptions) (*policy.Request, error) {
+	urlPath := "/planes/aws/{planeName}/providers/System.AWS/credentials"
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	req, err := runtime.NewRequest(ctx, http.MethodGet, runtime.JoinPaths(client.host, urlPath))
 	if err != nil {
 		return nil, err
@@ -259,11 +263,11 @@ func (client *AWSCredentialClient) listCreateRequest(ctx context.Context, planeT
 	return req, nil
 }
 
-// listHandleResponse handles the List response.
-func (client *AWSCredentialClient) listHandleResponse(resp *http.Response) (AWSCredentialClientListResponse, error) {
-	result := AWSCredentialClientListResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.CredentialResourceList); err != nil {
-		return AWSCredentialClientListResponse{}, err
+// listByRootScopeHandleResponse handles the ListByRootScope response.
+func (client *AwsCredentialClient) listByRootScopeHandleResponse(resp *http.Response) (AwsCredentialClientListByRootScopeResponse, error) {
+	result := AwsCredentialClientListByRootScopeResponse{}
+	if err := runtime.UnmarshalAsJSON(resp, &result.AWSCredentialResourceListResult); err != nil {
+		return AwsCredentialClientListByRootScopeResponse{}, err
 	}
 	return result, nil
 }
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_azurecredential_client.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_azurecredential_client.go
index f8853b881..7adcec346 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_azurecredential_client.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_azurecredential_client.go
@@ -20,6 +20,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 )
 
@@ -52,17 +53,16 @@ pl: pl,
 	return client, nil
 }
 
-// CreateOrUpdate - Create or update a Credential.
+// CreateOrUpdate - Creates or updates a AzureCredentialResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
 // planeName - The name of the plane
-// credentialName - The name of the credential
-// credential - Credential details
+// credentialName - The Azure credential name.
+// resource - Resource create parameters.
 // options - AzureCredentialClientCreateOrUpdateOptions contains the optional parameters for the AzureCredentialClient.CreateOrUpdate
 // method.
-func (client *AzureCredentialClient) CreateOrUpdate(ctx context.Context, planeType string, planeName string, credentialName string, credential CredentialResource, options *AzureCredentialClientCreateOrUpdateOptions) (AzureCredentialClientCreateOrUpdateResponse, error) {
-	req, err := client.createOrUpdateCreateRequest(ctx, planeType, planeName, credentialName, credential, options)
+func (client *AzureCredentialClient) CreateOrUpdate(ctx context.Context, planeName string, credentialName string, resource AzureCredentialResource, options *AzureCredentialClientCreateOrUpdateOptions) (AzureCredentialClientCreateOrUpdateResponse, error) {
+	req, err := client.createOrUpdateCreateRequest(ctx, planeName, credentialName, resource, options)
 	if err != nil {
 		return AzureCredentialClientCreateOrUpdateResponse{}, err
 	}
@@ -77,16 +77,9 @@ func (client *AzureCredentialClient) CreateOrUpdate(ctx context.Context, planeTy
 }
 
 // createOrUpdateCreateRequest creates the CreateOrUpdate request.
-func (client *AzureCredentialClient) createOrUpdateCreateRequest(ctx context.Context, planeType string, planeName string, credentialName string, credential CredentialResource, options *AzureCredentialClientCreateOrUpdateOptions) (*policy.Request, error) {
-	urlPath := "/planes/{planeType}/{planeName}/providers/System.Azure/credentials/{credentialName}"
-	if planeType == "" {
-		return nil, errors.New("parameter planeType cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+func (client *AzureCredentialClient) createOrUpdateCreateRequest(ctx context.Context, planeName string, credentialName string, resource AzureCredentialResource, options *AzureCredentialClientCreateOrUpdateOptions) (*policy.Request, error) {
+	urlPath := "/planes/azure/{planeName}/providers/System.Azure/credentials/{credentialName}"
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if credentialName == "" {
 		return nil, errors.New("parameter credentialName cannot be empty")
 	}
@@ -99,27 +92,34 @@ func (client *AzureCredentialClient) createOrUpdateCreateRequest(ctx context.Con
 	reqQP.Set("api-version", "2022-09-01-privatepreview")
 	req.Raw().URL.RawQuery = reqQP.Encode()
 	req.Raw().Header["Accept"] = []string{"application/json"}
-	return req, runtime.MarshalAsJSON(req, credential)
+	return req, runtime.MarshalAsJSON(req, resource)
 }
 
 // createOrUpdateHandleResponse handles the CreateOrUpdate response.
 func (client *AzureCredentialClient) createOrUpdateHandleResponse(resp *http.Response) (AzureCredentialClientCreateOrUpdateResponse, error) {
 	result := AzureCredentialClientCreateOrUpdateResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.CredentialResource); err != nil {
+	if val := resp.Header.Get("Retry-After"); val != "" {
+		retryAfter32, err := strconv.ParseInt(val, 10, 32)
+		retryAfter := int32(retryAfter32)
+		if err != nil {
+			return AzureCredentialClientCreateOrUpdateResponse{}, err
+		}
+		result.RetryAfter = &retryAfter
+	}
+	if err := runtime.UnmarshalAsJSON(resp, &result.AzureCredentialResource); err != nil {
 		return AzureCredentialClientCreateOrUpdateResponse{}, err
 	}
 	return result, nil
 }
 
-// Delete - Delete credential resource for this plane instance
+// Delete - Deletes an existing AzureCredentialResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
 // planeName - The name of the plane
-// credentialName - The name of the credential
+// credentialName - The Azure credential name.
 // options - AzureCredentialClientDeleteOptions contains the optional parameters for the AzureCredentialClient.Delete method.
-func (client *AzureCredentialClient) Delete(ctx context.Context, planeType string, planeName string, credentialName string, options *AzureCredentialClientDeleteOptions) (AzureCredentialClientDeleteResponse, error) {
-	req, err := client.deleteCreateRequest(ctx, planeType, planeName, credentialName, options)
+func (client *AzureCredentialClient) Delete(ctx context.Context, planeName string, credentialName string, options *AzureCredentialClientDeleteOptions) (AzureCredentialClientDeleteResponse, error) {
+	req, err := client.deleteCreateRequest(ctx, planeName, credentialName, options)
 	if err != nil {
 		return AzureCredentialClientDeleteResponse{}, err
 	}
@@ -127,23 +127,16 @@ func (client *AzureCredentialClient) Delete(ctx context.Context, planeType strin
 	if err != nil {
 		return AzureCredentialClientDeleteResponse{}, err
 	}
-	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusNoContent) {
+	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusAccepted, http.StatusNoContent) {
 		return AzureCredentialClientDeleteResponse{}, runtime.NewResponseError(resp)
 	}
-	return AzureCredentialClientDeleteResponse{}, nil
+	return client.deleteHandleResponse(resp)
 }
 
 // deleteCreateRequest creates the Delete request.
-func (client *AzureCredentialClient) deleteCreateRequest(ctx context.Context, planeType string, planeName string, credentialName string, options *AzureCredentialClientDeleteOptions) (*policy.Request, error) {
-	urlPath := "/planes/{planeType}/{planeName}/providers/System.Azure/credentials/{credentialName}"
-	if planeType == "" {
-		return nil, errors.New("parameter planeType cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+func (client *AzureCredentialClient) deleteCreateRequest(ctx context.Context, planeName string, credentialName string, options *AzureCredentialClientDeleteOptions) (*policy.Request, error) {
+	urlPath := "/planes/azure/{planeName}/providers/System.Azure/credentials/{credentialName}"
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if credentialName == "" {
 		return nil, errors.New("parameter credentialName cannot be empty")
 	}
@@ -159,15 +152,28 @@ func (client *AzureCredentialClient) deleteCreateRequest(ctx context.Context, pl
 	return req, nil
 }
 
-// Get - Get name of the secret that is holding credential for the plane instance
+// deleteHandleResponse handles the Delete response.
+func (client *AzureCredentialClient) deleteHandleResponse(resp *http.Response) (AzureCredentialClientDeleteResponse, error) {
+	result := AzureCredentialClientDeleteResponse{}
+	if val := resp.Header.Get("Retry-After"); val != "" {
+		retryAfter32, err := strconv.ParseInt(val, 10, 32)
+		retryAfter := int32(retryAfter32)
+		if err != nil {
+			return AzureCredentialClientDeleteResponse{}, err
+		}
+		result.RetryAfter = &retryAfter
+	}
+	return result, nil
+}
+
+// Get - Retrieves information about a AzureCredentialResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
 // planeName - The name of the plane
-// credentialName - The name of the credential
+// credentialName - The Azure credential name.
 // options - AzureCredentialClientGetOptions contains the optional parameters for the AzureCredentialClient.Get method.
-func (client *AzureCredentialClient) Get(ctx context.Context, planeType string, planeName string, credentialName string, options *AzureCredentialClientGetOptions) (AzureCredentialClientGetResponse, error) {
-	req, err := client.getCreateRequest(ctx, planeType, planeName, credentialName, options)
+func (client *AzureCredentialClient) Get(ctx context.Context, planeName string, credentialName string, options *AzureCredentialClientGetOptions) (AzureCredentialClientGetResponse, error) {
+	req, err := client.getCreateRequest(ctx, planeName, credentialName, options)
 	if err != nil {
 		return AzureCredentialClientGetResponse{}, err
 	}
@@ -182,16 +188,9 @@ func (client *AzureCredentialClient) Get(ctx context.Context, planeType string,
 }
 
 // getCreateRequest creates the Get request.
-func (client *AzureCredentialClient) getCreateRequest(ctx context.Context, planeType string, planeName string, credentialName string, options *AzureCredentialClientGetOptions) (*policy.Request, error) {
-	urlPath := "/planes/{planeType}/{planeName}/providers/System.Azure/credentials/{credentialName}"
-	if planeType == "" {
-		return nil, errors.New("parameter planeType cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+func (client *AzureCredentialClient) getCreateRequest(ctx context.Context, planeName string, credentialName string, options *AzureCredentialClientGetOptions) (*policy.Request, error) {
+	urlPath := "/planes/azure/{planeName}/providers/System.Azure/credentials/{credentialName}"
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if credentialName == "" {
 		return nil, errors.New("parameter credentialName cannot be empty")
 	}
@@ -210,44 +209,49 @@ func (client *AzureCredentialClient) getCreateRequest(ctx context.Context, plane
 // getHandleResponse handles the Get response.
 func (client *AzureCredentialClient) getHandleResponse(resp *http.Response) (AzureCredentialClientGetResponse, error) {
 	result := AzureCredentialClientGetResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.CredentialResource); err != nil {
+	if err := runtime.UnmarshalAsJSON(resp, &result.AzureCredentialResource); err != nil {
 		return AzureCredentialClientGetResponse{}, err
 	}
 	return result, nil
 }
 
-// List - List the credentials for this plane instance
-// If the operation fails it returns an *azcore.ResponseError type.
+// NewListByRootScopePager - Lists information about all AzureCredentialResource
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
 // planeName - The name of the plane
-// options - AzureCredentialClientListOptions contains the optional parameters for the AzureCredentialClient.List method.
-func (client *AzureCredentialClient) List(ctx context.Context, planeType string, planeName string, options *AzureCredentialClientListOptions) (AzureCredentialClientListResponse, error) {
-	req, err := client.listCreateRequest(ctx, planeType, planeName, options)
-	if err != nil {
-		return AzureCredentialClientListResponse{}, err
-	}
-	resp, err := client.pl.Do(req)
-	if err != nil {
-		return AzureCredentialClientListResponse{}, err
-	}
-	if !runtime.HasStatusCode(resp, http.StatusOK) {
-		return AzureCredentialClientListResponse{}, runtime.NewResponseError(resp)
-	}
-	return client.listHandleResponse(resp)
+// options - AzureCredentialClientListByRootScopeOptions contains the optional parameters for the AzureCredentialClient.ListByRootScope
+// method.
+func (client *AzureCredentialClient) NewListByRootScopePager(planeName string, options *AzureCredentialClientListByRootScopeOptions) (*runtime.Pager[AzureCredentialClientListByRootScopeResponse]) {
+	return runtime.NewPager(runtime.PagingHandler[AzureCredentialClientListByRootScopeResponse]{
+		More: func(page AzureCredentialClientListByRootScopeResponse) bool {
+			return page.NextLink != nil && len(*page.NextLink) > 0
+		},
+		Fetcher: func(ctx context.Context, page *AzureCredentialClientListByRootScopeResponse) (AzureCredentialClientListByRootScopeResponse, error) {
+			var req *policy.Request
+			var err error
+			if page == nil {
+				req, err = client.listByRootScopeCreateRequest(ctx, planeName, options)
+			} else {
+				req, err = runtime.NewRequest(ctx, http.MethodGet, *page.NextLink)
+			}
+			if err != nil {
+				return AzureCredentialClientListByRootScopeResponse{}, err
+			}
+			resp, err := client.pl.Do(req)
+			if err != nil {
+				return AzureCredentialClientListByRootScopeResponse{}, err
+			}
+			if !runtime.HasStatusCode(resp, http.StatusOK) {
+				return AzureCredentialClientListByRootScopeResponse{}, runtime.NewResponseError(resp)
+			}
+			return client.listByRootScopeHandleResponse(resp)
+		},
+	})
 }
 
-// listCreateRequest creates the List request.
-func (client *AzureCredentialClient) listCreateRequest(ctx context.Context, planeType string, planeName string, options *AzureCredentialClientListOptions) (*policy.Request, error) {
-	urlPath := "/planes/{planeType}/{planeName}/providers/System.Azure/credentials"
-	if planeType == "" {
-		return nil, errors.New("parameter planeType cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+// listByRootScopeCreateRequest creates the ListByRootScope request.
+func (client *AzureCredentialClient) listByRootScopeCreateRequest(ctx context.Context, planeName string, options *AzureCredentialClientListByRootScopeOptions) (*policy.Request, error) {
+	urlPath := "/planes/azure/{planeName}/providers/System.Azure/credentials"
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	req, err := runtime.NewRequest(ctx, http.MethodGet, runtime.JoinPaths(client.host, urlPath))
 	if err != nil {
 		return nil, err
@@ -259,11 +263,11 @@ func (client *AzureCredentialClient) listCreateRequest(ctx context.Context, plan
 	return req, nil
 }
 
-// listHandleResponse handles the List response.
-func (client *AzureCredentialClient) listHandleResponse(resp *http.Response) (AzureCredentialClientListResponse, error) {
-	result := AzureCredentialClientListResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.CredentialResourceList); err != nil {
-		return AzureCredentialClientListResponse{}, err
+// listByRootScopeHandleResponse handles the ListByRootScope response.
+func (client *AzureCredentialClient) listByRootScopeHandleResponse(resp *http.Response) (AzureCredentialClientListByRootScopeResponse, error) {
+	result := AzureCredentialClientListByRootScopeResponse{}
+	if err := runtime.UnmarshalAsJSON(resp, &result.AzureCredentialResourceListResult); err != nil {
+		return AzureCredentialClientListByRootScopeResponse{}, err
 	}
 	return result, nil
 }
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_constants.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_constants.go
index aee75ccd7..e79273f5b 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_constants.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_constants.go
@@ -14,7 +14,55 @@ const (
 	moduleVersion = "v0.0.1"
 )
 
-// CredentialStorageKind - credential store kinds supported.
+// AWSCredentialKind - AWS credential kinds supported.
+type AWSCredentialKind string
+
+const (
+	AWSCredentialKindAccessKey AWSCredentialKind = "AccessKey"
+)
+
+// PossibleAWSCredentialKindValues returns the possible values for the AWSCredentialKind const type.
+func PossibleAWSCredentialKindValues() []AWSCredentialKind {
+	return []AWSCredentialKind{	
+		AWSCredentialKindAccessKey,
+	}
+}
+
+// AzureCredentialKind - Azure credential kinds supported.
+type AzureCredentialKind string
+
+const (
+	AzureCredentialKindServicePrincipal AzureCredentialKind = "ServicePrincipal"
+)
+
+// PossibleAzureCredentialKindValues returns the possible values for the AzureCredentialKind const type.
+func PossibleAzureCredentialKindValues() []AzureCredentialKind {
+	return []AzureCredentialKind{	
+		AzureCredentialKindServicePrincipal,
+	}
+}
+
+// CreatedByType - The type of identity that created the resource.
+type CreatedByType string
+
+const (
+	CreatedByTypeApplication CreatedByType = "Application"
+	CreatedByTypeKey CreatedByType = "Key"
+	CreatedByTypeManagedIdentity CreatedByType = "ManagedIdentity"
+	CreatedByTypeUser CreatedByType = "User"
+)
+
+// PossibleCreatedByTypeValues returns the possible values for the CreatedByType const type.
+func PossibleCreatedByTypeValues() []CreatedByType {
+	return []CreatedByType{	
+		CreatedByTypeApplication,
+		CreatedByTypeKey,
+		CreatedByTypeManagedIdentity,
+		CreatedByTypeUser,
+	}
+}
+
+// CredentialStorageKind - Credential store kinds supported.
 type CredentialStorageKind string
 
 const (
@@ -46,3 +94,29 @@ func PossiblePlaneKindValues() []PlaneKind {
 	}
 }
 
+// ProvisioningState - Provisioning state of the link at the time the operation was called
+type ProvisioningState string
+
+const (
+	ProvisioningStateAccepted ProvisioningState = "Accepted"
+	ProvisioningStateCanceled ProvisioningState = "Canceled"
+	ProvisioningStateDeleting ProvisioningState = "Deleting"
+	ProvisioningStateFailed ProvisioningState = "Failed"
+	ProvisioningStateProvisioning ProvisioningState = "Provisioning"
+	ProvisioningStateSucceeded ProvisioningState = "Succeeded"
+	ProvisioningStateUpdating ProvisioningState = "Updating"
+)
+
+// PossibleProvisioningStateValues returns the possible values for the ProvisioningState const type.
+func PossibleProvisioningStateValues() []ProvisioningState {
+	return []ProvisioningState{	
+		ProvisioningStateAccepted,
+		ProvisioningStateCanceled,
+		ProvisioningStateDeleting,
+		ProvisioningStateFailed,
+		ProvisioningStateProvisioning,
+		ProvisioningStateSucceeded,
+		ProvisioningStateUpdating,
+	}
+}
+
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_models.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_models.go
index c7dd4e088..c74101a2f 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_models.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_models.go
@@ -9,48 +9,110 @@
 
 package v20220901privatepreview
 
-// AWSCredentialClientCreateOrUpdateOptions contains the optional parameters for the AWSCredentialClient.CreateOrUpdate method.
-type AWSCredentialClientCreateOrUpdateOptions struct {
-	// placeholder for future optional parameters
-}
-
-// AWSCredentialClientDeleteOptions contains the optional parameters for the AWSCredentialClient.Delete method.
-type AWSCredentialClientDeleteOptions struct {
-	// placeholder for future optional parameters
-}
-
-// AWSCredentialClientGetOptions contains the optional parameters for the AWSCredentialClient.Get method.
-type AWSCredentialClientGetOptions struct {
-	// placeholder for future optional parameters
-}
-
-// AWSCredentialClientListOptions contains the optional parameters for the AWSCredentialClient.List method.
-type AWSCredentialClientListOptions struct {
-	// placeholder for future optional parameters
-}
+import "time"
 
-type AWSCredentialProperties struct {
+// AWSAccessKeyCredentialProperties - AWS credential storage properties
+type AWSAccessKeyCredentialProperties struct {
 	// REQUIRED; Access key ID for AWS identity
 	AccessKeyID *string `json:"accessKeyId,omitempty"`
 
-	// REQUIRED; The kind of secret
+	// REQUIRED; Discriminator property for AWSCredentialProperties.
 	Kind *string `json:"kind,omitempty"`
 
 	// REQUIRED; Secret Access Key for AWS identity
 	SecretAccessKey *string `json:"secretAccessKey,omitempty"`
 
-	// REQUIRED; Credential storage properties
+	// REQUIRED; The storage properties
 	Storage CredentialStoragePropertiesClassification `json:"storage,omitempty"`
+
+	// READ-ONLY; Provisioning state of the resource at the time the operation was called
+	ProvisioningState *ProvisioningState `json:"provisioningState,omitempty" azure:"ro"`
 }
 
-// GetCredentialResourceProperties implements the CredentialResourcePropertiesClassification interface for type AWSCredentialProperties.
-func (a *AWSCredentialProperties) GetCredentialResourceProperties() *CredentialResourceProperties {
-	return &CredentialResourceProperties{
+// GetAWSCredentialProperties implements the AWSCredentialPropertiesClassification interface for type AWSAccessKeyCredentialProperties.
+func (a *AWSAccessKeyCredentialProperties) GetAWSCredentialProperties() *AWSCredentialProperties {
+	return &AWSCredentialProperties{
 		Kind: a.Kind,
-		Storage: a.Storage,
+		ProvisioningState: a.ProvisioningState,
 	}
 }
 
+// AWSCredentialPropertiesClassification provides polymorphic access to related types.
+// Call the interface's GetAWSCredentialProperties() method to access the common type.
+// Use a type switch to determine the concrete type.  The possible types are:
+// - *AWSAccessKeyCredentialProperties, *AWSCredentialProperties
+type AWSCredentialPropertiesClassification interface {
+	// GetAWSCredentialProperties returns the AWSCredentialProperties content of the underlying type.
+	GetAWSCredentialProperties() *AWSCredentialProperties
+}
+
+// AWSCredentialProperties - AWS Credential properties
+type AWSCredentialProperties struct {
+	// REQUIRED; Discriminator property for AWSCredentialProperties.
+	Kind *string `json:"kind,omitempty"`
+
+	// READ-ONLY; Provisioning state of the resource at the time the operation was called
+	ProvisioningState *ProvisioningState `json:"provisioningState,omitempty" azure:"ro"`
+}
+
+// GetAWSCredentialProperties implements the AWSCredentialPropertiesClassification interface for type AWSCredentialProperties.
+func (a *AWSCredentialProperties) GetAWSCredentialProperties() *AWSCredentialProperties { return a }
+
+// AWSCredentialResource - Concrete tracked resource types can be created by aliasing this type using a specific property
+// type.
+type AWSCredentialResource struct {
+	// REQUIRED; The geo-location where the resource lives
+	Location *string `json:"location,omitempty"`
+
+	// The resource-specific properties for this resource.
+	Properties AWSCredentialPropertiesClassification `json:"properties,omitempty"`
+
+	// Resource tags.
+	Tags map[string]*string `json:"tags,omitempty"`
+
+	// READ-ONLY; Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
+	ID *string `json:"id,omitempty" azure:"ro"`
+
+	// READ-ONLY; The name of the resource
+	Name *string `json:"name,omitempty" azure:"ro"`
+
+	// READ-ONLY; Azure Resource Manager metadata containing createdBy and modifiedBy information.
+	SystemData *SystemData `json:"systemData,omitempty" azure:"ro"`
+
+	// READ-ONLY; The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
+	Type *string `json:"type,omitempty" azure:"ro"`
+}
+
+// AWSCredentialResourceListResult - The response of a AWSCredentialResource list operation.
+type AWSCredentialResourceListResult struct {
+	// REQUIRED; The AWSCredentialResource items on this page
+	Value []*AWSCredentialResource `json:"value,omitempty"`
+
+	// The link to the next page of items
+	NextLink *string `json:"nextLink,omitempty"`
+}
+
+// AwsCredentialClientCreateOrUpdateOptions contains the optional parameters for the AwsCredentialClient.CreateOrUpdate method.
+type AwsCredentialClientCreateOrUpdateOptions struct {
+	// placeholder for future optional parameters
+}
+
+// AwsCredentialClientDeleteOptions contains the optional parameters for the AwsCredentialClient.Delete method.
+type AwsCredentialClientDeleteOptions struct {
+	// placeholder for future optional parameters
+}
+
+// AwsCredentialClientGetOptions contains the optional parameters for the AwsCredentialClient.Get method.
+type AwsCredentialClientGetOptions struct {
+	// placeholder for future optional parameters
+}
+
+// AwsCredentialClientListByRootScopeOptions contains the optional parameters for the AwsCredentialClient.ListByRootScope
+// method.
+type AwsCredentialClientListByRootScopeOptions struct {
+	// placeholder for future optional parameters
+}
+
 // AzureCredentialClientCreateOrUpdateOptions contains the optional parameters for the AzureCredentialClient.CreateOrUpdate
 // method.
 type AzureCredentialClientCreateOrUpdateOptions struct {
@@ -67,43 +129,41 @@ type AzureCredentialClientGetOptions struct {
 	// placeholder for future optional parameters
 }
 
-// AzureCredentialClientListOptions contains the optional parameters for the AzureCredentialClient.List method.
-type AzureCredentialClientListOptions struct {
+// AzureCredentialClientListByRootScopeOptions contains the optional parameters for the AzureCredentialClient.ListByRootScope
+// method.
+type AzureCredentialClientListByRootScopeOptions struct {
 	// placeholder for future optional parameters
 }
 
-type AzureServicePrincipalProperties struct {
-	// REQUIRED; A client ID that represents the application.
-	ClientID *string `json:"clientId,omitempty"`
-
-	// REQUIRED; A secret string that the application uses to prove its identity when requesting a token.
-	ClientSecret *string `json:"clientSecret,omitempty"`
+// AzureCredentialPropertiesClassification provides polymorphic access to related types.
+// Call the interface's GetAzureCredentialProperties() method to access the common type.
+// Use a type switch to determine the concrete type.  The possible types are:
+// - *AzureCredentialProperties, *AzureServicePrincipalProperties
+type AzureCredentialPropertiesClassification interface {
+	// GetAzureCredentialProperties returns the AzureCredentialProperties content of the underlying type.
+	GetAzureCredentialProperties() *AzureCredentialProperties
+}
 
-	// REQUIRED; The kind of secret
+// AzureCredentialProperties - Azure Credential properties
+type AzureCredentialProperties struct {
+	// REQUIRED; Discriminator property for AzureCredentialProperties.
 	Kind *string `json:"kind,omitempty"`
 
-	// REQUIRED; Credential storage properties
-	Storage CredentialStoragePropertiesClassification `json:"storage,omitempty"`
-
-	// REQUIRED; A tenant Id that the application is created.
-	TenantID *string `json:"tenantId,omitempty"`
+	// READ-ONLY; Provisioning state of the resource at the time the operation was called
+	ProvisioningState *ProvisioningState `json:"provisioningState,omitempty" azure:"ro"`
 }
 
-// GetCredentialResourceProperties implements the CredentialResourcePropertiesClassification interface for type AzureServicePrincipalProperties.
-func (a *AzureServicePrincipalProperties) GetCredentialResourceProperties() *CredentialResourceProperties {
-	return &CredentialResourceProperties{
-		Kind: a.Kind,
-		Storage: a.Storage,
-	}
-}
+// GetAzureCredentialProperties implements the AzureCredentialPropertiesClassification interface for type AzureCredentialProperties.
+func (a *AzureCredentialProperties) GetAzureCredentialProperties() *AzureCredentialProperties { return a }
 
-// CredentialResource - Credential to a plane instance
-type CredentialResource struct {
+// AzureCredentialResource - Concrete tracked resource types can be created by aliasing this type using a specific property
+// type.
+type AzureCredentialResource struct {
 	// REQUIRED; The geo-location where the resource lives
 	Location *string `json:"location,omitempty"`
 
-	// REQUIRED; Credential properties
-	Properties CredentialResourcePropertiesClassification `json:"properties,omitempty"`
+	// The resource-specific properties for this resource.
+	Properties AzureCredentialPropertiesClassification `json:"properties,omitempty"`
 
 	// Resource tags.
 	Tags map[string]*string `json:"tags,omitempty"`
@@ -114,36 +174,56 @@ type CredentialResource struct {
 	// READ-ONLY; The name of the resource
 	Name *string `json:"name,omitempty" azure:"ro"`
 
+	// READ-ONLY; Azure Resource Manager metadata containing createdBy and modifiedBy information.
+	SystemData *SystemData `json:"systemData,omitempty" azure:"ro"`
+
 	// READ-ONLY; The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
 	Type *string `json:"type,omitempty" azure:"ro"`
 }
 
-// CredentialResourceList - The list of credentials.
-type CredentialResourceList struct {
-	// The list of credentials.
-	Value []*CredentialResource `json:"value,omitempty"`
-}
+// AzureCredentialResourceListResult - The response of a AzureCredentialResource list operation.
+type AzureCredentialResourceListResult struct {
+	// REQUIRED; The AzureCredentialResource items on this page
+	Value []*AzureCredentialResource `json:"value,omitempty"`
 
-// CredentialResourcePropertiesClassification provides polymorphic access to related types.
-// Call the interface's GetCredentialResourceProperties() method to access the common type.
-// Use a type switch to determine the concrete type.  The possible types are:
-// - *AWSCredentialProperties, *AzureServicePrincipalProperties, *CredentialResourceProperties
-type CredentialResourcePropertiesClassification interface {
-	// GetCredentialResourceProperties returns the CredentialResourceProperties content of the underlying type.
-	GetCredentialResourceProperties() *CredentialResourceProperties
+	// The link to the next page of items
+	NextLink *string `json:"nextLink,omitempty"`
 }
 
-// CredentialResourceProperties - Credential properties
-type CredentialResourceProperties struct {
-	// REQUIRED; The kind of secret
+// AzureServicePrincipalProperties - Service Principal credential storage properties
+type AzureServicePrincipalProperties struct {
+	// REQUIRED; clientId for ServicePrincipal
+	ClientID *string `json:"clientId,omitempty"`
+
+	// REQUIRED; secret for ServicePrincipal
+	ClientSecret *string `json:"clientSecret,omitempty"`
+
+	// REQUIRED; Discriminator property for AzureCredentialProperties.
 	Kind *string `json:"kind,omitempty"`
 
-	// REQUIRED; Credential storage properties
+	// REQUIRED; The storage properties
 	Storage CredentialStoragePropertiesClassification `json:"storage,omitempty"`
+
+	// REQUIRED; tenantId for ServicePrincipal
+	TenantID *string `json:"tenantId,omitempty"`
+
+	// READ-ONLY; Provisioning state of the resource at the time the operation was called
+	ProvisioningState *ProvisioningState `json:"provisioningState,omitempty" azure:"ro"`
+}
+
+// GetAzureCredentialProperties implements the AzureCredentialPropertiesClassification interface for type AzureServicePrincipalProperties.
+func (a *AzureServicePrincipalProperties) GetAzureCredentialProperties() *AzureCredentialProperties {
+	return &AzureCredentialProperties{
+		Kind: a.Kind,
+		ProvisioningState: a.ProvisioningState,
+	}
 }
 
-// GetCredentialResourceProperties implements the CredentialResourcePropertiesClassification interface for type CredentialResourceProperties.
-func (c *CredentialResourceProperties) GetCredentialResourceProperties() *CredentialResourceProperties { return c }
+// BasicResourceProperties - Basic properties of a UCP resource.
+type BasicResourceProperties struct {
+	// READ-ONLY; Provisioning state of the resource at the time the operation was called
+	ProvisioningState *ProvisioningState `json:"provisioningState,omitempty" azure:"ro"`
+}
 
 // CredentialStoragePropertiesClassification provides polymorphic access to related types.
 // Call the interface's GetCredentialStorageProperties() method to access the common type.
@@ -156,8 +236,8 @@ type CredentialStoragePropertiesClassification interface {
 
 // CredentialStorageProperties - Credential storage properties
 type CredentialStorageProperties struct {
-	// REQUIRED; credential store kinds supported.
-	Kind *CredentialStorageKind `json:"kind,omitempty"`
+	// REQUIRED; Discriminator property for CredentialStorageProperties.
+	Kind *string `json:"kind,omitempty"`
 }
 
 // GetCredentialStorageProperties implements the CredentialStoragePropertiesClassification interface for type CredentialStorageProperties.
@@ -197,9 +277,10 @@ type ErrorResponse struct {
 	Error *ErrorDetail `json:"error,omitempty"`
 }
 
+// InternalCredentialStorageProperties - Internal credential storage properties
 type InternalCredentialStorageProperties struct {
-	// REQUIRED; credential store kinds supported.
-	Kind *CredentialStorageKind `json:"kind,omitempty"`
+	// REQUIRED; Discriminator property for CredentialStorageProperties.
+	Kind *string `json:"kind,omitempty"`
 
 	// READ-ONLY; The name of secret stored.
 	SecretName *string `json:"secretName,omitempty" azure:"ro"`
@@ -212,12 +293,12 @@ func (i *InternalCredentialStorageProperties) GetCredentialStorageProperties() *
 	}
 }
 
-// PlaneResource - UCP Plane.
+// PlaneResource - UCP PlaneResource.
 type PlaneResource struct {
 	// REQUIRED; The geo-location where the resource lives
 	Location *string `json:"location,omitempty"`
 
-	// REQUIRED; UCP Plane properties
+	// The resource-specific properties for this resource.
 	Properties *PlaneResourceProperties `json:"properties,omitempty"`
 
 	// Resource tags.
@@ -229,19 +310,25 @@ type PlaneResource struct {
 	// READ-ONLY; The name of the resource
 	Name *string `json:"name,omitempty" azure:"ro"`
 
+	// READ-ONLY; Azure Resource Manager metadata containing createdBy and modifiedBy information.
+	SystemData *SystemData `json:"systemData,omitempty" azure:"ro"`
+
 	// READ-ONLY; The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
 	Type *string `json:"type,omitempty" azure:"ro"`
 }
 
-// PlaneResourceList - The list of planes.
-type PlaneResourceList struct {
-	// The list of planes.
+// PlaneResourceListResult - The response of a PlaneResource list operation.
+type PlaneResourceListResult struct {
+	// REQUIRED; The PlaneResource items on this page
 	Value []*PlaneResource `json:"value,omitempty"`
+
+	// The link to the next page of items
+	NextLink *string `json:"nextLink,omitempty"`
 }
 
-// PlaneResourceProperties - UCP Plane properties
+// PlaneResourceProperties - Plane properties.
 type PlaneResourceProperties struct {
-	// REQUIRED; Plane kinds supported.
+	// REQUIRED; The kind of plane
 	Kind *PlaneKind `json:"kind,omitempty"`
 
 	// Resource Providers for UCP Native Plane
@@ -249,6 +336,14 @@ type PlaneResourceProperties struct {
 
 	// URL to forward requests to for non UCP Native Plane
 	URL *string `json:"url,omitempty"`
+
+	// READ-ONLY; Provisioning state of the resource at the time the operation was called
+	ProvisioningState *ProvisioningState `json:"provisioningState,omitempty" azure:"ro"`
+}
+
+// PlaneTypesClientGetOptions contains the optional parameters for the PlaneTypesClient.Get method.
+type PlaneTypesClientGetOptions struct {
+	// placeholder for future optional parameters
 }
 
 // PlanesClientCreateOrUpdateOptions contains the optional parameters for the PlanesClient.CreateOrUpdate method.
@@ -266,13 +361,8 @@ type PlanesClientGetOptions struct {
 	// placeholder for future optional parameters
 }
 
-// PlanesClientListOptions contains the optional parameters for the PlanesClient.List method.
-type PlanesClientListOptions struct {
-	// placeholder for future optional parameters
-}
-
-// PlanesTypeClientListOptions contains the optional parameters for the PlanesTypeClient.List method.
-type PlanesTypeClientListOptions struct {
+// PlanesClientListByRootScopeOptions contains the optional parameters for the PlanesClient.ListByRootScope method.
+type PlanesClientListByRootScopeOptions struct {
 	// placeholder for future optional parameters
 }
 
@@ -284,6 +374,9 @@ type Resource struct {
 	// READ-ONLY; The name of the resource
 	Name *string `json:"name,omitempty" azure:"ro"`
 
+	// READ-ONLY; Azure Resource Manager metadata containing createdBy and modifiedBy information.
+	SystemData *SystemData `json:"systemData,omitempty" azure:"ro"`
+
 	// READ-ONLY; The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
 	Type *string `json:"type,omitempty" azure:"ro"`
 }
@@ -293,6 +386,9 @@ type ResourceGroupResource struct {
 	// REQUIRED; The geo-location where the resource lives
 	Location *string `json:"location,omitempty"`
 
+	// The resource-specific properties for this resource.
+	Properties *BasicResourceProperties `json:"properties,omitempty"`
+
 	// Resource tags.
 	Tags map[string]*string `json:"tags,omitempty"`
 
@@ -302,14 +398,20 @@ type ResourceGroupResource struct {
 	// READ-ONLY; The name of the resource
 	Name *string `json:"name,omitempty" azure:"ro"`
 
+	// READ-ONLY; Azure Resource Manager metadata containing createdBy and modifiedBy information.
+	SystemData *SystemData `json:"systemData,omitempty" azure:"ro"`
+
 	// READ-ONLY; The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
 	Type *string `json:"type,omitempty" azure:"ro"`
 }
 
-// ResourceGroupResourceList - The list of resource groups.
-type ResourceGroupResourceList struct {
-	// The list of resource groups.
+// ResourceGroupResourceListResult - The response of a ResourceGroupResource list operation.
+type ResourceGroupResourceListResult struct {
+	// REQUIRED; The ResourceGroupResource items on this page
 	Value []*ResourceGroupResource `json:"value,omitempty"`
+
+	// The link to the next page of items
+	NextLink *string `json:"nextLink,omitempty"`
 }
 
 // ResourceGroupsClientCreateOrUpdateOptions contains the optional parameters for the ResourceGroupsClient.CreateOrUpdate
@@ -328,11 +430,33 @@ type ResourceGroupsClientGetOptions struct {
 	// placeholder for future optional parameters
 }
 
-// ResourceGroupsClientListOptions contains the optional parameters for the ResourceGroupsClient.List method.
-type ResourceGroupsClientListOptions struct {
+// ResourceGroupsClientListByRootScopeOptions contains the optional parameters for the ResourceGroupsClient.ListByRootScope
+// method.
+type ResourceGroupsClientListByRootScopeOptions struct {
 	// placeholder for future optional parameters
 }
 
+// SystemData - Metadata pertaining to creation and last modification of the resource.
+type SystemData struct {
+	// The timestamp of resource creation (UTC).
+	CreatedAt *time.Time `json:"createdAt,omitempty"`
+
+	// The identity that created the resource.
+	CreatedBy *string `json:"createdBy,omitempty"`
+
+	// The type of identity that created the resource.
+	CreatedByType *CreatedByType `json:"createdByType,omitempty"`
+
+	// The timestamp of resource last modification (UTC)
+	LastModifiedAt *time.Time `json:"lastModifiedAt,omitempty"`
+
+	// The identity that last modified the resource.
+	LastModifiedBy *string `json:"lastModifiedBy,omitempty"`
+
+	// The type of identity that last modified the resource.
+	LastModifiedByType *CreatedByType `json:"lastModifiedByType,omitempty"`
+}
+
 // TrackedResource - The resource model definition for an Azure Resource Manager tracked top level resource which has 'tags'
 // and a 'location'
 type TrackedResource struct {
@@ -348,6 +472,9 @@ type TrackedResource struct {
 	// READ-ONLY; The name of the resource
 	Name *string `json:"name,omitempty" azure:"ro"`
 
+	// READ-ONLY; Azure Resource Manager metadata containing createdBy and modifiedBy information.
+	SystemData *SystemData `json:"systemData,omitempty" azure:"ro"`
+
 	// READ-ONLY; The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
 	Type *string `json:"type,omitempty" azure:"ro"`
 }
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_models_serde.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_models_serde.go
index aa7cc1680..fd13571c8 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_models_serde.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_models_serde.go
@@ -16,18 +16,19 @@ import (
 	"reflect"
 )
 
-// MarshalJSON implements the json.Marshaller interface for type AWSCredentialProperties.
-func (a AWSCredentialProperties) MarshalJSON() ([]byte, error) {
+// MarshalJSON implements the json.Marshaller interface for type AWSAccessKeyCredentialProperties.
+func (a AWSAccessKeyCredentialProperties) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
 	populate(objectMap, "accessKeyId", a.AccessKeyID)
-	objectMap["kind"] = "aws.com.iam"
+	objectMap["kind"] = "AccessKey"
+	populate(objectMap, "provisioningState", a.ProvisioningState)
 	populate(objectMap, "secretAccessKey", a.SecretAccessKey)
 	populate(objectMap, "storage", a.Storage)
 	return json.Marshal(objectMap)
 }
 
-// UnmarshalJSON implements the json.Unmarshaller interface for type AWSCredentialProperties.
-func (a *AWSCredentialProperties) UnmarshalJSON(data []byte) error {
+// UnmarshalJSON implements the json.Unmarshaller interface for type AWSAccessKeyCredentialProperties.
+func (a *AWSAccessKeyCredentialProperties) UnmarshalJSON(data []byte) error {
 	var rawMsg map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawMsg); err != nil {
 		return fmt.Errorf("unmarshalling type %T: %v", a, err)
@@ -41,6 +42,9 @@ func (a *AWSCredentialProperties) UnmarshalJSON(data []byte) error {
 		case "kind":
 				err = unpopulate(val, "Kind", &a.Kind)
 				delete(rawMsg, key)
+		case "provisioningState":
+				err = unpopulate(val, "ProvisioningState", &a.ProvisioningState)
+				delete(rawMsg, key)
 		case "secretAccessKey":
 				err = unpopulate(val, "SecretAccessKey", &a.SecretAccessKey)
 				delete(rawMsg, key)
@@ -55,19 +59,16 @@ func (a *AWSCredentialProperties) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// MarshalJSON implements the json.Marshaller interface for type AzureServicePrincipalProperties.
-func (a AzureServicePrincipalProperties) MarshalJSON() ([]byte, error) {
+// MarshalJSON implements the json.Marshaller interface for type AWSCredentialProperties.
+func (a AWSCredentialProperties) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
-	populate(objectMap, "clientId", a.ClientID)
-	populate(objectMap, "clientSecret", a.ClientSecret)
-	objectMap["kind"] = "azure.com.serviceprincipal"
-	populate(objectMap, "storage", a.Storage)
-	populate(objectMap, "tenantId", a.TenantID)
+	objectMap["kind"] = a.Kind
+	populate(objectMap, "provisioningState", a.ProvisioningState)
 	return json.Marshal(objectMap)
 }
 
-// UnmarshalJSON implements the json.Unmarshaller interface for type AzureServicePrincipalProperties.
-func (a *AzureServicePrincipalProperties) UnmarshalJSON(data []byte) error {
+// UnmarshalJSON implements the json.Unmarshaller interface for type AWSCredentialProperties.
+func (a *AWSCredentialProperties) UnmarshalJSON(data []byte) error {
 	var rawMsg map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawMsg); err != nil {
 		return fmt.Errorf("unmarshalling type %T: %v", a, err)
@@ -75,20 +76,124 @@ func (a *AzureServicePrincipalProperties) UnmarshalJSON(data []byte) error {
 	for key, val := range rawMsg {
 		var err error
 		switch key {
-		case "clientId":
-				err = unpopulate(val, "ClientID", &a.ClientID)
+		case "kind":
+				err = unpopulate(val, "Kind", &a.Kind)
 				delete(rawMsg, key)
-		case "clientSecret":
-				err = unpopulate(val, "ClientSecret", &a.ClientSecret)
+		case "provisioningState":
+				err = unpopulate(val, "ProvisioningState", &a.ProvisioningState)
+				delete(rawMsg, key)
+		}
+		if err != nil {
+			return fmt.Errorf("unmarshalling type %T: %v", a, err)
+		}
+	}
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaller interface for type AWSCredentialResource.
+func (a AWSCredentialResource) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	populate(objectMap, "id", a.ID)
+	populate(objectMap, "location", a.Location)
+	populate(objectMap, "name", a.Name)
+	populate(objectMap, "properties", a.Properties)
+	populate(objectMap, "systemData", a.SystemData)
+	populate(objectMap, "tags", a.Tags)
+	populate(objectMap, "type", a.Type)
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface for type AWSCredentialResource.
+func (a *AWSCredentialResource) UnmarshalJSON(data []byte) error {
+	var rawMsg map[string]json.RawMessage
+	if err := json.Unmarshal(data, &rawMsg); err != nil {
+		return fmt.Errorf("unmarshalling type %T: %v", a, err)
+	}
+	for key, val := range rawMsg {
+		var err error
+		switch key {
+		case "id":
+				err = unpopulate(val, "ID", &a.ID)
+				delete(rawMsg, key)
+		case "location":
+				err = unpopulate(val, "Location", &a.Location)
+				delete(rawMsg, key)
+		case "name":
+				err = unpopulate(val, "Name", &a.Name)
+				delete(rawMsg, key)
+		case "properties":
+				a.Properties, err = unmarshalAWSCredentialPropertiesClassification(val)
+				delete(rawMsg, key)
+		case "systemData":
+				err = unpopulate(val, "SystemData", &a.SystemData)
+				delete(rawMsg, key)
+		case "tags":
+				err = unpopulate(val, "Tags", &a.Tags)
 				delete(rawMsg, key)
+		case "type":
+				err = unpopulate(val, "Type", &a.Type)
+				delete(rawMsg, key)
+		}
+		if err != nil {
+			return fmt.Errorf("unmarshalling type %T: %v", a, err)
+		}
+	}
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaller interface for type AWSCredentialResourceListResult.
+func (a AWSCredentialResourceListResult) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	populate(objectMap, "nextLink", a.NextLink)
+	populate(objectMap, "value", a.Value)
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface for type AWSCredentialResourceListResult.
+func (a *AWSCredentialResourceListResult) UnmarshalJSON(data []byte) error {
+	var rawMsg map[string]json.RawMessage
+	if err := json.Unmarshal(data, &rawMsg); err != nil {
+		return fmt.Errorf("unmarshalling type %T: %v", a, err)
+	}
+	for key, val := range rawMsg {
+		var err error
+		switch key {
+		case "nextLink":
+				err = unpopulate(val, "NextLink", &a.NextLink)
+				delete(rawMsg, key)
+		case "value":
+				err = unpopulate(val, "Value", &a.Value)
+				delete(rawMsg, key)
+		}
+		if err != nil {
+			return fmt.Errorf("unmarshalling type %T: %v", a, err)
+		}
+	}
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaller interface for type AzureCredentialProperties.
+func (a AzureCredentialProperties) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	objectMap["kind"] = a.Kind
+	populate(objectMap, "provisioningState", a.ProvisioningState)
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface for type AzureCredentialProperties.
+func (a *AzureCredentialProperties) UnmarshalJSON(data []byte) error {
+	var rawMsg map[string]json.RawMessage
+	if err := json.Unmarshal(data, &rawMsg); err != nil {
+		return fmt.Errorf("unmarshalling type %T: %v", a, err)
+	}
+	for key, val := range rawMsg {
+		var err error
+		switch key {
 		case "kind":
 				err = unpopulate(val, "Kind", &a.Kind)
 				delete(rawMsg, key)
-		case "storage":
-				a.Storage, err = unmarshalCredentialStoragePropertiesClassification(val)
-				delete(rawMsg, key)
-		case "tenantId":
-				err = unpopulate(val, "TenantID", &a.TenantID)
+		case "provisioningState":
+				err = unpopulate(val, "ProvisioningState", &a.ProvisioningState)
 				delete(rawMsg, key)
 		}
 		if err != nil {
@@ -98,106 +203,157 @@ func (a *AzureServicePrincipalProperties) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// MarshalJSON implements the json.Marshaller interface for type CredentialResource.
-func (c CredentialResource) MarshalJSON() ([]byte, error) {
+// MarshalJSON implements the json.Marshaller interface for type AzureCredentialResource.
+func (a AzureCredentialResource) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
-	populate(objectMap, "id", c.ID)
-	populate(objectMap, "location", c.Location)
-	populate(objectMap, "name", c.Name)
-	populate(objectMap, "properties", c.Properties)
-	populate(objectMap, "tags", c.Tags)
-	populate(objectMap, "type", c.Type)
+	populate(objectMap, "id", a.ID)
+	populate(objectMap, "location", a.Location)
+	populate(objectMap, "name", a.Name)
+	populate(objectMap, "properties", a.Properties)
+	populate(objectMap, "systemData", a.SystemData)
+	populate(objectMap, "tags", a.Tags)
+	populate(objectMap, "type", a.Type)
 	return json.Marshal(objectMap)
 }
 
-// UnmarshalJSON implements the json.Unmarshaller interface for type CredentialResource.
-func (c *CredentialResource) UnmarshalJSON(data []byte) error {
+// UnmarshalJSON implements the json.Unmarshaller interface for type AzureCredentialResource.
+func (a *AzureCredentialResource) UnmarshalJSON(data []byte) error {
 	var rawMsg map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawMsg); err != nil {
-		return fmt.Errorf("unmarshalling type %T: %v", c, err)
+		return fmt.Errorf("unmarshalling type %T: %v", a, err)
 	}
 	for key, val := range rawMsg {
 		var err error
 		switch key {
 		case "id":
-				err = unpopulate(val, "ID", &c.ID)
+				err = unpopulate(val, "ID", &a.ID)
 				delete(rawMsg, key)
 		case "location":
-				err = unpopulate(val, "Location", &c.Location)
+				err = unpopulate(val, "Location", &a.Location)
 				delete(rawMsg, key)
 		case "name":
-				err = unpopulate(val, "Name", &c.Name)
+				err = unpopulate(val, "Name", &a.Name)
 				delete(rawMsg, key)
 		case "properties":
-				c.Properties, err = unmarshalCredentialResourcePropertiesClassification(val)
+				a.Properties, err = unmarshalAzureCredentialPropertiesClassification(val)
+				delete(rawMsg, key)
+		case "systemData":
+				err = unpopulate(val, "SystemData", &a.SystemData)
 				delete(rawMsg, key)
 		case "tags":
-				err = unpopulate(val, "Tags", &c.Tags)
+				err = unpopulate(val, "Tags", &a.Tags)
 				delete(rawMsg, key)
 		case "type":
-				err = unpopulate(val, "Type", &c.Type)
+				err = unpopulate(val, "Type", &a.Type)
 				delete(rawMsg, key)
 		}
 		if err != nil {
-			return fmt.Errorf("unmarshalling type %T: %v", c, err)
+			return fmt.Errorf("unmarshalling type %T: %v", a, err)
 		}
 	}
 	return nil
 }
 
-// MarshalJSON implements the json.Marshaller interface for type CredentialResourceList.
-func (c CredentialResourceList) MarshalJSON() ([]byte, error) {
+// MarshalJSON implements the json.Marshaller interface for type AzureCredentialResourceListResult.
+func (a AzureCredentialResourceListResult) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
-	populate(objectMap, "value", c.Value)
+	populate(objectMap, "nextLink", a.NextLink)
+	populate(objectMap, "value", a.Value)
 	return json.Marshal(objectMap)
 }
 
-// UnmarshalJSON implements the json.Unmarshaller interface for type CredentialResourceList.
-func (c *CredentialResourceList) UnmarshalJSON(data []byte) error {
+// UnmarshalJSON implements the json.Unmarshaller interface for type AzureCredentialResourceListResult.
+func (a *AzureCredentialResourceListResult) UnmarshalJSON(data []byte) error {
 	var rawMsg map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawMsg); err != nil {
-		return fmt.Errorf("unmarshalling type %T: %v", c, err)
+		return fmt.Errorf("unmarshalling type %T: %v", a, err)
 	}
 	for key, val := range rawMsg {
 		var err error
 		switch key {
+		case "nextLink":
+				err = unpopulate(val, "NextLink", &a.NextLink)
+				delete(rawMsg, key)
 		case "value":
-				err = unpopulate(val, "Value", &c.Value)
+				err = unpopulate(val, "Value", &a.Value)
 				delete(rawMsg, key)
 		}
 		if err != nil {
-			return fmt.Errorf("unmarshalling type %T: %v", c, err)
+			return fmt.Errorf("unmarshalling type %T: %v", a, err)
 		}
 	}
 	return nil
 }
 
-// MarshalJSON implements the json.Marshaller interface for type CredentialResourceProperties.
-func (c CredentialResourceProperties) MarshalJSON() ([]byte, error) {
+// MarshalJSON implements the json.Marshaller interface for type AzureServicePrincipalProperties.
+func (a AzureServicePrincipalProperties) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
-	objectMap["kind"] = c.Kind
-	populate(objectMap, "storage", c.Storage)
+	populate(objectMap, "clientId", a.ClientID)
+	populate(objectMap, "clientSecret", a.ClientSecret)
+	objectMap["kind"] = "ServicePrincipal"
+	populate(objectMap, "provisioningState", a.ProvisioningState)
+	populate(objectMap, "storage", a.Storage)
+	populate(objectMap, "tenantId", a.TenantID)
 	return json.Marshal(objectMap)
 }
 
-// UnmarshalJSON implements the json.Unmarshaller interface for type CredentialResourceProperties.
-func (c *CredentialResourceProperties) UnmarshalJSON(data []byte) error {
+// UnmarshalJSON implements the json.Unmarshaller interface for type AzureServicePrincipalProperties.
+func (a *AzureServicePrincipalProperties) UnmarshalJSON(data []byte) error {
 	var rawMsg map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawMsg); err != nil {
-		return fmt.Errorf("unmarshalling type %T: %v", c, err)
+		return fmt.Errorf("unmarshalling type %T: %v", a, err)
 	}
 	for key, val := range rawMsg {
 		var err error
 		switch key {
+		case "clientId":
+				err = unpopulate(val, "ClientID", &a.ClientID)
+				delete(rawMsg, key)
+		case "clientSecret":
+				err = unpopulate(val, "ClientSecret", &a.ClientSecret)
+				delete(rawMsg, key)
 		case "kind":
-				err = unpopulate(val, "Kind", &c.Kind)
+				err = unpopulate(val, "Kind", &a.Kind)
+				delete(rawMsg, key)
+		case "provisioningState":
+				err = unpopulate(val, "ProvisioningState", &a.ProvisioningState)
 				delete(rawMsg, key)
 		case "storage":
-				c.Storage, err = unmarshalCredentialStoragePropertiesClassification(val)
+				a.Storage, err = unmarshalCredentialStoragePropertiesClassification(val)
+				delete(rawMsg, key)
+		case "tenantId":
+				err = unpopulate(val, "TenantID", &a.TenantID)
 				delete(rawMsg, key)
 		}
 		if err != nil {
-			return fmt.Errorf("unmarshalling type %T: %v", c, err)
+			return fmt.Errorf("unmarshalling type %T: %v", a, err)
+		}
+	}
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaller interface for type BasicResourceProperties.
+func (b BasicResourceProperties) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	populate(objectMap, "provisioningState", b.ProvisioningState)
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface for type BasicResourceProperties.
+func (b *BasicResourceProperties) UnmarshalJSON(data []byte) error {
+	var rawMsg map[string]json.RawMessage
+	if err := json.Unmarshal(data, &rawMsg); err != nil {
+		return fmt.Errorf("unmarshalling type %T: %v", b, err)
+	}
+	for key, val := range rawMsg {
+		var err error
+		switch key {
+		case "provisioningState":
+				err = unpopulate(val, "ProvisioningState", &b.ProvisioningState)
+				delete(rawMsg, key)
+		}
+		if err != nil {
+			return fmt.Errorf("unmarshalling type %T: %v", b, err)
 		}
 	}
 	return nil
@@ -334,7 +490,7 @@ func (e *ErrorResponse) UnmarshalJSON(data []byte) error {
 // MarshalJSON implements the json.Marshaller interface for type InternalCredentialStorageProperties.
 func (i InternalCredentialStorageProperties) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
-	objectMap["kind"] = CredentialStorageKindInternal
+	objectMap["kind"] = "Internal"
 	populate(objectMap, "secretName", i.SecretName)
 	return json.Marshal(objectMap)
 }
@@ -369,6 +525,7 @@ func (p PlaneResource) MarshalJSON() ([]byte, error) {
 	populate(objectMap, "location", p.Location)
 	populate(objectMap, "name", p.Name)
 	populate(objectMap, "properties", p.Properties)
+	populate(objectMap, "systemData", p.SystemData)
 	populate(objectMap, "tags", p.Tags)
 	populate(objectMap, "type", p.Type)
 	return json.Marshal(objectMap)
@@ -395,6 +552,9 @@ func (p *PlaneResource) UnmarshalJSON(data []byte) error {
 		case "properties":
 				err = unpopulate(val, "Properties", &p.Properties)
 				delete(rawMsg, key)
+		case "systemData":
+				err = unpopulate(val, "SystemData", &p.SystemData)
+				delete(rawMsg, key)
 		case "tags":
 				err = unpopulate(val, "Tags", &p.Tags)
 				delete(rawMsg, key)
@@ -409,15 +569,16 @@ func (p *PlaneResource) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// MarshalJSON implements the json.Marshaller interface for type PlaneResourceList.
-func (p PlaneResourceList) MarshalJSON() ([]byte, error) {
+// MarshalJSON implements the json.Marshaller interface for type PlaneResourceListResult.
+func (p PlaneResourceListResult) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
+	populate(objectMap, "nextLink", p.NextLink)
 	populate(objectMap, "value", p.Value)
 	return json.Marshal(objectMap)
 }
 
-// UnmarshalJSON implements the json.Unmarshaller interface for type PlaneResourceList.
-func (p *PlaneResourceList) UnmarshalJSON(data []byte) error {
+// UnmarshalJSON implements the json.Unmarshaller interface for type PlaneResourceListResult.
+func (p *PlaneResourceListResult) UnmarshalJSON(data []byte) error {
 	var rawMsg map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawMsg); err != nil {
 		return fmt.Errorf("unmarshalling type %T: %v", p, err)
@@ -425,6 +586,9 @@ func (p *PlaneResourceList) UnmarshalJSON(data []byte) error {
 	for key, val := range rawMsg {
 		var err error
 		switch key {
+		case "nextLink":
+				err = unpopulate(val, "NextLink", &p.NextLink)
+				delete(rawMsg, key)
 		case "value":
 				err = unpopulate(val, "Value", &p.Value)
 				delete(rawMsg, key)
@@ -440,6 +604,7 @@ func (p *PlaneResourceList) UnmarshalJSON(data []byte) error {
 func (p PlaneResourceProperties) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
 	populate(objectMap, "kind", p.Kind)
+	populate(objectMap, "provisioningState", p.ProvisioningState)
 	populate(objectMap, "resourceProviders", p.ResourceProviders)
 	populate(objectMap, "url", p.URL)
 	return json.Marshal(objectMap)
@@ -457,6 +622,9 @@ func (p *PlaneResourceProperties) UnmarshalJSON(data []byte) error {
 		case "kind":
 				err = unpopulate(val, "Kind", &p.Kind)
 				delete(rawMsg, key)
+		case "provisioningState":
+				err = unpopulate(val, "ProvisioningState", &p.ProvisioningState)
+				delete(rawMsg, key)
 		case "resourceProviders":
 				err = unpopulate(val, "ResourceProviders", &p.ResourceProviders)
 				delete(rawMsg, key)
@@ -476,6 +644,7 @@ func (r Resource) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
 	populate(objectMap, "id", r.ID)
 	populate(objectMap, "name", r.Name)
+	populate(objectMap, "systemData", r.SystemData)
 	populate(objectMap, "type", r.Type)
 	return json.Marshal(objectMap)
 }
@@ -495,6 +664,9 @@ func (r *Resource) UnmarshalJSON(data []byte) error {
 		case "name":
 				err = unpopulate(val, "Name", &r.Name)
 				delete(rawMsg, key)
+		case "systemData":
+				err = unpopulate(val, "SystemData", &r.SystemData)
+				delete(rawMsg, key)
 		case "type":
 				err = unpopulate(val, "Type", &r.Type)
 				delete(rawMsg, key)
@@ -512,6 +684,8 @@ func (r ResourceGroupResource) MarshalJSON() ([]byte, error) {
 	populate(objectMap, "id", r.ID)
 	populate(objectMap, "location", r.Location)
 	populate(objectMap, "name", r.Name)
+	populate(objectMap, "properties", r.Properties)
+	populate(objectMap, "systemData", r.SystemData)
 	populate(objectMap, "tags", r.Tags)
 	populate(objectMap, "type", r.Type)
 	return json.Marshal(objectMap)
@@ -535,6 +709,12 @@ func (r *ResourceGroupResource) UnmarshalJSON(data []byte) error {
 		case "name":
 				err = unpopulate(val, "Name", &r.Name)
 				delete(rawMsg, key)
+		case "properties":
+				err = unpopulate(val, "Properties", &r.Properties)
+				delete(rawMsg, key)
+		case "systemData":
+				err = unpopulate(val, "SystemData", &r.SystemData)
+				delete(rawMsg, key)
 		case "tags":
 				err = unpopulate(val, "Tags", &r.Tags)
 				delete(rawMsg, key)
@@ -549,15 +729,16 @@ func (r *ResourceGroupResource) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// MarshalJSON implements the json.Marshaller interface for type ResourceGroupResourceList.
-func (r ResourceGroupResourceList) MarshalJSON() ([]byte, error) {
+// MarshalJSON implements the json.Marshaller interface for type ResourceGroupResourceListResult.
+func (r ResourceGroupResourceListResult) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
+	populate(objectMap, "nextLink", r.NextLink)
 	populate(objectMap, "value", r.Value)
 	return json.Marshal(objectMap)
 }
 
-// UnmarshalJSON implements the json.Unmarshaller interface for type ResourceGroupResourceList.
-func (r *ResourceGroupResourceList) UnmarshalJSON(data []byte) error {
+// UnmarshalJSON implements the json.Unmarshaller interface for type ResourceGroupResourceListResult.
+func (r *ResourceGroupResourceListResult) UnmarshalJSON(data []byte) error {
 	var rawMsg map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawMsg); err != nil {
 		return fmt.Errorf("unmarshalling type %T: %v", r, err)
@@ -565,6 +746,9 @@ func (r *ResourceGroupResourceList) UnmarshalJSON(data []byte) error {
 	for key, val := range rawMsg {
 		var err error
 		switch key {
+		case "nextLink":
+				err = unpopulate(val, "NextLink", &r.NextLink)
+				delete(rawMsg, key)
 		case "value":
 				err = unpopulate(val, "Value", &r.Value)
 				delete(rawMsg, key)
@@ -576,12 +760,60 @@ func (r *ResourceGroupResourceList) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
+// MarshalJSON implements the json.Marshaller interface for type SystemData.
+func (s SystemData) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	populateTimeRFC3339(objectMap, "createdAt", s.CreatedAt)
+	populate(objectMap, "createdBy", s.CreatedBy)
+	populate(objectMap, "createdByType", s.CreatedByType)
+	populateTimeRFC3339(objectMap, "lastModifiedAt", s.LastModifiedAt)
+	populate(objectMap, "lastModifiedBy", s.LastModifiedBy)
+	populate(objectMap, "lastModifiedByType", s.LastModifiedByType)
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface for type SystemData.
+func (s *SystemData) UnmarshalJSON(data []byte) error {
+	var rawMsg map[string]json.RawMessage
+	if err := json.Unmarshal(data, &rawMsg); err != nil {
+		return fmt.Errorf("unmarshalling type %T: %v", s, err)
+	}
+	for key, val := range rawMsg {
+		var err error
+		switch key {
+		case "createdAt":
+				err = unpopulateTimeRFC3339(val, "CreatedAt", &s.CreatedAt)
+				delete(rawMsg, key)
+		case "createdBy":
+				err = unpopulate(val, "CreatedBy", &s.CreatedBy)
+				delete(rawMsg, key)
+		case "createdByType":
+				err = unpopulate(val, "CreatedByType", &s.CreatedByType)
+				delete(rawMsg, key)
+		case "lastModifiedAt":
+				err = unpopulateTimeRFC3339(val, "LastModifiedAt", &s.LastModifiedAt)
+				delete(rawMsg, key)
+		case "lastModifiedBy":
+				err = unpopulate(val, "LastModifiedBy", &s.LastModifiedBy)
+				delete(rawMsg, key)
+		case "lastModifiedByType":
+				err = unpopulate(val, "LastModifiedByType", &s.LastModifiedByType)
+				delete(rawMsg, key)
+		}
+		if err != nil {
+			return fmt.Errorf("unmarshalling type %T: %v", s, err)
+		}
+	}
+	return nil
+}
+
 // MarshalJSON implements the json.Marshaller interface for type TrackedResource.
 func (t TrackedResource) MarshalJSON() ([]byte, error) {
 	objectMap := make(map[string]interface{})
 	populate(objectMap, "id", t.ID)
 	populate(objectMap, "location", t.Location)
 	populate(objectMap, "name", t.Name)
+	populate(objectMap, "systemData", t.SystemData)
 	populate(objectMap, "tags", t.Tags)
 	populate(objectMap, "type", t.Type)
 	return json.Marshal(objectMap)
@@ -605,6 +837,9 @@ func (t *TrackedResource) UnmarshalJSON(data []byte) error {
 		case "name":
 				err = unpopulate(val, "Name", &t.Name)
 				delete(rawMsg, key)
+		case "systemData":
+				err = unpopulate(val, "SystemData", &t.SystemData)
+				delete(rawMsg, key)
 		case "tags":
 				err = unpopulate(val, "Tags", &t.Tags)
 				delete(rawMsg, key)
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_planes_client.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_planes_client.go
index b0202c325..0f6182b09 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_planes_client.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_planes_client.go
@@ -20,6 +20,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 )
 
@@ -52,15 +53,15 @@ pl: pl,
 	return client, nil
 }
 
-// CreateOrUpdate - Create or update a Plane.
+// CreateOrUpdate - Creates or updates a PlaneResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
+// planeType - The plane type.
 // planeName - The name of the plane
-// plane - plane details
+// resource - Resource create parameters.
 // options - PlanesClientCreateOrUpdateOptions contains the optional parameters for the PlanesClient.CreateOrUpdate method.
-func (client *PlanesClient) CreateOrUpdate(ctx context.Context, planeType string, planeName string, plane PlaneResource, options *PlanesClientCreateOrUpdateOptions) (PlanesClientCreateOrUpdateResponse, error) {
-	req, err := client.createOrUpdateCreateRequest(ctx, planeType, planeName, plane, options)
+func (client *PlanesClient) CreateOrUpdate(ctx context.Context, planeType string, planeName string, resource PlaneResource, options *PlanesClientCreateOrUpdateOptions) (PlanesClientCreateOrUpdateResponse, error) {
+	req, err := client.createOrUpdateCreateRequest(ctx, planeType, planeName, resource, options)
 	if err != nil {
 		return PlanesClientCreateOrUpdateResponse{}, err
 	}
@@ -68,23 +69,20 @@ func (client *PlanesClient) CreateOrUpdate(ctx context.Context, planeType string
 	if err != nil {
 		return PlanesClientCreateOrUpdateResponse{}, err
 	}
-	if !runtime.HasStatusCode(resp, http.StatusOK) {
+	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusCreated) {
 		return PlanesClientCreateOrUpdateResponse{}, runtime.NewResponseError(resp)
 	}
 	return client.createOrUpdateHandleResponse(resp)
 }
 
 // createOrUpdateCreateRequest creates the CreateOrUpdate request.
-func (client *PlanesClient) createOrUpdateCreateRequest(ctx context.Context, planeType string, planeName string, plane PlaneResource, options *PlanesClientCreateOrUpdateOptions) (*policy.Request, error) {
+func (client *PlanesClient) createOrUpdateCreateRequest(ctx context.Context, planeType string, planeName string, resource PlaneResource, options *PlanesClientCreateOrUpdateOptions) (*policy.Request, error) {
 	urlPath := "/planes/{planeType}/{planeName}"
 	if planeType == "" {
 		return nil, errors.New("parameter planeType cannot be empty")
 	}
 	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	req, err := runtime.NewRequest(ctx, http.MethodPut, runtime.JoinPaths(client.host, urlPath))
 	if err != nil {
 		return nil, err
@@ -93,22 +91,30 @@ func (client *PlanesClient) createOrUpdateCreateRequest(ctx context.Context, pla
 	reqQP.Set("api-version", "2022-09-01-privatepreview")
 	req.Raw().URL.RawQuery = reqQP.Encode()
 	req.Raw().Header["Accept"] = []string{"application/json"}
-	return req, runtime.MarshalAsJSON(req, plane)
+	return req, runtime.MarshalAsJSON(req, resource)
 }
 
 // createOrUpdateHandleResponse handles the CreateOrUpdate response.
 func (client *PlanesClient) createOrUpdateHandleResponse(resp *http.Response) (PlanesClientCreateOrUpdateResponse, error) {
 	result := PlanesClientCreateOrUpdateResponse{}
+	if val := resp.Header.Get("Retry-After"); val != "" {
+		retryAfter32, err := strconv.ParseInt(val, 10, 32)
+		retryAfter := int32(retryAfter32)
+		if err != nil {
+			return PlanesClientCreateOrUpdateResponse{}, err
+		}
+		result.RetryAfter = &retryAfter
+	}
 	if err := runtime.UnmarshalAsJSON(resp, &result.PlaneResource); err != nil {
 		return PlanesClientCreateOrUpdateResponse{}, err
 	}
 	return result, nil
 }
 
-// Delete - Delete a Plane.
+// Delete - Deletes an existing PlaneResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
+// planeType - The plane type.
 // planeName - The name of the plane
 // options - PlanesClientDeleteOptions contains the optional parameters for the PlanesClient.Delete method.
 func (client *PlanesClient) Delete(ctx context.Context, planeType string, planeName string, options *PlanesClientDeleteOptions) (PlanesClientDeleteResponse, error) {
@@ -120,10 +126,10 @@ func (client *PlanesClient) Delete(ctx context.Context, planeType string, planeN
 	if err != nil {
 		return PlanesClientDeleteResponse{}, err
 	}
-	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusNoContent) {
+	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusAccepted, http.StatusNoContent) {
 		return PlanesClientDeleteResponse{}, runtime.NewResponseError(resp)
 	}
-	return PlanesClientDeleteResponse{}, nil
+	return client.deleteHandleResponse(resp)
 }
 
 // deleteCreateRequest creates the Delete request.
@@ -133,10 +139,7 @@ func (client *PlanesClient) deleteCreateRequest(ctx context.Context, planeType s
 		return nil, errors.New("parameter planeType cannot be empty")
 	}
 	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	req, err := runtime.NewRequest(ctx, http.MethodDelete, runtime.JoinPaths(client.host, urlPath))
 	if err != nil {
 		return nil, err
@@ -148,10 +151,24 @@ func (client *PlanesClient) deleteCreateRequest(ctx context.Context, planeType s
 	return req, nil
 }
 
-// Get - Gets the properties of a UCP Plane.
+// deleteHandleResponse handles the Delete response.
+func (client *PlanesClient) deleteHandleResponse(resp *http.Response) (PlanesClientDeleteResponse, error) {
+	result := PlanesClientDeleteResponse{}
+	if val := resp.Header.Get("Retry-After"); val != "" {
+		retryAfter32, err := strconv.ParseInt(val, 10, 32)
+		retryAfter := int32(retryAfter32)
+		if err != nil {
+			return PlanesClientDeleteResponse{}, err
+		}
+		result.RetryAfter = &retryAfter
+	}
+	return result, nil
+}
+
+// Get - Retrieves information about a PlaneResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
+// planeType - The plane type.
 // planeName - The name of the plane
 // options - PlanesClientGetOptions contains the optional parameters for the PlanesClient.Get method.
 func (client *PlanesClient) Get(ctx context.Context, planeType string, planeName string, options *PlanesClientGetOptions) (PlanesClientGetResponse, error) {
@@ -176,10 +193,7 @@ func (client *PlanesClient) getCreateRequest(ctx context.Context, planeType stri
 		return nil, errors.New("parameter planeType cannot be empty")
 	}
 	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	req, err := runtime.NewRequest(ctx, http.MethodGet, runtime.JoinPaths(client.host, urlPath))
 	if err != nil {
 		return nil, err
@@ -200,27 +214,39 @@ func (client *PlanesClient) getHandleResponse(resp *http.Response) (PlanesClient
 	return result, nil
 }
 
-// List - List all planes.
-// If the operation fails it returns an *azcore.ResponseError type.
+// NewListByRootScopePager - Lists information about all PlaneResources in the given plane
 // Generated from API version 2022-09-01-privatepreview
-// options - PlanesClientListOptions contains the optional parameters for the PlanesClient.List method.
-func (client *PlanesClient) List(ctx context.Context, options *PlanesClientListOptions) (PlanesClientListResponse, error) {
-	req, err := client.listCreateRequest(ctx, options)
-	if err != nil {
-		return PlanesClientListResponse{}, err
-	}
-	resp, err := client.pl.Do(req)
-	if err != nil {
-		return PlanesClientListResponse{}, err
-	}
-	if !runtime.HasStatusCode(resp, http.StatusOK) {
-		return PlanesClientListResponse{}, runtime.NewResponseError(resp)
-	}
-	return client.listHandleResponse(resp)
+// options - PlanesClientListByRootScopeOptions contains the optional parameters for the PlanesClient.ListByRootScope method.
+func (client *PlanesClient) NewListByRootScopePager(options *PlanesClientListByRootScopeOptions) (*runtime.Pager[PlanesClientListByRootScopeResponse]) {
+	return runtime.NewPager(runtime.PagingHandler[PlanesClientListByRootScopeResponse]{
+		More: func(page PlanesClientListByRootScopeResponse) bool {
+			return page.NextLink != nil && len(*page.NextLink) > 0
+		},
+		Fetcher: func(ctx context.Context, page *PlanesClientListByRootScopeResponse) (PlanesClientListByRootScopeResponse, error) {
+			var req *policy.Request
+			var err error
+			if page == nil {
+				req, err = client.listByRootScopeCreateRequest(ctx, options)
+			} else {
+				req, err = runtime.NewRequest(ctx, http.MethodGet, *page.NextLink)
+			}
+			if err != nil {
+				return PlanesClientListByRootScopeResponse{}, err
+			}
+			resp, err := client.pl.Do(req)
+			if err != nil {
+				return PlanesClientListByRootScopeResponse{}, err
+			}
+			if !runtime.HasStatusCode(resp, http.StatusOK) {
+				return PlanesClientListByRootScopeResponse{}, runtime.NewResponseError(resp)
+			}
+			return client.listByRootScopeHandleResponse(resp)
+		},
+	})
 }
 
-// listCreateRequest creates the List request.
-func (client *PlanesClient) listCreateRequest(ctx context.Context, options *PlanesClientListOptions) (*policy.Request, error) {
+// listByRootScopeCreateRequest creates the ListByRootScope request.
+func (client *PlanesClient) listByRootScopeCreateRequest(ctx context.Context, options *PlanesClientListByRootScopeOptions) (*policy.Request, error) {
 	urlPath := "/planes"
 	req, err := runtime.NewRequest(ctx, http.MethodGet, runtime.JoinPaths(client.host, urlPath))
 	if err != nil {
@@ -233,11 +259,11 @@ func (client *PlanesClient) listCreateRequest(ctx context.Context, options *Plan
 	return req, nil
 }
 
-// listHandleResponse handles the List response.
-func (client *PlanesClient) listHandleResponse(resp *http.Response) (PlanesClientListResponse, error) {
-	result := PlanesClientListResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.PlaneResourceList); err != nil {
-		return PlanesClientListResponse{}, err
+// listByRootScopeHandleResponse handles the ListByRootScope response.
+func (client *PlanesClient) listByRootScopeHandleResponse(resp *http.Response) (PlanesClientListByRootScopeResponse, error) {
+	result := PlanesClientListByRootScopeResponse{}
+	if err := runtime.UnmarshalAsJSON(resp, &result.PlaneResourceListResult); err != nil {
+		return PlanesClientListByRootScopeResponse{}, err
 	}
 	return result, nil
 }
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_planestype_client.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_planetypes_client.go
similarity index 59%
rename from pkg/ucp/api/v20220901privatepreview/zz_generated_planestype_client.go
rename to pkg/ucp/api/v20220901privatepreview/zz_generated_planetypes_client.go
index cb3c40488..4cea8b8c6 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_planestype_client.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_planetypes_client.go
@@ -23,17 +23,17 @@ import (
 	"strings"
 )
 
-// PlanesTypeClient contains the methods for the PlanesType group.
-// Don't use this type directly, use NewPlanesTypeClient() instead.
-type PlanesTypeClient struct {
+// PlaneTypesClient contains the methods for the PlaneTypes group.
+// Don't use this type directly, use NewPlaneTypesClient() instead.
+type PlaneTypesClient struct {
 	host string
 	pl runtime.Pipeline
 }
 
-// NewPlanesTypeClient creates a new instance of PlanesTypeClient with the specified values.
+// NewPlaneTypesClient creates a new instance of PlaneTypesClient with the specified values.
 // credential - used to authorize requests. Usually a credential from azidentity.
 // options - pass nil to accept the default values.
-func NewPlanesTypeClient(credential azcore.TokenCredential, options *arm.ClientOptions) (*PlanesTypeClient, error) {
+func NewPlaneTypesClient(credential azcore.TokenCredential, options *arm.ClientOptions) (*PlaneTypesClient, error) {
 	if options == nil {
 		options = &arm.ClientOptions{}
 	}
@@ -45,35 +45,35 @@ func NewPlanesTypeClient(credential azcore.TokenCredential, options *arm.ClientO
 	if err != nil {
 		return nil, err
 	}
-	client := &PlanesTypeClient{
+	client := &PlaneTypesClient{
 		host: ep,
 pl: pl,
 	}
 	return client, nil
 }
 
-// List - List all planes of {planeType}.
+// Get - Retrieves information about a PlaneResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
-// options - PlanesTypeClientListOptions contains the optional parameters for the PlanesTypeClient.List method.
-func (client *PlanesTypeClient) List(ctx context.Context, planeType string, options *PlanesTypeClientListOptions) (PlanesTypeClientListResponse, error) {
-	req, err := client.listCreateRequest(ctx, planeType, options)
+// planeType - The plane type.
+// options - PlaneTypesClientGetOptions contains the optional parameters for the PlaneTypesClient.Get method.
+func (client *PlaneTypesClient) Get(ctx context.Context, planeType string, options *PlaneTypesClientGetOptions) (PlaneTypesClientGetResponse, error) {
+	req, err := client.getCreateRequest(ctx, planeType, options)
 	if err != nil {
-		return PlanesTypeClientListResponse{}, err
+		return PlaneTypesClientGetResponse{}, err
 	}
 	resp, err := client.pl.Do(req)
 	if err != nil {
-		return PlanesTypeClientListResponse{}, err
+		return PlaneTypesClientGetResponse{}, err
 	}
 	if !runtime.HasStatusCode(resp, http.StatusOK) {
-		return PlanesTypeClientListResponse{}, runtime.NewResponseError(resp)
+		return PlaneTypesClientGetResponse{}, runtime.NewResponseError(resp)
 	}
-	return client.listHandleResponse(resp)
+	return client.getHandleResponse(resp)
 }
 
-// listCreateRequest creates the List request.
-func (client *PlanesTypeClient) listCreateRequest(ctx context.Context, planeType string, options *PlanesTypeClientListOptions) (*policy.Request, error) {
+// getCreateRequest creates the Get request.
+func (client *PlaneTypesClient) getCreateRequest(ctx context.Context, planeType string, options *PlaneTypesClientGetOptions) (*policy.Request, error) {
 	urlPath := "/planes/{planeType}"
 	if planeType == "" {
 		return nil, errors.New("parameter planeType cannot be empty")
@@ -90,11 +90,11 @@ func (client *PlanesTypeClient) listCreateRequest(ctx context.Context, planeType
 	return req, nil
 }
 
-// listHandleResponse handles the List response.
-func (client *PlanesTypeClient) listHandleResponse(resp *http.Response) (PlanesTypeClientListResponse, error) {
-	result := PlanesTypeClientListResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.PlaneResourceList); err != nil {
-		return PlanesTypeClientListResponse{}, err
+// getHandleResponse handles the Get response.
+func (client *PlaneTypesClient) getHandleResponse(resp *http.Response) (PlaneTypesClientGetResponse, error) {
+	result := PlaneTypesClientGetResponse{}
+	if err := runtime.UnmarshalAsJSON(resp, &result.PlaneResource); err != nil {
+		return PlaneTypesClientGetResponse{}, err
 	}
 	return result, nil
 }
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_polymorphic_helpers.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_polymorphic_helpers.go
index 2560b0dad..4cd3aa63b 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_polymorphic_helpers.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_polymorphic_helpers.go
@@ -11,7 +11,7 @@ package v20220901privatepreview
 
 import "encoding/json"
 
-func unmarshalCredentialResourcePropertiesClassification(rawMsg json.RawMessage) (CredentialResourcePropertiesClassification, error) {
+func unmarshalAWSCredentialPropertiesClassification(rawMsg json.RawMessage) (AWSCredentialPropertiesClassification, error) {
 	if rawMsg == nil {
 		return nil, nil
 	}
@@ -19,14 +19,30 @@ func unmarshalCredentialResourcePropertiesClassification(rawMsg json.RawMessage)
 	if err := json.Unmarshal(rawMsg, &m); err != nil {
 		return nil, err
 	}
-	var b CredentialResourcePropertiesClassification
+	var b AWSCredentialPropertiesClassification
 	switch m["kind"] {
-	case "aws.com.iam":
+	case "AccessKey":
+		b = &AWSAccessKeyCredentialProperties{}
+	default:
 		b = &AWSCredentialProperties{}
-	case "azure.com.serviceprincipal":
+	}
+	return b, json.Unmarshal(rawMsg, b)
+}
+
+func unmarshalAzureCredentialPropertiesClassification(rawMsg json.RawMessage) (AzureCredentialPropertiesClassification, error) {
+	if rawMsg == nil {
+		return nil, nil
+	}
+	var m map[string]interface{}
+	if err := json.Unmarshal(rawMsg, &m); err != nil {
+		return nil, err
+	}
+	var b AzureCredentialPropertiesClassification
+	switch m["kind"] {
+	case "ServicePrincipal":
 		b = &AzureServicePrincipalProperties{}
 	default:
-		b = &CredentialResourceProperties{}
+		b = &AzureCredentialProperties{}
 	}
 	return b, json.Unmarshal(rawMsg, b)
 }
@@ -41,7 +57,7 @@ func unmarshalCredentialStoragePropertiesClassification(rawMsg json.RawMessage)
 	}
 	var b CredentialStoragePropertiesClassification
 	switch m["kind"] {
-	case string(CredentialStorageKindInternal):
+	case "Internal":
 		b = &InternalCredentialStorageProperties{}
 	default:
 		b = &CredentialStorageProperties{}
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_resourcegroups_client.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_resourcegroups_client.go
index 0a3c56fe9..6ea09d4f9 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_resourcegroups_client.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_resourcegroups_client.go
@@ -20,6 +20,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 )
 
@@ -52,17 +53,17 @@ pl: pl,
 	return client, nil
 }
 
-// CreateOrUpdate - Create or update a ResourceGroup.
+// CreateOrUpdate - Creates or updates a ResourceGroupResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
+// planeType - The plane type.
 // planeName - The name of the plane
-// resourceGroupName - The name of the resource group
-// resourceGroup - ResourceGroup details
+// resourceGroupName - UCP resourcegroup name
+// resource - Resource create parameters.
 // options - ResourceGroupsClientCreateOrUpdateOptions contains the optional parameters for the ResourceGroupsClient.CreateOrUpdate
 // method.
-func (client *ResourceGroupsClient) CreateOrUpdate(ctx context.Context, planeType string, planeName string, resourceGroupName string, resourceGroup ResourceGroupResource, options *ResourceGroupsClientCreateOrUpdateOptions) (ResourceGroupsClientCreateOrUpdateResponse, error) {
-	req, err := client.createOrUpdateCreateRequest(ctx, planeType, planeName, resourceGroupName, resourceGroup, options)
+func (client *ResourceGroupsClient) CreateOrUpdate(ctx context.Context, planeType string, planeName string, resourceGroupName string, resource ResourceGroupResource, options *ResourceGroupsClientCreateOrUpdateOptions) (ResourceGroupsClientCreateOrUpdateResponse, error) {
+	req, err := client.createOrUpdateCreateRequest(ctx, planeType, planeName, resourceGroupName, resource, options)
 	if err != nil {
 		return ResourceGroupsClientCreateOrUpdateResponse{}, err
 	}
@@ -70,23 +71,20 @@ func (client *ResourceGroupsClient) CreateOrUpdate(ctx context.Context, planeTyp
 	if err != nil {
 		return ResourceGroupsClientCreateOrUpdateResponse{}, err
 	}
-	if !runtime.HasStatusCode(resp, http.StatusOK) {
+	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusCreated) {
 		return ResourceGroupsClientCreateOrUpdateResponse{}, runtime.NewResponseError(resp)
 	}
 	return client.createOrUpdateHandleResponse(resp)
 }
 
 // createOrUpdateCreateRequest creates the CreateOrUpdate request.
-func (client *ResourceGroupsClient) createOrUpdateCreateRequest(ctx context.Context, planeType string, planeName string, resourceGroupName string, resourceGroup ResourceGroupResource, options *ResourceGroupsClientCreateOrUpdateOptions) (*policy.Request, error) {
+func (client *ResourceGroupsClient) createOrUpdateCreateRequest(ctx context.Context, planeType string, planeName string, resourceGroupName string, resource ResourceGroupResource, options *ResourceGroupsClientCreateOrUpdateOptions) (*policy.Request, error) {
 	urlPath := "/planes/{planeType}/{planeName}/resourcegroups/{resourceGroupName}"
 	if planeType == "" {
 		return nil, errors.New("parameter planeType cannot be empty")
 	}
 	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if resourceGroupName == "" {
 		return nil, errors.New("parameter resourceGroupName cannot be empty")
 	}
@@ -99,24 +97,32 @@ func (client *ResourceGroupsClient) createOrUpdateCreateRequest(ctx context.Cont
 	reqQP.Set("api-version", "2022-09-01-privatepreview")
 	req.Raw().URL.RawQuery = reqQP.Encode()
 	req.Raw().Header["Accept"] = []string{"application/json"}
-	return req, runtime.MarshalAsJSON(req, resourceGroup)
+	return req, runtime.MarshalAsJSON(req, resource)
 }
 
 // createOrUpdateHandleResponse handles the CreateOrUpdate response.
 func (client *ResourceGroupsClient) createOrUpdateHandleResponse(resp *http.Response) (ResourceGroupsClientCreateOrUpdateResponse, error) {
 	result := ResourceGroupsClientCreateOrUpdateResponse{}
+	if val := resp.Header.Get("Retry-After"); val != "" {
+		retryAfter32, err := strconv.ParseInt(val, 10, 32)
+		retryAfter := int32(retryAfter32)
+		if err != nil {
+			return ResourceGroupsClientCreateOrUpdateResponse{}, err
+		}
+		result.RetryAfter = &retryAfter
+	}
 	if err := runtime.UnmarshalAsJSON(resp, &result.ResourceGroupResource); err != nil {
 		return ResourceGroupsClientCreateOrUpdateResponse{}, err
 	}
 	return result, nil
 }
 
-// Delete - Delete a ResourceGroup.
+// Delete - Deletes an existing ResourceGroupResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
+// planeType - The plane type.
 // planeName - The name of the plane
-// resourceGroupName - The name of the resource group
+// resourceGroupName - UCP resourcegroup name
 // options - ResourceGroupsClientDeleteOptions contains the optional parameters for the ResourceGroupsClient.Delete method.
 func (client *ResourceGroupsClient) Delete(ctx context.Context, planeType string, planeName string, resourceGroupName string, options *ResourceGroupsClientDeleteOptions) (ResourceGroupsClientDeleteResponse, error) {
 	req, err := client.deleteCreateRequest(ctx, planeType, planeName, resourceGroupName, options)
@@ -127,10 +133,10 @@ func (client *ResourceGroupsClient) Delete(ctx context.Context, planeType string
 	if err != nil {
 		return ResourceGroupsClientDeleteResponse{}, err
 	}
-	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusNoContent) {
+	if !runtime.HasStatusCode(resp, http.StatusOK, http.StatusAccepted, http.StatusNoContent) {
 		return ResourceGroupsClientDeleteResponse{}, runtime.NewResponseError(resp)
 	}
-	return ResourceGroupsClientDeleteResponse{}, nil
+	return client.deleteHandleResponse(resp)
 }
 
 // deleteCreateRequest creates the Delete request.
@@ -140,10 +146,7 @@ func (client *ResourceGroupsClient) deleteCreateRequest(ctx context.Context, pla
 		return nil, errors.New("parameter planeType cannot be empty")
 	}
 	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if resourceGroupName == "" {
 		return nil, errors.New("parameter resourceGroupName cannot be empty")
 	}
@@ -159,12 +162,26 @@ func (client *ResourceGroupsClient) deleteCreateRequest(ctx context.Context, pla
 	return req, nil
 }
 
-// Get - Gets the properties of a UCP ResourceGroup.
+// deleteHandleResponse handles the Delete response.
+func (client *ResourceGroupsClient) deleteHandleResponse(resp *http.Response) (ResourceGroupsClientDeleteResponse, error) {
+	result := ResourceGroupsClientDeleteResponse{}
+	if val := resp.Header.Get("Retry-After"); val != "" {
+		retryAfter32, err := strconv.ParseInt(val, 10, 32)
+		retryAfter := int32(retryAfter32)
+		if err != nil {
+			return ResourceGroupsClientDeleteResponse{}, err
+		}
+		result.RetryAfter = &retryAfter
+	}
+	return result, nil
+}
+
+// Get - Retrieves information about a ResourceGroupResource
 // If the operation fails it returns an *azcore.ResponseError type.
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
+// planeType - The plane type.
 // planeName - The name of the plane
-// resourceGroupName - The name of the resource group
+// resourceGroupName - UCP resourcegroup name
 // options - ResourceGroupsClientGetOptions contains the optional parameters for the ResourceGroupsClient.Get method.
 func (client *ResourceGroupsClient) Get(ctx context.Context, planeType string, planeName string, resourceGroupName string, options *ResourceGroupsClientGetOptions) (ResourceGroupsClientGetResponse, error) {
 	req, err := client.getCreateRequest(ctx, planeType, planeName, resourceGroupName, options)
@@ -188,10 +205,7 @@ func (client *ResourceGroupsClient) getCreateRequest(ctx context.Context, planeT
 		return nil, errors.New("parameter planeType cannot be empty")
 	}
 	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	if resourceGroupName == "" {
 		return nil, errors.New("parameter resourceGroupName cannot be empty")
 	}
@@ -216,38 +230,48 @@ func (client *ResourceGroupsClient) getHandleResponse(resp *http.Response) (Reso
 	return result, nil
 }
 
-// List - List all resource groups.
-// If the operation fails it returns an *azcore.ResponseError type.
+// NewListByRootScopePager - Lists information about all ResourceGroupResource
 // Generated from API version 2022-09-01-privatepreview
-// planeType - The type of the plane
+// planeType - The plane type.
 // planeName - The name of the plane
-// options - ResourceGroupsClientListOptions contains the optional parameters for the ResourceGroupsClient.List method.
-func (client *ResourceGroupsClient) List(ctx context.Context, planeType string, planeName string, options *ResourceGroupsClientListOptions) (ResourceGroupsClientListResponse, error) {
-	req, err := client.listCreateRequest(ctx, planeType, planeName, options)
-	if err != nil {
-		return ResourceGroupsClientListResponse{}, err
-	}
-	resp, err := client.pl.Do(req)
-	if err != nil {
-		return ResourceGroupsClientListResponse{}, err
-	}
-	if !runtime.HasStatusCode(resp, http.StatusOK) {
-		return ResourceGroupsClientListResponse{}, runtime.NewResponseError(resp)
-	}
-	return client.listHandleResponse(resp)
+// options - ResourceGroupsClientListByRootScopeOptions contains the optional parameters for the ResourceGroupsClient.ListByRootScope
+// method.
+func (client *ResourceGroupsClient) NewListByRootScopePager(planeType string, planeName string, options *ResourceGroupsClientListByRootScopeOptions) (*runtime.Pager[ResourceGroupsClientListByRootScopeResponse]) {
+	return runtime.NewPager(runtime.PagingHandler[ResourceGroupsClientListByRootScopeResponse]{
+		More: func(page ResourceGroupsClientListByRootScopeResponse) bool {
+			return page.NextLink != nil && len(*page.NextLink) > 0
+		},
+		Fetcher: func(ctx context.Context, page *ResourceGroupsClientListByRootScopeResponse) (ResourceGroupsClientListByRootScopeResponse, error) {
+			var req *policy.Request
+			var err error
+			if page == nil {
+				req, err = client.listByRootScopeCreateRequest(ctx, planeType, planeName, options)
+			} else {
+				req, err = runtime.NewRequest(ctx, http.MethodGet, *page.NextLink)
+			}
+			if err != nil {
+				return ResourceGroupsClientListByRootScopeResponse{}, err
+			}
+			resp, err := client.pl.Do(req)
+			if err != nil {
+				return ResourceGroupsClientListByRootScopeResponse{}, err
+			}
+			if !runtime.HasStatusCode(resp, http.StatusOK) {
+				return ResourceGroupsClientListByRootScopeResponse{}, runtime.NewResponseError(resp)
+			}
+			return client.listByRootScopeHandleResponse(resp)
+		},
+	})
 }
 
-// listCreateRequest creates the List request.
-func (client *ResourceGroupsClient) listCreateRequest(ctx context.Context, planeType string, planeName string, options *ResourceGroupsClientListOptions) (*policy.Request, error) {
+// listByRootScopeCreateRequest creates the ListByRootScope request.
+func (client *ResourceGroupsClient) listByRootScopeCreateRequest(ctx context.Context, planeType string, planeName string, options *ResourceGroupsClientListByRootScopeOptions) (*policy.Request, error) {
 	urlPath := "/planes/{planeType}/{planeName}/resourcegroups"
 	if planeType == "" {
 		return nil, errors.New("parameter planeType cannot be empty")
 	}
 	urlPath = strings.ReplaceAll(urlPath, "{planeType}", url.PathEscape(planeType))
-	if planeName == "" {
-		return nil, errors.New("parameter planeName cannot be empty")
-	}
-	urlPath = strings.ReplaceAll(urlPath, "{planeName}", url.PathEscape(planeName))
+	urlPath = strings.ReplaceAll(urlPath, "{planeName}", planeName)
 	req, err := runtime.NewRequest(ctx, http.MethodGet, runtime.JoinPaths(client.host, urlPath))
 	if err != nil {
 		return nil, err
@@ -259,11 +283,11 @@ func (client *ResourceGroupsClient) listCreateRequest(ctx context.Context, plane
 	return req, nil
 }
 
-// listHandleResponse handles the List response.
-func (client *ResourceGroupsClient) listHandleResponse(resp *http.Response) (ResourceGroupsClientListResponse, error) {
-	result := ResourceGroupsClientListResponse{}
-	if err := runtime.UnmarshalAsJSON(resp, &result.ResourceGroupResourceList); err != nil {
-		return ResourceGroupsClientListResponse{}, err
+// listByRootScopeHandleResponse handles the ListByRootScope response.
+func (client *ResourceGroupsClient) listByRootScopeHandleResponse(resp *http.Response) (ResourceGroupsClientListByRootScopeResponse, error) {
+	result := ResourceGroupsClientListByRootScopeResponse{}
+	if err := runtime.UnmarshalAsJSON(resp, &result.ResourceGroupResourceListResult); err != nil {
+		return ResourceGroupsClientListByRootScopeResponse{}, err
 	}
 	return result, nil
 }
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_response_types.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_response_types.go
index a8aeaacc8..ff26264ef 100644
--- a/pkg/ucp/api/v20220901privatepreview/zz_generated_response_types.go
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_response_types.go
@@ -9,54 +9,68 @@
 
 package v20220901privatepreview
 
-// AWSCredentialClientCreateOrUpdateResponse contains the response from method AWSCredentialClient.CreateOrUpdate.
-type AWSCredentialClientCreateOrUpdateResponse struct {
-	CredentialResource
+// AwsCredentialClientCreateOrUpdateResponse contains the response from method AwsCredentialClient.CreateOrUpdate.
+type AwsCredentialClientCreateOrUpdateResponse struct {
+	AWSCredentialResource
+	// RetryAfter contains the information returned from the Retry-After header response.
+	RetryAfter *int32
 }
 
-// AWSCredentialClientDeleteResponse contains the response from method AWSCredentialClient.Delete.
-type AWSCredentialClientDeleteResponse struct {
-	// placeholder for future response values
+// AwsCredentialClientDeleteResponse contains the response from method AwsCredentialClient.Delete.
+type AwsCredentialClientDeleteResponse struct {
+	// RetryAfter contains the information returned from the Retry-After header response.
+	RetryAfter *int32
 }
 
-// AWSCredentialClientGetResponse contains the response from method AWSCredentialClient.Get.
-type AWSCredentialClientGetResponse struct {
-	CredentialResource
+// AwsCredentialClientGetResponse contains the response from method AwsCredentialClient.Get.
+type AwsCredentialClientGetResponse struct {
+	AWSCredentialResource
 }
 
-// AWSCredentialClientListResponse contains the response from method AWSCredentialClient.List.
-type AWSCredentialClientListResponse struct {
-	CredentialResourceList
+// AwsCredentialClientListByRootScopeResponse contains the response from method AwsCredentialClient.ListByRootScope.
+type AwsCredentialClientListByRootScopeResponse struct {
+	AWSCredentialResourceListResult
 }
 
 // AzureCredentialClientCreateOrUpdateResponse contains the response from method AzureCredentialClient.CreateOrUpdate.
 type AzureCredentialClientCreateOrUpdateResponse struct {
-	CredentialResource
+	AzureCredentialResource
+	// RetryAfter contains the information returned from the Retry-After header response.
+	RetryAfter *int32
 }
 
 // AzureCredentialClientDeleteResponse contains the response from method AzureCredentialClient.Delete.
 type AzureCredentialClientDeleteResponse struct {
-	// placeholder for future response values
+	// RetryAfter contains the information returned from the Retry-After header response.
+	RetryAfter *int32
 }
 
 // AzureCredentialClientGetResponse contains the response from method AzureCredentialClient.Get.
 type AzureCredentialClientGetResponse struct {
-	CredentialResource
+	AzureCredentialResource
 }
 
-// AzureCredentialClientListResponse contains the response from method AzureCredentialClient.List.
-type AzureCredentialClientListResponse struct {
-	CredentialResourceList
+// AzureCredentialClientListByRootScopeResponse contains the response from method AzureCredentialClient.ListByRootScope.
+type AzureCredentialClientListByRootScopeResponse struct {
+	AzureCredentialResourceListResult
+}
+
+// PlaneTypesClientGetResponse contains the response from method PlaneTypesClient.Get.
+type PlaneTypesClientGetResponse struct {
+	PlaneResource
 }
 
 // PlanesClientCreateOrUpdateResponse contains the response from method PlanesClient.CreateOrUpdate.
 type PlanesClientCreateOrUpdateResponse struct {
 	PlaneResource
+	// RetryAfter contains the information returned from the Retry-After header response.
+	RetryAfter *int32
 }
 
 // PlanesClientDeleteResponse contains the response from method PlanesClient.Delete.
 type PlanesClientDeleteResponse struct {
-	// placeholder for future response values
+	// RetryAfter contains the information returned from the Retry-After header response.
+	RetryAfter *int32
 }
 
 // PlanesClientGetResponse contains the response from method PlanesClient.Get.
@@ -64,24 +78,22 @@ type PlanesClientGetResponse struct {
 	PlaneResource
 }
 
-// PlanesClientListResponse contains the response from method PlanesClient.List.
-type PlanesClientListResponse struct {
-	PlaneResourceList
-}
-
-// PlanesTypeClientListResponse contains the response from method PlanesTypeClient.List.
-type PlanesTypeClientListResponse struct {
-	PlaneResourceList
+// PlanesClientListByRootScopeResponse contains the response from method PlanesClient.ListByRootScope.
+type PlanesClientListByRootScopeResponse struct {
+	PlaneResourceListResult
 }
 
 // ResourceGroupsClientCreateOrUpdateResponse contains the response from method ResourceGroupsClient.CreateOrUpdate.
 type ResourceGroupsClientCreateOrUpdateResponse struct {
 	ResourceGroupResource
+	// RetryAfter contains the information returned from the Retry-After header response.
+	RetryAfter *int32
 }
 
 // ResourceGroupsClientDeleteResponse contains the response from method ResourceGroupsClient.Delete.
 type ResourceGroupsClientDeleteResponse struct {
-	// placeholder for future response values
+	// RetryAfter contains the information returned from the Retry-After header response.
+	RetryAfter *int32
 }
 
 // ResourceGroupsClientGetResponse contains the response from method ResourceGroupsClient.Get.
@@ -89,8 +101,8 @@ type ResourceGroupsClientGetResponse struct {
 	ResourceGroupResource
 }
 
-// ResourceGroupsClientListResponse contains the response from method ResourceGroupsClient.List.
-type ResourceGroupsClientListResponse struct {
-	ResourceGroupResourceList
+// ResourceGroupsClientListByRootScopeResponse contains the response from method ResourceGroupsClient.ListByRootScope.
+type ResourceGroupsClientListByRootScopeResponse struct {
+	ResourceGroupResourceListResult
 }
 
diff --git a/pkg/ucp/api/v20220901privatepreview/zz_generated_time_rfc3339.go b/pkg/ucp/api/v20220901privatepreview/zz_generated_time_rfc3339.go
new file mode 100644
index 000000000..b59e22d36
--- /dev/null
+++ b/pkg/ucp/api/v20220901privatepreview/zz_generated_time_rfc3339.go
@@ -0,0 +1,92 @@
+//go:build go1.18
+// +build go1.18
+
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+// DO NOT EDIT.
+
+package v20220901privatepreview
+
+
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+	"reflect"
+	"regexp"
+	"strings"
+	"time"
+)
+
+
+
+const (
+	utcLayoutJSON = `"2006-01-02T15:04:05.999999999"`
+	utcLayout     = "2006-01-02T15:04:05.999999999"
+	rfc3339JSON   = `"` + time.RFC3339Nano + `"`
+)
+
+// Azure reports time in UTC but it doesn't include the 'Z' time zone suffix in some cases.
+var tzOffsetRegex = regexp.MustCompile(`(Z|z|\+|-)(\d+:\d+)*"*$`)
+
+type timeRFC3339 time.Time
+
+func (t timeRFC3339) MarshalJSON() (json []byte, err error) {
+	tt := time.Time(t)
+	return tt.MarshalJSON()
+}
+
+func (t timeRFC3339) MarshalText() (text []byte, err error) {
+	tt := time.Time(t)
+	return tt.MarshalText()
+}
+
+func (t *timeRFC3339) UnmarshalJSON(data []byte) error {
+	layout := utcLayoutJSON
+	if tzOffsetRegex.Match(data) {
+		layout = rfc3339JSON
+	}
+	return t.Parse(layout, string(data))
+}
+
+func (t *timeRFC3339) UnmarshalText(data []byte) (err error) {
+	layout := utcLayout
+	if tzOffsetRegex.Match(data) {
+		layout = time.RFC3339Nano
+	}
+	return t.Parse(layout, string(data))
+}
+
+func (t *timeRFC3339) Parse(layout, value string) error {
+	p, err := time.Parse(layout, strings.ToUpper(value))
+	*t = timeRFC3339(p)
+	return err
+}
+
+
+func populateTimeRFC3339(m map[string]interface{}, k string, t *time.Time) {
+	if t == nil {
+		return
+	} else if azcore.IsNullValue(t) {
+		m[k] = nil
+		return
+	} else if reflect.ValueOf(t).IsNil() {
+		return
+	}
+	m[k] = (*timeRFC3339)(t)
+}
+
+func unpopulateTimeRFC3339(data json.RawMessage, fn string, t **time.Time) error {
+	if data == nil || strings.EqualFold(string(data), "null") {
+		return nil
+	}
+	var aux timeRFC3339
+	if err := json.Unmarshal(data, &aux); err != nil {
+		return fmt.Errorf("struct field %s: %v", fn, err)
+	}
+	*t = (*time.Time)(&aux)
+	return nil
+}
diff --git a/pkg/ucp/credentials/aws.go b/pkg/ucp/credentials/aws.go
index 77936e9e5..f74ab26a2 100644
--- a/pkg/ucp/credentials/aws.go
+++ b/pkg/ucp/credentials/aws.go
@@ -23,12 +23,12 @@ var _ CredentialProvider[AWSCredential] = (*AWSCredentialProvider)(nil)
 // AWSCredentialProvider is UCP credential provider for Azure.
 type AWSCredentialProvider struct {
 	secretProvider *provider.SecretProvider
-	client         *ucpapi.AWSCredentialClient
+	client         *ucpapi.AwsCredentialClient
 }
 
 // NewAWSCredentialProvider creates new AWSCredentialProvider.
 func NewAWSCredentialProvider(provider *provider.SecretProvider, ucpConn sdk.Connection, credential azcore.TokenCredential) (*AWSCredentialProvider, error) {
-	cli, err := ucpapi.NewAWSCredentialClient(credential, sdk.NewClientOptions(ucpConn))
+	cli, err := ucpapi.NewAwsCredentialClient(credential, sdk.NewClientOptions(ucpConn))
 	if err != nil {
 		return nil, err
 	}
@@ -42,14 +42,23 @@ func NewAWSCredentialProvider(provider *provider.SecretProvider, ucpConn sdk.Con
 // Fetch gets the AWS IAM credentials from secret storage.
 func (p *AWSCredentialProvider) Fetch(ctx context.Context, planeName, name string) (*AWSCredential, error) {
 	// 1. Fetch the secret name of AWS IAM access keys from UCP.
-	cred, err := p.client.Get(ctx, "aws", planeName, name, &ucpapi.AWSCredentialClientGetOptions{})
+	cred, err := p.client.Get(ctx, planeName, name, &ucpapi.AwsCredentialClientGetOptions{})
 	if err != nil {
 		return nil, err
 	}
 
 	// We support only kubernetes secret, but we may support multiple secret stores.
-	storage, ok := cred.Properties.GetCredentialResourceProperties().Storage.(*ucpapi.InternalCredentialStorageProperties)
-	if !ok {
+	var storage *ucpapi.InternalCredentialStorageProperties
+
+	switch p := cred.Properties.(type) {
+	case *ucpapi.AWSAccessKeyCredentialProperties:
+		switch c := p.Storage.(type) {
+		case *ucpapi.InternalCredentialStorageProperties:
+			storage = c
+		default:
+			return nil, errors.New("invalid AWSAccessKeyCredentialProperties")
+		}
+	default:
 		return nil, errors.New("invalid InternalCredentialStorageProperties")
 	}
 
diff --git a/pkg/ucp/credentials/azure.go b/pkg/ucp/credentials/azure.go
index f03fd669f..472b40a56 100644
--- a/pkg/ucp/credentials/azure.go
+++ b/pkg/ucp/credentials/azure.go
@@ -42,14 +42,23 @@ func NewAzureCredentialProvider(provider *provider.SecretProvider, ucpConn sdk.C
 // Fetch gets the Azure credentials from secret storage.
 func (p *AzureCredentialProvider) Fetch(ctx context.Context, planeName, name string) (*AzureCredential, error) {
 	// 1. Fetch the secret name of Azure service principal credentials from UCP.
-	cred, err := p.client.Get(ctx, "azure", planeName, name, &ucpapi.AzureCredentialClientGetOptions{})
+	cred, err := p.client.Get(ctx, planeName, name, &ucpapi.AzureCredentialClientGetOptions{})
 	if err != nil {
 		return nil, err
 	}
 
 	// We support only kubernetes secret, but we may support multiple secret stores.
-	storage, ok := cred.Properties.GetCredentialResourceProperties().Storage.(*ucpapi.InternalCredentialStorageProperties)
-	if !ok {
+	var storage *ucpapi.InternalCredentialStorageProperties
+
+	switch p := cred.Properties.(type) {
+	case *ucpapi.AzureServicePrincipalProperties:
+		switch c := p.Storage.(type) {
+		case *ucpapi.InternalCredentialStorageProperties:
+			storage = c
+		default:
+			return nil, errors.New("invalid AzureServicePrincipalProperties")
+		}
+	default:
 		return nil, errors.New("invalid InternalCredentialStorageProperties")
 	}
 
diff --git a/pkg/ucp/datamodel/converter/credential_converter.go b/pkg/ucp/datamodel/converter/awscredential_converter.go
similarity index 60%
rename from pkg/ucp/datamodel/converter/credential_converter.go
rename to pkg/ucp/datamodel/converter/awscredential_converter.go
index 78d5905f9..f7cf853cf 100644
--- a/pkg/ucp/datamodel/converter/credential_converter.go
+++ b/pkg/ucp/datamodel/converter/awscredential_converter.go
@@ -13,11 +13,11 @@ import (
 	"github.com/project-radius/radius/pkg/ucp/datamodel"
 )
 
-// CredentialDataModelToVersioned converts version agnostic credential datamodel to versioned model.
-func CredentialDataModelToVersioned(model *datamodel.Credential, version string) (v1.VersionedModelInterface, error) {
+// AWSCredentialDataModelToVersioned converts version agnostic AWS credential datamodel to versioned model.
+func AWSCredentialDataModelToVersioned(model *datamodel.AWSCredential, version string) (v1.VersionedModelInterface, error) {
 	switch version {
 	case v20220901privatepreview.Version:
-		versioned := &v20220901privatepreview.CredentialResource{}
+		versioned := &v20220901privatepreview.AWSCredentialResource{}
 		if err := versioned.ConvertFrom(model); err != nil {
 			return nil, err
 		}
@@ -28,11 +28,11 @@ func CredentialDataModelToVersioned(model *datamodel.Credential, version string)
 	}
 }
 
-// CredentialDataModelFromVersioned converts versioned credential model to datamodel.
-func CredentialDataModelFromVersioned(content []byte, version string) (*datamodel.Credential, error) {
+// AWSCredentialDataModelFromVersioned converts AWS versioned credential model to datamodel.
+func AWSCredentialDataModelFromVersioned(content []byte, version string) (*datamodel.AWSCredential, error) {
 	switch version {
 	case v20220901privatepreview.Version:
-		vm := &v20220901privatepreview.CredentialResource{}
+		vm := &v20220901privatepreview.AWSCredentialResource{}
 		if err := json.Unmarshal(content, vm); err != nil {
 			return nil, err
 		}
@@ -40,7 +40,7 @@ func CredentialDataModelFromVersioned(content []byte, version string) (*datamode
 		if err != nil {
 			return nil, err
 		}
-		return dm.(*datamodel.Credential), nil
+		return dm.(*datamodel.AWSCredential), nil
 
 	default:
 		return nil, v1.ErrUnsupportedAPIVersion
diff --git a/pkg/ucp/datamodel/converter/azurecredential_converter.go b/pkg/ucp/datamodel/converter/azurecredential_converter.go
new file mode 100644
index 000000000..8100dfc9c
--- /dev/null
+++ b/pkg/ucp/datamodel/converter/azurecredential_converter.go
@@ -0,0 +1,48 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package converter
+
+import (
+	"encoding/json"
+
+	v1 "github.com/project-radius/radius/pkg/armrpc/api/v1"
+	"github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
+	"github.com/project-radius/radius/pkg/ucp/datamodel"
+)
+
+// AzureCredentialDataModelToVersioned converts version agnostic Azure credential datamodel to versioned model.
+func AzureCredentialDataModelToVersioned(model *datamodel.AzureCredential, version string) (v1.VersionedModelInterface, error) {
+	switch version {
+	case v20220901privatepreview.Version:
+		versioned := &v20220901privatepreview.AzureCredentialResource{}
+		if err := versioned.ConvertFrom(model); err != nil {
+			return nil, err
+		}
+		return versioned, nil
+
+	default:
+		return nil, v1.ErrUnsupportedAPIVersion
+	}
+}
+
+// AzureCredentialDataModelFromVersioned converts versioned Azure credential model to datamodel.
+func AzureCredentialDataModelFromVersioned(content []byte, version string) (*datamodel.AzureCredential, error) {
+	switch version {
+	case v20220901privatepreview.Version:
+		vm := &v20220901privatepreview.AzureCredentialResource{}
+		if err := json.Unmarshal(content, vm); err != nil {
+			return nil, err
+		}
+		dm, err := vm.ConvertTo()
+		if err != nil {
+			return nil, err
+		}
+		return dm.(*datamodel.AzureCredential), nil
+
+	default:
+		return nil, v1.ErrUnsupportedAPIVersion
+	}
+}
diff --git a/pkg/ucp/datamodel/converter/plane_converter.go b/pkg/ucp/datamodel/converter/plane_converter.go
index 59a1b7306..4efdaf07e 100644
--- a/pkg/ucp/datamodel/converter/plane_converter.go
+++ b/pkg/ucp/datamodel/converter/plane_converter.go
@@ -13,7 +13,7 @@ import (
 	"github.com/project-radius/radius/pkg/ucp/datamodel"
 )
 
-// PlaneDataModelToVersioned converts version agnostic environment datamodel to versioned model.
+// PlaneDataModelToVersioned converts version agnostic plane datamodel to versioned model.
 func PlaneDataModelToVersioned(model *datamodel.Plane, version string) (v1.VersionedModelInterface, error) {
 	switch version {
 	case v20220901privatepreview.Version:
@@ -28,7 +28,7 @@ func PlaneDataModelToVersioned(model *datamodel.Plane, version string) (v1.Versi
 	}
 }
 
-// PlaneDataModelFromVersioned converts versioned environment model to datamodel.
+// PlaneDataModelFromVersioned converts versioned plane model to datamodel.
 func PlaneDataModelFromVersioned(content []byte, version string) (*datamodel.Plane, error) {
 	switch version {
 	case v20220901privatepreview.Version:
diff --git a/pkg/ucp/datamodel/credential.go b/pkg/ucp/datamodel/credential.go
index 5b403e938..ddc08f095 100644
--- a/pkg/ucp/datamodel/credential.go
+++ b/pkg/ucp/datamodel/credential.go
@@ -11,29 +11,49 @@ const (
 	// InternalStorageKind represents ucp credential storage type for internal credential type
 	InternalStorageKind = "Internal"
 	// AzureCredentialKind represents ucp credential kind for azure credentials.
-	AzureCredentialKind = "azure.com.serviceprincipal"
+	AzureCredentialKind = "ServicePrincipal"
 	// AWSCredentialKind represents ucp credential kind for aws credentials.
-	AWSCredentialKind = "aws.com.iam"
+	AWSCredentialKind = "AccessKey"
 )
 
 // Credential represents UCP Credential.
-type Credential struct {
+type AzureCredential struct {
 	v1.BaseResource
 
-	Properties *CredentialResourceProperties `json:"properties,omitempty"`
+	Properties *AzureCredentialResourceProperties `json:"properties,omitempty"`
 }
 
 // ResourceTypeName gives the type of ucp resource.
-func (c *Credential) ResourceTypeName() string {
+func (c *AzureCredential) ResourceTypeName() string {
 	return c.Type
 }
 
-// Credential Properties represents UCP Credential Properties.
-type CredentialResourceProperties struct {
-	// Kind is the kind of credential resource.
+// Credential represents UCP Credential.
+type AWSCredential struct {
+	v1.BaseResource
+
+	Properties *AWSCredentialResourceProperties `json:"properties,omitempty"`
+}
+
+// ResourceTypeName gives the type of ucp resource.
+func (c *AWSCredential) ResourceTypeName() string {
+	return c.Type
+}
+
+// Azure Credential Properties represents UCP Credential Properties.
+type AzureCredentialResourceProperties struct {
+	// Kind is the kind of azure credential resource.
 	Kind string `json:"kind,omitempty"`
 	// AzureCredential is the azure service principal credentials.
 	AzureCredential *AzureCredentialProperties `json:"azureCredential,omitempty"`
+	// Storage contains the properties of the storage associated with the kind.
+	Storage *CredentialStorageProperties `json:"storage,omitempty"`
+}
+
+// AWS Credential Properties represents UCP Credential Properties.
+type AWSCredentialResourceProperties struct {
+	// Kind is the kind of aws credential resource.
+	Kind string `json:"kind,omitempty"`
 	// AWSCredential is the aws iam credentials.
 	AWSCredential *AWSCredentialProperties `json:"awsCredential,omitempty"`
 	// Storage contains the properties of the storage associated with the kind.
diff --git a/pkg/ucp/frontend/api/routes.go b/pkg/ucp/frontend/api/routes.go
index e311a8db7..e3e91ff59 100644
--- a/pkg/ucp/frontend/api/routes.go
+++ b/pkg/ucp/frontend/api/routes.go
@@ -255,9 +255,9 @@ func Register(ctx context.Context, router *mux.Router, ctrlOpts ctrl.Options) er
 			Method:       v1.OperationList,
 			HandlerFactory: func(opt ctrl.Options) (frontend_ctrl.Controller, error) {
 				return defaultoperation.NewListResources(opt.Options,
-					frontend_ctrl.ResourceOptions[datamodel.Credential]{
-						RequestConverter:  converter.CredentialDataModelFromVersioned,
-						ResponseConverter: converter.CredentialDataModelToVersioned,
+					frontend_ctrl.ResourceOptions[datamodel.AzureCredential]{
+						RequestConverter:  converter.AzureCredentialDataModelFromVersioned,
+						ResponseConverter: converter.AzureCredentialDataModelToVersioned,
 					},
 				)
 			},
@@ -268,9 +268,9 @@ func Register(ctx context.Context, router *mux.Router, ctrlOpts ctrl.Options) er
 			Method:       v1.OperationGet,
 			HandlerFactory: func(opt ctrl.Options) (frontend_ctrl.Controller, error) {
 				return defaultoperation.NewGetResource(opt.Options,
-					frontend_ctrl.ResourceOptions[datamodel.Credential]{
-						RequestConverter:  converter.CredentialDataModelFromVersioned,
-						ResponseConverter: converter.CredentialDataModelToVersioned,
+					frontend_ctrl.ResourceOptions[datamodel.AzureCredential]{
+						RequestConverter:  converter.AzureCredentialDataModelFromVersioned,
+						ResponseConverter: converter.AzureCredentialDataModelToVersioned,
 					},
 				)
 			},
@@ -278,12 +278,12 @@ func Register(ctx context.Context, router *mux.Router, ctrlOpts ctrl.Options) er
 		{
 			ParentRouter:   azureCredentialResourceSubRouter,
 			Method:         v1.OperationPut,
-			HandlerFactory: azure_credential_ctrl.NewCreateOrUpdateCredential,
+			HandlerFactory: azure_credential_ctrl.NewCreateOrUpdateAzureCredential,
 		},
 		{
 			ParentRouter:   azureCredentialResourceSubRouter,
 			Method:         v1.OperationDelete,
-			HandlerFactory: azure_credential_ctrl.NewDeleteCredential,
+			HandlerFactory: azure_credential_ctrl.NewDeleteAzureCredential,
 		},
 
 		// AWS Credential Handlers
@@ -293,9 +293,9 @@ func Register(ctx context.Context, router *mux.Router, ctrlOpts ctrl.Options) er
 			Method:       v1.OperationList,
 			HandlerFactory: func(opt ctrl.Options) (frontend_ctrl.Controller, error) {
 				return defaultoperation.NewListResources(opt.Options,
-					frontend_ctrl.ResourceOptions[datamodel.Credential]{
-						RequestConverter:  converter.CredentialDataModelFromVersioned,
-						ResponseConverter: converter.CredentialDataModelToVersioned,
+					frontend_ctrl.ResourceOptions[datamodel.AWSCredential]{
+						RequestConverter:  converter.AWSCredentialDataModelFromVersioned,
+						ResponseConverter: converter.AWSCredentialDataModelToVersioned,
 					},
 				)
 			},
@@ -306,9 +306,9 @@ func Register(ctx context.Context, router *mux.Router, ctrlOpts ctrl.Options) er
 			Method:       v1.OperationGet,
 			HandlerFactory: func(opt ctrl.Options) (frontend_ctrl.Controller, error) {
 				return defaultoperation.NewGetResource(opt.Options,
-					frontend_ctrl.ResourceOptions[datamodel.Credential]{
-						RequestConverter:  converter.CredentialDataModelFromVersioned,
-						ResponseConverter: converter.CredentialDataModelToVersioned,
+					frontend_ctrl.ResourceOptions[datamodel.AWSCredential]{
+						RequestConverter:  converter.AWSCredentialDataModelFromVersioned,
+						ResponseConverter: converter.AWSCredentialDataModelToVersioned,
 					},
 				)
 			},
@@ -316,12 +316,12 @@ func Register(ctx context.Context, router *mux.Router, ctrlOpts ctrl.Options) er
 		{
 			ParentRouter:   awsCredentialResourceSubRouter,
 			Method:         v1.OperationPut,
-			HandlerFactory: aws_credential_ctrl.NewCreateOrUpdateCredential,
+			HandlerFactory: aws_credential_ctrl.NewCreateOrUpdateAWSCredential,
 		},
 		{
 			ParentRouter:   awsCredentialResourceSubRouter,
 			Method:         v1.OperationDelete,
-			HandlerFactory: aws_credential_ctrl.NewDeleteCredential,
+			HandlerFactory: aws_credential_ctrl.NewDeleteAWSCredential,
 		},
 		// Proxy request should take the least priority in routing and should therefore be last
 		{
diff --git a/pkg/ucp/frontend/controller/credentials/aws/createorupdatecredential.go b/pkg/ucp/frontend/controller/credentials/aws/createorupdateawscredential.go
similarity index 72%
rename from pkg/ucp/frontend/controller/credentials/aws/createorupdatecredential.go
rename to pkg/ucp/frontend/controller/credentials/aws/createorupdateawscredential.go
index dbbd34a13..e3e8265fb 100644
--- a/pkg/ucp/frontend/controller/credentials/aws/createorupdatecredential.go
+++ b/pkg/ucp/frontend/controller/credentials/aws/createorupdateawscredential.go
@@ -18,28 +18,28 @@ import (
 	"github.com/project-radius/radius/pkg/ucp/secret"
 )
 
-var _ armrpc_controller.Controller = (*CreateOrUpdateCredential)(nil)
+var _ armrpc_controller.Controller = (*CreateOrUpdateAWSCredential)(nil)
 
-// CreateOrUpdateCredential is the controller implementation to create/update a UCP credential.
-type CreateOrUpdateCredential struct {
-	armrpc_controller.Operation[*datamodel.Credential, datamodel.Credential]
+// CreateOrUpdateAWSCredential is the controller implementation to create/update a UCP AWS credential.
+type CreateOrUpdateAWSCredential struct {
+	armrpc_controller.Operation[*datamodel.AWSCredential, datamodel.AWSCredential]
 	secretClient secret.Client
 }
 
-// NewCreateOrUpdateCredential creates a new CreateOrUpdateCredential.
-func NewCreateOrUpdateCredential(opts ctrl.Options) (armrpc_controller.Controller, error) {
-	return &CreateOrUpdateCredential{
+// NewCreateOrUpdateAWSCredential creates a new CreateOrUpdateAWSCredential.
+func NewCreateOrUpdateAWSCredential(opts ctrl.Options) (armrpc_controller.Controller, error) {
+	return &CreateOrUpdateAWSCredential{
 		Operation: armrpc_controller.NewOperation(opts.Options,
-			armrpc_controller.ResourceOptions[datamodel.Credential]{
-				RequestConverter:  converter.CredentialDataModelFromVersioned,
-				ResponseConverter: converter.CredentialDataModelToVersioned,
+			armrpc_controller.ResourceOptions[datamodel.AWSCredential]{
+				RequestConverter:  converter.AWSCredentialDataModelFromVersioned,
+				ResponseConverter: converter.AWSCredentialDataModelToVersioned,
 			},
 		),
 		secretClient: opts.SecretClient,
 	}, nil
 }
 
-func (c *CreateOrUpdateCredential) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (armrpc_rest.Response, error) {
+func (c *CreateOrUpdateAWSCredential) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (armrpc_rest.Response, error) {
 	serviceCtx := v1.ARMRequestContextFromContext(ctx)
 	newResource, err := c.GetResourceFromRequest(ctx, req)
 	if err != nil {
diff --git a/pkg/ucp/frontend/controller/credentials/aws/deletecredential.go b/pkg/ucp/frontend/controller/credentials/aws/deleteawscredential.go
similarity index 69%
rename from pkg/ucp/frontend/controller/credentials/aws/deletecredential.go
rename to pkg/ucp/frontend/controller/credentials/aws/deleteawscredential.go
index 802563b13..cd12a86d7 100644
--- a/pkg/ucp/frontend/controller/credentials/aws/deletecredential.go
+++ b/pkg/ucp/frontend/controller/credentials/aws/deleteawscredential.go
@@ -23,28 +23,28 @@ import (
 	"github.com/project-radius/radius/pkg/ucp/ucplog"
 )
 
-var _ armrpc_controller.Controller = (*DeleteCredential)(nil)
+var _ armrpc_controller.Controller = (*DeleteAWSCredential)(nil)
 
-// DeleteCredential is the controller implementation to delete a UCP credential.
-type DeleteCredential struct {
-	armrpc_controller.Operation[*datamodel.Credential, datamodel.Credential]
+// DeleteAWSCredential is the controller implementation to delete a UCP AWS credential.
+type DeleteAWSCredential struct {
+	armrpc_controller.Operation[*datamodel.AWSCredential, datamodel.AWSCredential]
 	secretClient secret.Client
 }
 
-// NewDeleteCredential creates a new DeleteCredential.
-func NewDeleteCredential(opts ctrl.Options) (armrpc_controller.Controller, error) {
-	return &DeleteCredential{
+// NewDeleteAWSCredential creates a new DeleteCredential.
+func NewDeleteAWSCredential(opts ctrl.Options) (armrpc_controller.Controller, error) {
+	return &DeleteAWSCredential{
 		Operation: armrpc_controller.NewOperation(opts.Options,
-			armrpc_controller.ResourceOptions[datamodel.Credential]{
-				RequestConverter:  converter.CredentialDataModelFromVersioned,
-				ResponseConverter: converter.CredentialDataModelToVersioned,
+			armrpc_controller.ResourceOptions[datamodel.AWSCredential]{
+				RequestConverter:  converter.AWSCredentialDataModelFromVersioned,
+				ResponseConverter: converter.AWSCredentialDataModelToVersioned,
 			},
 		),
 		secretClient: opts.SecretClient,
 	}, nil
 }
 
-func (c *DeleteCredential) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (armrpc_rest.Response, error) {
+func (c *DeleteAWSCredential) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (armrpc_rest.Response, error) {
 	logger := ucplog.FromContextOrDiscard(ctx)
 	serviceCtx := v1.ARMRequestContextFromContext(ctx)
 
@@ -78,6 +78,6 @@ func (c *DeleteCredential) Run(ctx context.Context, w http.ResponseWriter, req *
 		return nil, err
 	}
 
-	logger.Info(fmt.Sprintf("Deleted Credential %s successfully", serviceCtx.ResourceID))
+	logger.Info(fmt.Sprintf("Deleted AWS Credential %s successfully", serviceCtx.ResourceID))
 	return rest.NewOKResponse(nil), nil
 }
diff --git a/pkg/ucp/frontend/controller/credentials/azure/createorupdatecredential.go b/pkg/ucp/frontend/controller/credentials/azure/createorupdateazurecredential.go
similarity index 71%
rename from pkg/ucp/frontend/controller/credentials/azure/createorupdatecredential.go
rename to pkg/ucp/frontend/controller/credentials/azure/createorupdateazurecredential.go
index c162c30a3..ca9c0d895 100644
--- a/pkg/ucp/frontend/controller/credentials/azure/createorupdatecredential.go
+++ b/pkg/ucp/frontend/controller/credentials/azure/createorupdateazurecredential.go
@@ -18,28 +18,28 @@ import (
 	"github.com/project-radius/radius/pkg/ucp/secret"
 )
 
-var _ armrpc_controller.Controller = (*CreateOrUpdateCredential)(nil)
+var _ armrpc_controller.Controller = (*CreateOrUpdateAzureCredential)(nil)
 
-// CreateOrUpdateCredential is the controller implementation to create/update a UCP credential.
-type CreateOrUpdateCredential struct {
-	armrpc_controller.Operation[*datamodel.Credential, datamodel.Credential]
+// CreateOrUpdateAzureCredential is the controller implementation to create/update a UCP Azure credential.
+type CreateOrUpdateAzureCredential struct {
+	armrpc_controller.Operation[*datamodel.AzureCredential, datamodel.AzureCredential]
 	secretClient secret.Client
 }
 
-// NewCreateOrUpdateCredential creates a new CreateOrUpdateCredential.
-func NewCreateOrUpdateCredential(opts ctrl.Options) (armrpc_controller.Controller, error) {
-	return &CreateOrUpdateCredential{
+// NewCreateOrUpdateAzureCredential creates a new CreateOrUpdateAzureCredential.
+func NewCreateOrUpdateAzureCredential(opts ctrl.Options) (armrpc_controller.Controller, error) {
+	return &CreateOrUpdateAzureCredential{
 		Operation: armrpc_controller.NewOperation(opts.Options,
-			armrpc_controller.ResourceOptions[datamodel.Credential]{
-				RequestConverter:  converter.CredentialDataModelFromVersioned,
-				ResponseConverter: converter.CredentialDataModelToVersioned,
+			armrpc_controller.ResourceOptions[datamodel.AzureCredential]{
+				RequestConverter:  converter.AzureCredentialDataModelFromVersioned,
+				ResponseConverter: converter.AzureCredentialDataModelToVersioned,
 			},
 		),
 		secretClient: opts.SecretClient,
 	}, nil
 }
 
-func (c *CreateOrUpdateCredential) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (armrpc_rest.Response, error) {
+func (c *CreateOrUpdateAzureCredential) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (armrpc_rest.Response, error) {
 	serviceCtx := v1.ARMRequestContextFromContext(ctx)
 	newResource, err := c.GetResourceFromRequest(ctx, req)
 	if err != nil {
diff --git a/pkg/ucp/frontend/controller/credentials/azure/deletecredential.go b/pkg/ucp/frontend/controller/credentials/azure/deleteazurecredential.go
similarity index 63%
rename from pkg/ucp/frontend/controller/credentials/azure/deletecredential.go
rename to pkg/ucp/frontend/controller/credentials/azure/deleteazurecredential.go
index 1c059fcd5..c03ea7436 100644
--- a/pkg/ucp/frontend/controller/credentials/azure/deletecredential.go
+++ b/pkg/ucp/frontend/controller/credentials/azure/deleteazurecredential.go
@@ -12,7 +12,6 @@ import (
 
 	v1 "github.com/project-radius/radius/pkg/armrpc/api/v1"
 	armrpc_controller "github.com/project-radius/radius/pkg/armrpc/frontend/controller"
-	"github.com/project-radius/radius/pkg/armrpc/rest"
 	armrpc_rest "github.com/project-radius/radius/pkg/armrpc/rest"
 	"github.com/project-radius/radius/pkg/ucp/datamodel"
 	"github.com/project-radius/radius/pkg/ucp/datamodel/converter"
@@ -23,28 +22,28 @@ import (
 	"github.com/project-radius/radius/pkg/ucp/ucplog"
 )
 
-var _ armrpc_controller.Controller = (*DeleteCredential)(nil)
+var _ armrpc_controller.Controller = (*DeleteAzureCredential)(nil)
 
-// DeleteCredential is the controller implementation to delete a UCP credential.
-type DeleteCredential struct {
-	armrpc_controller.Operation[*datamodel.Credential, datamodel.Credential]
+// DeleteAzureCredential is the controller implementation to delete a UCP Azure credential.
+type DeleteAzureCredential struct {
+	armrpc_controller.Operation[*datamodel.AzureCredential, datamodel.AzureCredential]
 	secretClient secret.Client
 }
 
-// NewDeleteCredential creates a new DeleteCredential.
-func NewDeleteCredential(opts ctrl.Options) (armrpc_controller.Controller, error) {
-	return &DeleteCredential{
+// NewDeleteAzureCredential creates a new DeleteAzureCredential.
+func NewDeleteAzureCredential(opts ctrl.Options) (armrpc_controller.Controller, error) {
+	return &DeleteAzureCredential{
 		Operation: armrpc_controller.NewOperation(opts.Options,
-			armrpc_controller.ResourceOptions[datamodel.Credential]{
-				RequestConverter:  converter.CredentialDataModelFromVersioned,
-				ResponseConverter: converter.CredentialDataModelToVersioned,
+			armrpc_controller.ResourceOptions[datamodel.AzureCredential]{
+				RequestConverter:  converter.AzureCredentialDataModelFromVersioned,
+				ResponseConverter: converter.AzureCredentialDataModelToVersioned,
 			},
 		),
 		secretClient: opts.SecretClient,
 	}, nil
 }
 
-func (c *DeleteCredential) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (armrpc_rest.Response, error) {
+func (c *DeleteAzureCredential) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (armrpc_rest.Response, error) {
 	logger := ucplog.FromContextOrDiscard(ctx)
 	serviceCtx := v1.ARMRequestContextFromContext(ctx)
 
@@ -54,7 +53,7 @@ func (c *DeleteCredential) Run(ctx context.Context, w http.ResponseWriter, req *
 	}
 
 	if old == nil {
-		return rest.NewNoContentResponse(), nil
+		return armrpc_rest.NewNoContentResponse(), nil
 	}
 
 	secretName := credentials.GetSecretName(serviceCtx.ResourceID)
@@ -73,11 +72,11 @@ func (c *DeleteCredential) Run(ctx context.Context, w http.ResponseWriter, req *
 
 	if err := c.StorageClient().Delete(ctx, serviceCtx.ResourceID.String()); err != nil {
 		if errors.Is(&store.ErrNotFound{}, err) {
-			return rest.NewNoContentResponse(), nil
+			return armrpc_rest.NewNoContentResponse(), nil
 		}
 		return nil, err
 	}
 
-	logger.Info(fmt.Sprintf("Deleted Credential %s successfully", serviceCtx.ResourceID))
-	return rest.NewOKResponse(nil), nil
+	logger.Info(fmt.Sprintf("Deleted Azure Credential %s successfully", serviceCtx.ResourceID))
+	return armrpc_rest.NewOKResponse(nil), nil
 }
diff --git a/pkg/ucp/frontend/controller/planes/listplanes.go b/pkg/ucp/frontend/controller/planes/listplanes.go
index ca10fb04e..e40e0ff42 100644
--- a/pkg/ucp/frontend/controller/planes/listplanes.go
+++ b/pkg/ucp/frontend/controller/planes/listplanes.go
@@ -55,30 +55,28 @@ func (e *ListPlanes) Run(ctx context.Context, w http.ResponseWriter, req *http.R
 	if err != nil {
 		return nil, err
 	}
-	var ok = armrpc_rest.NewOKResponse(&v1.PaginatedList{
-		Value: listOfPlanes,
-	})
+	var ok = armrpc_rest.NewOKResponse(listOfPlanes)
 	return ok, nil
 }
 
-func (p *ListPlanes) createResponse(ctx context.Context, req *http.Request, result *store.ObjectQueryResult) ([]any, error) {
+func (p *ListPlanes) createResponse(ctx context.Context, req *http.Request, result *store.ObjectQueryResult) (*v1.PaginatedList, error) {
 	serviceCtx := v1.ARMRequestContextFromContext(ctx)
-	listOfPlanes := []any{}
-	if len(result.Items) > 0 {
-		for _, item := range result.Items {
-			var plane datamodel.Plane
-			err := item.As(&plane)
-			if err != nil {
-				return nil, err
-			}
+	items := v1.PaginatedList{}
 
-			versioned, err := converter.PlaneDataModelToVersioned(&plane, serviceCtx.APIVersion)
-			if err != nil {
-				return nil, err
-			}
+	for _, item := range result.Items {
+		var plane datamodel.Plane
+		err := item.As(&plane)
+		if err != nil {
+			return nil, err
+		}
 
-			listOfPlanes = append(listOfPlanes, versioned)
+		versioned, err := converter.PlaneDataModelToVersioned(&plane, serviceCtx.APIVersion)
+		if err != nil {
+			return nil, err
 		}
+
+		items.Value = append(items.Value, versioned)
 	}
-	return listOfPlanes, nil
+
+	return &items, nil
 }
diff --git a/pkg/ucp/frontend/controller/planes/listplanesbytype.go b/pkg/ucp/frontend/controller/planes/listplanesbytype.go
index 0111cbed2..76e805768 100644
--- a/pkg/ucp/frontend/controller/planes/listplanesbytype.go
+++ b/pkg/ucp/frontend/controller/planes/listplanesbytype.go
@@ -63,30 +63,28 @@ func (e *ListPlanesByType) Run(ctx context.Context, w http.ResponseWriter, req *
 	if err != nil {
 		return nil, err
 	}
-	var ok = armrpc_rest.NewOKResponse(&v1.PaginatedList{
-		Value: listOfPlanes,
-	})
+	var ok = armrpc_rest.NewOKResponse(listOfPlanes)
 	return ok, nil
 }
 
-func (p *ListPlanesByType) createResponse(ctx context.Context, req *http.Request, result *store.ObjectQueryResult) ([]any, error) {
+func (p *ListPlanesByType) createResponse(ctx context.Context, req *http.Request, result *store.ObjectQueryResult) (*v1.PaginatedList, error) {
 	serviceCtx := v1.ARMRequestContextFromContext(ctx)
-	listOfPlanes := []any{}
-	if len(result.Items) > 0 {
-		for _, item := range result.Items {
-			var plane datamodel.Plane
-			err := item.As(&plane)
-			if err != nil {
-				return nil, err
-			}
+	items := v1.PaginatedList{}
 
-			versioned, err := converter.PlaneDataModelToVersioned(&plane, serviceCtx.APIVersion)
-			if err != nil {
-				return nil, err
-			}
+	for _, item := range result.Items {
+		var plane datamodel.Plane
+		err := item.As(&plane)
+		if err != nil {
+			return nil, err
+		}
 
-			listOfPlanes = append(listOfPlanes, versioned)
+		versioned, err := converter.PlaneDataModelToVersioned(&plane, serviceCtx.APIVersion)
+		if err != nil {
+			return nil, err
 		}
+
+		items.Value = append(items.Value, versioned)
 	}
-	return listOfPlanes, nil
+
+	return &items, nil
 }
diff --git a/pkg/validator/apivalidator.go b/pkg/validator/apivalidator.go
index 0a555c429..8b5b5d138 100644
--- a/pkg/validator/apivalidator.go
+++ b/pkg/validator/apivalidator.go
@@ -18,11 +18,11 @@ import (
 )
 
 const (
-	// This comes from the path: /Users/vinayada/radius/radius/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/ucp.json
+	// This comes from the path: /Users/vinayada/radius/radius/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/openapi.json
 	// This spec path is parsed and this string needs to be provider/resourceType.
-	// For UCP, the provider is UCP and since all UCP resource types are in a single json, the file is named ucp.json.
+	// For UCP, the provider is UCP and since all UCP resource types are in a single json, the file is named openapi.json.
 	// Therefore, resourceType = ucp
-	UCPEndpointType = "ucp/ucp"
+	UCPEndpointType = "ucp/openapi"
 	UCPApiVersion   = "2022-09-01-privatepreview"
 )
 
diff --git a/pkg/validator/loader.go b/pkg/validator/loader.go
index 21ea117ce..05899345a 100644
--- a/pkg/validator/loader.go
+++ b/pkg/validator/loader.go
@@ -120,6 +120,9 @@ func LoadSpec(ctx context.Context, providerName string, specs fs.FS, rootScopePr
 				// Trim before 'specification' to convert relative path.
 				first := strings.Index(path, "specification")
 				data, err := fs.ReadFile(l.specFiles, path[first:])
+				if err != nil {
+					return nil, err
+				}
 				return json.RawMessage(data), err
 			},
 		})
diff --git a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialGet.json b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialGet.json
index 84ae45b27..b96132b56 100644
--- a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialGet.json
+++ b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialGet.json
@@ -8,12 +8,12 @@
     "responses": {
         "200": {
             "body": {
-                "id": "/planes/AWS/awscloud/providers/System.AWS/credentials/default",
+                "id": "/planes/AWS/aws/providers/System.AWS/credentials/default",
                 "name": "default",
                 "type": "System.AWS/credentials",
                 "location": "us-west-2",
                 "properties": {
-                    "kind": "aws.com.iam",
+                    "kind": "AccessKey",
                     "storage": {
                         "kind": "Internal",
                         "secretName": "aws-awscloud-default"
diff --git a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialList.json b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialList.json
index c0c953915..0ecba5c63 100644
--- a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialList.json
+++ b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialList.json
@@ -9,12 +9,12 @@
             "body": {
                 "value": [
                     {
-                        "id": "/planes/AWS/awscloud/providers/System.AWS/credentials/default",
+                        "id": "/planes/AWS/aws/providers/System.AWS/credentials/default",
                         "name": "default",
                         "type": "System.AWS/credentials",
                         "location": "us-west-2",
                         "properties": {
-                            "kind": "aws.com.iam",
+                            "kind": "AccessKey",
                             "storage": {
                                 "kind": "Internal",
                                 "secretName": "aws-awscloud-default"
diff --git a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialPut.json b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialPut.json
index 9cd22e0e7..6ba724a84 100644
--- a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialPut.json
+++ b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AWSCredentialPut.json
@@ -2,12 +2,12 @@
     "parameters": {
         "api-version": "2022-09-01-privatepreview",
         "planeType": "aws",
-        "planeName": "awscloud",
+        "planeName": "aws",
         "credentialName": "default",
         "Credential": {
             "location": "us-west-2",
             "properties": {
-                "kind": "aws.com.iam",
+                "kind": "AccessKey",
                 "accessKeyId": "enterAccessKeyIdHere",
                 "secretAccessKey": "enterSecretAccessKey",
                 "storage": {
@@ -19,12 +19,12 @@
     "responses": {
         "200": {
             "body": {
-                "id": "/planes/AWS/awscloud/providers/System.AWS/credentials/default",
+                "id": "/planes/AWS/aws/providers/System.AWS/credentials/default",
                 "name": "default",
                 "type": "System.AWS/credentials",
                 "location": "us-west-2",
                 "properties": {
-                    "kind": "aws.com.iam",
+                    "kind": "AccessKey",
                     "storage": {
                         "kind": "Internal",
                         "secretName": "aws-awscloud-default"
@@ -34,12 +34,12 @@
         },
         "201": {
             "body": {
-                "id": "/planes/AWS/awscloud/providers/System.AWS/credentials/default",
+                "id": "/planes/AWS/aws/providers/System.AWS/credentials/default",
                 "name": "default",
                 "type": "System.AWS/credentials",
                 "location": "us-west-2",
                 "properties": {
-                    "kind": "aws.com.iam",
+                    "kind": "AccessKey",
                     "storage": {
                         "kind": "Internal",
                         "secretName": "aws-awscloud-default"
diff --git a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialGet.json b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialGet.json
index e49ae7f37..cff9c5853 100644
--- a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialGet.json
+++ b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialGet.json
@@ -13,7 +13,7 @@
         "type": "System.Azure/credentials",
         "location": "west-us-2",
         "properties": {
-          "kind": "azure.com.serviceprincipal",
+          "kind": "ServicePrincipal",
           "tenantId": "00000000-0000-0000-0000-000000000000",
           "clientId": "00000000-0000-0000-0000-000000000000",
           "storage": {
diff --git a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialList.json b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialList.json
index 3794af366..94e104644 100644
--- a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialList.json
+++ b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialList.json
@@ -14,7 +14,7 @@
             "type": "System.Azure/credentials",
             "location": "west-us-2",
             "properties": {
-              "kind": "azure.com.serviceprincipal",
+              "kind": "ServicePrincipal",
               "tenantId": "00000000-0000-0000-0000-000000000000",
               "clientId": "00000000-0000-0000-0000-000000000000",
               "storage": {
diff --git a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialPut.json b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialPut.json
index 309810e97..92779ffd5 100644
--- a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialPut.json
+++ b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/examples/AzureCredentialPut.json
@@ -7,7 +7,7 @@
     "Credential": {
       "location": "west-us-2",
       "properties": {
-        "kind": "azure.com.serviceprincipal",
+        "kind": "ServicePrincipal",
         "clientId": "00000000-0000-0000-0000-000000000000",
         "clientSecret": "secretString",
         "tenantId": "00000000-0000-0000-0000-000000000000",
@@ -25,7 +25,7 @@
         "type": "System.Azure/credentials",
         "location": "west-us-2",
         "properties": {
-          "kind": "azure.com.serviceprincipal",
+          "kind": "ServicePrincipal",
           "tenantId": "00000000-0000-0000-0000-000000000000",
           "clientId": "00000000-0000-0000-0000-000000000000",
           "storage": {
@@ -41,7 +41,7 @@
         "type": "System.Azure/credentials",
         "location": "west-us-2",
         "properties": {
-          "kind": "azure.com.serviceprincipal",
+          "kind": "ServicePrincipal",
           "tenantId": "00000000-0000-0000-0000-000000000000",
           "clientId": "00000000-0000-0000-0000-000000000000",
           "storage": {
diff --git a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/openapi.json b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/openapi.json
new file mode 100644
index 000000000..6f7ca2f46
--- /dev/null
+++ b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/openapi.json
@@ -0,0 +1,1311 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "UCP Management APIs",
+    "version": "2022-09-01-privatepreview",
+    "description": "REST APIs for UCP",
+    "x-cadl-generated": [
+      {
+        "emitter": "@azure-tools/cadl-autorest"
+      }
+    ]
+  },
+  "schemes": [
+    "https"
+  ],
+  "host": "management.azure.com",
+  "produces": [
+    "application/json"
+  ],
+  "consumes": [
+    "application/json"
+  ],
+  "security": [
+    {
+      "azure_auth": [
+        "user_impersonation"
+      ]
+    }
+  ],
+  "securityDefinitions": {
+    "azure_auth": {
+      "type": "oauth2",
+      "description": "Azure Active Directory OAuth2 Flow.",
+      "flow": "implicit",
+      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
+      "scopes": {
+        "user_impersonation": "impersonate your user account"
+      }
+    }
+  },
+  "tags": [
+    {
+      "name": "Planes"
+    },
+    {
+      "name": "PlaneTypes"
+    },
+    {
+      "name": "ResourceGroups"
+    },
+    {
+      "name": "AzureCredential"
+    },
+    {
+      "name": "AWSCredential"
+    }
+  ],
+  "paths": {
+    "/planes": {
+      "get": {
+        "tags": [
+          "Planes"
+        ],
+        "operationId": "Planes_ListByRootScope",
+        "description": "Lists information about all PlaneResources in the given plane",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/PlaneResourceListResult"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/planes/{planeType}": {
+      "get": {
+        "tags": [
+          "PlaneTypes"
+        ],
+        "operationId": "PlaneTypes_Get",
+        "description": "Retrieves information about a PlaneResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "name": "planeType",
+            "in": "path",
+            "required": true,
+            "description": "The plane type.",
+            "type": "string"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/PlaneResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      }
+    },
+    "/planes/{planeType}/{planeName}": {
+      "get": {
+        "tags": [
+          "Planes"
+        ],
+        "operationId": "Planes_Get",
+        "description": "Retrieves information about a PlaneResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "name": "planeType",
+            "in": "path",
+            "required": true,
+            "description": "The plane type.",
+            "type": "string"
+          },
+          {
+            "$ref": "#/parameters/PlaneNameParameter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/PlaneResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Planes"
+        ],
+        "operationId": "Planes_CreateOrUpdate",
+        "description": "Creates or updates a PlaneResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "name": "planeType",
+            "in": "path",
+            "required": true,
+            "description": "The plane type.",
+            "type": "string"
+          },
+          {
+            "$ref": "#/parameters/PlaneNameParameter"
+          },
+          {
+            "name": "resource",
+            "in": "body",
+            "required": true,
+            "description": "Resource create parameters.",
+            "schema": {
+              "$ref": "#/definitions/PlaneResource"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/PlaneResource"
+            }
+          },
+          "201": {
+            "description": "ARM create operation completed successfully.",
+            "headers": {
+              "Retry-After": {
+                "description": "The Retry-After header can indicate how long the client should wait before polling the operation status.",
+                "type": "integer",
+                "format": "int32"
+              }
+            },
+            "schema": {
+              "$ref": "#/definitions/PlaneResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Planes"
+        ],
+        "operationId": "Planes_Delete",
+        "description": "Deletes an existing PlaneResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "name": "planeType",
+            "in": "path",
+            "required": true,
+            "description": "The plane type.",
+            "type": "string"
+          },
+          {
+            "$ref": "#/parameters/PlaneNameParameter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Resource deleted successfully."
+          },
+          "202": {
+            "description": "Resource deletion accepted.",
+            "headers": {
+              "Retry-After": {
+                "description": "The Retry-After header can indicate how long the client should wait before polling the operation status.",
+                "type": "integer",
+                "format": "int32"
+              }
+            }
+          },
+          "204": {
+            "description": "Resource deleted successfully."
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      }
+    },
+    "/planes/{planeType}/{planeName}/resourcegroups": {
+      "get": {
+        "tags": [
+          "ResourceGroups"
+        ],
+        "operationId": "ResourceGroups_ListByRootScope",
+        "description": "Lists information about all ResourceGroupResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "name": "planeType",
+            "in": "path",
+            "required": true,
+            "description": "The plane type.",
+            "type": "string"
+          },
+          {
+            "$ref": "#/parameters/PlaneNameParameter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/ResourceGroupResourceListResult"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/planes/{planeType}/{planeName}/resourcegroups/{resourceGroupName}": {
+      "get": {
+        "tags": [
+          "ResourceGroups"
+        ],
+        "operationId": "ResourceGroups_Get",
+        "description": "Retrieves information about a ResourceGroupResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "name": "planeType",
+            "in": "path",
+            "required": true,
+            "description": "The plane type.",
+            "type": "string"
+          },
+          {
+            "$ref": "#/parameters/PlaneNameParameter"
+          },
+          {
+            "name": "resourceGroupName",
+            "in": "path",
+            "required": true,
+            "description": "UCP resourcegroup name",
+            "pattern": "^[A-Za-z]([-A-Za-z0-9]*[A-Za-z0-9])?$",
+            "maxLength": 63,
+            "x-ms-parameter-location": "method",
+            "type": "string"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/ResourceGroupResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "ResourceGroups"
+        ],
+        "operationId": "ResourceGroups_CreateOrUpdate",
+        "description": "Creates or updates a ResourceGroupResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "name": "planeType",
+            "in": "path",
+            "required": true,
+            "description": "The plane type.",
+            "type": "string"
+          },
+          {
+            "$ref": "#/parameters/PlaneNameParameter"
+          },
+          {
+            "name": "resourceGroupName",
+            "in": "path",
+            "required": true,
+            "description": "UCP resourcegroup name",
+            "pattern": "^[A-Za-z]([-A-Za-z0-9]*[A-Za-z0-9])?$",
+            "maxLength": 63,
+            "x-ms-parameter-location": "method",
+            "type": "string"
+          },
+          {
+            "name": "resource",
+            "in": "body",
+            "required": true,
+            "description": "Resource create parameters.",
+            "schema": {
+              "$ref": "#/definitions/ResourceGroupResource"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/ResourceGroupResource"
+            }
+          },
+          "201": {
+            "description": "ARM create operation completed successfully.",
+            "headers": {
+              "Retry-After": {
+                "description": "The Retry-After header can indicate how long the client should wait before polling the operation status.",
+                "type": "integer",
+                "format": "int32"
+              }
+            },
+            "schema": {
+              "$ref": "#/definitions/ResourceGroupResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "ResourceGroups"
+        ],
+        "operationId": "ResourceGroups_Delete",
+        "description": "Deletes an existing ResourceGroupResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "name": "planeType",
+            "in": "path",
+            "required": true,
+            "description": "The plane type.",
+            "type": "string"
+          },
+          {
+            "$ref": "#/parameters/PlaneNameParameter"
+          },
+          {
+            "name": "resourceGroupName",
+            "in": "path",
+            "required": true,
+            "description": "UCP resourcegroup name",
+            "pattern": "^[A-Za-z]([-A-Za-z0-9]*[A-Za-z0-9])?$",
+            "maxLength": 63,
+            "x-ms-parameter-location": "method",
+            "type": "string"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Resource deleted successfully."
+          },
+          "202": {
+            "description": "Resource deletion accepted.",
+            "headers": {
+              "Retry-After": {
+                "description": "The Retry-After header can indicate how long the client should wait before polling the operation status.",
+                "type": "integer",
+                "format": "int32"
+              }
+            }
+          },
+          "204": {
+            "description": "Resource deleted successfully."
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      }
+    },
+    "/planes/aws/{planeName}/providers/System.AWS/credentials": {
+      "get": {
+        "tags": [
+          "AWSCredential"
+        ],
+        "operationId": "AwsCredential_ListByRootScope",
+        "description": "Lists information about all AWSCredentialResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "#/parameters/AWSPlaneNameParameter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/AWSCredentialResourceListResult"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/planes/aws/{planeName}/providers/System.AWS/credentials/{credentialName}": {
+      "get": {
+        "tags": [
+          "AWSCredential"
+        ],
+        "operationId": "AwsCredential_Get",
+        "description": "Retrieves information about a AWSCredentialResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "#/parameters/AWSPlaneNameParameter"
+          },
+          {
+            "name": "credentialName",
+            "in": "path",
+            "required": true,
+            "description": "The AWS credential name.",
+            "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+            "maxLength": 63,
+            "type": "string"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/AWSCredentialResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "AWSCredential"
+        ],
+        "operationId": "AwsCredential_CreateOrUpdate",
+        "description": "Creates or updates a AWSCredentialResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "#/parameters/AWSPlaneNameParameter"
+          },
+          {
+            "name": "credentialName",
+            "in": "path",
+            "required": true,
+            "description": "The AWS credential name.",
+            "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+            "maxLength": 63,
+            "type": "string"
+          },
+          {
+            "name": "resource",
+            "in": "body",
+            "required": true,
+            "description": "Resource create parameters.",
+            "schema": {
+              "$ref": "#/definitions/AWSCredentialResource"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/AWSCredentialResource"
+            }
+          },
+          "201": {
+            "description": "ARM create operation completed successfully.",
+            "headers": {
+              "Retry-After": {
+                "description": "The Retry-After header can indicate how long the client should wait before polling the operation status.",
+                "type": "integer",
+                "format": "int32"
+              }
+            },
+            "schema": {
+              "$ref": "#/definitions/AWSCredentialResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "AWSCredential"
+        ],
+        "operationId": "AwsCredential_Delete",
+        "description": "Deletes an existing AWSCredentialResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "#/parameters/AWSPlaneNameParameter"
+          },
+          {
+            "name": "credentialName",
+            "in": "path",
+            "required": true,
+            "description": "The AWS credential name.",
+            "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+            "maxLength": 63,
+            "type": "string"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Resource deleted successfully."
+          },
+          "202": {
+            "description": "Resource deletion accepted.",
+            "headers": {
+              "Retry-After": {
+                "description": "The Retry-After header can indicate how long the client should wait before polling the operation status.",
+                "type": "integer",
+                "format": "int32"
+              }
+            }
+          },
+          "204": {
+            "description": "Resource deleted successfully."
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      }
+    },
+    "/planes/azure/{planeName}/providers/System.Azure/credentials": {
+      "get": {
+        "tags": [
+          "AzureCredential"
+        ],
+        "operationId": "AzureCredential_ListByRootScope",
+        "description": "Lists information about all AzureCredentialResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "#/parameters/AzurePlaneNameParameter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/AzureCredentialResourceListResult"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/planes/azure/{planeName}/providers/System.Azure/credentials/{credentialName}": {
+      "get": {
+        "tags": [
+          "AzureCredential"
+        ],
+        "operationId": "AzureCredential_Get",
+        "description": "Retrieves information about a AzureCredentialResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "#/parameters/AzurePlaneNameParameter"
+          },
+          {
+            "name": "credentialName",
+            "in": "path",
+            "required": true,
+            "description": "The Azure credential name.",
+            "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+            "maxLength": 63,
+            "type": "string"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/AzureCredentialResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "AzureCredential"
+        ],
+        "operationId": "AzureCredential_CreateOrUpdate",
+        "description": "Creates or updates a AzureCredentialResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "#/parameters/AzurePlaneNameParameter"
+          },
+          {
+            "name": "credentialName",
+            "in": "path",
+            "required": true,
+            "description": "The Azure credential name.",
+            "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+            "maxLength": 63,
+            "type": "string"
+          },
+          {
+            "name": "resource",
+            "in": "body",
+            "required": true,
+            "description": "Resource create parameters.",
+            "schema": {
+              "$ref": "#/definitions/AzureCredentialResource"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ARM operation completed successfully.",
+            "schema": {
+              "$ref": "#/definitions/AzureCredentialResource"
+            }
+          },
+          "201": {
+            "description": "ARM create operation completed successfully.",
+            "headers": {
+              "Retry-After": {
+                "description": "The Retry-After header can indicate how long the client should wait before polling the operation status.",
+                "type": "integer",
+                "format": "int32"
+              }
+            },
+            "schema": {
+              "$ref": "#/definitions/AzureCredentialResource"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "AzureCredential"
+        ],
+        "operationId": "AzureCredential_Delete",
+        "description": "Deletes an existing AzureCredentialResource",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "#/parameters/AzurePlaneNameParameter"
+          },
+          {
+            "name": "credentialName",
+            "in": "path",
+            "required": true,
+            "description": "The Azure credential name.",
+            "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+            "maxLength": 63,
+            "type": "string"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Resource deleted successfully."
+          },
+          "202": {
+            "description": "Resource deletion accepted.",
+            "headers": {
+              "Retry-After": {
+                "description": "The Retry-After header can indicate how long the client should wait before polling the operation status.",
+                "type": "integer",
+                "format": "int32"
+              }
+            }
+          },
+          "204": {
+            "description": "Resource deleted successfully."
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/ErrorResponse"
+            }
+          }
+        }
+      }
+    }
+  },
+  "definitions": {
+    "AWSAccessKeyCredentialProperties": {
+      "type": "object",
+      "properties": {
+        "accessKeyId": {
+          "type": "string",
+          "description": "Access key ID for AWS identity",
+          "x-ms-secret": true
+        },
+        "secretAccessKey": {
+          "type": "string",
+          "description": "Secret Access Key for AWS identity",
+          "x-ms-secret": true
+        },
+        "storage": {
+          "$ref": "#/definitions/CredentialStorageProperties",
+          "description": "The storage properties"
+        }
+      },
+      "description": "AWS credential storage properties",
+      "required": [
+        "accessKeyId",
+        "secretAccessKey",
+        "storage"
+      ],
+      "allOf": [
+        {
+          "$ref": "#/definitions/AWSCredentialProperties"
+        }
+      ],
+      "x-ms-discriminator-value": "AccessKey"
+    },
+    "AWSCredentialKind": {
+      "type": "string",
+      "description": "AWS credential kinds supported.",
+      "enum": [
+        "AccessKey"
+      ],
+      "x-ms-enum": {
+        "name": "AWSCredentialKind",
+        "modelAsString": true
+      }
+    },
+    "AWSCredentialProperties": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "description": "Discriminator property for AWSCredentialProperties."
+        }
+      },
+      "description": "AWS Credential properties",
+      "discriminator": "kind",
+      "required": [
+        "kind"
+      ],
+      "allOf": [
+        {
+          "$ref": "#/definitions/BasicResourceProperties"
+        }
+      ]
+    },
+    "AWSCredentialResource": {
+      "type": "object",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/AWSCredentialProperties",
+          "description": "The resource-specific properties for this resource.",
+          "x-ms-client-flatten": true,
+          "x-ms-mutability": [
+            "read",
+            "create"
+          ]
+        }
+      },
+      "description": "Concrete tracked resource types can be created by aliasing this type using a specific property type.",
+      "allOf": [
+        {
+          "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/TrackedResource"
+        }
+      ]
+    },
+    "AWSCredentialResourceListResult": {
+      "type": "object",
+      "properties": {
+        "value": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AWSCredentialResource"
+          },
+          "x-cadl-name": "AWSCredentialResource[]",
+          "description": "The AWSCredentialResource items on this page"
+        },
+        "nextLink": {
+          "type": "string",
+          "format": "uri",
+          "description": "The link to the next page of items",
+          "x-cadl-name": "Rest.ResourceLocation"
+        }
+      },
+      "description": "The response of a AWSCredentialResource list operation.",
+      "required": [
+        "value"
+      ]
+    },
+    "AWSPlaneNameParameter": {
+      "type": "object",
+      "properties": {},
+      "description": "Custom root scope"
+    },
+    "AzureCredentialKind": {
+      "type": "string",
+      "description": "Azure credential kinds supported.",
+      "enum": [
+        "ServicePrincipal"
+      ],
+      "x-ms-enum": {
+        "name": "AzureCredentialKind",
+        "modelAsString": true
+      }
+    },
+    "AzureCredentialProperties": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "description": "Discriminator property for AzureCredentialProperties."
+        }
+      },
+      "description": "Azure Credential properties",
+      "discriminator": "kind",
+      "required": [
+        "kind"
+      ],
+      "allOf": [
+        {
+          "$ref": "#/definitions/BasicResourceProperties"
+        }
+      ]
+    },
+    "AzureCredentialResource": {
+      "type": "object",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/AzureCredentialProperties",
+          "description": "The resource-specific properties for this resource.",
+          "x-ms-client-flatten": true,
+          "x-ms-mutability": [
+            "read",
+            "create"
+          ]
+        }
+      },
+      "description": "Concrete tracked resource types can be created by aliasing this type using a specific property type.",
+      "allOf": [
+        {
+          "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/TrackedResource"
+        }
+      ]
+    },
+    "AzureCredentialResourceListResult": {
+      "type": "object",
+      "properties": {
+        "value": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AzureCredentialResource"
+          },
+          "x-cadl-name": "AzureCredentialResource[]",
+          "description": "The AzureCredentialResource items on this page"
+        },
+        "nextLink": {
+          "type": "string",
+          "format": "uri",
+          "description": "The link to the next page of items",
+          "x-cadl-name": "Rest.ResourceLocation"
+        }
+      },
+      "description": "The response of a AzureCredentialResource list operation.",
+      "required": [
+        "value"
+      ]
+    },
+    "AzurePlaneNameParameter": {
+      "type": "object",
+      "properties": {},
+      "description": "Custom root scope"
+    },
+    "AzureServicePrincipalProperties": {
+      "type": "object",
+      "properties": {
+        "clientId": {
+          "type": "string",
+          "description": "clientId for ServicePrincipal"
+        },
+        "clientSecret": {
+          "type": "string",
+          "description": "secret for ServicePrincipal",
+          "x-ms-secret": true
+        },
+        "tenantId": {
+          "type": "string",
+          "description": "tenantId for ServicePrincipal"
+        },
+        "storage": {
+          "$ref": "#/definitions/CredentialStorageProperties",
+          "description": "The storage properties"
+        }
+      },
+      "description": "Service Principal credential storage properties",
+      "required": [
+        "clientId",
+        "clientSecret",
+        "tenantId",
+        "storage"
+      ],
+      "allOf": [
+        {
+          "$ref": "#/definitions/AzureCredentialProperties"
+        }
+      ],
+      "x-ms-discriminator-value": "ServicePrincipal"
+    },
+    "BasicResourceProperties": {
+      "type": "object",
+      "properties": {
+        "provisioningState": {
+          "$ref": "#/definitions/ProvisioningState",
+          "description": "Provisioning state of the resource at the time the operation was called",
+          "readOnly": true
+        }
+      },
+      "description": "Basic properties of a UCP resource."
+    },
+    "CredentialStorageKind": {
+      "type": "string",
+      "description": "Credential store kinds supported.",
+      "enum": [
+        "Internal"
+      ],
+      "x-ms-enum": {
+        "name": "CredentialStorageKind",
+        "modelAsString": true
+      }
+    },
+    "CredentialStorageProperties": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "description": "Discriminator property for CredentialStorageProperties."
+        }
+      },
+      "description": "Credential storage properties",
+      "discriminator": "kind",
+      "required": [
+        "kind"
+      ]
+    },
+    "InternalCredentialStorageProperties": {
+      "type": "object",
+      "properties": {
+        "secretName": {
+          "type": "string",
+          "description": "The name of secret stored.",
+          "readOnly": true
+        }
+      },
+      "description": "Internal credential storage properties",
+      "required": [
+        "secretName"
+      ],
+      "allOf": [
+        {
+          "$ref": "#/definitions/CredentialStorageProperties"
+        }
+      ],
+      "x-ms-discriminator-value": "Internal"
+    },
+    "PlaneKind": {
+      "type": "string",
+      "description": "Plane kinds supported.",
+      "enum": [
+        "UCPNative",
+        "Azure",
+        "AWS"
+      ],
+      "x-ms-enum": {
+        "name": "PlaneKind",
+        "modelAsString": true
+      }
+    },
+    "PlaneNameParameter": {
+      "type": "object",
+      "properties": {},
+      "description": "Custom root scope"
+    },
+    "PlaneResource": {
+      "type": "object",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/PlaneResourceProperties",
+          "description": "The resource-specific properties for this resource.",
+          "x-ms-client-flatten": true,
+          "x-ms-mutability": [
+            "read",
+            "create"
+          ]
+        }
+      },
+      "description": "UCP PlaneResource.",
+      "allOf": [
+        {
+          "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/TrackedResource"
+        }
+      ]
+    },
+    "PlaneResourceListResult": {
+      "type": "object",
+      "properties": {
+        "value": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/PlaneResource"
+          },
+          "x-cadl-name": "PlaneResource[]",
+          "description": "The PlaneResource items on this page"
+        },
+        "nextLink": {
+          "type": "string",
+          "format": "uri",
+          "description": "The link to the next page of items",
+          "x-cadl-name": "Rest.ResourceLocation"
+        }
+      },
+      "description": "The response of a PlaneResource list operation.",
+      "required": [
+        "value"
+      ]
+    },
+    "PlaneResourceProperties": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "$ref": "#/definitions/PlaneKind",
+          "description": "The kind of plane"
+        },
+        "url": {
+          "type": "string",
+          "description": "URL to forward requests to for non UCP Native Plane"
+        },
+        "resourceProviders": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "x-cadl-name": "Record<string>",
+          "description": "Resource Providers for UCP Native Plane"
+        }
+      },
+      "description": "Plane properties.",
+      "required": [
+        "kind"
+      ],
+      "allOf": [
+        {
+          "$ref": "#/definitions/BasicResourceProperties"
+        }
+      ]
+    },
+    "ProvisioningState": {
+      "type": "string",
+      "description": "Provisioning state of the link at the time the operation was called",
+      "enum": [
+        "Succeeded",
+        "Failed",
+        "Canceled",
+        "Provisioning",
+        "Updating",
+        "Deleting",
+        "Accepted"
+      ],
+      "x-ms-enum": {
+        "name": "ProvisioningState",
+        "modelAsString": true
+      }
+    },
+    "ResourceGroupResource": {
+      "type": "object",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/BasicResourceProperties",
+          "description": "The resource-specific properties for this resource.",
+          "x-ms-client-flatten": true,
+          "x-ms-mutability": [
+            "read",
+            "create"
+          ]
+        }
+      },
+      "description": "UCP ResourceGroup.",
+      "allOf": [
+        {
+          "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/TrackedResource"
+        }
+      ]
+    },
+    "ResourceGroupResourceListResult": {
+      "type": "object",
+      "properties": {
+        "value": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ResourceGroupResource"
+          },
+          "x-cadl-name": "ResourceGroupResource[]",
+          "description": "The ResourceGroupResource items on this page"
+        },
+        "nextLink": {
+          "type": "string",
+          "format": "uri",
+          "description": "The link to the next page of items",
+          "x-cadl-name": "Rest.ResourceLocation"
+        }
+      },
+      "description": "The response of a ResourceGroupResource list operation.",
+      "required": [
+        "value"
+      ]
+    }
+  },
+  "parameters": {
+    "AWSPlaneNameParameter": {
+      "name": "planeName",
+      "in": "path",
+      "required": true,
+      "description": "The name of the plane",
+      "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+      "maxLength": 63,
+      "x-ms-parameter-location": "method",
+      "x-ms-skip-url-encoding": true,
+      "type": "string"
+    },
+    "AzurePlaneNameParameter": {
+      "name": "planeName",
+      "in": "path",
+      "required": true,
+      "description": "The name of the plane",
+      "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+      "maxLength": 63,
+      "x-ms-parameter-location": "method",
+      "x-ms-skip-url-encoding": true,
+      "type": "string"
+    },
+    "PlaneNameParameter": {
+      "name": "planeName",
+      "in": "path",
+      "required": true,
+      "description": "The name of the plane",
+      "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
+      "maxLength": 63,
+      "x-ms-parameter-location": "method",
+      "x-ms-skip-url-encoding": true,
+      "type": "string"
+    }
+  }
+}
diff --git a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/ucp.json b/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/ucp.json
deleted file mode 100644
index 760c3e25e..000000000
--- a/swagger/specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/ucp.json
+++ /dev/null
@@ -1,1150 +0,0 @@
-{
-  "swagger": "2.0",
-  "info": {
-    "title": "UCP APIs",
-    "description": "REST API for UCP Plane Resource",
-    "version": "2022-09-01-privatepreview"
-  },
-  "host": "api.ucp.dev",
-  "schemes": [
-    "https"
-  ],
-  "consumes": [
-    "application/json"
-  ],
-  "produces": [
-    "application/json"
-  ],
-  "security": [
-    {
-      "basicAuth": []
-    }
-  ],
-  "securityDefinitions": {
-    "basicAuth": {
-      "type": "basic"
-    }
-  },
-  "paths": {
-    "/planes": {
-      "get": {
-        "description": "List all planes.",
-        "operationId": "Planes_List",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "RadiusPlanesList": {
-            "$ref": "./examples/PlanesList.json"
-          }
-        },
-        "tags": [
-          "Planes"
-        ],
-        "parameters": [
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Plane list.",
-            "schema": {
-              "$ref": "#/definitions/PlaneResourceList"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      }
-    },
-    "/planes/{planeType}": {
-      "get": {
-        "description": "List all planes of {planeType}.",
-        "operationId": "PlanesType_List",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "RadiusPlanesList": {
-            "$ref": "./examples/PlanesTypeList.json"
-          }
-        },
-        "tags": [
-          "PlanesType"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Plane list.",
-            "schema": {
-              "$ref": "#/definitions/PlaneResourceList"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      }
-    },
-    "/planes/{planeType}/{planeName}": {
-      "get": {
-        "description": "Gets the properties of a UCP Plane.",
-        "operationId": "Planes_Get",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "RadiusPlanesGet": {
-            "$ref": "./examples/PlanesGetPlaneLocal.json"
-          }
-        },
-        "tags": [
-          "Planes"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Plane details.",
-            "schema": {
-              "$ref": "#/definitions/PlaneResource"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        }
-      },
-      "put": {
-        "description": "Create or update a Plane.",
-        "operationId": "Planes_CreateOrUpdate",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "RadiusPlanesPut": {
-            "$ref": "./examples/PlanesPutPlaneLocal.json"
-          }
-        },
-        "tags": [
-          "Planes"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "name": "Plane",
-            "description": "plane details",
-            "in": "body",
-            "required": true,
-            "schema": {
-              "$ref": "#/definitions/PlaneResource"
-            }
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The resource was created/updated successfully.",
-            "schema": {
-              "$ref": "#/definitions/PlaneResource"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        }
-      },
-      "delete": {
-        "description": "Delete a Plane.",
-        "operationId": "Planes_Delete",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "RadiusPlanesDelete": {
-            "$ref": "./examples/PlanesDeletePlaneLocal.json"
-          }
-        },
-        "tags": [
-          "Planes"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The plane was successfully deleted."
-          },
-          "204": {
-            "description": "The plane does not exist."
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        }
-      }
-    },
-    "/planes/{planeType}/{planeName}/resourcegroups": {
-      "get": {
-        "description": "List all resource groups.",
-        "operationId": "ResourceGroups_List",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "UCPResourceGroupsList": {
-            "$ref": "./examples/ResourceGroupsList.json"
-          }
-        },
-        "tags": [
-          "ResourceGroups"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "ResourceGroup list.",
-            "schema": {
-              "$ref": "#/definitions/ResourceGroupResourceList"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      }
-    },
-    "/planes/{planeType}/{planeName}/resourcegroups/{resourceGroupName}": {
-      "get": {
-        "description": "Gets the properties of a UCP ResourceGroup.",
-        "operationId": "ResourceGroups_Get",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "UCPResourceGroupsGet": {
-            "$ref": "./examples/ResourceGroupsGetResourceGroupRG1.json"
-          }
-        },
-        "tags": [
-          "ResourceGroups"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/ResourceGroupNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "ResourceGroup details.",
-            "schema": {
-              "$ref": "#/definitions/ResourceGroupResource"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        }
-      },
-      "put": {
-        "description": "Create or update a ResourceGroup.",
-        "operationId": "ResourceGroups_CreateOrUpdate",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "UCPResourceGroupsPut": {
-            "$ref": "./examples/ResourceGroupsPutResourceGroupRG1.json"
-          }
-        },
-        "tags": [
-          "ResourceGroups"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/ResourceGroupNameParameter"
-          },
-          {
-            "name": "ResourceGroup",
-            "description": "ResourceGroup details",
-            "in": "body",
-            "required": true,
-            "schema": {
-              "$ref": "#/definitions/ResourceGroupResource"
-            }
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The resource was created/updated successfully.",
-            "schema": {
-              "$ref": "#/definitions/ResourceGroupResource"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        }
-      },
-      "delete": {
-        "description": "Delete a ResourceGroup.",
-        "operationId": "ResourceGroups_Delete",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "RadiusEnvironmentsDelete": {
-            "$ref": "./examples/ResourceGroupsDeleteResourceGroupRG1.json"
-          }
-        },
-        "tags": [
-          "ResourceGroups"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/ResourceGroupNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The resource group was successfully deleted."
-          },
-          "204": {
-            "description": "The resource group does not exist."
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        }
-      }
-    },
-    "/planes/{planeType}/{planeName}/providers/System.Azure/credentials/{credentialName}": {
-      "get": {
-        "description": "Get name of the secret that is holding credential for the plane instance",
-        "operationId": "AzureCredential_Get",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "CredentialGet": {
-            "$ref": "./examples/AzureCredentialGet.json"
-          }
-        },
-        "tags": [
-          "Azure Credential"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/CredentialNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Credential resource. Secrets not displayed",
-            "schema": {
-              "$ref": "#/definitions/CredentialResource"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      },
-      "put": {
-        "description": "Create or update a Credential.",
-        "operationId": "AzureCredential_CreateOrUpdate",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "CredentialPut": {
-            "$ref": "./examples/AzureCredentialPut.json"
-          }
-        },
-        "tags": [
-          "Azure Credential"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/CredentialNameParameter"
-          },
-          {
-            "name": "Credential",
-            "description": "Credential details",
-            "in": "body",
-            "required": true,
-            "schema": {
-              "$ref": "#/definitions/CredentialResource"
-            }
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The resource was updated successfully.",
-            "schema": {
-              "$ref": "#/definitions/CredentialResource"
-            }
-          },
-          "201": {
-            "description": "The resource was created successfully.",
-            "schema": {
-              "$ref": "#/definitions/CredentialResource"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        }
-      },
-      "delete": {
-        "description": "Delete credential resource for this plane instance",
-        "operationId": "AzureCredential_Delete",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "CredentialDelete": {
-            "$ref": "./examples/AzureCredentialDelete.json"
-          }
-        },
-        "tags": [
-          "Azure Credential"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/CredentialNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The credential was successfully deleted."
-          },
-          "204": {
-            "description": "The credential does not exist."
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      }
-    },
-    "/planes/{planeType}/{planeName}/providers/System.Azure/credentials": {
-      "get": {
-        "description": "List the credentials for this plane instance",
-        "operationId": "AzureCredential_List",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "CredentialGet": {
-            "$ref": "./examples/AzureCredentialList.json"
-          }
-        },
-        "tags": [
-          "Azure Credential"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Credential list.",
-            "schema": {
-              "$ref": "#/definitions/CredentialResourceList"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      }
-    },
-    "/planes/{planeType}/{planeName}/providers/System.AWS/credentials/{credentialName}": {
-      "get": {
-        "description": "Get name of the secret that is holding credentials for the plane instance",
-        "operationId": "AWSCredential_Get",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "CredentialsGet": {
-            "$ref": "./examples/AWSCredentialGet.json"
-          }
-        },
-        "tags": [
-          "AWS Credential"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/CredentialNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Credential resource. Secrets not displayed",
-            "schema": {
-              "$ref": "#/definitions/CredentialResource"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      },
-      "put": {
-        "description": "Create or update a Credential.",
-        "operationId": "AWSCredential_CreateOrUpdate",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "CredentialPut": {
-            "$ref": "./examples/AWSCredentialPut.json"
-          }
-        },
-        "tags": [
-          "AWS Credential"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/CredentialNameParameter"
-          },
-          {
-            "name": "Credential",
-            "description": "Credential details",
-            "in": "body",
-            "required": true,
-            "schema": {
-              "$ref": "#/definitions/CredentialResource"
-            }
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The resource was updated successfully.",
-            "schema": {
-              "$ref": "#/definitions/CredentialResource"
-            }
-          },
-          "201": {
-            "description": "The resource was created successfully.",
-            "schema": {
-              "$ref": "#/definitions/CredentialResource"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        }
-      },
-      "delete": {
-        "description": "Delete credential resource for this plane instance",
-        "operationId": "AWSCredential_Delete",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "CredentialDelete": {
-            "$ref": "./examples/AWSCredentialDelete.json"
-          }
-        },
-        "tags": [
-          "AWS Credential"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "#/parameters/CredentialNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The credential was successfully deleted."
-          },
-          "204": {
-            "description": "The credential does not exist."
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      }
-    },
-    "/planes/{planeType}/{planeName}/providers/System.AWS/credentials": {
-      "get": {
-        "description": "List the credentials for this plane instance",
-        "operationId": "AWSCredential_List",
-        "produces": [
-          "application/json"
-        ],
-        "x-ms-examples": {
-          "CredentialList": {
-            "$ref": "./examples/AWSCredentialList.json"
-          }
-        },
-        "tags": [
-          "AWS Credential"
-        ],
-        "parameters": [
-          {
-            "$ref": "#/parameters/PlaneTypeParameter"
-          },
-          {
-            "$ref": "#/parameters/PlaneNameParameter"
-          },
-          {
-            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Credentials list.",
-            "schema": {
-              "$ref": "#/definitions/CredentialResourceList"
-            }
-          },
-          "default": {
-            "description": "Error response describing why the operation failed.",
-            "schema": {
-              "$ref": "#/definitions/ErrorResponse"
-            }
-          }
-        },
-        "deprecated": false
-      }
-    }
-  },
-  "definitions": {
-    "PlaneResourceList": {
-      "description": "The list of planes.",
-      "type": "object",
-      "properties": {
-        "value": {
-          "description": "The list of planes.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/PlaneResource"
-          }
-        }
-      }
-    },
-    "PlaneResource": {
-      "description": "UCP Plane.",
-      "type": "object",
-      "allOf": [
-        {
-          "$ref": "../../../../../common-types/resource-management/v2/types.json#/definitions/TrackedResource"
-        }
-      ],
-      "required": [
-        "properties"
-      ],
-      "properties": {
-        "properties": {
-          "x-ms-client-flatten": true,
-          "$ref": "#/definitions/PlaneResourceProperties"
-        }
-      }
-    },
-    "PlaneResourceProperties": {
-      "description": "UCP Plane properties",
-      "type": "object",
-      "required": [
-        "kind"
-      ],
-      "properties": {
-        "kind": {
-          "$ref": "#/definitions/PlaneKind"
-        },
-        "url": {
-          "description": "URL to forward requests to for non UCP Native Plane",
-          "type": "string"
-        },
-        "resourceProviders": {
-          "description": "Resource Providers for UCP Native Plane",
-          "type": "object",
-          "additionalProperties": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "PlaneKind": {
-      "type": "string",
-      "description": "Plane kinds supported.",
-      "enum": [
-        "UCPNative",
-        "Azure",
-        "AWS"
-      ],
-      "x-ms-enum": {
-        "name": "PlaneKind",
-        "modelAsString": true
-      }
-    },
-    "ResourceGroupResourceList": {
-      "description": "The list of resource groups.",
-      "type": "object",
-      "properties": {
-        "value": {
-          "description": "The list of resource groups.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/ResourceGroupResource"
-          }
-        }
-      }
-    },
-    "ResourceGroupResource": {
-      "description": "UCP ResourceGroup.",
-      "type": "object",
-      "allOf": [
-        {
-          "$ref": "../../../../../common-types/resource-management/v2/types.json#/definitions/TrackedResource"
-        }
-      ]
-    },
-    "CredentialResourceList": {
-      "description": "The list of credentials.",
-      "type": "object",
-      "properties": {
-        "value": {
-          "description": "The list of credentials.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/CredentialResource"
-          }
-        }
-      }
-    },
-    "CredentialResource": {
-      "description": "Credential to a plane instance",
-      "type": "object",
-      "allOf": [
-        {
-          "$ref": "../../../../../common-types/resource-management/v2/types.json#/definitions/TrackedResource"
-        }
-      ],
-      "required": [
-        "properties"
-      ],
-      "properties": {
-        "properties": {
-          "$ref": "#/definitions/CredentialResourceProperties"
-        }
-      }
-    },
-    "CredentialResourceProperties": {
-      "description": "Credential properties",
-      "type": "object",
-      "discriminator": "kind",
-      "required": [
-        "kind",
-        "storage"
-      ],
-      "properties": {
-        "kind": {
-          "description": "The kind of secret",
-          "type": "string"
-        },
-        "storage": {
-          "$ref":"#/definitions/CredentialStorageProperties"
-        }
-      }
-    },
-    "AzureServicePrincipalProperties": {
-      "additionalProperties": false,
-      "allOf": [
-        {
-          "$ref": "#/definitions/CredentialResourceProperties"
-        }
-      ],
-      "properties": {
-        "clientId": {
-          "description": "A client ID that represents the application.",
-          "type": "string"
-        },
-        "tenantId": {
-          "description": "A tenant Id that the application is created.",
-          "type": "string"
-        },
-        "clientSecret": {
-          "description": "A secret string that the application uses to prove its identity when requesting a token.",
-          "type": "string",
-          "x-ms-secret": true
-        }
-      },
-      "required": [
-        "clientId",
-        "tenantId",
-        "clientSecret"
-      ],
-      "type": "object",
-      "x-ms-discriminator-value": "azure.com.serviceprincipal"
-    },
-    "AWSCredentialProperties": {
-      "additionalProperties": false,
-      "allOf": [
-        {
-          "$ref": "#/definitions/CredentialResourceProperties"
-        }
-      ],
-      "properties": {
-        "accessKeyId": {
-          "description": "Access key ID for AWS identity",
-          "type": "string",
-          "x-ms-secret": true
-        },
-        "secretAccessKey": {
-          "description": "Secret Access Key for AWS identity",
-          "type": "string",
-          "x-ms-secret": true
-        }
-      },
-      "required": [
-        "accessKeyId",
-        "secretAccessKey"
-      ],
-      "type": "object",
-      "x-ms-discriminator-value": "aws.com.iam"
-    },
-    "CredentialStorageProperties": {
-      "description": "Credential storage properties",
-      "type": "object",
-      "discriminator": "kind",
-      "required": [
-        "kind"
-      ],
-      "properties": {
-        "kind": {
-          "$ref": "#/definitions/CredentialStorageKind"
-        }
-      }
-    },
-    "InternalCredentialStorageProperties": {
-      "additionalProperties": false,
-      "allOf": [
-        {
-          "$ref": "#/definitions/CredentialStorageProperties"
-        }
-      ],
-      "properties": {
-        "secretName": {
-          "readOnly": true,
-          "type": "string",
-          "description": "The name of secret stored."
-        }
-      },
-      "type": "object",
-      "x-ms-discriminator-value": "Internal"
-    },
-    "CredentialStorageKind": {
-      "type": "string",
-      "description": "credential store kinds supported.",
-      "enum": [
-        "Internal"
-      ],
-      "x-ms-enum": {
-        "name": "CredentialStorageKind",
-        "modelAsString": true
-      }
-    },
-    "ErrorDetail": {
-      "description": "The error detail.",
-      "type": "object",
-      "properties": {
-        "code": {
-          "readOnly": true,
-          "type": "string",
-          "description": "The error code."
-        },
-        "message": {
-          "readOnly": true,
-          "type": "string",
-          "description": "The error message."
-        },
-        "target": {
-          "readOnly": true,
-          "type": "string",
-          "description": "The error target."
-        },
-        "details": {
-          "readOnly": true,
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/ErrorDetail"
-          },
-          "x-ms-identifiers": [
-            "message",
-            "target"
-          ],
-          "description": "The error details."
-        },
-        "additionalInfo": {
-          "readOnly": true,
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/ErrorAdditionalInfo"
-          },
-          "x-ms-identifiers": [],
-          "description": "The error additional info."
-        }
-      }
-    },
-    "ErrorResponse": {
-      "title": "Error response",
-      "description": "Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).",
-      "type": "object",
-      "properties": {
-        "error": {
-          "description": "The error object.",
-          "$ref": "#/definitions/ErrorDetail"
-        }
-      }
-    },
-    "ErrorAdditionalInfo": {
-      "type": "object",
-      "properties": {
-        "type": {
-          "readOnly": true,
-          "type": "string",
-          "description": "The additional info type."
-        },
-        "info": {
-          "readOnly": true,
-          "type": "object",
-          "description": "The additional info."
-        }
-      },
-      "description": "The resource management error additional info."
-    }
-  },
-  "parameters": {
-    "PlaneTypeParameter": {
-      "name": "planeType",
-      "in": "path",
-      "required": true,
-      "type": "string",
-      "description": "The type of the plane",
-      "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
-      "maxLength": 63,
-      "x-ms-parameter-location": "method"
-    },
-    "PlaneNameParameter": {
-      "name": "planeName",
-      "in": "path",
-      "required": true,
-      "type": "string",
-      "description": "The name of the plane",
-      "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
-      "maxLength": 63,
-      "x-ms-parameter-location": "method"
-    },
-    "ResourceGroupNameParameter": {
-      "name": "resourceGroupName",
-      "in": "path",
-      "required": true,
-      "type": "string",
-      "description": "The name of the resource group",
-      "pattern": "^[A-Za-z]([-A-Za-z0-9]*[A-Za-z0-9])?$",
-      "maxLength": 63,
-      "x-ms-parameter-location": "method"
-    },
-    "CredentialNameParameter": {
-      "name": "credentialName",
-      "in": "path",
-      "required": true,
-      "type": "string",
-      "description": "The name of the credential",
-      "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$",
-      "maxLength": 63,
-      "x-ms-parameter-location": "method"
-    }
-  }
-}
diff --git a/swagger/specs.go b/swagger/specs.go
index 747dce099..010c59d74 100644
--- a/swagger/specs.go
+++ b/swagger/specs.go
@@ -21,6 +21,7 @@ var (
 	SpecFiles embed.FS
 
 	//go:embed specification/common-types/resource-management/v2/types.json
+	//go:embed specification/common-types/resource-management/v3/types.json
 	//go:embed specification/ucp/resource-manager/UCP/preview/2022-09-01-privatepreview/*.json
 	SpecFilesUCP embed.FS
 )



Test patch:
diff --git a/pkg/cli/cmd/app/delete/delete_test.go b/pkg/cli/cmd/app/delete/delete_test.go
new file mode 100644
index 000000000..9ac7d4064
--- /dev/null
+++ b/pkg/cli/cmd/app/delete/delete_test.go
@@ -0,0 +1,283 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package list
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/clients"
+	"github.com/project-radius/radius/pkg/cli/connections"
+	"github.com/project-radius/radius/pkg/cli/framework"
+	"github.com/project-radius/radius/pkg/cli/output"
+	"github.com/project-radius/radius/pkg/cli/prompt"
+	"github.com/project-radius/radius/pkg/cli/workspaces"
+	"github.com/project-radius/radius/test/radcli"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_CommandValidation(t *testing.T) {
+	radcli.SharedCommandValidation(t, NewCommand)
+}
+
+func Test_Validate(t *testing.T) {
+	testcases := []radcli.ValidateInput{
+		{
+			Name:          "Delete Command with default application",
+			Input:         []string{},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadConfigWithWorkspaceAndApplication(t),
+			},
+		},
+		{
+			Name:          "Delete Command with flag",
+			Input:         []string{"-a", "test-application"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadConfigWithWorkspace(t),
+			},
+		},
+		{
+			Name:          "Delete Command with positional arg",
+			Input:         []string{"test-application"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadConfigWithWorkspace(t),
+			},
+		},
+		{
+			Name:          "Delete Command with confirm",
+			Input:         []string{"--yes"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadConfigWithWorkspaceAndApplication(t),
+			},
+		},
+		{
+			Name:          "Delete Command with fallback workspace",
+			Input:         []string{"--application", "test-application", "--group", "test-group"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadEmptyConfig(t),
+			},
+		},
+		{
+			Name:          "Delete Command with incorrect args",
+			Input:         []string{"foo", "bar"},
+			ExpectedValid: false,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadConfigWithWorkspace(t),
+			},
+		},
+	}
+	radcli.SharedValidateValidation(t, NewCommand, testcases)
+}
+
+func Test_Show(t *testing.T) {
+	t.Run("Success: Application Found", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		appManagementClient := clients.NewMockApplicationsManagementClient(ctrl)
+		appManagementClient.EXPECT().
+			DeleteApplication(gomock.Any(), "test-app").
+			Return(true, nil).
+			Times(1)
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			ConnectionFactory: &connections.MockFactory{ApplicationsManagementClient: appManagementClient},
+			Workspace:         workspace,
+			Output:            outputSink,
+			ApplicationName:   "test-app",
+			Confirm:           true,
+		}
+
+		err := runner.Run(context.Background())
+		require.NoError(t, err)
+
+		expected := []any{
+			output.LogOutput{
+				Format: "Application deleted",
+			},
+		}
+
+		require.Equal(t, expected, outputSink.Writes)
+	})
+
+	t.Run("Success: Prompt Confirmed", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+
+		promptMock := prompt.NewMockInterface(ctrl)
+		promptMock.EXPECT().
+			GetListInput([]string{"No", "Yes"}, fmt.Sprintf(deleteConfirmation, "test-app", workspace.Name)).
+			Return("yes", nil).
+			Times(1)
+
+		appManagementClient := clients.NewMockApplicationsManagementClient(ctrl)
+		appManagementClient.EXPECT().
+			DeleteApplication(gomock.Any(), "test-app").
+			Return(true, nil).
+			Times(1)
+
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			ConnectionFactory: &connections.MockFactory{ApplicationsManagementClient: appManagementClient},
+			InputPrompter:     promptMock,
+			Workspace:         workspace,
+			Output:            outputSink,
+			ApplicationName:   "test-app",
+		}
+
+		err := runner.Run(context.Background())
+		require.NoError(t, err)
+
+		expected := []any{
+			output.LogOutput{
+				Format: "Application deleted",
+			},
+		}
+
+		require.Equal(t, expected, outputSink.Writes)
+	})
+
+	t.Run("Success: Prompt Cancelled", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+
+		promptMock := prompt.NewMockInterface(ctrl)
+		promptMock.EXPECT().
+			GetListInput([]string{"No", "Yes"}, fmt.Sprintf(deleteConfirmation, "test-app", workspace.Name)).
+			Return("no", nil).
+			Times(1)
+
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			InputPrompter:   promptMock,
+			Workspace:       workspace,
+			Output:          outputSink,
+			ApplicationName: "test-app",
+		}
+
+		err := runner.Run(context.Background())
+		require.NoError(t, err)
+		require.Empty(t, outputSink.Writes)
+	})
+
+	// YES, this is a success case. Delete means "make it be gone", so if the application is already
+	// gone that counts as a success.
+	//
+	// We print a different message which is why it has a separate test
+	t.Run("Success: Application Not Found", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		appManagementClient := clients.NewMockApplicationsManagementClient(ctrl)
+		appManagementClient.EXPECT().
+			DeleteApplication(gomock.Any(), "test-app").
+			Return(false, nil).
+			Times(1)
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			ConnectionFactory: &connections.MockFactory{ApplicationsManagementClient: appManagementClient},
+			Workspace:         workspace,
+			Output:            outputSink,
+			ApplicationName:   "test-app",
+			Confirm:           true,
+		}
+
+		err := runner.Run(context.Background())
+		require.NoError(t, err)
+
+		expected := []any{
+			output.LogOutput{
+				Format: "Application '%s' does not exist or has already been deleted.",
+				Params: []any{"test-app"},
+			},
+		}
+
+		require.Equal(t, expected, outputSink.Writes)
+	})
+
+	// This is a success scenario because the user intended for the interrupt
+	t.Run("Success: Console Interrupt", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+
+		promptMock := prompt.NewMockInterface(ctrl)
+		promptMock.EXPECT().
+			GetListInput([]string{"No", "Yes"}, fmt.Sprintf(deleteConfirmation, "test-app", workspace.Name)).
+			Return("", &prompt.ErrExitConsole{}).
+			Times(1)
+
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			InputPrompter:   promptMock,
+			Output:          outputSink,
+			Workspace:       workspace,
+			ApplicationName: "test-app",
+		}
+
+		err := runner.Run(context.Background())
+		require.Equal(t, err, &cli.FriendlyError{Message: prompt.ErrExitConsoleMessage})
+		require.Empty(t, outputSink.Writes)
+	})
+}
diff --git a/pkg/cli/cmd/app/list/list_test.go b/pkg/cli/cmd/app/list/list_test.go
new file mode 100644
index 000000000..2f37d936a
--- /dev/null
+++ b/pkg/cli/cmd/app/list/list_test.go
@@ -0,0 +1,119 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package list
+
+import (
+	"context"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/project-radius/radius/pkg/cli/clients"
+	"github.com/project-radius/radius/pkg/cli/connections"
+	"github.com/project-radius/radius/pkg/cli/framework"
+	"github.com/project-radius/radius/pkg/cli/objectformats"
+	"github.com/project-radius/radius/pkg/cli/output"
+	"github.com/project-radius/radius/pkg/cli/workspaces"
+	"github.com/project-radius/radius/pkg/corerp/api/v20220315privatepreview"
+	"github.com/project-radius/radius/pkg/to"
+	"github.com/project-radius/radius/test/radcli"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_CommandValidation(t *testing.T) {
+	radcli.SharedCommandValidation(t, NewCommand)
+}
+
+func Test_Validate(t *testing.T) {
+	configWithWorkspace := radcli.LoadConfigWithWorkspace(t)
+	testcases := []radcli.ValidateInput{
+		{
+			Name:          "List Command with incorrect args",
+			Input:         []string{"group"},
+			ExpectedValid: false,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         configWithWorkspace,
+			},
+		},
+		{
+			Name:          "List Command with correct options but bad workspace",
+			Input:         []string{"-w", "doesnotexist"},
+			ExpectedValid: false,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         configWithWorkspace,
+			},
+		},
+		{
+			Name:          "List Command with valid workspace specified",
+			Input:         []string{"-w", radcli.TestWorkspaceName},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         configWithWorkspace,
+			},
+		},
+		{
+			Name:          "List Command with fallback workspace",
+			Input:         []string{"--group", "test-group"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadEmptyConfig(t),
+			},
+		},
+	}
+	radcli.SharedValidateValidation(t, NewCommand, testcases)
+}
+
+func Test_Run(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	applications := []v20220315privatepreview.ApplicationResource{
+		{
+			Name: to.Ptr("A"),
+		},
+		{
+			Name: to.Ptr("B"),
+		},
+	}
+
+	appManagementClient := clients.NewMockApplicationsManagementClient(ctrl)
+	appManagementClient.EXPECT().
+		ListApplications(gomock.Any()).
+		Return(applications, nil).
+		Times(1)
+
+	workspace := &workspaces.Workspace{
+		Connection: map[string]any{
+			"kind":    "kubernetes",
+			"context": "kind-kind",
+		},
+		Name:  "kind-kind",
+		Scope: "/planes/radius/local/resourceGroups/test-group",
+	}
+	outputSink := &output.MockOutput{}
+	runner := &Runner{
+		ConnectionFactory: &connections.MockFactory{ApplicationsManagementClient: appManagementClient},
+		Workspace:         workspace,
+		Format:            "table",
+		Output:            outputSink,
+	}
+
+	err := runner.Run(context.Background())
+	require.NoError(t, err)
+
+	expected := []any{
+		output.FormattedOutput{
+			Format:  "table",
+			Obj:     applications,
+			Options: objectformats.GetResourceTableFormat(),
+		},
+	}
+
+	require.Equal(t, expected, outputSink.Writes)
+}
diff --git a/pkg/cli/cmd/app/show/show_test.go b/pkg/cli/cmd/app/show/show_test.go
new file mode 100644
index 000000000..0bcfee1e1
--- /dev/null
+++ b/pkg/cli/cmd/app/show/show_test.go
@@ -0,0 +1,161 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package list
+
+import (
+	"context"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/clients"
+	"github.com/project-radius/radius/pkg/cli/connections"
+	"github.com/project-radius/radius/pkg/cli/framework"
+	"github.com/project-radius/radius/pkg/cli/objectformats"
+	"github.com/project-radius/radius/pkg/cli/output"
+	"github.com/project-radius/radius/pkg/cli/workspaces"
+	"github.com/project-radius/radius/pkg/corerp/api/v20220315privatepreview"
+	"github.com/project-radius/radius/pkg/to"
+	"github.com/project-radius/radius/test/radcli"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_CommandValidation(t *testing.T) {
+	radcli.SharedCommandValidation(t, NewCommand)
+}
+
+func Test_Validate(t *testing.T) {
+	config := radcli.LoadConfigWithWorkspace(t)
+	testcases := []radcli.ValidateInput{
+		{
+			Name:          "Show Command with default application",
+			Input:         []string{},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadConfigWithWorkspaceAndApplication(t),
+			},
+		},
+		{
+			Name:          "Show Command with flag",
+			Input:         []string{"-a", "test-app"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         config,
+			},
+		},
+		{
+			Name:          "Show Command with positional arg",
+			Input:         []string{"test-app"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         config,
+			},
+		},
+		{
+			Name:          "Show Command with fallback workspace",
+			Input:         []string{"--application", "test-app", "--group", "test-group"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadEmptyConfig(t),
+			},
+		},
+		{
+			Name:          "Show Command with incorrect args",
+			Input:         []string{"foo", "bar"},
+			ExpectedValid: false,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         config,
+			},
+		},
+	}
+	radcli.SharedValidateValidation(t, NewCommand, testcases)
+}
+
+func Test_Run(t *testing.T) {
+	t.Run("Success: Application Found", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		application := v20220315privatepreview.ApplicationResource{
+			Name: to.Ptr("test-app"),
+		}
+
+		appManagementClient := clients.NewMockApplicationsManagementClient(ctrl)
+		appManagementClient.EXPECT().
+			ShowApplication(gomock.Any(), "test-app").
+			Return(application, nil).
+			Times(1)
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			ConnectionFactory: &connections.MockFactory{ApplicationsManagementClient: appManagementClient},
+			Workspace:         workspace,
+			Format:            "table",
+			Output:            outputSink,
+			ApplicationName:   "test-app",
+		}
+
+		err := runner.Run(context.Background())
+		require.NoError(t, err)
+
+		expected := []any{
+			output.FormattedOutput{
+				Format:  "table",
+				Obj:     application,
+				Options: objectformats.GetResourceTableFormat(),
+			},
+		}
+
+		require.Equal(t, expected, outputSink.Writes)
+	})
+
+	t.Run("Error: Application Not Found", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		appManagementClient := clients.NewMockApplicationsManagementClient(ctrl)
+		appManagementClient.EXPECT().
+			ShowApplication(gomock.Any(), "test-app").
+			Return(v20220315privatepreview.ApplicationResource{}, radcli.Create404Error()).
+			Times(1)
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			ConnectionFactory: &connections.MockFactory{ApplicationsManagementClient: appManagementClient},
+			Workspace:         workspace,
+			Format:            "table",
+			Output:            outputSink,
+			ApplicationName:   "test-app",
+		}
+
+		err := runner.Run(context.Background())
+		require.Error(t, err)
+		require.ErrorIs(t, err, &cli.FriendlyError{Message: "The application \"test-app\" was not found or has been deleted."})
+
+		require.Empty(t, outputSink.Writes)
+	})
+}
diff --git a/pkg/cli/cmd/app/status/status_test.go b/pkg/cli/cmd/app/status/status_test.go
new file mode 100644
index 000000000..bc42df292
--- /dev/null
+++ b/pkg/cli/cmd/app/status/status_test.go
@@ -0,0 +1,228 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package status
+
+import (
+	"context"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/project-radius/radius/pkg/cli"
+	"github.com/project-radius/radius/pkg/cli/clients"
+	"github.com/project-radius/radius/pkg/cli/clients_new/generated"
+	"github.com/project-radius/radius/pkg/cli/connections"
+	"github.com/project-radius/radius/pkg/cli/framework"
+	"github.com/project-radius/radius/pkg/cli/objectformats"
+	"github.com/project-radius/radius/pkg/cli/output"
+	"github.com/project-radius/radius/pkg/cli/workspaces"
+	"github.com/project-radius/radius/pkg/corerp/api/v20220315privatepreview"
+	"github.com/project-radius/radius/pkg/to"
+	"github.com/project-radius/radius/pkg/ucp/resources"
+	"github.com/project-radius/radius/test/radcli"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_CommandValidation(t *testing.T) {
+	radcli.SharedCommandValidation(t, NewCommand)
+}
+
+func Test_Validate(t *testing.T) {
+	config := radcli.LoadConfigWithWorkspace(t)
+	testcases := []radcli.ValidateInput{
+		{
+			Name:          "Status Command with default application",
+			Input:         []string{},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadConfigWithWorkspaceAndApplication(t),
+			},
+		},
+		{
+			Name:          "Status Command with flag",
+			Input:         []string{"-a", "test-app"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         config,
+			},
+		},
+		{
+			Name:          "Status Command with positional arg",
+			Input:         []string{"test-app"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         config,
+			},
+		},
+		{
+			Name:          "Status Command with fallback workspace",
+			Input:         []string{"--application", "test-app", "--group", "test-group"},
+			ExpectedValid: true,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         radcli.LoadEmptyConfig(t),
+			},
+		},
+		{
+			Name:          "Status Command with incorrect args",
+			Input:         []string{"foo", "bar"},
+			ExpectedValid: false,
+			ConfigHolder: framework.ConfigHolder{
+				ConfigFilePath: "",
+				Config:         config,
+			},
+		},
+	}
+	radcli.SharedValidateValidation(t, NewCommand, testcases)
+}
+
+func Test_Run(t *testing.T) {
+	t.Run("Success: Application Found", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		application := v20220315privatepreview.ApplicationResource{
+			Name: to.Ptr("test-app"),
+		}
+
+		appManagementClient := clients.NewMockApplicationsManagementClient(ctrl)
+		appManagementClient.EXPECT().
+			ShowApplication(gomock.Any(), "test-app").
+			Return(application, nil).
+			Times(1)
+
+		resourceList := []generated.GenericResource{
+			{
+				Name: to.Ptr("test-container"),
+				ID:   to.Ptr("/planes/radius/local/resourceGroups/test-group/providers/Applications.Core/containers/test-container"),
+			},
+			{
+				Name: to.Ptr("test-route"),
+				ID:   to.Ptr("/planes/radius/local/resourceGroups/test-group/providers/Applications.Core/httpRoutes/test-route"),
+			},
+			{
+				Name: to.Ptr("test-gateway"),
+				ID:   to.Ptr("/planes/radius/local/resourceGroups/test-group/providers/Applications.Core/gateways/test-gateway"),
+			},
+		}
+
+		appManagementClient.EXPECT().
+			ListAllResourcesByApplication(gomock.Any(), "test-app").
+			Return(resourceList, nil).
+			Times(1)
+
+		diagnosticsClient := clients.NewMockDiagnosticsClient(ctrl)
+		diagnosticsClient.EXPECT().
+			GetPublicEndpoint(gomock.Any(), clients.EndpointOptions{ResourceID: mustParse(t, "/planes/radius/local/resourceGroups/test-group/providers/Applications.Core/containers/test-container")}).
+			Return(nil, nil).
+			Times(1)
+
+		diagnosticsClient.EXPECT().
+			GetPublicEndpoint(gomock.Any(), clients.EndpointOptions{ResourceID: mustParse(t, "/planes/radius/local/resourceGroups/test-group/providers/Applications.Core/httpRoutes/test-route")}).
+			Return(nil, nil).
+			Times(1)
+
+		diagnosticsClient.EXPECT().
+			GetPublicEndpoint(gomock.Any(), clients.EndpointOptions{ResourceID: mustParse(t, "/planes/radius/local/resourceGroups/test-group/providers/Applications.Core/gateways/test-gateway")}).
+			Return(to.Ptr("http://some-url.example.com"), nil).
+			Times(1)
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			ConnectionFactory: &connections.MockFactory{
+				ApplicationsManagementClient: appManagementClient,
+				DiagnosticsClient:            diagnosticsClient,
+			},
+			Workspace:       workspace,
+			Format:          "table",
+			Output:          outputSink,
+			ApplicationName: "test-app",
+		}
+
+		err := runner.Run(context.Background())
+		require.NoError(t, err)
+
+		applicationStatus := clients.ApplicationStatus{
+			Name:          "test-app",
+			ResourceCount: 3,
+			Gateways: []clients.GatewayStatus{
+				{
+					Name:     "test-gateway",
+					Endpoint: "http://some-url.example.com",
+				},
+			},
+		}
+
+		expected := []any{
+			output.FormattedOutput{
+				Format:  "table",
+				Obj:     applicationStatus,
+				Options: objectformats.GetApplicationStatusTableFormat(),
+			},
+			output.LogOutput{
+				Format: "",
+			},
+			output.FormattedOutput{
+				Format:  "table",
+				Obj:     applicationStatus.Gateways,
+				Options: objectformats.GetApplicationGatewaysTableFormat(),
+			},
+		}
+
+		require.Equal(t, expected, outputSink.Writes)
+	})
+
+	t.Run("Error: Application Not Found", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		appManagementClient := clients.NewMockApplicationsManagementClient(ctrl)
+		appManagementClient.EXPECT().
+			ShowApplication(gomock.Any(), "test-app").
+			Return(v20220315privatepreview.ApplicationResource{}, radcli.Create404Error()).
+			Times(1)
+
+		workspace := &workspaces.Workspace{
+			Connection: map[string]any{
+				"kind":    "kubernetes",
+				"context": "kind-kind",
+			},
+			Name:  "kind-kind",
+			Scope: "/planes/radius/local/resourceGroups/test-group",
+		}
+		outputSink := &output.MockOutput{}
+		runner := &Runner{
+			ConnectionFactory: &connections.MockFactory{ApplicationsManagementClient: appManagementClient},
+			Workspace:         workspace,
+			Format:            "table",
+			Output:            outputSink,
+			ApplicationName:   "test-app",
+		}
+
+		err := runner.Run(context.Background())
+		require.Error(t, err)
+		require.ErrorIs(t, err, &cli.FriendlyError{Message: "The application \"test-app\" was not found or has been deleted."})
+
+		require.Empty(t, outputSink.Writes)
+	})
+}
+
+func mustParse(t *testing.T, s string) resources.ID {
+	t.Helper()
+	id, err := resources.Parse(s)
+	require.NoError(t, err)
+	return id
+}
diff --git a/pkg/cli/cmd/credential/register/aws/aws_test.go b/pkg/cli/cmd/credential/register/aws/aws_test.go
index a2bb1dd28..870da32c8 100644
--- a/pkg/cli/cmd/credential/register/aws/aws_test.go
+++ b/pkg/cli/cmd/credential/register/aws/aws_test.go
@@ -89,12 +89,12 @@ func Test_Run(t *testing.T) {
 	t.Run("Create aws provider", func(t *testing.T) {
 		t.Run("Success", func(t *testing.T) {
 			ctrl := gomock.NewController(t)
-			expectedPut := ucp.CredentialResource{
+			expectedPut := ucp.AWSCredentialResource{
 				Location: to.Ptr(v1.LocationGlobal),
 				Type:     to.Ptr(cli_credential.AWSCredential),
-				Properties: &ucp.AWSCredentialProperties{
+				Properties: &ucp.AWSAccessKeyCredentialProperties{
 					Storage: &ucp.CredentialStorageProperties{
-						Kind: to.Ptr(ucp.CredentialStorageKindInternal),
+						Kind: to.Ptr(string(ucp.CredentialStorageKindInternal)),
 					},
 					AccessKeyID:     to.Ptr(testAccessKeyId),
 					SecretAccessKey: to.Ptr(testSecretAccessKey),
@@ -103,7 +103,7 @@ func Test_Run(t *testing.T) {
 
 			client := cli_credential.NewMockCredentialManagementClient(ctrl)
 			client.EXPECT().
-				Put(gomock.Any(), expectedPut).
+				PutAWS(gomock.Any(), expectedPut).
 				Return(nil).
 				Times(1)
 
diff --git a/pkg/cli/cmd/credential/register/azure/azure_test.go b/pkg/cli/cmd/credential/register/azure/azure_test.go
index 4cc20a1db..6aa7eb5e6 100644
--- a/pkg/cli/cmd/credential/register/azure/azure_test.go
+++ b/pkg/cli/cmd/credential/register/azure/azure_test.go
@@ -149,24 +149,24 @@ func Test_Run(t *testing.T) {
 			config := radcli.LoadConfig(t, string(yamlData))
 			config.SetConfigFile(configPath)
 
-			expectedPut := ucp.CredentialResource{
-				Name:     to.Ptr("default"),
+			expectedPut := ucp.AzureCredentialResource{
 				Location: to.Ptr(v1.LocationGlobal),
 				Type:     to.Ptr(cli_credential.AzureCredential),
 				ID:       to.Ptr(fmt.Sprintf(common.AzureCredentialID, "default")),
 				Properties: &ucp.AzureServicePrincipalProperties{
 					Storage: &ucp.CredentialStorageProperties{
-						Kind: to.Ptr(ucp.CredentialStorageKindInternal),
+						Kind: to.Ptr(string(ucp.CredentialStorageKindInternal)),
 					},
 					ClientID:     to.Ptr("cool-client-id"),
 					ClientSecret: to.Ptr("cool-client-secret"),
 					TenantID:     to.Ptr("cool-tenant-id"),
+					Kind:         to.Ptr("ServicePrincipal"),
 				},
 			}
 
 			client := cli_credential.NewMockCredentialManagementClient(ctrl)
 			client.EXPECT().
-				Put(gomock.Any(), expectedPut).
+				PutAzure(gomock.Any(), expectedPut).
 				Return(nil).
 				Times(1)
 
diff --git a/pkg/cli/cmd/radinit/init_test.go b/pkg/cli/cmd/radinit/init_test.go
index dcf2c65d2..75344af12 100644
--- a/pkg/cli/cmd/radinit/init_test.go
+++ b/pkg/cli/cmd/radinit/init_test.go
@@ -474,7 +474,7 @@ func Test_Run_InstallAndCreateEnvironment_WithAzureProvider_WithRecipes(t *testi
 
 	credentialManagementClient := cli_credential.NewMockCredentialManagementClient(ctrl)
 	credentialManagementClient.EXPECT().
-		Put(context.Background(), gomock.Any()).
+		PutAzure(context.Background(), gomock.Any()).
 		Return(nil).Times(1)
 
 	configFileInterface.EXPECT().
@@ -550,7 +550,7 @@ func Test_Run_InstallAndCreateEnvironment_WithAWSProvider(t *testing.T) {
 
 	credentialManagementClient := cli_credential.NewMockCredentialManagementClient(ctrl)
 	credentialManagementClient.EXPECT().
-		Put(context.Background(), gomock.Any()).
+		PutAWS(context.Background(), gomock.Any()).
 		Return(nil).Times(1)
 
 	configFileInterface.EXPECT().
diff --git a/pkg/cli/credential/credential_management_test.go b/pkg/cli/credential/credential_management_test.go
index 027010067..e134783b6 100644
--- a/pkg/cli/credential/credential_management_test.go
+++ b/pkg/cli/credential/credential_management_test.go
@@ -7,7 +7,6 @@ package credential
 
 import (
 	"errors"
-	"strings"
 	"testing"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
@@ -32,25 +31,26 @@ var (
 	errInternalServer     = errors.New("internal server error")
 )
 
-func Test_Credential_Put(t *testing.T) {
+func Test_AzureCredential_Put(t *testing.T) {
 	tests := []struct {
 		name       string
 		planeType  string
 		planeName  string
-		credential ucp.CredentialResource
+		credential ucp.AzureCredentialResource
 		err        error
-		setupMocks func(mockCredentialClient MockInterface, planeType string, planeName string)
+		setupMocks func(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string)
 	}{
 		{
 			name:      "create azure credential success",
 			planeType: AzurePlaneType,
 			planeName: AzurePlaneName,
-			credential: ucp.CredentialResource{
+			credential: ucp.AzureCredentialResource{
+				Name:     to.Ptr(azureProviderName),
 				Location: to.Ptr(v1.LocationGlobal),
 				Type:     to.Ptr(AzureCredential),
 				Properties: &ucp.AzureServicePrincipalProperties{
 					Storage: &ucp.CredentialStorageProperties{
-						Kind: to.Ptr(ucp.CredentialStorageKindInternal),
+						Kind: to.Ptr(string(ucp.CredentialStorageKindInternal)),
 					},
 					ClientID:     to.Ptr(clientID),
 					ClientSecret: to.Ptr("cool-client-secret"),
@@ -58,34 +58,62 @@ func Test_Credential_Put(t *testing.T) {
 				},
 			},
 			err:        nil,
-			setupMocks: setupSuccessPutMocks,
+			setupMocks: setupSuccessPutAzureMocks,
 		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx, cancel := testcontext.New(t)
+			defer cancel()
+			mockCtrl := gomock.NewController(t)
+			defer mockCtrl.Finish()
+			azMockCredentialClient := NewMockAzureCredentialManagementClientInterface(mockCtrl)
+			awsMockCredentialClient := NewMockAWSCredentialManagementClientInterface(mockCtrl)
+			if tt.setupMocks != nil {
+				tt.setupMocks(*azMockCredentialClient, *awsMockCredentialClient, tt.planeType, tt.planeName)
+			}
+			cliCredentialClient := UCPCredentialManagementClient{
+				AzClient:  azMockCredentialClient,
+				AWSClient: awsMockCredentialClient,
+			}
+			err := cliCredentialClient.PutAzure(ctx, tt.credential)
+			if tt.err == nil {
+				require.NoError(t, err)
+			} else {
+				require.Equal(t, tt.err, err)
+			}
+		})
+	}
+}
+
+func Test_AWSCredential_Put(t *testing.T) {
+	tests := []struct {
+		name       string
+		planeType  string
+		planeName  string
+		credential ucp.AWSCredentialResource
+		err        error
+		setupMocks func(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string)
+	}{
 		{
 			name:      "create aws credential success",
 			planeType: AWSPlaneType,
 			planeName: AWSPlaneName,
-			credential: ucp.CredentialResource{
+			credential: ucp.AWSCredentialResource{
+				Name:     to.Ptr(awsProviderName),
 				Location: to.Ptr(v1.LocationGlobal),
 				Type:     to.Ptr(AWSCredential),
-				Properties: &ucp.AWSCredentialProperties{
+				Properties: &ucp.AWSAccessKeyCredentialProperties{
 					Storage: &ucp.CredentialStorageProperties{
-						Kind: to.Ptr(ucp.CredentialStorageKindInternal),
+						Kind: to.Ptr(string(ucp.CredentialStorageKindInternal)),
 					},
 					AccessKeyID:     to.Ptr("access-key-id"),
 					SecretAccessKey: to.Ptr("secret-access-key"),
 				},
 			},
 			err:        nil,
-			setupMocks: setupSuccessPutMocks,
-		},
-		{
-			name: "create unsupported provider credential",
-			credential: ucp.CredentialResource{
-				Location: to.Ptr(v1.LocationGlobal),
-				Type:     to.Ptr(""),
-			},
-			err:        &ErrUnsupportedCloudProvider{},
-			setupMocks: nil,
+			setupMocks: setupSuccessPutAWSMocks,
 		},
 	}
 
@@ -95,14 +123,16 @@ func Test_Credential_Put(t *testing.T) {
 			defer cancel()
 			mockCtrl := gomock.NewController(t)
 			defer mockCtrl.Finish()
-			mockCredentialClient := NewMockInterface(mockCtrl)
+			azMockCredentialClient := NewMockAzureCredentialManagementClientInterface(mockCtrl)
+			awsMockCredentialClient := NewMockAWSCredentialManagementClientInterface(mockCtrl)
 			if tt.setupMocks != nil {
-				tt.setupMocks(*mockCredentialClient, tt.planeType, tt.planeName)
+				tt.setupMocks(*azMockCredentialClient, *awsMockCredentialClient, tt.planeType, tt.planeName)
 			}
 			cliCredentialClient := UCPCredentialManagementClient{
-				CredentialInterface: mockCredentialClient,
+				AzClient:  azMockCredentialClient,
+				AWSClient: awsMockCredentialClient,
 			}
-			err := cliCredentialClient.Put(ctx, tt.credential)
+			err := cliCredentialClient.PutAWS(ctx, tt.credential)
 			if tt.err == nil {
 				require.NoError(t, err)
 			} else {
@@ -119,7 +149,7 @@ func Test_Credential_Get(t *testing.T) {
 		planeType          string
 		planeName          string
 		err                error
-		setupMocks         func(mockCredentialClient MockInterface, planeType string, planeName string)
+		setupMocks         func(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string)
 	}{
 		{
 			name: "get azure credential success",
@@ -132,7 +162,7 @@ func Test_Credential_Get(t *testing.T) {
 			planeType:  AzurePlaneType,
 			planeName:  AzurePlaneName,
 			err:        nil,
-			setupMocks: setupSuccessGetMocks,
+			setupMocks: setupSuccessGetAzureMocks,
 		},
 		{
 			name: "get aws credential success",
@@ -145,10 +175,10 @@ func Test_Credential_Get(t *testing.T) {
 			planeType:  AWSPlaneType,
 			planeName:  AWSPlaneName,
 			err:        nil,
-			setupMocks: setupSuccessGetMocks,
+			setupMocks: setupSuccessGetAWSMocks,
 		},
 		{
-			name: "credential not found",
+			name: "credential not found azure",
 			credentialResource: ProviderCredentialConfiguration{
 				CloudProviderStatus: CloudProviderStatus{
 					Name:    azureProviderName,
@@ -158,10 +188,23 @@ func Test_Credential_Get(t *testing.T) {
 			planeType:  AzurePlaneType,
 			planeName:  AzurePlaneName,
 			err:        nil,
-			setupMocks: setupNotFoundGetMocks,
+			setupMocks: setupNotFoundAzureGetMocks,
 		},
 		{
-			name: "credential get failure",
+			name: "credential not found aws",
+			credentialResource: ProviderCredentialConfiguration{
+				CloudProviderStatus: CloudProviderStatus{
+					Name:    awsProviderName,
+					Enabled: false,
+				},
+			},
+			planeType:  AWSPlaneType,
+			planeName:  AWSPlaneName,
+			err:        nil,
+			setupMocks: setupNotFoundAWSGetMocks,
+		},
+		{
+			name: "credential get failure azure",
 			credentialResource: ProviderCredentialConfiguration{
 				CloudProviderStatus: CloudProviderStatus{
 					Name:    azureProviderName,
@@ -171,7 +214,20 @@ func Test_Credential_Get(t *testing.T) {
 			planeType:  AzurePlaneType,
 			planeName:  AzurePlaneName,
 			err:        errInternalServer,
-			setupMocks: setupErrorGetMocks,
+			setupMocks: setupErrorAzureGetMocks,
+		},
+		{
+			name: "credential get failure aws",
+			credentialResource: ProviderCredentialConfiguration{
+				CloudProviderStatus: CloudProviderStatus{
+					Name:    awsProviderName,
+					Enabled: false,
+				},
+			},
+			planeType:  AWSPlaneType,
+			planeName:  AWSPlaneName,
+			err:        errInternalServer,
+			setupMocks: setupErrorAWSGetMocks,
 		},
 	}
 	for _, tt := range tests {
@@ -180,12 +236,14 @@ func Test_Credential_Get(t *testing.T) {
 			defer cancel()
 			mockCtrl := gomock.NewController(t)
 			defer mockCtrl.Finish()
-			mockCredentialClient := NewMockInterface(mockCtrl)
+			azMockCredentialClient := NewMockAzureCredentialManagementClientInterface(mockCtrl)
+			awsMockCredentialClient := NewMockAWSCredentialManagementClientInterface(mockCtrl)
 			if tt.setupMocks != nil {
-				tt.setupMocks(*mockCredentialClient, tt.planeType, tt.planeName)
+				tt.setupMocks(*azMockCredentialClient, *awsMockCredentialClient, tt.planeType, tt.planeName)
 			}
 			cliCredentialClient := UCPCredentialManagementClient{
-				CredentialInterface: mockCredentialClient,
+				AzClient:  azMockCredentialClient,
+				AWSClient: awsMockCredentialClient,
 			}
 			resp, err := cliCredentialClient.Get(ctx, tt.credentialResource.Name)
 			if tt.err == nil {
@@ -204,15 +262,18 @@ func Test_Credential_List(t *testing.T) {
 	defer cancel()
 	mockCtrl := gomock.NewController(t)
 	defer mockCtrl.Finish()
-	mockCredentialClient := NewMockInterface(mockCtrl)
+
+	azMockCredentialClient := NewMockAzureCredentialManagementClientInterface(mockCtrl)
+	awsMockCredentialClient := NewMockAWSCredentialManagementClientInterface(mockCtrl)
+
 	azureList := []CloudProviderStatus{
 		{
 			Name:    AzureCredential,
 			Enabled: true,
 		},
 	}
-	mockCredentialClient.EXPECT().
-		ListCredential(gomock.Any(), AzurePlaneType, AzurePlaneName).
+	azMockCredentialClient.EXPECT().
+		List(gomock.Any()).
 		Return(azureList, nil).
 		Times(1)
 	awsList := []CloudProviderStatus{
@@ -221,13 +282,14 @@ func Test_Credential_List(t *testing.T) {
 			Enabled: true,
 		},
 	}
-	mockCredentialClient.EXPECT().
-		ListCredential(gomock.Any(), AWSPlaneType, AWSPlaneName).
+	awsMockCredentialClient.EXPECT().
+		List(gomock.Any()).
 		Return(awsList, nil).
 		Times(1)
 
 	cliCredentialClient := UCPCredentialManagementClient{
-		CredentialInterface: mockCredentialClient,
+		AzClient:  azMockCredentialClient,
+		AWSClient: awsMockCredentialClient,
 	}
 	resp, err := cliCredentialClient.List(ctx)
 	require.NoError(t, err)
@@ -241,7 +303,7 @@ func Test_Credential_Delete(t *testing.T) {
 		planeType      string
 		planeName      string
 		err            error
-		setupMocks     func(mockCredentialClient MockInterface, planeType string, planeName string)
+		setupMocks     func(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string)
 	}{
 		{
 			name:           "delete azure credential",
@@ -249,7 +311,7 @@ func Test_Credential_Delete(t *testing.T) {
 			planeType:      AzurePlaneType,
 			planeName:      AzurePlaneName,
 			err:            nil,
-			setupMocks:     setupSuccessDeleteMocks,
+			setupMocks:     setupSuccessAzureDeleteMocks,
 		},
 		{
 			name:           "delete aws credential",
@@ -257,15 +319,23 @@ func Test_Credential_Delete(t *testing.T) {
 			planeType:      AWSPlaneType,
 			planeName:      AWSPlaneName,
 			err:            nil,
-			setupMocks:     setupSuccessDeleteMocks,
+			setupMocks:     setupSuccessAWSDeleteMocks,
 		},
 		{
-			name:           "delete unsupported credential",
+			name:           "delete unsupported azure credential",
 			credentialName: AzureCredential,
 			planeType:      AzurePlaneType,
 			planeName:      AzurePlaneName,
 			err:            errInternalServer,
-			setupMocks:     setupErrDeleteMocks,
+			setupMocks:     setupErrorAzureDeleteMocks,
+		},
+		{
+			name:           "delete unsupported aws credential",
+			credentialName: AWSCredential,
+			planeType:      AWSPlaneType,
+			planeName:      AWSPlaneName,
+			err:            errInternalServer,
+			setupMocks:     setupErrorAWSDeleteMocks,
 		},
 		{
 			name:           "delete non existent azure credential",
@@ -273,7 +343,15 @@ func Test_Credential_Delete(t *testing.T) {
 			planeType:      AzurePlaneType,
 			planeName:      AzurePlaneName,
 			err:            nil,
-			setupMocks:     setupNotFoundDeleteMocks,
+			setupMocks:     setupNotFoundAzureDeleteMocks,
+		},
+		{
+			name:           "delete non existent aws credential",
+			credentialName: AWSCredential,
+			planeType:      AWSPlaneType,
+			planeName:      AWSPlaneName,
+			err:            nil,
+			setupMocks:     setupNotFoundAWSDeleteMocks,
 		},
 	}
 	for _, tt := range tests {
@@ -282,12 +360,14 @@ func Test_Credential_Delete(t *testing.T) {
 			defer cancel()
 			mockCtrl := gomock.NewController(t)
 			defer mockCtrl.Finish()
-			mockCredentialClient := NewMockInterface(mockCtrl)
+			azMockCredentialClient := NewMockAzureCredentialManagementClientInterface(mockCtrl)
+			awsMockCredentialClient := NewMockAWSCredentialManagementClientInterface(mockCtrl)
 			if tt.setupMocks != nil {
-				tt.setupMocks(*mockCredentialClient, tt.planeType, tt.planeName)
+				tt.setupMocks(*azMockCredentialClient, *awsMockCredentialClient, tt.planeType, tt.planeName)
 			}
 			cliCredentialClient := UCPCredentialManagementClient{
-				CredentialInterface: mockCredentialClient,
+				AzClient:  azMockCredentialClient,
+				AWSClient: awsMockCredentialClient,
 			}
 			isDeleted, err := cliCredentialClient.Delete(ctx, tt.credentialName)
 			if tt.err == nil {
@@ -300,57 +380,101 @@ func Test_Credential_Delete(t *testing.T) {
 	}
 }
 
-func setupSuccessPutMocks(mockCredentialClient MockInterface, planeType string, planeName string) {
-	mockCredentialClient.EXPECT().
-		CreateCredential(gomock.Any(), planeType, planeName, gomock.Any(), gomock.Any()).
+func setupSuccessPutAzureMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAzure.EXPECT().
+		Put(gomock.Any(), gomock.Any()).
+		Return(nil).Times(1)
+}
+func setupSuccessPutAWSMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAWS.EXPECT().
+		Put(gomock.Any(), gomock.Any()).
 		Return(nil).Times(1)
 }
 
-func setupSuccessGetMocks(mockCredentialClient MockInterface, planeType string, planeName string) {
+func setupSuccessGetAzureMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
 	credential := ProviderCredentialConfiguration{
 		CloudProviderStatus: CloudProviderStatus{
 			Name:    azureProviderName,
 			Enabled: true,
 		},
 	}
-	if strings.EqualFold(planeType, AzurePlaneType) {
-		credential.CloudProviderStatus.Name = azureProviderName
-	} else if strings.EqualFold(planeType, AWSPlaneType) {
-		credential.CloudProviderStatus.Name = awsProviderName
+	mockAzure.EXPECT().
+		Get(gomock.Any(), gomock.Any()).
+		Return(credential, nil).Times(1)
+}
+
+func setupSuccessGetAWSMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	credential := ProviderCredentialConfiguration{
+		CloudProviderStatus: CloudProviderStatus{
+			Name:    awsProviderName,
+			Enabled: true,
+		},
 	}
-	mockCredentialClient.EXPECT().
-		GetCredential(gomock.Any(), planeType, planeName, defaultSecretName).
+	mockAWS.EXPECT().
+		Get(gomock.Any(), gomock.Any()).
 		Return(credential, nil).Times(1)
 }
 
-func setupNotFoundGetMocks(mockCredentialClient MockInterface, planeType string, planeName string) {
-	mockCredentialClient.EXPECT().
-		GetCredential(gomock.Any(), planeType, planeName, defaultSecretName).
+func setupNotFoundAzureGetMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAzure.EXPECT().
+		Get(gomock.Any(), gomock.Any()).
+		Return(ProviderCredentialConfiguration{}, errCredentialNotFound).
+		Times(1)
+}
+
+func setupNotFoundAWSGetMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAWS.EXPECT().
+		Get(gomock.Any(), gomock.Any()).
 		Return(ProviderCredentialConfiguration{}, errCredentialNotFound).
 		Times(1)
 }
 
-func setupErrorGetMocks(mockCredentialClient MockInterface, planeType string, planeName string) {
-	mockCredentialClient.EXPECT().
-		GetCredential(gomock.Any(), planeType, planeName, defaultSecretName).
+func setupErrorAzureGetMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAzure.EXPECT().
+		Get(gomock.Any(), gomock.Any()).
 		Return(ProviderCredentialConfiguration{}, errInternalServer).
 		Times(1)
 }
 
-func setupSuccessDeleteMocks(mockCredentialClient MockInterface, planeType string, planeName string) {
-	mockCredentialClient.EXPECT().
-		DeleteCredential(gomock.Any(), planeType, planeName, defaultSecretName).
-		Return(nil).Times(1)
+func setupErrorAWSGetMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAWS.EXPECT().
+		Get(gomock.Any(), gomock.Any()).
+		Return(ProviderCredentialConfiguration{}, errInternalServer).
+		Times(1)
+}
+
+func setupSuccessAzureDeleteMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAzure.EXPECT().
+		Delete(gomock.Any(), gomock.Any()).
+		Return(true, nil).Times(1)
+}
+
+func setupSuccessAWSDeleteMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAWS.EXPECT().
+		Delete(gomock.Any(), gomock.Any()).
+		Return(true, nil).Times(1)
+}
+
+func setupNotFoundAzureDeleteMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAzure.EXPECT().
+		Delete(gomock.Any(), gomock.Any()).
+		Return(true, nil).Times(1)
+}
+
+func setupNotFoundAWSDeleteMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAWS.EXPECT().
+		Delete(gomock.Any(), gomock.Any()).
+		Return(true, nil).Times(1)
 }
 
-func setupNotFoundDeleteMocks(mockCredentialClient MockInterface, planeType string, planeName string) {
-	mockCredentialClient.EXPECT().
-		DeleteCredential(gomock.Any(), planeType, planeName, defaultSecretName).
-		Return(errCredentialNotFound).Times(1)
+func setupErrorAzureDeleteMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAzure.EXPECT().
+		Delete(gomock.Any(), gomock.Any()).
+		Return(false, errInternalServer).Times(1)
 }
 
-func setupErrDeleteMocks(mockCredentialClient MockInterface, planeType string, planeName string) {
-	mockCredentialClient.EXPECT().
-		DeleteCredential(gomock.Any(), planeType, planeName, defaultSecretName).
-		Return(errInternalServer).Times(1)
+func setupErrorAWSDeleteMocks(mockAzure MockAzureCredentialManagementClientInterface, mockAWS MockAWSCredentialManagementClientInterface, planeType string, planeName string) {
+	mockAWS.EXPECT().
+		Delete(gomock.Any(), gomock.Any()).
+		Return(false, errInternalServer).Times(1)
 }
diff --git a/pkg/ucp/api/v20220901privatepreview/aws_credential_conversion_test.go b/pkg/ucp/api/v20220901privatepreview/aws_credential_conversion_test.go
new file mode 100644
index 000000000..aa7bd63ea
--- /dev/null
+++ b/pkg/ucp/api/v20220901privatepreview/aws_credential_conversion_test.go
@@ -0,0 +1,147 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package v20220901privatepreview
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	v1 "github.com/project-radius/radius/pkg/armrpc/api/v1"
+	"github.com/project-radius/radius/pkg/ucp/datamodel"
+	"github.com/project-radius/radius/test/testutil"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAWSCredentialConvertVersionedToDataModel(t *testing.T) {
+	conversionTests := []struct {
+		filename string
+		expected *datamodel.AWSCredential
+		err      error
+	}{
+		{
+			filename: "credentialresource-aws.json",
+			expected: &datamodel.AWSCredential{
+				BaseResource: v1.BaseResource{
+					TrackedResource: v1.TrackedResource{
+						ID:       "/planes/aws/aws/providers/System.AWS/credentials/default",
+						Name:     "default",
+						Type:     "System.AWS/credentials",
+						Location: "west-us-2",
+						Tags: map[string]string{
+							"env": "dev",
+						},
+					},
+					InternalMetadata: v1.InternalMetadata{
+						UpdatedAPIVersion: Version,
+					},
+				},
+				Properties: &datamodel.AWSCredentialResourceProperties{
+					Kind: "AccessKey",
+					AWSCredential: &datamodel.AWSCredentialProperties{
+						AccessKeyID:     "00000000-0000-0000-0000-000000000000",
+						SecretAccessKey: "00000000-0000-0000-0000-000000000000",
+					},
+					Storage: &datamodel.CredentialStorageProperties{
+						Kind:               datamodel.InternalStorageKind,
+						InternalCredential: &datamodel.InternalCredentialStorageProperties{},
+					},
+				},
+			},
+		},
+		{
+			filename: "credentialresource-other.json",
+			err:      v1.ErrInvalidModelConversion,
+		},
+		{
+			filename: "credentialresource-empty-properties.json",
+			err:      &v1.ErrModelConversion{PropertyName: "$.properties", ValidValue: "not nil"},
+		},
+		{
+			filename: "credentialresource-empty-storage-aws.json",
+			err:      &v1.ErrModelConversion{PropertyName: "$.properties.storage", ValidValue: "not nil"},
+		},
+		{
+			filename: "credentialresource-empty-storage-kind-aws.json",
+			err:      &v1.ErrModelConversion{PropertyName: "$.properties.storage.kind", ValidValue: "not nil"},
+		},
+		{
+			filename: "credentialresource-invalid-storagekind-aws.json",
+			err:      &v1.ErrModelConversion{PropertyName: "$.properties.storage.kind", ValidValue: fmt.Sprintf("one of %q", PossibleCredentialStorageKindValues())},
+		},
+	}
+	for _, tt := range conversionTests {
+		t.Run(tt.filename, func(t *testing.T) {
+			rawPayload := testutil.ReadFixture(tt.filename)
+			r := &AWSCredentialResource{}
+			err := json.Unmarshal(rawPayload, r)
+			require.NoError(t, err)
+
+			dm, err := r.ConvertTo()
+
+			if tt.err != nil {
+				require.ErrorIs(t, err, tt.err)
+			} else {
+				require.NoError(t, err)
+				ct := dm.(*datamodel.AWSCredential)
+				require.Equal(t, tt.expected, ct)
+			}
+		})
+	}
+}
+
+func TestAWSCredentialConvertDataModelToVersioned(t *testing.T) {
+	conversionTests := []struct {
+		filename string
+		expected *AWSCredentialResource
+		err      error
+	}{
+		{
+			filename: "credentialresourcedatamodel-aws.json",
+			expected: &AWSCredentialResource{
+				ID:       to.Ptr("/planes/aws/aws/providers/System.AWS/credentials/default"),
+				Name:     to.Ptr("default"),
+				Type:     to.Ptr("System.AWS/credentials"),
+				Location: to.Ptr("west-us-2"),
+				Tags: map[string]*string{
+					"env": to.Ptr("dev"),
+				},
+				Properties: &AWSAccessKeyCredentialProperties{
+					Kind:        to.Ptr("AccessKey"),
+					AccessKeyID: to.Ptr("00000000-0000-0000-0000-000000000000"),
+					Storage: &InternalCredentialStorageProperties{
+						Kind:       to.Ptr(string(CredentialStorageKindInternal)),
+						SecretName: to.Ptr("aws-awscloud-default"),
+					},
+				},
+			},
+		},
+		{
+			filename: "credentialresourcedatamodel-default.json",
+			err:      v1.ErrInvalidModelConversion,
+		},
+	}
+	for _, tt := range conversionTests {
+		t.Run(tt.filename, func(t *testing.T) {
+			rawPayload := testutil.ReadFixture(tt.filename)
+			r := &datamodel.AWSCredential{}
+			err := json.Unmarshal(rawPayload, r)
+			require.NoError(t, err)
+
+			versioned := &AWSCredentialResource{}
+			err = versioned.ConvertFrom(r)
+
+			if tt.err != nil {
+				require.ErrorIs(t, err, tt.err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tt.expected, versioned)
+			}
+		})
+	}
+}
diff --git a/pkg/ucp/api/v20220901privatepreview/credential_conversion_test.go b/pkg/ucp/api/v20220901privatepreview/azure_credential_conversion_test.go
similarity index 60%
rename from pkg/ucp/api/v20220901privatepreview/credential_conversion_test.go
rename to pkg/ucp/api/v20220901privatepreview/azure_credential_conversion_test.go
index 89a9269ae..923c6816c 100644
--- a/pkg/ucp/api/v20220901privatepreview/credential_conversion_test.go
+++ b/pkg/ucp/api/v20220901privatepreview/azure_credential_conversion_test.go
@@ -18,45 +18,15 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestCredentialConvertVersionedToDataModel(t *testing.T) {
+func TestAzureCredentialConvertVersionedToDataModel(t *testing.T) {
 	conversionTests := []struct {
 		filename string
-		expected *datamodel.Credential
+		expected *datamodel.AzureCredential
 		err      error
 	}{
-		{
-			filename: "credentialresource-aws.json",
-			expected: &datamodel.Credential{
-				BaseResource: v1.BaseResource{
-					TrackedResource: v1.TrackedResource{
-						ID:       "/planes/aws/awscloud/providers/System.AWS/credentials/default",
-						Name:     "default",
-						Type:     "System.AWS/credentials",
-						Location: "west-us-2",
-						Tags: map[string]string{
-							"env": "dev",
-						},
-					},
-					InternalMetadata: v1.InternalMetadata{
-						UpdatedAPIVersion: Version,
-					},
-				},
-				Properties: &datamodel.CredentialResourceProperties{
-					Kind: "aws.com.iam",
-					AWSCredential: &datamodel.AWSCredentialProperties{
-						AccessKeyID:     "00000000-0000-0000-0000-000000000000",
-						SecretAccessKey: "00000000-0000-0000-0000-000000000000",
-					},
-					Storage: &datamodel.CredentialStorageProperties{
-						Kind:               datamodel.InternalStorageKind,
-						InternalCredential: &datamodel.InternalCredentialStorageProperties{},
-					},
-				},
-			},
-		},
 		{
 			filename: "credentialresource-azure.json",
-			expected: &datamodel.Credential{
+			expected: &datamodel.AzureCredential{
 				BaseResource: v1.BaseResource{
 					TrackedResource: v1.TrackedResource{
 						ID:       "/planes/azure/azurecloud/providers/System.Azure/credentials/default",
@@ -71,8 +41,8 @@ func TestCredentialConvertVersionedToDataModel(t *testing.T) {
 						UpdatedAPIVersion: Version,
 					},
 				},
-				Properties: &datamodel.CredentialResourceProperties{
-					Kind: "azure.com.serviceprincipal",
+				Properties: &datamodel.AzureCredentialResourceProperties{
+					Kind: "ServicePrincipal",
 					AzureCredential: &datamodel.AzureCredentialProperties{
 						TenantID:     "00000000-0000-0000-0000-000000000000",
 						ClientID:     "00000000-0000-0000-0000-000000000000",
@@ -94,22 +64,22 @@ func TestCredentialConvertVersionedToDataModel(t *testing.T) {
 			err:      &v1.ErrModelConversion{PropertyName: "$.properties", ValidValue: "not nil"},
 		},
 		{
-			filename: "credentialresource-empty-storage.json",
+			filename: "credentialresource-empty-storage-azure.json",
 			err:      &v1.ErrModelConversion{PropertyName: "$.properties.storage", ValidValue: "not nil"},
 		},
 		{
-			filename: "credentialresource-empty-storage-kind.json",
+			filename: "credentialresource-empty-storage-kind-azure.json",
 			err:      &v1.ErrModelConversion{PropertyName: "$.properties.storage.kind", ValidValue: "not nil"},
 		},
 		{
-			filename: "credentialresource-invalid-storagekind.json",
+			filename: "credentialresource-invalid-storagekind-azure.json",
 			err:      &v1.ErrModelConversion{PropertyName: "$.properties.storage.kind", ValidValue: fmt.Sprintf("one of %q", PossibleCredentialStorageKindValues())},
 		},
 	}
 	for _, tt := range conversionTests {
 		t.Run(tt.filename, func(t *testing.T) {
 			rawPayload := testutil.ReadFixture(tt.filename)
-			r := &CredentialResource{}
+			r := &AzureCredentialResource{}
 			err := json.Unmarshal(rawPayload, r)
 			require.NoError(t, err)
 
@@ -119,42 +89,22 @@ func TestCredentialConvertVersionedToDataModel(t *testing.T) {
 				require.ErrorIs(t, err, tt.err)
 			} else {
 				require.NoError(t, err)
-				ct := dm.(*datamodel.Credential)
+				ct := dm.(*datamodel.AzureCredential)
 				require.Equal(t, tt.expected, ct)
 			}
 		})
 	}
 }
 
-func TestCredentialConvertDataModelToVersioned(t *testing.T) {
+func TestAzureCredentialConvertDataModelToVersioned(t *testing.T) {
 	conversionTests := []struct {
 		filename string
-		expected *CredentialResource
+		expected *AzureCredentialResource
 		err      error
 	}{
-		{
-			filename: "credentialresourcedatamodel-aws.json",
-			expected: &CredentialResource{
-				ID:       to.Ptr("/planes/aws/awscloud/providers/System.AWS/credentials/default"),
-				Name:     to.Ptr("default"),
-				Type:     to.Ptr("System.AWS/credentials"),
-				Location: to.Ptr("west-us-2"),
-				Tags: map[string]*string{
-					"env": to.Ptr("dev"),
-				},
-				Properties: &AWSCredentialProperties{
-					Kind:        to.Ptr("aws.com.iam"),
-					AccessKeyID: to.Ptr("00000000-0000-0000-0000-000000000000"),
-					Storage: &InternalCredentialStorageProperties{
-						Kind:       to.Ptr(CredentialStorageKindInternal),
-						SecretName: to.Ptr("aws-awscloud-default"),
-					},
-				},
-			},
-		},
 		{
 			filename: "credentialresourcedatamodel-azure.json",
-			expected: &CredentialResource{
+			expected: &AzureCredentialResource{
 				ID:       to.Ptr("/planes/azure/azurecloud/providers/System.Azure/credentials/default"),
 				Name:     to.Ptr("default"),
 				Type:     to.Ptr("System.Azure/credentials"),
@@ -163,11 +113,11 @@ func TestCredentialConvertDataModelToVersioned(t *testing.T) {
 					"env": to.Ptr("dev"),
 				},
 				Properties: &AzureServicePrincipalProperties{
-					Kind:     to.Ptr("azure.com.serviceprincipal"),
+					Kind:     to.Ptr("ServicePrincipal"),
 					ClientID: to.Ptr("00000000-0000-0000-0000-000000000000"),
 					TenantID: to.Ptr("00000000-0000-0000-0000-000000000000"),
 					Storage: &InternalCredentialStorageProperties{
-						Kind:       to.Ptr(CredentialStorageKindInternal),
+						Kind:       to.Ptr(string(CredentialStorageKindInternal)),
 						SecretName: to.Ptr("azure-azurecloud-default"),
 					},
 				},
@@ -181,11 +131,11 @@ func TestCredentialConvertDataModelToVersioned(t *testing.T) {
 	for _, tt := range conversionTests {
 		t.Run(tt.filename, func(t *testing.T) {
 			rawPayload := testutil.ReadFixture(tt.filename)
-			r := &datamodel.Credential{}
+			r := &datamodel.AzureCredential{}
 			err := json.Unmarshal(rawPayload, r)
 			require.NoError(t, err)
 
-			versioned := &CredentialResource{}
+			versioned := &AzureCredentialResource{}
 			err = versioned.ConvertFrom(r)
 
 			if tt.err != nil {
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-aws.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-aws.json
index c1ffbd709..fd0db898a 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-aws.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-aws.json
@@ -1,5 +1,5 @@
 {
-    "id": "/planes/aws/awscloud/providers/System.AWS/credentials/default",
+    "id": "/planes/aws/aws/providers/System.AWS/credentials/default",
     "name": "default",
     "type": "System.AWS/credentials",
     "location": "west-us-2",
@@ -9,7 +9,7 @@
     "properties": {
         "accessKeyId": "00000000-0000-0000-0000-000000000000",
         "secretAccessKey": "00000000-0000-0000-0000-000000000000",
-        "kind": "aws.com.iam",
+        "kind": "AccessKey",
         "storage": {
             "kind": "Internal"
         }
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-azure.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-azure.json
index aabab705c..579317268 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-azure.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-azure.json
@@ -7,10 +7,10 @@
         "env": "dev"
     },
     "properties": {
+        "kind": "ServicePrincipal",
         "tenantId": "00000000-0000-0000-0000-000000000000",
         "clientId": "00000000-0000-0000-0000-000000000000",
         "clientSecret": "secret",
-        "kind": "azure.com.serviceprincipal",
         "storage": {
             "kind": "Internal"
         }
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-aws.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-aws.json
new file mode 100644
index 000000000..b48807fd7
--- /dev/null
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-aws.json
@@ -0,0 +1,12 @@
+{
+    "id": "/planes/aws/aws/providers/System.AWS/credentials/default",
+    "name": "default",
+    "type": "System.AWS/credentials",
+    "location": "west-us-2",
+    "properties": {
+        "tenantId": "00000000-0000-0000-0000-000000000000",
+        "clientId": "00000000-0000-0000-0000-000000000000",
+        "clientSecret": "secret",
+        "kind": "AccessKey"
+    }
+}
\ No newline at end of file
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-azure.json
similarity index 90%
rename from pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage.json
rename to pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-azure.json
index c9e2224ed..d93935992 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-azure.json
@@ -7,6 +7,6 @@
         "tenantId": "00000000-0000-0000-0000-000000000000",
         "clientId": "00000000-0000-0000-0000-000000000000",
         "clientSecret": "secret",
-        "kind": "azure.com.credential"
+        "kind": "ServicePrincipal"
     }
 }
diff --git a/pkg/ucp/frontend/controller/credentials/azure/testdata/invalid-kind-azure-credential.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind-aws.json
similarity index 51%
rename from pkg/ucp/frontend/controller/credentials/azure/testdata/invalid-kind-azure-credential.json
rename to pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind-aws.json
index 992be441e..39bb58d77 100644
--- a/pkg/ucp/frontend/controller/credentials/azure/testdata/invalid-kind-azure-credential.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind-aws.json
@@ -1,15 +1,14 @@
 {
-    "id": "/planes/azure/azurecloud/providers/System.Azure/credentials/default",
+    "id": "/planes/aws/aws/providers/System.AWS/credentials/default",
     "name": "default",
-    "type": "System.Azure/credentials",
+    "type": "System.AWS/credentials",
     "location": "west-us-2",
     "properties": {
         "tenantId": "00000000-0000-0000-0000-000000000000",
         "clientId": "00000000-0000-0000-0000-000000000000",
-        "secret":   "secret",
-        "kind":     "aws.com.iam",
+        "clientSecret": "secret",
+        "kind": "AccessKey",
         "storage": {
-            "kind": "Internal"
         }
     }
 }
\ No newline at end of file
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind-azure.json
similarity index 88%
rename from pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind.json
rename to pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind-azure.json
index 3159cfac2..fcf8cfbee 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-empty-storage-kind-azure.json
@@ -7,7 +7,7 @@
         "tenantId": "00000000-0000-0000-0000-000000000000",
         "clientId": "00000000-0000-0000-0000-000000000000",
         "clientSecret": "secret",
-        "kind": "azure.com.serviceprincipal",
+        "kind": "ServicePrincipal",
         "storage": {}
     }
 }
\ No newline at end of file
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind-aws.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind-aws.json
new file mode 100644
index 000000000..2fb0b4898
--- /dev/null
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind-aws.json
@@ -0,0 +1,15 @@
+{
+    "id": "/planes/aws/aws/providers/System.AWS/credentials/default",
+    "name": "default",
+    "type": "System.AWS/credentials",
+    "location": "west-us-2",
+    "properties": {
+        "tenantId": "00000000-0000-0000-0000-000000000000",
+        "clientId": "00000000-0000-0000-0000-000000000000",
+        "clientSecret": "secret",
+        "kind": "AccessKey",
+        "storage": {
+            "kind": "invalid"
+        }
+    }
+}
\ No newline at end of file
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind-azure.json
similarity index 91%
rename from pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind.json
rename to pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind-azure.json
index 43de7d5bc..dce8af6b1 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-invalid-storagekind-azure.json
@@ -7,7 +7,7 @@
         "tenantId": "00000000-0000-0000-0000-000000000000",
         "clientId": "00000000-0000-0000-0000-000000000000",
         "clientSecret": "secret",
-        "kind": "azure.com.credential",
+        "kind": "ServicePrincipal",
         "storage": {
             "kind": "invalid"
         }
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-other.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-other.json
index 8f35ea559..9b6c61780 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-other.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresource-other.json
@@ -7,7 +7,6 @@
         "env": "dev"
     },
     "properties": {
-        "kind": "other.com.credential",
         "storage": {
             "kind": "Internal"
         }
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-aws.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-aws.json
index 1c8adc9a1..4e30d5777 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-aws.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-aws.json
@@ -1,5 +1,5 @@
 {
-    "id": "/planes/aws/awscloud/providers/System.AWS/credentials/default",
+    "id": "/planes/aws/aws/providers/System.AWS/credentials/default",
     "name": "default",
     "type": "System.AWS/credentials",
     "location": "west-us-2",
@@ -15,8 +15,8 @@
         "env": "dev"
     },
     "properties": {
-        "kind": "aws.com.iam",
         "namespace": "radius-system",
+        "kind": "AccessKey",
         "awsCredential": {
             "accessKeyId": "00000000-0000-0000-0000-000000000000",
             "secretAccessKey": "00000000-0000-0000-0000-000000000000"
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-azure.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-azure.json
index 7cfa1a07d..6bee5560b 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-azure.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-azure.json
@@ -15,8 +15,8 @@
         "env": "dev"
     },
     "properties": {
-        "kind": "azure.com.serviceprincipal",
         "namespace": "radius-system",
+        "kind": "ServicePrincipal",
         "azureCredential": {
             "tenantId": "00000000-0000-0000-0000-000000000000",
             "clientId": "00000000-0000-0000-0000-000000000000",
diff --git a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-default.json b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-default.json
index 17d6f1996..0cf4c6ed5 100644
--- a/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-default.json
+++ b/pkg/ucp/api/v20220901privatepreview/testdata/credentialresourcedatamodel-default.json
@@ -15,8 +15,8 @@
         "env": "dev"
     },
     "properties": {
-        "kind": "other.com.credential",
         "namespace": "radius-system",
+        "kind": "default",
         "storage": {
             "kind": "Internal",
             "internalCredential": {
diff --git a/pkg/ucp/frontend/controller/credentials/aws/createorupdatecredential_test.go b/pkg/ucp/frontend/controller/credentials/aws/createorupdateawscredential_test.go
similarity index 90%
rename from pkg/ucp/frontend/controller/credentials/aws/createorupdatecredential_test.go
rename to pkg/ucp/frontend/controller/credentials/aws/createorupdateawscredential_test.go
index d9029d483..8e9762e7f 100644
--- a/pkg/ucp/frontend/controller/credentials/aws/createorupdatecredential_test.go
+++ b/pkg/ucp/frontend/controller/credentials/aws/createorupdateawscredential_test.go
@@ -25,13 +25,13 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func Test_Credential(t *testing.T) {
+func Test_AWS_Credential(t *testing.T) {
 	mockCtrl := gomock.NewController(t)
 	defer mockCtrl.Finish()
 	mockStorageClient := store.NewMockStorageClient(mockCtrl)
 	mockSecretClient := secret.NewMockClient(mockCtrl)
 
-	credentialCtrl, err := NewCreateOrUpdateCredential(ctrl.Options{
+	credentialCtrl, err := NewCreateOrUpdateAWSCredential(ctrl.Options{
 		Options: armrpc_controller.Options{
 			StorageClient: mockStorageClient,
 		},
@@ -78,15 +78,6 @@ func Test_Credential(t *testing.T) {
 				ValidValue:   "not nil",
 			},
 		},
-		{
-			name:       "test_invalid_credential_kind",
-			filename:   "invalid-kind-aws-credential.json",
-			headerfile: testHeaderFile,
-			url:        "/planes/aws/awscloud/providers/System.AWS/credentials/default?api-version=2022-09-01-privatepreview",
-			expected:   armrpc_rest.NewBadRequestResponse("Invalid Credential Kind"),
-			fn:         setupEmptyMocks,
-			err:        nil,
-		},
 		{
 			name:       "test_credential_created",
 			filename:   "aws-credential.json",
@@ -126,7 +117,7 @@ func Test_Credential(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			tt.fn(*mockStorageClient, *mockSecretClient)
 
-			credentialVersionedInput := &v20220901privatepreview.CredentialResource{}
+			credentialVersionedInput := &v20220901privatepreview.AWSCredentialResource{}
 			credentialInput := testutil.ReadFixture(tt.filename)
 			err = json.Unmarshal(credentialInput, credentialVersionedInput)
 			require.NoError(t, err)
@@ -138,7 +129,7 @@ func Test_Credential(t *testing.T) {
 
 			response, err := credentialCtrl.Run(ctx, nil, request)
 			if tt.err != nil {
-				require.Equal(t, err, tt.err)
+				require.Equal(t, tt.err, err)
 			} else {
 				require.NoError(t, err)
 				require.Equal(t, tt.expected, response)
@@ -149,7 +140,7 @@ func Test_Credential(t *testing.T) {
 }
 
 func getAwsResponse() armrpc_rest.Response {
-	return armrpc_rest.NewOKResponseWithHeaders(&v20220901privatepreview.CredentialResource{
+	return armrpc_rest.NewOKResponseWithHeaders(&v20220901privatepreview.AWSCredentialResource{
 		Location: to.Ptr("West US"),
 		ID:       to.Ptr("/planes/aws/awscloud/providers/System.AWS/credentials/default"),
 		Name:     to.Ptr("default"),
@@ -157,11 +148,11 @@ func getAwsResponse() armrpc_rest.Response {
 		Tags: map[string]*string{
 			"env": to.Ptr("dev"),
 		},
-		Properties: &v20220901privatepreview.AWSCredentialProperties{
+		Properties: &v20220901privatepreview.AWSAccessKeyCredentialProperties{
 			AccessKeyID: to.Ptr("00000000-0000-0000-0000-000000000000"),
-			Kind:        to.Ptr("aws.com.iam"),
+			Kind:        to.Ptr("AccessKey"),
 			Storage: &v20220901privatepreview.InternalCredentialStorageProperties{
-				Kind:       to.Ptr(v20220901privatepreview.CredentialStorageKindInternal),
+				Kind:       to.Ptr(string(v20220901privatepreview.CredentialStorageKindInternal)),
 				SecretName: to.Ptr("aws-awscloud-default"),
 			},
 		},
diff --git a/pkg/ucp/frontend/controller/credentials/aws/deletecredential_test.go b/pkg/ucp/frontend/controller/credentials/aws/deleteawscredential_test.go
similarity index 97%
rename from pkg/ucp/frontend/controller/credentials/aws/deletecredential_test.go
rename to pkg/ucp/frontend/controller/credentials/aws/deleteawscredential_test.go
index 7f6fcd040..6e462f466 100644
--- a/pkg/ucp/frontend/controller/credentials/aws/deletecredential_test.go
+++ b/pkg/ucp/frontend/controller/credentials/aws/deleteawscredential_test.go
@@ -29,7 +29,7 @@ func Test_Credential_Delete(t *testing.T) {
 	mockStorageClient := store.NewMockStorageClient(mockCtrl)
 	mockSecretClient := secret.NewMockClient(mockCtrl)
 
-	credentialCtrl, err := NewDeleteCredential(ctrl.Options{
+	credentialCtrl, err := NewDeleteAWSCredential(ctrl.Options{
 		Options: armrpc_controller.Options{
 			StorageClient: mockStorageClient,
 		},
@@ -121,9 +121,9 @@ func Test_Credential_Delete(t *testing.T) {
 }
 
 func setupCredentialMocks(mockStorageClient store.MockStorageClient, mockSecretClient secret.MockClient) {
-	datamodelCredential := datamodel.Credential{
+	datamodelCredential := datamodel.AWSCredential{
 		BaseResource: v1.BaseResource{},
-		Properties: &datamodel.CredentialResourceProperties{
+		Properties: &datamodel.AWSCredentialResourceProperties{
 			Kind: datamodel.AWSCredentialKind,
 		},
 	}
diff --git a/pkg/ucp/frontend/controller/credentials/aws/testdata/aws-credential.json b/pkg/ucp/frontend/controller/credentials/aws/testdata/aws-credential.json
index c1ffbd709..99f677f72 100644
--- a/pkg/ucp/frontend/controller/credentials/aws/testdata/aws-credential.json
+++ b/pkg/ucp/frontend/controller/credentials/aws/testdata/aws-credential.json
@@ -1,15 +1,14 @@
 {
     "id": "/planes/aws/awscloud/providers/System.AWS/credentials/default",
-    "name": "default",
     "type": "System.AWS/credentials",
-    "location": "west-us-2",
+    "location": "West US",
     "tags": {
         "env": "dev"
     },
     "properties": {
         "accessKeyId": "00000000-0000-0000-0000-000000000000",
         "secretAccessKey": "00000000-0000-0000-0000-000000000000",
-        "kind": "aws.com.iam",
+        "kind": "AccessKey",
         "storage": {
             "kind": "Internal"
         }
diff --git a/pkg/ucp/frontend/controller/credentials/aws/testdata/invalid-kind-aws-credential.json b/pkg/ucp/frontend/controller/credentials/aws/testdata/invalid-kind-aws-credential.json
deleted file mode 100644
index 5fb8bb79c..000000000
--- a/pkg/ucp/frontend/controller/credentials/aws/testdata/invalid-kind-aws-credential.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-    "id": "/planes/aws/awscloud/providers/System.AWS/credentials/default",
-    "name": "default",
-    "type": "System.AWS/credentials",
-    "location": "west-us-2",
-    "properties": {
-        "accessKeyId": "00000000-0000-0000-0000-000000000000",
-        "secretAccessKey": "00000000-0000-0000-0000-000000000000",
-        "kind": "azure.com.serviceprincipal",
-        "storage": {
-            "kind": "Internal"
-        }
-    }
-}
\ No newline at end of file
diff --git a/pkg/ucp/frontend/controller/credentials/aws/testdata/invalid-request-aws-credential.json b/pkg/ucp/frontend/controller/credentials/aws/testdata/invalid-request-aws-credential.json
index f11eabd0a..d531c4758 100644
--- a/pkg/ucp/frontend/controller/credentials/aws/testdata/invalid-request-aws-credential.json
+++ b/pkg/ucp/frontend/controller/credentials/aws/testdata/invalid-request-aws-credential.json
@@ -1,6 +1,5 @@
 {
     "id": "/planes/aws/awscloud/providers/System.AWS/credentials/default",
-    "name": "default",
     "type": "System.AWS/credentials",
-    "location": "west-us-2"
+    "location": "West US"
 }
\ No newline at end of file
diff --git a/pkg/ucp/frontend/controller/credentials/azure/createorupdatecredential_test.go b/pkg/ucp/frontend/controller/credentials/azure/createorupdateazurecredential_test.go
similarity index 91%
rename from pkg/ucp/frontend/controller/credentials/azure/createorupdatecredential_test.go
rename to pkg/ucp/frontend/controller/credentials/azure/createorupdateazurecredential_test.go
index edaebac38..bb0942ed8 100644
--- a/pkg/ucp/frontend/controller/credentials/azure/createorupdatecredential_test.go
+++ b/pkg/ucp/frontend/controller/credentials/azure/createorupdateazurecredential_test.go
@@ -25,13 +25,13 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func Test_Credential(t *testing.T) {
+func Test_Azure_Credential(t *testing.T) {
 	mockCtrl := gomock.NewController(t)
 	defer mockCtrl.Finish()
 	mockStorageClient := store.NewMockStorageClient(mockCtrl)
 	mockSecretClient := secret.NewMockClient(mockCtrl)
 
-	credentialCtrl, err := NewCreateOrUpdateCredential(ctrl.Options{
+	credentialCtrl, err := NewCreateOrUpdateAzureCredential(ctrl.Options{
 		Options: armrpc_controller.Options{
 			StorageClient: mockStorageClient,
 		},
@@ -78,15 +78,6 @@ func Test_Credential(t *testing.T) {
 				ValidValue:   "not nil",
 			},
 		},
-		{
-			name:       "test_invalid_credential_kind",
-			filename:   "invalid-kind-azure-credential.json",
-			headerfile: testHeaderFile,
-			url:        "/planes/azure/azurecloud/providers/System.Azure/credentials/default?api-version=2022-09-01-privatepreview",
-			expected:   armrpc_rest.NewBadRequestResponse("Invalid Credential Kind"),
-			fn:         setupEmptyMocks,
-			err:        nil,
-		},
 		{
 			name:       "test_credential_created",
 			filename:   "azure-credential.json",
@@ -125,7 +116,7 @@ func Test_Credential(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			tt.fn(*mockStorageClient, *mockSecretClient)
-			credentialVersionedInput := &v20220901privatepreview.CredentialResource{}
+			credentialVersionedInput := &v20220901privatepreview.AzureCredentialResource{}
 			credentialInput := testutil.ReadFixture(tt.filename)
 			err = json.Unmarshal(credentialInput, credentialVersionedInput)
 			require.NoError(t, err)
@@ -146,7 +137,7 @@ func Test_Credential(t *testing.T) {
 }
 
 func getAzureCredentialResponse() armrpc_rest.Response {
-	return armrpc_rest.NewOKResponseWithHeaders(&v20220901privatepreview.CredentialResource{
+	return armrpc_rest.NewOKResponseWithHeaders(&v20220901privatepreview.AzureCredentialResource{
 		Location: to.Ptr("West US"),
 		ID:       to.Ptr("/planes/azure/azurecloud/providers/System.Azure/credentials/default"),
 		Name:     to.Ptr("default"),
@@ -157,9 +148,9 @@ func getAzureCredentialResponse() armrpc_rest.Response {
 		Properties: &v20220901privatepreview.AzureServicePrincipalProperties{
 			ClientID: to.Ptr("00000000-0000-0000-0000-000000000000"),
 			TenantID: to.Ptr("00000000-0000-0000-0000-000000000000"),
-			Kind:     to.Ptr("azure.com.serviceprincipal"),
+			Kind:     to.Ptr("ServicePrincipal"),
 			Storage: &v20220901privatepreview.InternalCredentialStorageProperties{
-				Kind:       to.Ptr(v20220901privatepreview.CredentialStorageKindInternal),
+				Kind:       to.Ptr(string(v20220901privatepreview.CredentialStorageKindInternal)),
 				SecretName: to.Ptr("azure-azurecloud-default"),
 			},
 		},
diff --git a/pkg/ucp/frontend/controller/credentials/azure/deletecredential_test.go b/pkg/ucp/frontend/controller/credentials/azure/deleteazurecredential_test.go
similarity index 96%
rename from pkg/ucp/frontend/controller/credentials/azure/deletecredential_test.go
rename to pkg/ucp/frontend/controller/credentials/azure/deleteazurecredential_test.go
index 55022cf3a..acffddfa4 100644
--- a/pkg/ucp/frontend/controller/credentials/azure/deletecredential_test.go
+++ b/pkg/ucp/frontend/controller/credentials/azure/deleteazurecredential_test.go
@@ -13,7 +13,6 @@ import (
 	"github.com/golang/mock/gomock"
 	v1 "github.com/project-radius/radius/pkg/armrpc/api/v1"
 	armrpc_controller "github.com/project-radius/radius/pkg/armrpc/frontend/controller"
-	"github.com/project-radius/radius/pkg/armrpc/rest"
 	armrpc_rest "github.com/project-radius/radius/pkg/armrpc/rest"
 	"github.com/project-radius/radius/pkg/ucp/datamodel"
 	ctrl "github.com/project-radius/radius/pkg/ucp/frontend/controller"
@@ -29,7 +28,7 @@ func Test_Credential_Delete(t *testing.T) {
 	mockStorageClient := store.NewMockStorageClient(mockCtrl)
 	mockSecretClient := secret.NewMockClient(mockCtrl)
 
-	credentialCtrl, err := NewDeleteCredential(ctrl.Options{
+	credentialCtrl, err := NewDeleteAzureCredential(ctrl.Options{
 		Options: armrpc_controller.Options{
 			StorageClient: mockStorageClient,
 		},
@@ -50,7 +49,7 @@ func Test_Credential_Delete(t *testing.T) {
 			url:        "/planes/azure/azurecloud/providers/System.Azure/credentials/default?api-version=2022-09-01-privatepreview",
 			headerfile: testHeaderFile,
 			fn:         setupCredentialDeleteSuccessMocks,
-			expected:   rest.NewOKResponse(nil),
+			expected:   armrpc_rest.NewOKResponse(nil),
 			err:        nil,
 		},
 		{
@@ -123,9 +122,9 @@ func Test_Credential_Delete(t *testing.T) {
 }
 
 func setupCredentialMocks(mockStorageClient store.MockStorageClient, mockSecretClient secret.MockClient) {
-	datamodelCredential := datamodel.Credential{
+	datamodelCredential := datamodel.AzureCredential{
 		BaseResource: v1.BaseResource{},
-		Properties: &datamodel.CredentialResourceProperties{
+		Properties: &datamodel.AzureCredentialResourceProperties{
 			Kind: datamodel.AWSCredentialKind,
 		},
 	}
diff --git a/pkg/ucp/frontend/controller/credentials/azure/testdata/azure-credential.json b/pkg/ucp/frontend/controller/credentials/azure/testdata/azure-credential.json
index 3fd3fb35a..d611fac0b 100644
--- a/pkg/ucp/frontend/controller/credentials/azure/testdata/azure-credential.json
+++ b/pkg/ucp/frontend/controller/credentials/azure/testdata/azure-credential.json
@@ -2,7 +2,7 @@
     "id": "/planes/azure/azurecloud/providers/System.Azure/credentials/default",
     "name": "default",
     "type": "System.Azure/credentials",
-    "location": "west-us-2",
+    "location": "West US",
     "tags": {
         "env": "dev"
     },
@@ -10,7 +10,7 @@
         "tenantId": "00000000-0000-0000-0000-000000000000",
         "clientId": "00000000-0000-0000-0000-000000000000",
         "secret":   "secret",
-        "kind":     "azure.com.serviceprincipal",
+        "kind":     "ServicePrincipal",
         "storage": {
             "kind": "Internal"
         }
diff --git a/pkg/ucp/frontend/controller/credentials/azure/testdata/invalid-request-azure-credential.json b/pkg/ucp/frontend/controller/credentials/azure/testdata/invalid-request-azure-credential.json
index f622bc893..0fe0eab7f 100644
--- a/pkg/ucp/frontend/controller/credentials/azure/testdata/invalid-request-azure-credential.json
+++ b/pkg/ucp/frontend/controller/credentials/azure/testdata/invalid-request-azure-credential.json
@@ -1,6 +1,5 @@
 {
     "id": "/planes/azure/azurecloud/providers/System.Azure/credentials/default",
-    "name": "default",
     "type": "System.Azure/credentials",
-    "location": "west-us-2"
+    "location": "West US"
 }
\ No newline at end of file
diff --git a/pkg/ucp/frontend/controller/planes/listplanes_test.go b/pkg/ucp/frontend/controller/planes/listplanes_test.go
index 55e93a9aa..44eb1ad8f 100644
--- a/pkg/ucp/frontend/controller/planes/listplanes_test.go
+++ b/pkg/ucp/frontend/controller/planes/listplanes_test.go
@@ -12,6 +12,9 @@ import (
 	v1 "github.com/project-radius/radius/pkg/armrpc/api/v1"
 	armrpc_controller "github.com/project-radius/radius/pkg/armrpc/frontend/controller"
 	armrpc_rest "github.com/project-radius/radius/pkg/armrpc/rest"
+	"github.com/project-radius/radius/pkg/to"
+	"github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
+	"github.com/project-radius/radius/pkg/ucp/datamodel"
 	ctrl "github.com/project-radius/radius/pkg/ucp/frontend/controller"
 	"github.com/project-radius/radius/pkg/ucp/store"
 	"github.com/project-radius/radius/test/testutil"
@@ -30,25 +33,65 @@ func Test_ListPlanes(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	rootScope := "/planes"
-	url := rootScope + "?api-version=2022-09-01-privatepreview"
-	var query store.Query
-	query.RootScope = rootScope
-	query.IsScopeQuery = true
+	url := "/planes?api-version=2022-09-01-privatepreview"
 
-	expectedPlaneList := []any{}
-	expectedResponse := armrpc_rest.NewOKResponse(
-		&v1.PaginatedList{
-			Value: expectedPlaneList,
-		})
+	query := store.Query{
+		RootScope:    "/planes",
+		IsScopeQuery: true,
+	}
 
-	mockStorageClient.EXPECT().Query(gomock.Any(), query).Return(&store.ObjectQueryResult{}, nil)
+	testPlaneId := "/planes/radius"
+	testPlaneName := "radius"
+	testPlaneType := "planes"
+
+	planeData := datamodel.Plane{
+		BaseResource: v1.BaseResource{
+			TrackedResource: v1.TrackedResource{
+				ID:   testPlaneId,
+				Name: testPlaneName,
+				Type: testPlaneType,
+			},
+		},
+		Properties: datamodel.PlaneProperties{
+			Kind: "AWS",
+		},
+	}
+
+	mockStorageClient.EXPECT().Query(gomock.Any(), query).Return(&store.ObjectQueryResult{
+		Items: []store.Object{
+			{
+				Metadata: store.Metadata{},
+				Data:     &planeData,
+			},
+		},
+	}, nil)
 
 	request, err := http.NewRequest(http.MethodGet, url, nil)
 	require.NoError(t, err)
-
 	ctx := testutil.ARMTestContextFromRequest(request)
 	actualResponse, err := planesCtrl.Run(ctx, nil, request)
 	require.NoError(t, err)
+
+	expectedPlane := v20220901privatepreview.PlaneResource{
+		ID:   &testPlaneId,
+		Name: &testPlaneName,
+		Type: &testPlaneType,
+		Tags: nil,
+		Properties: &v20220901privatepreview.PlaneResourceProperties{
+			Kind:              to.Ptr(v20220901privatepreview.PlaneKindAWS),
+			ResourceProviders: nil,
+			URL:               nil,
+			ProvisioningState: nil,
+		},
+	}
+
+	expectedPlaneList := &v1.PaginatedList{
+		Value: []any{
+			&expectedPlane,
+		},
+	}
+
+	expectedResponse := armrpc_rest.NewOKResponse(expectedPlaneList)
+
 	require.Equal(t, expectedResponse, actualResponse)
 }
diff --git a/pkg/ucp/frontend/controller/planes/listplanesbytype_test.go b/pkg/ucp/frontend/controller/planes/listplanesbytype_test.go
index d86b233e6..72e78d7ca 100644
--- a/pkg/ucp/frontend/controller/planes/listplanesbytype_test.go
+++ b/pkg/ucp/frontend/controller/planes/listplanesbytype_test.go
@@ -12,6 +12,9 @@ import (
 	v1 "github.com/project-radius/radius/pkg/armrpc/api/v1"
 	armrpc_controller "github.com/project-radius/radius/pkg/armrpc/frontend/controller"
 	armrpc_rest "github.com/project-radius/radius/pkg/armrpc/rest"
+	"github.com/project-radius/radius/pkg/to"
+	"github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
+	"github.com/project-radius/radius/pkg/ucp/datamodel"
 	ctrl "github.com/project-radius/radius/pkg/ucp/frontend/controller"
 	"github.com/project-radius/radius/pkg/ucp/store"
 	"github.com/project-radius/radius/test/testutil"
@@ -30,25 +33,66 @@ func Test_ListPlanesByType(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	rootScope := "/planes/radius"
-	url := rootScope + "?api-version=2022-09-01-privatepreview"
-	var query store.Query
-	query.RootScope = "/planes"
-	query.IsScopeQuery = true
-	query.ResourceType = "radius"
+	url := "/planes/radius?api-version=2022-09-01-privatepreview"
 
-	expectedPlaneList := []any{}
-	expectedResponse := armrpc_rest.NewOKResponse(
-		&v1.PaginatedList{
-			Value: expectedPlaneList,
-		})
+	query := store.Query{
+		RootScope:    "/planes",
+		IsScopeQuery: true,
+		ResourceType: "radius",
+	}
 
-	mockStorageClient.EXPECT().Query(gomock.Any(), query).Return(&store.ObjectQueryResult{}, nil)
+	testPlaneId := "/planes/radius/local"
+	testPlaneName := "local"
+	testPlaneType := "planesType"
+
+	planeData := datamodel.Plane{
+		BaseResource: v1.BaseResource{
+			TrackedResource: v1.TrackedResource{
+				ID:   testPlaneId,
+				Name: testPlaneName,
+				Type: testPlaneType,
+			},
+		},
+		Properties: datamodel.PlaneProperties{
+			Kind: "AWS",
+		},
+	}
+
+	mockStorageClient.EXPECT().Query(gomock.Any(), query).Return(&store.ObjectQueryResult{
+		Items: []store.Object{
+			{
+				Metadata: store.Metadata{},
+				Data:     &planeData,
+			},
+		},
+	}, nil)
 
 	request, err := http.NewRequest(http.MethodGet, url, nil)
 	require.NoError(t, err)
 	ctx := testutil.ARMTestContextFromRequest(request)
 	actualResponse, err := planesCtrl.Run(ctx, nil, request)
 	require.NoError(t, err)
+
+	expectedPlane := v20220901privatepreview.PlaneResource{
+		ID:   &testPlaneId,
+		Name: &testPlaneName,
+		Type: &testPlaneType,
+		Tags: nil,
+		Properties: &v20220901privatepreview.PlaneResourceProperties{
+			Kind:              to.Ptr(v20220901privatepreview.PlaneKindAWS),
+			ResourceProviders: nil,
+			URL:               nil,
+			ProvisioningState: nil,
+		},
+	}
+
+	expectedPlaneList := &v1.PaginatedList{
+		Value: []any{
+			&expectedPlane,
+		},
+	}
+
+	expectedResponse := armrpc_rest.NewOKResponse(expectedPlaneList)
+
 	require.Equal(t, expectedResponse, actualResponse)
 }
diff --git a/pkg/ucp/integrationtests/integration_test.go b/pkg/ucp/integrationtests/integration_test.go
index 7b9a71f70..7d1663649 100644
--- a/pkg/ucp/integrationtests/integration_test.go
+++ b/pkg/ucp/integrationtests/integration_test.go
@@ -517,7 +517,7 @@ func Test_RequestWithBadAPIVersion(t *testing.T) {
 	expectedResponse := armrpc_v1.ErrorResponse{
 		Error: armrpc_v1.ErrorDetails{
 			Code:    "InvalidApiVersionParameter",
-			Message: "API version 'unsupported-version' for type 'ucp/ucp' is not supported. The supported api-versions are '2022-09-01-privatepreview'.",
+			Message: "API version 'unsupported-version' for type 'ucp/openapi' is not supported. The supported api-versions are '2022-09-01-privatepreview'.",
 		},
 	}
 	responseBody, err := io.ReadAll(response.Body)
diff --git a/pkg/ucp/resources/aws_test.go b/pkg/ucp/resources/aws_test.go
new file mode 100644
index 000000000..b911dd9e3
--- /dev/null
+++ b/pkg/ucp/resources/aws_test.go
@@ -0,0 +1,24 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package resources
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_ToAWSResourceType(t *testing.T) {
+	expected := "AWS::S3::Bucket"
+	resourceId := "/planes/aws/aws/accounts/123341234/regions/us-west-2/providers/AWS.S3/Bucket"
+
+	id, err := Parse(resourceId)
+	require.NoError(t, err)
+
+	actual := ToAWSResourceType(id)
+
+	require.Equal(t, expected, actual)
+}
diff --git a/test/functional/ucp/aws_credential_test.go b/test/functional/ucp/aws_credential_test.go
new file mode 100644
index 000000000..d320bdd23
--- /dev/null
+++ b/test/functional/ucp/aws_credential_test.go
@@ -0,0 +1,196 @@
+// ------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+// ------------------------------------------------------------
+
+package ucp
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
+	ucp "github.com/project-radius/radius/pkg/ucp/api/v20220901privatepreview"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_AWS_Credential_Operations(t *testing.T) {
+	test := NewUCPTest(t, "Test_AWS_Credential_Operations", func(t *testing.T, url string, roundTripper http.RoundTripper) {
+		resourceTypePath := "/planes/aws/awstest/providers/System.AWS/credentials"
+		resourceURL := fmt.Sprintf("%s%s/default?api-version=%s", url, resourceTypePath, ucp.Version)
+		collectionURL := fmt.Sprintf("%s%s?api-version=%s", url, resourceTypePath, ucp.Version)
+		runAWSCredentialTests(t, resourceURL, collectionURL, roundTripper, getAWSTestCredentialObject(), getExpectedAWSTestCredentialObject())
+	})
+
+	test.Test(t)
+}
+
+func runAWSCredentialTests(t *testing.T, resourceUrl string, collectionUrl string, roundTripper http.RoundTripper, createCredential ucp.AWSCredentialResource, expectedCredential ucp.AWSCredentialResource) {
+	// Create credential operation
+	createAWSTestCredential(t, roundTripper, resourceUrl, createCredential)
+
+	// Create duplicate credential
+	createAWSTestCredential(t, roundTripper, resourceUrl, createCredential)
+
+	// List credential operation
+	credentialList := listAWSTestCredential(t, roundTripper, collectionUrl)
+
+	index, err := getIndexOfAWSTestCredential(*expectedCredential.ID, credentialList)
+	require.NoError(t, err)
+	require.Equal(t, credentialList[index], expectedCredential)
+
+	// Check for correctness of credential
+	createdCredential, statusCode := getAWSTestCredential(t, roundTripper, resourceUrl)
+
+	require.Equal(t, http.StatusOK, statusCode)
+	require.Equal(t, createdCredential, expectedCredential)
+
+	// Delete credential operation
+	statusCode, err = deleteAWSTestCredential(t, roundTripper, resourceUrl)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, statusCode)
+
+	// Delete non-existent credential
+	statusCode, err = deleteAWSTestCredential(t, roundTripper, resourceUrl)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusNoContent, statusCode)
+}
+
+func createAWSTestCredential(t *testing.T, roundTripper http.RoundTripper, url string, credential ucp.AWSCredentialResource) {
+	body, err := json.Marshal(credential)
+	require.NoError(t, err)
+	createRequest, err := NewUCPRequest(http.MethodPut, url, bytes.NewBuffer(body))
+	require.NoError(t, err)
+
+	res, err := roundTripper.RoundTrip(createRequest)
+	require.NoError(t, err)
+
+	require.Equal(t, http.StatusOK, res.StatusCode)
+	t.Logf("Credential: %s created/updated successfully", url)
+}
+
+func getAWSTestCredential(t *testing.T, roundTripper http.RoundTripper, url string) (ucp.AWSCredentialResource, int) {
+	getCredentialRequest, err := NewUCPRequest(http.MethodGet, url, nil)
+	require.NoError(t, err)
+
+	result, err := roundTripper.RoundTrip(getCredentialRequest)
+	require.NoError(t, err)
+
+	body := result.Body
+	defer body.Close()
+	payload, err := io.ReadAll(body)
+	require.NoError(t, err)
+
+	credential := ucp.AWSCredentialResource{}
+	err = json.Unmarshal(payload, &credential)
+	require.NoError(t, err)
+
+	return credential, result.StatusCode
+}
+
+func deleteAWSTestCredential(t *testing.T, roundTripper http.RoundTripper, url string) (int, error) {
+	deleteCredentialRequest, err := NewUCPRequest(http.MethodDelete, url, nil)
+	require.NoError(t, err)
+
+	res, err := roundTripper.RoundTrip(deleteCredentialRequest)
+	return res.StatusCode, err
+}
+
+func listAWSTestCredential(t *testing.T, roundTripper http.RoundTripper, url string) []ucp.AWSCredentialResource {
+	listCredentialRequest, err := NewUCPRequest(http.MethodGet, url, nil)
+	require.NoError(t, err)
+
+	res, err := roundTripper.RoundTrip(listCredentialRequest)
+	require.NoError(t, err)
+	return getAWSTestCredentialList(t, res)
+}
+
+func getAWSTestCredentialList(t *testing.T, res *http.Response) []ucp.AWSCredentialResource {
+	body := res.Body
+	defer body.Close()
+
+	var data map[string]any
+	err := json.NewDecoder(body).Decode(&data)
+	require.NoError(t, err)
+	list, ok := data["value"].([]any)
+	require.Equal(t, ok, true)
+	var credentialList []ucp.AWSCredentialResource
+	for _, item := range list {
+		s, err := json.Marshal(item)
+		require.NoError(t, err)
+		credential := ucp.AWSCredentialResource{}
+		err = json.Unmarshal(s, &credential)
+		require.NoError(t, err)
+		credentialList = append(credentialList, credential)
+	}
+	return credentialList
+}
+
+func getAWSTestCredentialObject() ucp.AWSCredentialResource {
+	return ucp.AWSCredentialResource{
+		Location: to.Ptr("global"),
+		ID:       to.Ptr("/planes/aws/awstest/providers/System.AWS/credentials/default"),
+		Name:     to.Ptr("default"),
+		Type:     to.Ptr("System.AWS/credentials"),
+		Tags: map[string]*string{
+			"env": to.Ptr("dev"),
+		},
+		Properties: &ucp.AWSAccessKeyCredentialProperties{
+			AccessKeyID:     to.Ptr("00000000-0000-0000-0000-000000000000"),
+			SecretAccessKey: to.Ptr("00000000-0000-0000-0000-000000000000"),
+			Kind:            to.Ptr("AccessKey"),
+			Storage: &ucp.InternalCredentialStorageProperties{
+				Kind:       to.Ptr(string(ucp.CredentialStorageKindInternal)),
+				SecretName: to.Ptr("aws-awstest-default"),
+			},
+		},
+	}
+}
+
+func getExpectedAWSTestCredentialObject() ucp.AWSCredentialResource {
+	return ucp.AWSCredentialResource{
+		Location: to.Ptr("global"),
+		ID:       to.Ptr("/planes/aws/awstest/providers/System.AWS/credentials/default"),
+		Name:     to.Ptr("default"),
+		Type:     to.Ptr("System.AWS/credentials"),
+		Tags: map[string]*string{
+			"env": to.Ptr("dev"),
+		},
+		Properties: &ucp.AWSAccessKeyCredentialProperties{
+			AccessKeyID: to.Ptr("00000000-0000-0000-0000-000000000000"),
+			Kind:        to.Ptr("AccessKey"),
+			Storage: &ucp.InternalCredentialStorageProperties{
+				Kind:       to.Ptr(string(ucp.CredentialStorageKindInternal)),
+				SecretName: to.Ptr("aws-awstest-default"),
+			},
+		},
+	}
+}
+
+func getIndexOfAWSTestCredential(testCredentialId string, credentialList []ucp.AWSCredentialResource) (int, error) {
+	found := false
+	foundCredentials := make([]string, len(credentialList))
+	testCredentialIndex := -1
+
+	for index := range credentialList {
+		foundCredentials[index] = *credentialList[index].ID
+		if *credentialList[index].ID == testCredentialId {
+			if !found {
+				testCredentialIndex = index
+				found = true
+			} else {
+				return -1, fmt.Errorf("credential %s duplicated in credentialList: %v", testCredentialId, foundCredentials)
+			}
+		}
+	}
+
+	if !found {
+		return -1, fmt.Errorf("credential: %s not found in credentialList: %v", testCredentialId, foundCredentials)
+	}
+
+	return testCredentialIndex, nil
+}
diff --git a/test/functional/ucp/credential_test.go b/test/functional/ucp/azure_credential_test.go
similarity index 51%
rename from test/functional/ucp/credential_test.go
rename to test/functional/ucp/azure_credential_test.go
index f1c18be39..1252c4685 100644
--- a/test/functional/ucp/credential_test.go
+++ b/test/functional/ucp/azure_credential_test.go
@@ -23,50 +23,42 @@ func Test_Azure_Credential_Operations(t *testing.T) {
 		resourceTypePath := "/planes/azure/azuretest/providers/System.Azure/credentials"
 		resourceURL := fmt.Sprintf("%s%s/default?api-version=%s", url, resourceTypePath, ucp.Version)
 		collectionURL := fmt.Sprintf("%s%s?api-version=%s", url, resourceTypePath, ucp.Version)
-		runCredentialTests(t, resourceURL, collectionURL, roundTripper, getAzureCredentialObject())
+		runAzureCredentialTests(t, resourceURL, collectionURL, roundTripper, getAzureTestCredentialObject(), getExpectedAzureTestCredentialObject())
 	})
 
 	test.Test(t)
 }
 
-func Test_AWS_Credential_Operations(t *testing.T) {
-	test := NewUCPTest(t, "Test_AWS_Credential_Operations", func(t *testing.T, url string, roundTripper http.RoundTripper) {
-		resourceTypePath := "/planes/aws/awstest/providers/System.AWS/credentials"
-		resourceURL := fmt.Sprintf("%s%s/default?api-version=%s", url, resourceTypePath, ucp.Version)
-		collectionURL := fmt.Sprintf("%s%s?api-version=%s", url, resourceTypePath, ucp.Version)
-		runCredentialTests(t, resourceURL, collectionURL, roundTripper, getAWSCredentialObject())
-	})
-
-	test.Test(t)
-}
-
-func runCredentialTests(t *testing.T, resourceUrl string, collectionUrl string, roundTripper http.RoundTripper, credential ucp.CredentialResource) {
+func runAzureCredentialTests(t *testing.T, resourceUrl string, collectionUrl string, roundTripper http.RoundTripper, createCredential ucp.AzureCredentialResource, expectedCredential ucp.AzureCredentialResource) {
 	// Create credential operation
-	createCredential(t, roundTripper, resourceUrl, credential)
+	createAzureTestCredential(t, roundTripper, resourceUrl, createCredential)
+
 	// Create duplicate credential
-	createCredential(t, roundTripper, resourceUrl, credential)
+	createAzureTestCredential(t, roundTripper, resourceUrl, createCredential)
+
 	// List credential operation
-	credentialList := listCredential(t, roundTripper, collectionUrl)
-	require.Equal(t, len(credentialList), 1)
-	require.Equal(t, credentialList[0], credential)
+	credentialList := listAzureTestCredential(t, roundTripper, collectionUrl)
+	index, err := getIndexOfAzureTestCredential(*expectedCredential.ID, credentialList)
+	require.NoError(t, err)
+	require.Equal(t, credentialList[index], expectedCredential)
 
 	// Check for correctness of credential
-	createdCredential, statusCode := getCredential(t, roundTripper, resourceUrl)
+	createdCredential, statusCode := getAzureTestCredential(t, roundTripper, resourceUrl)
 	require.Equal(t, http.StatusOK, statusCode)
-	require.Equal(t, createdCredential, credential)
+	require.Equal(t, createdCredential, createdCredential)
 
 	// Delete credential operation
-	statusCode, err := deleteCredential(t, roundTripper, resourceUrl)
+	statusCode, err = deleteAzureTestCredential(t, roundTripper, resourceUrl)
 	require.NoError(t, err)
 	require.Equal(t, http.StatusOK, statusCode)
 
 	// Delete non-existent credential
-	statusCode, err = deleteCredential(t, roundTripper, resourceUrl)
+	statusCode, err = deleteAzureTestCredential(t, roundTripper, resourceUrl)
 	require.NoError(t, err)
 	require.Equal(t, http.StatusNoContent, statusCode)
 }
 
-func createCredential(t *testing.T, roundTripper http.RoundTripper, url string, credential ucp.CredentialResource) {
+func createAzureTestCredential(t *testing.T, roundTripper http.RoundTripper, url string, credential ucp.AzureCredentialResource) {
 	body, err := json.Marshal(credential)
 	require.NoError(t, err)
 	createRequest, err := NewUCPRequest(http.MethodPut, url, bytes.NewBuffer(body))
@@ -79,7 +71,7 @@ func createCredential(t *testing.T, roundTripper http.RoundTripper, url string,
 	t.Logf("Credential: %s created/updated successfully", url)
 }
 
-func getCredential(t *testing.T, roundTripper http.RoundTripper, url string) (ucp.CredentialResource, int) {
+func getAzureTestCredential(t *testing.T, roundTripper http.RoundTripper, url string) (ucp.AzureCredentialResource, int) {
 	getCredentialRequest, err := NewUCPRequest(http.MethodGet, url, nil)
 	require.NoError(t, err)
 
@@ -91,14 +83,14 @@ func getCredential(t *testing.T, roundTripper http.RoundTripper, url string) (uc
 	payload, err := io.ReadAll(body)
 	require.NoError(t, err)
 
-	credential := ucp.CredentialResource{}
+	credential := ucp.AzureCredentialResource{}
 	err = json.Unmarshal(payload, &credential)
 	require.NoError(t, err)
 
 	return credential, result.StatusCode
 }
 
-func deleteCredential(t *testing.T, roundTripper http.RoundTripper, url string) (int, error) {
+func deleteAzureTestCredential(t *testing.T, roundTripper http.RoundTripper, url string) (int, error) {
 	deleteCredentialRequest, err := NewUCPRequest(http.MethodDelete, url, nil)
 	require.NoError(t, err)
 
@@ -106,16 +98,16 @@ func deleteCredential(t *testing.T, roundTripper http.RoundTripper, url string)
 	return res.StatusCode, err
 }
 
-func listCredential(t *testing.T, roundTripper http.RoundTripper, url string) []ucp.CredentialResource {
+func listAzureTestCredential(t *testing.T, roundTripper http.RoundTripper, url string) []ucp.AzureCredentialResource {
 	listCredentialRequest, err := NewUCPRequest(http.MethodGet, url, nil)
 	require.NoError(t, err)
 
 	res, err := roundTripper.RoundTrip(listCredentialRequest)
 	require.NoError(t, err)
-	return getCredentialList(t, res)
+	return getAzureTestCredentialList(t, res)
 }
 
-func getCredentialList(t *testing.T, res *http.Response) []ucp.CredentialResource {
+func getAzureTestCredentialList(t *testing.T, res *http.Response) []ucp.AzureCredentialResource {
 	body := res.Body
 	defer body.Close()
 
@@ -124,11 +116,11 @@ func getCredentialList(t *testing.T, res *http.Response) []ucp.CredentialResourc
 	require.NoError(t, err)
 	list, ok := data["value"].([]any)
 	require.Equal(t, ok, true)
-	var credentialList []ucp.CredentialResource
+	var credentialList []ucp.AzureCredentialResource
 	for _, item := range list {
 		s, err := json.Marshal(item)
 		require.NoError(t, err)
-		credential := ucp.CredentialResource{}
+		credential := ucp.AzureCredentialResource{}
 		err = json.Unmarshal(s, &credential)
 		require.NoError(t, err)
 		credentialList = append(credentialList, credential)
@@ -136,8 +128,8 @@ func getCredentialList(t *testing.T, res *http.Response) []ucp.CredentialResourc
 	return credentialList
 }
 
-func getAzureCredentialObject() ucp.CredentialResource {
-	return ucp.CredentialResource{
+func getAzureTestCredentialObject() ucp.AzureCredentialResource {
+	return ucp.AzureCredentialResource{
 		Location: to.Ptr("global"),
 		ID:       to.Ptr("/planes/azure/azuretest/providers/System.Azure/credentials/default"),
 		Name:     to.Ptr("default"),
@@ -146,33 +138,59 @@ func getAzureCredentialObject() ucp.CredentialResource {
 			"env": to.Ptr("dev"),
 		},
 		Properties: &ucp.AzureServicePrincipalProperties{
-			ClientID: to.Ptr("00000000-0000-0000-0000-000000000000"),
-			TenantID: to.Ptr("00000000-0000-0000-0000-000000000000"),
-			Kind:     to.Ptr("azure.com.serviceprincipal"),
+			ClientID:     to.Ptr("00000000-0000-0000-0000-000000000000"),
+			TenantID:     to.Ptr("00000000-0000-0000-0000-000000000000"),
+			ClientSecret: to.Ptr("00000000-0000-0000-0000-000000000000"),
+			Kind:         to.Ptr("ServicePrincipal"),
 			Storage: &ucp.InternalCredentialStorageProperties{
-				Kind:       to.Ptr(ucp.CredentialStorageKindInternal),
+				Kind:       to.Ptr(string(ucp.CredentialStorageKindInternal)),
 				SecretName: to.Ptr("azure-azuretest-default"),
 			},
 		},
 	}
 }
 
-func getAWSCredentialObject() ucp.CredentialResource {
-	return ucp.CredentialResource{
+func getExpectedAzureTestCredentialObject() ucp.AzureCredentialResource {
+	return ucp.AzureCredentialResource{
 		Location: to.Ptr("global"),
-		ID:       to.Ptr("/planes/aws/awstest/providers/System.AWS/credentials/default"),
+		ID:       to.Ptr("/planes/azure/azuretest/providers/System.Azure/credentials/default"),
 		Name:     to.Ptr("default"),
-		Type:     to.Ptr("System.AWS/credentials"),
+		Type:     to.Ptr("System.Azure/credentials"),
 		Tags: map[string]*string{
 			"env": to.Ptr("dev"),
 		},
-		Properties: &ucp.AWSCredentialProperties{
-			AccessKeyID: to.Ptr("00000000-0000-0000-0000-000000000000"),
-			Kind:        to.Ptr("aws.com.iam"),
+		Properties: &ucp.AzureServicePrincipalProperties{
+			ClientID: to.Ptr("00000000-0000-0000-0000-000000000000"),
+			TenantID: to.Ptr("00000000-0000-0000-0000-000000000000"),
+			Kind:     to.Ptr("ServicePrincipal"),
 			Storage: &ucp.InternalCredentialStorageProperties{
-				Kind:       to.Ptr(ucp.CredentialStorageKindInternal),
-				SecretName: to.Ptr("aws-awstest-default"),
+				Kind:       to.Ptr(string(ucp.CredentialStorageKindInternal)),
+				SecretName: to.Ptr("azure-azuretest-default"),
 			},
 		},
 	}
 }
+
+func getIndexOfAzureTestCredential(testCredentialId string, credentialList []ucp.AzureCredentialResource) (int, error) {
+	found := false
+	foundCredentials := make([]string, len(credentialList))
+	testCredentialIndex := -1
+
+	for index := range credentialList {
+		foundCredentials[index] = *credentialList[index].ID
+		if *credentialList[index].ID == testCredentialId {
+			if !found {
+				testCredentialIndex = index
+				found = true
+			} else {
+				return -1, fmt.Errorf("credential %s duplicated in credentialList: %v", testCredentialId, foundCredentials)
+			}
+		}
+	}
+
+	if !found {
+		return -1, fmt.Errorf("credential: %s not found in credentialList: %v", testCredentialId, foundCredentials)
+	}
+
+	return testCredentialIndex, nil
+}
diff --git a/test/functional/ucp/plane_test.go b/test/functional/ucp/plane_test.go
index a2d7ed71d..3218a5c49 100644
--- a/test/functional/ucp/plane_test.go
+++ b/test/functional/ucp/plane_test.go
@@ -117,8 +117,8 @@ func getPlane(t *testing.T, roundTripper http.RoundTripper, url string) (rest.Pl
 	return plane, result.StatusCode
 }
 
-func listPlanes(t *testing.T, roundTripper http.RoundTripper, url string) v20220901privatepreview.PlanesClientListResponse {
-	listRequest, err := NewUCPRequest(
+func listPlanes(t *testing.T, roundTripper http.RoundTripper, url string) v20220901privatepreview.PlaneResourceListResult {
+	listRequest, err := http.NewRequest(
 		http.MethodGet,
 		url,
 		nil,
@@ -133,7 +133,7 @@ func listPlanes(t *testing.T, roundTripper http.RoundTripper, url string) v20220
 	defer body.Close()
 	payload, err := io.ReadAll(body)
 	require.NoError(t, err)
-	listOfPlanes := v20220901privatepreview.PlanesClientListResponse{}
+	listOfPlanes := v20220901privatepreview.PlaneResourceListResult{}
 	require.NoError(t, json.Unmarshal(payload, &listOfPlanes))
 	return listOfPlanes
 }
diff --git a/test/functional/ucp/resourcegroup_test.go b/test/functional/ucp/resourcegroup_test.go
index ed59fe7e4..64edccb86 100644
--- a/test/functional/ucp/resourcegroup_test.go
+++ b/test/functional/ucp/resourcegroup_test.go
@@ -86,7 +86,7 @@ func createResourceGroup(t *testing.T, roundTripper http.RoundTripper, url strin
 	t.Logf("Resource group: %s created/updated successfully", url)
 }
 
-func listResourceGroups(t *testing.T, roundTripper http.RoundTripper, url string) v20220901privatepreview.ResourceGroupResourceList {
+func listResourceGroups(t *testing.T, roundTripper http.RoundTripper, url string) v20220901privatepreview.ResourceGroupResourceListResult {
 	listRgsRequest, err := NewUCPRequest(
 		http.MethodGet,
 		url,
@@ -103,7 +103,7 @@ func listResourceGroups(t *testing.T, roundTripper http.RoundTripper, url string
 	payload, err := io.ReadAll(body)
 	require.NoError(t, err)
 
-	items := v20220901privatepreview.ResourceGroupResourceList{}
+	items := v20220901privatepreview.ResourceGroupResourceListResult{}
 	err = json.Unmarshal(payload, &items)
 	require.NoError(t, err)
 
diff --git a/test/radcli/shared.go b/test/radcli/shared.go
index 7816f1f4f..cafcfc33a 100644
--- a/test/radcli/shared.go
+++ b/test/radcli/shared.go
@@ -202,6 +202,24 @@ workspaces:
 	return LoadConfig(t, yamlData)
 }
 
+func LoadConfigWithWorkspaceAndApplication(t *testing.T) *viper.Viper {
+
+	var yamlData = `
+workspaces: 
+  default: test-workspace
+  items: 
+    test-workspace: 
+      connection: 
+        context: test-context
+        kind: kubernetes
+      defaultApplication: /planes/radius/local/resourceGroups/test-resource-group/providers/Applications.Core/applications/test-application
+      environment: /planes/radius/local/resourceGroups/test-resource-group/providers/Applications.Core/environments/test-environment
+      scope: /planes/radius/local/resourceGroups/test-resource-group
+`
+
+	return LoadConfig(t, yamlData)
+}
+
 func LoadEmptyConfig(t *testing.T) *viper.Viper {
 
 	var yamlData = `