This is an automated email from the ASF dual-hosted git repository.

jin pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-hugegraph.git


The following commit(s) were added to refs/heads/master by this push:
     new b7998c1c3 refactor(server): remove graph param in auth api path (#2899)
b7998c1c3 is described below

commit b7998c1c31f92bb090e5a17295ba06b3ac6b624b
Author: Tsukilc <[email protected]>
AuthorDate: Tue Nov 4 19:34:12 2025 +0800

    refactor(server): remove graph param in auth api path (#2899)
---
 .../org/apache/hugegraph/api/auth/AccessAPI.java   |  34 +--
 .../org/apache/hugegraph/api/auth/BelongAPI.java   |  34 +--
 .../org/apache/hugegraph/api/auth/GroupAPI.java    |  43 ++--
 .../org/apache/hugegraph/api/auth/LoginAPI.java    |  22 +-
 .../org/apache/hugegraph/api/auth/ManagerAPI.java  | 279 +++++++++++++++++++++
 .../org/apache/hugegraph/api/auth/ProjectAPI.java  |  32 +--
 .../org/apache/hugegraph/api/auth/TargetAPI.java   |  43 ++--
 .../org/apache/hugegraph/api/auth/UserAPI.java     |  37 +--
 .../org/apache/hugegraph/api/graph/EdgeAPI.java    |  12 +-
 .../org/apache/hugegraph/api/graph/VertexAPI.java  |  12 +-
 .../apache/hugegraph/api/schema/EdgeLabelAPI.java  |   8 +-
 .../apache/hugegraph/api/schema/IndexLabelAPI.java |   8 +-
 .../hugegraph/api/schema/PropertyKeyAPI.java       |  10 +-
 .../org/apache/hugegraph/api/schema/SchemaAPI.java |   2 +-
 .../hugegraph/api/schema/VertexLabelAPI.java       |   8 +-
 .../apache/hugegraph/api/traversers/CountAPI.java  |   2 +-
 .../apache/hugegraph/api/traversers/EdgesAPI.java  |   6 +-
 .../hugegraph/api/traversers/NeighborRankAPI.java  |   2 +-
 .../hugegraph/api/traversers/PersonalRankAPI.java  |   2 +-
 .../hugegraph/api/traversers/VerticesAPI.java      |   6 +-
 .../apache/hugegraph/auth/HugeGraphAuthProxy.java  |  13 +-
 .../org/apache/hugegraph/api/LoginApiTest.java     |   4 +-
 .../org/apache/hugegraph/api/ManagerApiTest.java   |   2 +-
 .../org/apache/hugegraph/api/ProjectApiTest.java   |   2 +-
 .../java/org/apache/hugegraph/api/UserApiTest.java |   2 +-
 25 files changed, 413 insertions(+), 212 deletions(-)

diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/AccessAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/AccessAPI.java
index 8813f2017..8fc8f0444 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/AccessAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/AccessAPI.java
@@ -19,7 +19,6 @@ package org.apache.hugegraph.api.auth;
 
 import java.util.List;
 
-import org.apache.hugegraph.HugeGraph;
 import org.apache.hugegraph.api.API;
 import org.apache.hugegraph.api.filter.StatusFilter.Status;
 import org.apache.hugegraph.auth.HugeAccess;
@@ -50,7 +49,7 @@ import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.Context;
 
-@Path("graphspaces/{graphspace}/graphs/{graph}/auth/accesses")
+@Path("graphspaces/{graphspace}/auth/accesses")
 @Singleton
 @Tag(name = "AccessAPI")
 public class AccessAPI extends API {
@@ -64,15 +63,13 @@ public class AccessAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String create(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          JsonAccess jsonAccess) {
-        LOG.debug("Graph [{}] create access: {}", graph, jsonAccess);
+        LOG.debug("GraphSpace [{}] create access: {}", graphSpace, jsonAccess);
         checkCreatingBody(jsonAccess);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeAccess access = jsonAccess.build();
         access.id(manager.authManager().createAccess(access));
-        return manager.serializer(g).writeAuthElement(access);
+        return manager.serializer().writeAuthElement(access);
     }
 
     @PUT
@@ -82,13 +79,11 @@ public class AccessAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String update(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          @PathParam("id") String id,
                          JsonAccess jsonAccess) {
-        LOG.debug("Graph [{}] update access: {}", graph, jsonAccess);
+        LOG.debug("GraphSpace [{}] update access: {}", graphSpace, jsonAccess);
         checkUpdatingBody(jsonAccess);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeAccess access;
         try {
             access = manager.authManager().getAccess(UserAPI.parseId(id));
@@ -97,7 +92,7 @@ public class AccessAPI extends API {
         }
         access = jsonAccess.build(access);
         manager.authManager().updateAccess(access);
-        return manager.serializer(g).writeAuthElement(access);
+        return manager.serializer().writeAuthElement(access);
     }
 
     @GET
@@ -105,16 +100,14 @@ public class AccessAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String list(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @QueryParam("group") String group,
                        @QueryParam("target") String target,
                        @QueryParam("limit") @DefaultValue("100") long limit) {
-        LOG.debug("Graph [{}] list belongs by group {} or target {}",
-                  graph, group, target);
+        LOG.debug("GraphSpace [{}] list accesses by group {} or target {}",
+                  graphSpace, group, target);
         E.checkArgument(group == null || target == null,
                         "Can't pass both group and target at the same time");
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         List<HugeAccess> belongs;
         if (group != null) {
             Id id = UserAPI.parseId(group);
@@ -125,7 +118,7 @@ public class AccessAPI extends API {
         } else {
             belongs = manager.authManager().listAllAccess(limit);
         }
-        return manager.serializer(g).writeAuthElements("accesses", belongs);
+        return manager.serializer().writeAuthElements("accesses", belongs);
     }
 
     @GET
@@ -134,13 +127,11 @@ public class AccessAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String get(@Context GraphManager manager,
                       @PathParam("graphspace") String graphSpace,
-                      @PathParam("graph") String graph,
                       @PathParam("id") String id) {
-        LOG.debug("Graph [{}] get access: {}", graph, id);
+        LOG.debug("GraphSpace [{}] get access: {}", graphSpace, id);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeAccess access = 
manager.authManager().getAccess(UserAPI.parseId(id));
-        return manager.serializer(g).writeAuthElement(access);
+        return manager.serializer().writeAuthElement(access);
     }
 
     @DELETE
@@ -149,12 +140,9 @@ public class AccessAPI extends API {
     @Consumes(APPLICATION_JSON)
     public void delete(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @PathParam("id") String id) {
-        LOG.debug("Graph [{}] delete access: {}", graph, id);
+        LOG.debug("GraphSpace [{}] delete access: {}", graphSpace, id);
 
-        @SuppressWarnings("unused") // just check if the graph exists
-        HugeGraph g = graph(manager, graphSpace, graph);
         try {
             manager.authManager().deleteAccess(UserAPI.parseId(id));
         } catch (NotFoundException e) {
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/BelongAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/BelongAPI.java
index df3b3a11d..1064802e2 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/BelongAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/BelongAPI.java
@@ -19,7 +19,6 @@ package org.apache.hugegraph.api.auth;
 
 import java.util.List;
 
-import org.apache.hugegraph.HugeGraph;
 import org.apache.hugegraph.api.API;
 import org.apache.hugegraph.api.filter.StatusFilter.Status;
 import org.apache.hugegraph.auth.HugeBelong;
@@ -49,7 +48,7 @@ import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.Context;
 
-@Path("graphspaces/{graphspace}/graphs/{graph}/auth/belongs")
+@Path("graphspaces/{graphspace}/auth/belongs")
 @Singleton
 @Tag(name = "BelongAPI")
 public class BelongAPI extends API {
@@ -63,15 +62,13 @@ public class BelongAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String create(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          JsonBelong jsonBelong) {
-        LOG.debug("Graph [{}] create belong: {}", graph, jsonBelong);
+        LOG.debug("GraphSpace [{}] create belong: {}", graphSpace, jsonBelong);
         checkCreatingBody(jsonBelong);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeBelong belong = jsonBelong.build();
         belong.id(manager.authManager().createBelong(belong));
-        return manager.serializer(g).writeAuthElement(belong);
+        return manager.serializer().writeAuthElement(belong);
     }
 
     @PUT
@@ -81,13 +78,11 @@ public class BelongAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String update(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          @PathParam("id") String id,
                          JsonBelong jsonBelong) {
-        LOG.debug("Graph [{}] update belong: {}", graph, jsonBelong);
+        LOG.debug("GraphSpace [{}] update belong: {}", graphSpace, jsonBelong);
         checkUpdatingBody(jsonBelong);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeBelong belong;
         try {
             belong = manager.authManager().getBelong(UserAPI.parseId(id));
@@ -96,7 +91,7 @@ public class BelongAPI extends API {
         }
         belong = jsonBelong.build(belong);
         manager.authManager().updateBelong(belong);
-        return manager.serializer(g).writeAuthElement(belong);
+        return manager.serializer().writeAuthElement(belong);
     }
 
     @GET
@@ -104,16 +99,14 @@ public class BelongAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String list(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @QueryParam("user") String user,
                        @QueryParam("group") String group,
                        @QueryParam("limit") @DefaultValue("100") long limit) {
-        LOG.debug("Graph [{}] list belongs by user {} or group {}",
-                  graph, user, group);
+        LOG.debug("GraphSpace [{}] list belongs by user {} or group {}",
+                  graphSpace, user, group);
         E.checkArgument(user == null || group == null,
                         "Can't pass both user and group at the same time");
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         List<HugeBelong> belongs;
         if (user != null) {
             Id id = UserAPI.parseId(user);
@@ -124,7 +117,7 @@ public class BelongAPI extends API {
         } else {
             belongs = manager.authManager().listAllBelong(limit);
         }
-        return manager.serializer(g).writeAuthElements("belongs", belongs);
+        return manager.serializer().writeAuthElements("belongs", belongs);
     }
 
     @GET
@@ -133,13 +126,11 @@ public class BelongAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String get(@Context GraphManager manager,
                       @PathParam("graphspace") String graphSpace,
-                      @PathParam("graph") String graph,
                       @PathParam("id") String id) {
-        LOG.debug("Graph [{}] get belong: {}", graph, id);
+        LOG.debug("GraphSpace [{}] get belong: {}", graphSpace, id);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeBelong belong = 
manager.authManager().getBelong(UserAPI.parseId(id));
-        return manager.serializer(g).writeAuthElement(belong);
+        return manager.serializer().writeAuthElement(belong);
     }
 
     @DELETE
@@ -148,12 +139,9 @@ public class BelongAPI extends API {
     @Consumes(APPLICATION_JSON)
     public void delete(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @PathParam("id") String id) {
-        LOG.debug("Graph [{}] delete belong: {}", graph, id);
+        LOG.debug("GraphSpace [{}] delete belong: {}", graphSpace, id);
 
-        @SuppressWarnings("unused") // just check if the graph exists
-        HugeGraph g = graph(manager, graphSpace, graph);
         try {
             manager.authManager().deleteBelong(UserAPI.parseId(id));
         } catch (NotFoundException e) {
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/GroupAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/GroupAPI.java
index 2c84a0310..2786ef0b6 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/GroupAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/GroupAPI.java
@@ -19,7 +19,6 @@ package org.apache.hugegraph.api.auth;
 
 import java.util.List;
 
-import org.apache.hugegraph.HugeGraph;
 import org.apache.hugegraph.api.API;
 import org.apache.hugegraph.api.filter.StatusFilter.Status;
 import org.apache.hugegraph.auth.HugeGroup;
@@ -36,6 +35,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.security.RolesAllowed;
 import jakarta.inject.Singleton;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
@@ -49,7 +49,7 @@ import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.Context;
 
-@Path("graphspaces/{graphspace}/graphs/{graph}/auth/groups")
+@Path("/auth/groups")
 @Singleton
 @Tag(name = "GroupAPI")
 public class GroupAPI extends API {
@@ -61,17 +61,15 @@ public class GroupAPI extends API {
     @Status(Status.CREATED)
     @Consumes(APPLICATION_JSON)
     @Produces(APPLICATION_JSON_WITH_CHARSET)
+    @RolesAllowed({"admin"})
     public String create(@Context GraphManager manager,
-                         @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          JsonGroup jsonGroup) {
-        LOG.debug("Graph [{}] create group: {}", graph, jsonGroup);
+        LOG.debug("create group: {}", jsonGroup);
         checkCreatingBody(jsonGroup);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeGroup group = jsonGroup.build();
         group.id(manager.authManager().createGroup(group));
-        return manager.serializer(g).writeAuthElement(group);
+        return manager.serializer().writeAuthElement(group);
     }
 
     @PUT
@@ -79,15 +77,13 @@ public class GroupAPI extends API {
     @Path("{id}")
     @Consumes(APPLICATION_JSON)
     @Produces(APPLICATION_JSON_WITH_CHARSET)
+    @RolesAllowed({"admin"})
     public String update(@Context GraphManager manager,
-                         @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          @PathParam("id") String id,
                          JsonGroup jsonGroup) {
-        LOG.debug("Graph [{}] update group: {}", graph, jsonGroup);
+        LOG.debug("update group: {}", jsonGroup);
         checkUpdatingBody(jsonGroup);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeGroup group;
         try {
             group = manager.authManager().getGroup(UserAPI.parseId(id));
@@ -96,50 +92,43 @@ public class GroupAPI extends API {
         }
         group = jsonGroup.build(group);
         manager.authManager().updateGroup(group);
-        return manager.serializer(g).writeAuthElement(group);
+        return manager.serializer().writeAuthElement(group);
     }
 
     @GET
     @Timed
     @Produces(APPLICATION_JSON_WITH_CHARSET)
+    @RolesAllowed({"admin"})
     public String list(@Context GraphManager manager,
-                       @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @QueryParam("limit") @DefaultValue("100") long limit) {
-        LOG.debug("Graph [{}] list groups", graph);
+        LOG.debug("list groups");
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         List<HugeGroup> groups = manager.authManager().listAllGroups(limit);
-        return manager.serializer(g).writeAuthElements("groups", groups);
+        return manager.serializer().writeAuthElements("groups", groups);
     }
 
     @GET
     @Timed
     @Path("{id}")
     @Produces(APPLICATION_JSON_WITH_CHARSET)
+    @RolesAllowed({"admin"})
     public String get(@Context GraphManager manager,
-                      @PathParam("graphspace") String graphSpace,
-                      @PathParam("graph") String graph,
                       @PathParam("id") String id) {
-        LOG.debug("Graph [{}] get group: {}", graph, id);
+        LOG.debug("get group: {}", id);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeGroup group = manager.authManager().getGroup(IdGenerator.of(id));
-        return manager.serializer(g).writeAuthElement(group);
+        return manager.serializer().writeAuthElement(group);
     }
 
     @DELETE
     @Timed
     @Path("{id}")
     @Consumes(APPLICATION_JSON)
+    @RolesAllowed({"admin"})
     public void delete(@Context GraphManager manager,
-                       @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @PathParam("id") String id) {
-        LOG.debug("Graph [{}] delete group: {}", graph, id);
+        LOG.debug("delete group: {}", id);
 
-        @SuppressWarnings("unused") // just check if the graph exists
-        HugeGraph g = graph(manager, graphSpace, graph);
         try {
             manager.authManager().deleteGroup(IdGenerator.of(id));
         } catch (NotFoundException e) {
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/LoginAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/LoginAPI.java
index faf09a312..7086b77af 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/LoginAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/LoginAPI.java
@@ -20,7 +20,6 @@ package org.apache.hugegraph.api.auth;
 import javax.security.sasl.AuthenticationException;
 
 import org.apache.commons.lang3.StringUtils;
-import org.apache.hugegraph.HugeGraph;
 import org.apache.hugegraph.api.API;
 import org.apache.hugegraph.api.filter.AuthenticationFilter;
 import org.apache.hugegraph.api.filter.StatusFilter.Status;
@@ -46,12 +45,11 @@ import jakarta.ws.rs.HeaderParam;
 import jakarta.ws.rs.NotAuthorizedException;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
-import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.HttpHeaders;
 
-@Path("graphspaces/{graphspace}/graphs/{graph}/auth")
+@Path("/auth")
 @Singleton
 @Tag(name = "LoginAPI")
 public class LoginAPI extends API {
@@ -65,17 +63,14 @@ public class LoginAPI extends API {
     @Consumes(APPLICATION_JSON)
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String login(@Context GraphManager manager,
-                        @PathParam("graphspace") String graphSpace,
-                        @PathParam("graph") String graph,
                         JsonLogin jsonLogin) {
-        LOG.debug("Graph [{}] user login: {}", graph, jsonLogin);
+        LOG.debug("user login: {}", jsonLogin);
         checkCreatingBody(jsonLogin);
 
         try {
             String token = manager.authManager()
                                   .loginUser(jsonLogin.name, 
jsonLogin.password, jsonLogin.expire);
-            HugeGraph g = graph(manager, graphSpace, graph);
-            return manager.serializer(g).writeMap(ImmutableMap.of("token", 
token));
+            return manager.serializer().writeMap(ImmutableMap.of("token", 
token));
         } catch (AuthenticationException e) {
             throw new NotAuthorizedException(e.getMessage(), e);
         }
@@ -87,11 +82,11 @@ public class LoginAPI extends API {
     @Status(Status.OK)
     @Consumes(APPLICATION_JSON)
     @Produces(APPLICATION_JSON_WITH_CHARSET)
-    public void logout(@Context GraphManager manager, @PathParam("graph") 
String graph,
+    public void logout(@Context GraphManager manager,
                        @HeaderParam(HttpHeaders.AUTHORIZATION) String auth) {
         E.checkArgument(StringUtils.isNotEmpty(auth),
                         "Request header Authorization must not be null");
-        LOG.debug("Graph [{}] user logout: {}", graph, auth);
+        LOG.debug("user logout: {}", auth);
 
         if (!auth.startsWith(AuthenticationFilter.BEARER_TOKEN_PREFIX)) {
             throw new BadRequestException("Only HTTP Bearer authentication is 
supported");
@@ -108,12 +103,10 @@ public class LoginAPI extends API {
     @Consumes(APPLICATION_JSON)
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String verifyToken(@Context GraphManager manager,
-                              @PathParam("graphspace") String graphSpace,
-                              @PathParam("graph") String graph,
                               @HeaderParam(HttpHeaders.AUTHORIZATION) String 
token) {
         E.checkArgument(StringUtils.isNotEmpty(token),
                         "Request header Authorization must not be null");
-        LOG.debug("Graph [{}] get user: {}", graph, token);
+        LOG.debug("get user: {}", token);
 
         if (!token.startsWith(AuthenticationFilter.BEARER_TOKEN_PREFIX)) {
             throw new BadRequestException("Only HTTP Bearer authentication is 
supported");
@@ -122,8 +115,7 @@ public class LoginAPI extends API {
         token = 
token.substring(AuthenticationFilter.BEARER_TOKEN_PREFIX.length());
         UserWithRole userWithRole = manager.authManager().validateUser(token);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
-        return manager.serializer(g)
+        return manager.serializer()
                       .writeMap(ImmutableMap.of(AuthConstant.TOKEN_USER_NAME,
                                                 userWithRole.username(),
                                                 AuthConstant.TOKEN_USER_ID,
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ManagerAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ManagerAPI.java
new file mode 100644
index 000000000..6f5756b6d
--- /dev/null
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ManagerAPI.java
@@ -0,0 +1,279 @@
+/*
+ * Copyright 2017 HugeGraph Authors
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.hugegraph.api.auth;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.hugegraph.api.API;
+import org.apache.hugegraph.api.filter.StatusFilter;
+import org.apache.hugegraph.auth.AuthManager;
+import org.apache.hugegraph.auth.HugeGraphAuthProxy;
+import org.apache.hugegraph.auth.HugePermission;
+import org.apache.hugegraph.core.GraphManager;
+import org.apache.hugegraph.define.Checkable;
+import org.apache.hugegraph.util.E;
+import org.apache.hugegraph.util.Log;
+import org.slf4j.Logger;
+
+import com.codahale.metrics.annotation.Timed;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.collect.ImmutableMap;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.inject.Singleton;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Context;
+
+@Path("graphspaces/{graphspace}/auth/managers")
+@Singleton
+@Tag(name = "ManagerAPI")
+public class ManagerAPI extends API {
+
+    private static final Logger LOG = Log.logger(ManagerAPI.class);
+
+    @POST
+    @Timed
+    @StatusFilter.Status(StatusFilter.Status.CREATED)
+    @Consumes(APPLICATION_JSON)
+    @Produces(APPLICATION_JSON_WITH_CHARSET)
+    public String createManager(@Context GraphManager manager,
+                                @PathParam("graphspace") String graphSpace,
+                                JsonManager jsonManager) {
+        LOG.debug("Create manager: {}", jsonManager);
+        String user = jsonManager.user;
+        HugePermission type = jsonManager.type;
+        // graphSpace now comes from @PathParam instead of JsonManager
+
+        validType(type);
+        AuthManager authManager = manager.authManager();
+        validUser(authManager, user);
+
+        String creator = HugeGraphAuthProxy.getContext().user().username();
+        switch (type) {
+            case SPACE:
+                validGraphSpace(manager, graphSpace);
+                validPermission(
+                        hasAdminOrSpaceManagerPerm(manager, graphSpace, 
creator),
+                        creator, "manager.create");
+                if (authManager.isSpaceMember(graphSpace, user)) {
+                    authManager.deleteSpaceMember(graphSpace, user);
+                }
+                authManager.createSpaceManager(graphSpace, user);
+                break;
+            case SPACE_MEMBER:
+                validGraphSpace(manager, graphSpace);
+                validPermission(
+                        hasAdminOrSpaceManagerPerm(manager, graphSpace, 
creator),
+                        creator, "manager.create");
+                if (authManager.isSpaceManager(graphSpace, user)) {
+                    authManager.deleteSpaceManager(graphSpace, user);
+                }
+                authManager.createSpaceMember(graphSpace, user);
+                break;
+            case ADMIN:
+                validPermission(hasAdminPerm(manager, creator),
+                                creator, "manager.create");
+                authManager.createAdminManager(user);
+                break;
+            default:
+                throw new IllegalArgumentException("Invalid type");
+        }
+
+        return manager.serializer()
+                      .writeMap(ImmutableMap.of("user", user, "type", type,
+                                                "graphspace", graphSpace));
+    }
+
+    @DELETE
+    @Timed
+    @Consumes(APPLICATION_JSON)
+    public void delete(@Context GraphManager manager,
+                       @PathParam("graphspace") String graphSpace,
+                       @QueryParam("user") String user,
+                       @QueryParam("type") HugePermission type) {
+        LOG.debug("Delete graph manager: {} {} {}", user, type, graphSpace);
+        E.checkArgument(!"admin".equals(user) ||
+                        type != HugePermission.ADMIN,
+                        "User 'admin' can't be removed from ADMIN");
+
+        AuthManager authManager = manager.authManager();
+        validType(type);
+        validUser(authManager, user);
+        String actionUser = HugeGraphAuthProxy.getContext().user().username();
+
+        switch (type) {
+            case SPACE:
+                // only space manager and admin can delete user permission
+                validGraphSpace(manager, graphSpace);
+                validPermission(
+                        hasAdminOrSpaceManagerPerm(manager, graphSpace, 
actionUser),
+                        actionUser, "manager.delete");
+                authManager.deleteSpaceManager(graphSpace, user);
+                break;
+            case SPACE_MEMBER:
+                validGraphSpace(manager, graphSpace);
+                validPermission(
+                        hasAdminOrSpaceManagerPerm(manager, graphSpace, 
actionUser),
+                        actionUser, "manager.delete");
+                authManager.deleteSpaceMember(graphSpace, user);
+                break;
+            case ADMIN:
+                validPermission(
+                        hasAdminPerm(manager, actionUser),
+                        actionUser, "manager.delete");
+                authManager.deleteAdminManager(user);
+                break;
+            default:
+                throw new IllegalArgumentException("Invalid type");
+        }
+    }
+
+    @GET
+    @Timed
+    @Consumes(APPLICATION_JSON)
+    public String list(@Context GraphManager manager,
+                       @PathParam("graphspace") String graphSpace,
+                       @QueryParam("type") HugePermission type) {
+        LOG.debug("list graph manager: {} {}", type, graphSpace);
+
+        AuthManager authManager = manager.authManager();
+        validType(type);
+        List<String> adminManagers;
+        switch (type) {
+            case SPACE:
+                validGraphSpace(manager, graphSpace);
+                adminManagers = authManager.listSpaceManager(graphSpace);
+                break;
+            case SPACE_MEMBER:
+                validGraphSpace(manager, graphSpace);
+                adminManagers = authManager.listSpaceMember(graphSpace);
+                break;
+            case ADMIN:
+                adminManagers = authManager.listAdminManager();
+                break;
+            default:
+                throw new IllegalArgumentException("Invalid type");
+        }
+        return manager.serializer().writeList("admins", adminManagers);
+    }
+
+    @GET
+    @Timed
+    @Path("check")
+    @Consumes(APPLICATION_JSON)
+    public String checkRole(@Context GraphManager manager,
+                            @PathParam("graphspace") String graphSpace,
+                            @QueryParam("type") HugePermission type) {
+        LOG.debug("check if current user is graph manager: {} {}", type, 
graphSpace);
+
+        validType(type);
+        AuthManager authManager = manager.authManager();
+        String user = HugeGraphAuthProxy.getContext().user().username();
+
+        boolean result;
+        switch (type) {
+            case SPACE:
+                validGraphSpace(manager, graphSpace);
+                result = authManager.isSpaceManager(graphSpace, user);
+                break;
+            case SPACE_MEMBER:
+                validGraphSpace(manager, graphSpace);
+                result = authManager.isSpaceMember(graphSpace, user);
+                break;
+            case ADMIN:
+                result = authManager.isAdminManager(user);
+                break;
+            default:
+                throw new IllegalArgumentException("Invalid type");
+        }
+        return manager.serializer().writeMap(ImmutableMap.of("check", result));
+    }
+
+    @GET
+    @Timed
+    @Path("role")
+    @Consumes(APPLICATION_JSON)
+    public String getRolesInGs(@Context GraphManager manager,
+                               @PathParam("graphspace") String graphSpace,
+                               @QueryParam("user") String user) {
+        LOG.debug("get user [{}]'s role in graph space [{}]", user, 
graphSpace);
+        AuthManager authManager = manager.authManager();
+        List<HugePermission> result = new ArrayList<>();
+        validGraphSpace(manager, graphSpace);
+
+        if (authManager.isAdminManager(user)) {
+            result.add(HugePermission.ADMIN);
+        }
+        if (authManager.isSpaceManager(graphSpace, user)) {
+            result.add(HugePermission.SPACE);
+        }
+        if (authManager.isSpaceMember(graphSpace, user)) {
+            result.add(HugePermission.SPACE_MEMBER);
+        }
+        if (result.isEmpty()) {
+            result.add(HugePermission.NONE);
+        }
+        return manager.serializer().writeMap(
+                ImmutableMap.of("user", user, "graphspace", graphSpace, 
"roles",
+                                result));
+    }
+
+    private void validUser(AuthManager authManager, String user) {
+        E.checkArgument(authManager.findUser(user) != null ||
+                        authManager.findGroup(user) != null,
+                        "The user or group is not exist");
+    }
+
+    private void validType(HugePermission type) {
+        E.checkArgument(type == HugePermission.SPACE ||
+                        type == HugePermission.SPACE_MEMBER ||
+                        type == HugePermission.ADMIN,
+                        "The type must be in [SPACE, SPACE_MEMBER, ADMIN]");
+    }
+
+    private void validGraphSpace(GraphManager manager, String graphSpace) {
+        E.checkArgument(manager.graphSpace(graphSpace) != null,
+                        "The graph space is not exist");
+    }
+
+    private static class JsonManager implements Checkable {
+
+        @JsonProperty("user")
+        private String user;
+        @JsonProperty("type")
+        private HugePermission type;
+
+        @Override
+        public void checkCreate(boolean isBatch) {
+        }
+
+        @Override
+        public void checkUpdate() {
+        }
+    }
+}
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ProjectAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ProjectAPI.java
index 97bf81e58..229903c13 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ProjectAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ProjectAPI.java
@@ -23,7 +23,6 @@ import java.util.Set;
 
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang.StringUtils;
-import org.apache.hugegraph.HugeGraph;
 import org.apache.hugegraph.api.API;
 import org.apache.hugegraph.api.filter.StatusFilter.Status;
 import org.apache.hugegraph.auth.AuthManager;
@@ -54,7 +53,7 @@ import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.Context;
 
-@Path("graphspaces/{graphspace}/graphs/{graph}/auth/projects")
+@Path("graphspaces/{graphspace}/auth/projects")
 @Singleton
 @Tag(name = "ProjectAPI")
 public class ProjectAPI extends API {
@@ -70,12 +69,10 @@ public class ProjectAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String create(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          JsonProject jsonProject) {
-        LOG.debug("Graph [{}] create project: {}", graph, jsonProject);
+        LOG.debug("GraphSpace [{}] create project: {}", graphSpace, 
jsonProject);
         checkCreatingBody(jsonProject);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeProject project = jsonProject.build();
         Id projectId = manager.authManager().createProject(project);
         /*
@@ -83,7 +80,7 @@ public class ProjectAPI extends API {
          * created
          */
         project = manager.authManager().getProject(projectId);
-        return manager.serializer(g).writeAuthElement(project);
+        return manager.serializer().writeAuthElement(project);
     }
 
     @PUT
@@ -93,15 +90,13 @@ public class ProjectAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String update(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          @PathParam("id") String id,
                          @QueryParam("action") String action,
                          JsonProject jsonProject) {
-        LOG.debug("Graph [{}] update {} project: {}", graph, action,
+        LOG.debug("GraphSpace [{}] update {} project: {}", graphSpace, action,
                   jsonProject);
         checkUpdatingBody(jsonProject);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeProject project;
         Id projectId = UserAPI.parseId(id);
         AuthManager authManager = manager.authManager();
@@ -124,7 +119,7 @@ public class ProjectAPI extends API {
             project = jsonProject.buildUpdateDescription(project);
         }
         authManager.updateProject(project);
-        return manager.serializer(g).writeAuthElement(project);
+        return manager.serializer().writeAuthElement(project);
     }
 
     @GET
@@ -132,14 +127,12 @@ public class ProjectAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String list(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @QueryParam("limit") @DefaultValue("100") long limit) {
-        LOG.debug("Graph [{}] list project", graph);
+        LOG.debug("GraphSpace [{}] list project", graphSpace);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         List<HugeProject> projects = manager.authManager()
                                             .listAllProject(limit);
-        return manager.serializer(g).writeAuthElements("projects", projects);
+        return manager.serializer().writeAuthElements("projects", projects);
     }
 
     @GET
@@ -148,18 +141,16 @@ public class ProjectAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String get(@Context GraphManager manager,
                       @PathParam("graphspace") String graphSpace,
-                      @PathParam("graph") String graph,
                       @PathParam("id") String id) {
-        LOG.debug("Graph [{}] get project: {}", graph, id);
+        LOG.debug("GraphSpace [{}] get project: {}", graphSpace, id);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeProject project;
         try {
             project = manager.authManager().getProject(UserAPI.parseId(id));
         } catch (NotFoundException e) {
             throw new IllegalArgumentException("Invalid project id: " + id);
         }
-        return manager.serializer(g).writeAuthElement(project);
+        return manager.serializer().writeAuthElement(project);
     }
 
     @DELETE
@@ -168,12 +159,9 @@ public class ProjectAPI extends API {
     @Consumes(APPLICATION_JSON)
     public void delete(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @PathParam("id") String id) {
-        LOG.debug("Graph [{}] delete project: {}", graph, id);
+        LOG.debug("GraphSpace [{}] delete project: {}", graphSpace, id);
 
-        @SuppressWarnings("unused") // just check if the graph exists
-        HugeGraph g = graph(manager, graphSpace, graph);
         try {
             manager.authManager().deleteProject(UserAPI.parseId(id));
         } catch (NotFoundException e) {
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/TargetAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/TargetAPI.java
index 8dfae357f..d59023f87 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/TargetAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/TargetAPI.java
@@ -20,7 +20,6 @@ package org.apache.hugegraph.api.auth;
 import java.util.List;
 import java.util.Map;
 
-import org.apache.hugegraph.HugeGraph;
 import org.apache.hugegraph.api.API;
 import org.apache.hugegraph.api.filter.StatusFilter.Status;
 import org.apache.hugegraph.auth.HugeTarget;
@@ -50,7 +49,7 @@ import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.Context;
 
-@Path("graphspaces/{graphspace}/graphs/{graph}/auth/targets")
+@Path("graphspaces/{graphspace}/auth/targets")
 @Singleton
 @Tag(name = "TargetAPI")
 public class TargetAPI extends API {
@@ -64,15 +63,13 @@ public class TargetAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String create(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          JsonTarget jsonTarget) {
-        LOG.debug("Graph [{}] create target: {}", graph, jsonTarget);
+        LOG.debug("GraphSpace [{}] create target: {}", graphSpace, jsonTarget);
         checkCreatingBody(jsonTarget);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeTarget target = jsonTarget.build();
         target.id(manager.authManager().createTarget(target));
-        return manager.serializer(g).writeAuthElement(target);
+        return manager.serializer().writeAuthElement(target);
     }
 
     @PUT
@@ -82,13 +79,11 @@ public class TargetAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String update(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          @PathParam("id") String id,
                          JsonTarget jsonTarget) {
-        LOG.debug("Graph [{}] update target: {}", graph, jsonTarget);
+        LOG.debug("GraphSpace [{}] update target: {}", graphSpace, jsonTarget);
         checkUpdatingBody(jsonTarget);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeTarget target;
         try {
             target = manager.authManager().getTarget(UserAPI.parseId(id));
@@ -97,7 +92,7 @@ public class TargetAPI extends API {
         }
         target = jsonTarget.build(target);
         manager.authManager().updateTarget(target);
-        return manager.serializer(g).writeAuthElement(target);
+        return manager.serializer().writeAuthElement(target);
     }
 
     @GET
@@ -105,13 +100,11 @@ public class TargetAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String list(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @QueryParam("limit") @DefaultValue("100") long limit) {
-        LOG.debug("Graph [{}] list targets", graph);
+        LOG.debug("GraphSpace [{}] list targets", graphSpace);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         List<HugeTarget> targets = manager.authManager().listAllTargets(limit);
-        return manager.serializer(g).writeAuthElements("targets", targets);
+        return manager.serializer().writeAuthElements("targets", targets);
     }
 
     @GET
@@ -120,13 +113,11 @@ public class TargetAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String get(@Context GraphManager manager,
                       @PathParam("graphspace") String graphSpace,
-                      @PathParam("graph") String graph,
                       @PathParam("id") String id) {
-        LOG.debug("Graph [{}] get target: {}", graph, id);
+        LOG.debug("GraphSpace [{}] get target: {}", graphSpace, id);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeTarget target = 
manager.authManager().getTarget(UserAPI.parseId(id));
-        return manager.serializer(g).writeAuthElement(target);
+        return manager.serializer().writeAuthElement(target);
     }
 
     @DELETE
@@ -135,12 +126,9 @@ public class TargetAPI extends API {
     @Consumes(APPLICATION_JSON)
     public void delete(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @PathParam("id") String id) {
-        LOG.debug("Graph [{}] delete target: {}", graph, id);
+        LOG.debug("GraphSpace [{}] delete target: {}", graphSpace, id);
 
-        @SuppressWarnings("unused") // just check if the graph exists
-        HugeGraph g = graph(manager, graphSpace, graph);
         try {
             manager.authManager().deleteTarget(UserAPI.parseId(id));
         } catch (NotFoundException e) {
@@ -185,6 +173,17 @@ public class TargetAPI extends API {
             return target;
         }
 
+        @Override
+        public String toString() {
+            return "JsonTarget{" +
+                   "name='" + name + '\'' +
+                   ", graph='" + graph + '\'' +
+                   ", url='" + url + '\'' +
+                   ", resources=" + resources +
+                   '}';
+        }
+
+
         @Override
         public void checkCreate(boolean isBatch) {
             E.checkArgumentNotNull(this.name,
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/UserAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/UserAPI.java
index f098508da..88fd60802 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/UserAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/UserAPI.java
@@ -20,7 +20,6 @@ package org.apache.hugegraph.api.auth;
 import java.util.List;
 
 import org.apache.commons.lang3.StringUtils;
-import org.apache.hugegraph.HugeGraph;
 import org.apache.hugegraph.api.API;
 import org.apache.hugegraph.api.filter.StatusFilter.Status;
 import org.apache.hugegraph.auth.HugeUser;
@@ -52,7 +51,7 @@ import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.Context;
 
-@Path("graphspaces/{graphspace}/graphs/{graph}/auth/users")
+@Path("graphspaces/{graphspace}/auth/users")
 @Singleton
 @Tag(name = "UserAPI")
 public class UserAPI extends API {
@@ -66,15 +65,13 @@ public class UserAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String create(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          JsonUser jsonUser) {
-        LOG.debug("Graph [{}] create user: {}", graph, jsonUser);
+        LOG.debug("GraphSpace [{}] create user: {}", graphSpace, jsonUser);
         checkCreatingBody(jsonUser);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeUser user = jsonUser.build();
         user.id(manager.authManager().createUser(user));
-        return manager.serializer(g).writeAuthElement(user);
+        return manager.serializer().writeAuthElement(user);
     }
 
     @PUT
@@ -84,13 +81,11 @@ public class UserAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String update(@Context GraphManager manager,
                          @PathParam("graphspace") String graphSpace,
-                         @PathParam("graph") String graph,
                          @PathParam("id") String id,
                          JsonUser jsonUser) {
-        LOG.debug("Graph [{}] update user: {}", graph, jsonUser);
+        LOG.debug("GraphSpace [{}] update user: {}", graphSpace, jsonUser);
         checkUpdatingBody(jsonUser);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeUser user;
         try {
             user = manager.authManager().getUser(UserAPI.parseId(id));
@@ -99,7 +94,7 @@ public class UserAPI extends API {
         }
         user = jsonUser.build(user);
         manager.authManager().updateUser(user);
-        return manager.serializer(g).writeAuthElement(user);
+        return manager.serializer().writeAuthElement(user);
     }
 
     @GET
@@ -107,13 +102,11 @@ public class UserAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String list(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @QueryParam("limit") @DefaultValue("100") long limit) {
-        LOG.debug("Graph [{}] list users", graph);
+        LOG.debug("GraphSpace [{}] list users", graphSpace);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         List<HugeUser> users = manager.authManager().listAllUsers(limit);
-        return manager.serializer(g).writeAuthElements("users", users);
+        return manager.serializer().writeAuthElements("users", users);
     }
 
     @GET
@@ -122,13 +115,11 @@ public class UserAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String get(@Context GraphManager manager,
                       @PathParam("graphspace") String graphSpace,
-                      @PathParam("graph") String graph,
                       @PathParam("id") String id) {
-        LOG.debug("Graph [{}] get user: {}", graph, id);
+        LOG.debug("GraphSpace [{}] get user: {}", graphSpace, id);
 
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeUser user = manager.authManager().getUser(IdGenerator.of(id));
-        return manager.serializer(g).writeAuthElement(user);
+        return manager.serializer().writeAuthElement(user);
     }
 
     @GET
@@ -137,12 +128,9 @@ public class UserAPI extends API {
     @Produces(APPLICATION_JSON_WITH_CHARSET)
     public String role(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @PathParam("id") String id) {
-        LOG.debug("Graph [{}] get user role: {}", graph, id);
+        LOG.debug("GraphSpace [{}] get user role: {}", graphSpace, id);
 
-        @SuppressWarnings("unused") // just check if the graph exists
-        HugeGraph g = graph(manager, graphSpace, graph);
         HugeUser user = manager.authManager().getUser(IdGenerator.of(id));
         return manager.authManager().rolePermission(user).toJson();
     }
@@ -153,12 +141,9 @@ public class UserAPI extends API {
     @Consumes(APPLICATION_JSON)
     public void delete(@Context GraphManager manager,
                        @PathParam("graphspace") String graphSpace,
-                       @PathParam("graph") String graph,
                        @PathParam("id") String id) {
-        LOG.debug("Graph [{}] delete user: {}", graph, id);
+        LOG.debug("GraphSpace [{}] delete user: {}", graphSpace, id);
 
-        @SuppressWarnings("unused") // just check if the graph exists
-        HugeGraph g = graph(manager, graphSpace, graph);
         try {
             manager.authManager().deleteUser(IdGenerator.of(id));
         } catch (NotFoundException e) {
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/graph/EdgeAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/graph/EdgeAPI.java
index 279c9c0e9..4afc2fec9 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/graph/EdgeAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/graph/EdgeAPI.java
@@ -114,7 +114,7 @@ public class EdgeAPI extends BatchAPI {
                                      jsonEdge.properties());
         });
 
-        return manager.serializer(g).writeEdge(edge);
+        return manager.serializer().writeEdge(edge);
     }
 
     @POST
@@ -155,7 +155,7 @@ public class EdgeAPI extends BatchAPI {
                 Edge edge = srcVertex.addEdge(jsonEdge.label, tgtVertex, 
jsonEdge.properties());
                 ids.add((Id) edge.id());
             }
-            return manager.serializer(g).writeIds(ids);
+            return manager.serializer().writeIds(ids);
         });
     }
 
@@ -213,7 +213,7 @@ public class EdgeAPI extends BatchAPI {
             });
 
             // If return ids, the ids.size() maybe different with the origins'
-            return manager.serializer(g).writeEdges(edges.iterator(), false);
+            return manager.serializer().writeEdges(edges.iterator(), false);
         });
     }
 
@@ -255,7 +255,7 @@ public class EdgeAPI extends BatchAPI {
         }
 
         commit(g, () -> updateProperties(edge, jsonEdge, append));
-        return manager.serializer(g).writeEdge(edge);
+        return manager.serializer().writeEdge(edge);
     }
 
     @GET
@@ -329,7 +329,7 @@ public class EdgeAPI extends BatchAPI {
         }
 
         try {
-            return manager.serializer(g).writeEdges(traversal, page != null);
+            return manager.serializer().writeEdges(traversal, page != null);
         } finally {
             if (g.tx().isOpen()) {
                 g.tx().close();
@@ -352,7 +352,7 @@ public class EdgeAPI extends BatchAPI {
         HugeGraph g = graph(manager, graphSpace, graph);
         try {
             Edge edge = g.edge(id);
-            return manager.serializer(g).writeEdge(edge);
+            return manager.serializer().writeEdge(edge);
         } finally {
             if (g.tx().isOpen()) {
                 g.tx().close();
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/graph/VertexAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/graph/VertexAPI.java
index f2c79f3bc..0f24a5ec4 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/graph/VertexAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/graph/VertexAPI.java
@@ -94,7 +94,7 @@ public class VertexAPI extends BatchAPI {
         HugeGraph g = graph(manager, graphSpace, graph);
         Vertex vertex = commit(g, () -> g.addVertex(jsonVertex.properties()));
 
-        return manager.serializer(g).writeVertex(vertex);
+        return manager.serializer().writeVertex(vertex);
     }
 
     @POST
@@ -121,7 +121,7 @@ public class VertexAPI extends BatchAPI {
             for (JsonVertex vertex : jsonVertices) {
                 ids.add((Id) g.addVertex(vertex.properties()).id());
             }
-            return manager.serializer(g).writeIds(ids);
+            return manager.serializer().writeIds(ids);
         });
     }
 
@@ -178,7 +178,7 @@ public class VertexAPI extends BatchAPI {
             });
 
             // If return ids, the ids.size() maybe different with the origins'
-            return manager.serializer(g).writeVertices(vertices.iterator(), 
false);
+            return manager.serializer().writeVertices(vertices.iterator(), 
false);
         });
     }
 
@@ -215,7 +215,7 @@ public class VertexAPI extends BatchAPI {
 
         commit(g, () -> updateProperties(vertex, jsonVertex, append));
 
-        return manager.serializer(g).writeVertex(vertex);
+        return manager.serializer().writeVertex(vertex);
     }
 
     @GET
@@ -272,7 +272,7 @@ public class VertexAPI extends BatchAPI {
         }
 
         try {
-            return manager.serializer(g).writeVertices(traversal, page != 
null);
+            return manager.serializer().writeVertices(traversal, page != null);
         } finally {
             if (g.tx().isOpen()) {
                 g.tx().close();
@@ -295,7 +295,7 @@ public class VertexAPI extends BatchAPI {
         HugeGraph g = graph(manager, graphSpace, graph);
         try {
             Vertex vertex = g.vertex(id);
-            return manager.serializer(g).writeVertex(vertex);
+            return manager.serializer().writeVertex(vertex);
         } finally {
             if (g.tx().isOpen()) {
                 g.tx().close();
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/EdgeLabelAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/EdgeLabelAPI.java
index 09d7fe542..0c10827a1 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/EdgeLabelAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/EdgeLabelAPI.java
@@ -84,7 +84,7 @@ public class EdgeLabelAPI extends API {
         HugeGraph g = graph(manager, graphSpace, graph);
         EdgeLabel.Builder builder = jsonEdgeLabel.convert2Builder(g);
         EdgeLabel edgeLabel = builder.create();
-        return manager.serializer(g).writeEdgeLabel(edgeLabel);
+        return manager.serializer().writeEdgeLabel(edgeLabel);
     }
 
     @PUT
@@ -114,7 +114,7 @@ public class EdgeLabelAPI extends API {
         HugeGraph g = graph(manager, graphSpace, graph);
         EdgeLabel.Builder builder = jsonEdgeLabel.convert2Builder(g);
         EdgeLabel edgeLabel = append ? builder.append() : builder.eliminate();
-        return manager.serializer(g).writeEdgeLabel(edgeLabel);
+        return manager.serializer().writeEdgeLabel(edgeLabel);
     }
 
     @GET
@@ -143,7 +143,7 @@ public class EdgeLabelAPI extends API {
                 labels.add(g.schema().getEdgeLabel(name));
             }
         }
-        return manager.serializer(g).writeEdgeLabels(labels);
+        return manager.serializer().writeEdgeLabels(labels);
     }
 
     @GET
@@ -160,7 +160,7 @@ public class EdgeLabelAPI extends API {
 
         HugeGraph g = graph(manager, graphSpace, graph);
         EdgeLabel edgeLabel = g.schema().getEdgeLabel(name);
-        return manager.serializer(g).writeEdgeLabel(edgeLabel);
+        return manager.serializer().writeEdgeLabel(edgeLabel);
     }
 
     @DELETE
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/IndexLabelAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/IndexLabelAPI.java
index f2a05d406..9e60b0107 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/IndexLabelAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/IndexLabelAPI.java
@@ -85,7 +85,7 @@ public class IndexLabelAPI extends API {
         IndexLabel.Builder builder = jsonIndexLabel.convert2Builder(g);
         SchemaElement.TaskWithSchema il = builder.createWithTask();
         il.indexLabel(mapIndexLabel(il.indexLabel()));
-        return manager.serializer(g).writeTaskWithSchema(il);
+        return manager.serializer().writeTaskWithSchema(il);
     }
 
     @PUT
@@ -112,7 +112,7 @@ public class IndexLabelAPI extends API {
         HugeGraph g = graph(manager, graphSpace, graph);
         IndexLabel.Builder builder = jsonIndexLabel.convert2Builder(g);
         IndexLabel indexLabel = append ? builder.append() : 
builder.eliminate();
-        return 
manager.serializer(g).writeIndexlabel(mapIndexLabel(indexLabel));
+        return manager.serializer().writeIndexlabel(mapIndexLabel(indexLabel));
     }
 
     @GET
@@ -141,7 +141,7 @@ public class IndexLabelAPI extends API {
                 labels.add(g.schema().getIndexLabel(name));
             }
         }
-        return manager.serializer(g).writeIndexlabels(mapIndexLabels(labels));
+        return manager.serializer().writeIndexlabels(mapIndexLabels(labels));
     }
 
     @GET
@@ -158,7 +158,7 @@ public class IndexLabelAPI extends API {
 
         HugeGraph g = graph(manager, graphSpace, graph);
         IndexLabel indexLabel = g.schema().getIndexLabel(name);
-        return 
manager.serializer(g).writeIndexlabel(mapIndexLabel(indexLabel));
+        return manager.serializer().writeIndexlabel(mapIndexLabel(indexLabel));
     }
 
     @DELETE
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/PropertyKeyAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/PropertyKeyAPI.java
index c95e25339..a23fa3e80 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/PropertyKeyAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/PropertyKeyAPI.java
@@ -87,7 +87,7 @@ public class PropertyKeyAPI extends API {
         HugeGraph g = graph(manager, graphSpace, graph);
         PropertyKey.Builder builder = jsonPropertyKey.convert2Builder(g);
         SchemaElement.TaskWithSchema pk = builder.createWithTask();
-        return manager.serializer(g).writeTaskWithSchema(pk);
+        return manager.serializer().writeTaskWithSchema(pk);
     }
 
     @PUT
@@ -121,7 +121,7 @@ public class PropertyKeyAPI extends API {
             Id id = g.clearPropertyKey(propertyKey);
             SchemaElement.TaskWithSchema pk =
                     new SchemaElement.TaskWithSchema(propertyKey, id);
-            return manager.serializer(g).writeTaskWithSchema(pk);
+            return manager.serializer().writeTaskWithSchema(pk);
         }
 
         // Parse action parameter
@@ -133,7 +133,7 @@ public class PropertyKeyAPI extends API {
                                   builder.eliminate();
         SchemaElement.TaskWithSchema pk =
                 new SchemaElement.TaskWithSchema(propertyKey, 
IdGenerator.ZERO);
-        return manager.serializer(g).writeTaskWithSchema(pk);
+        return manager.serializer().writeTaskWithSchema(pk);
     }
 
     @GET
@@ -162,7 +162,7 @@ public class PropertyKeyAPI extends API {
                 propKeys.add(g.schema().getPropertyKey(name));
             }
         }
-        return manager.serializer(g).writePropertyKeys(propKeys);
+        return manager.serializer().writePropertyKeys(propKeys);
     }
 
     @GET
@@ -179,7 +179,7 @@ public class PropertyKeyAPI extends API {
 
         HugeGraph g = graph(manager, graphSpace, graph);
         PropertyKey propertyKey = g.schema().getPropertyKey(name);
-        return manager.serializer(g).writePropertyKey(propertyKey);
+        return manager.serializer().writePropertyKey(propertyKey);
     }
 
     @DELETE
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/SchemaAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/SchemaAPI.java
index 0fb0b1cd1..07968925e 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/SchemaAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/SchemaAPI.java
@@ -65,6 +65,6 @@ public class SchemaAPI extends API {
         schemaMap.put("edgelabels", schema.getEdgeLabels());
         schemaMap.put("indexlabels", schema.getIndexLabels());
 
-        return manager.serializer(g).writeMap(schemaMap);
+        return manager.serializer().writeMap(schemaMap);
     }
 }
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/VertexLabelAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/VertexLabelAPI.java
index a845be7a6..70f448f28 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/VertexLabelAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/VertexLabelAPI.java
@@ -83,7 +83,7 @@ public class VertexLabelAPI extends API {
         HugeGraph g = graph(manager, graphSpace, graph);
         VertexLabel.Builder builder = jsonVertexLabel.convert2Builder(g);
         VertexLabel vertexLabel = builder.create();
-        return manager.serializer(g).writeVertexLabel(vertexLabel);
+        return manager.serializer().writeVertexLabel(vertexLabel);
     }
 
     @PUT
@@ -115,7 +115,7 @@ public class VertexLabelAPI extends API {
         VertexLabel vertexLabel = append ?
                                   builder.append() :
                                   builder.eliminate();
-        return manager.serializer(g).writeVertexLabel(vertexLabel);
+        return manager.serializer().writeVertexLabel(vertexLabel);
     }
 
     @GET
@@ -144,7 +144,7 @@ public class VertexLabelAPI extends API {
                 labels.add(g.schema().getVertexLabel(name));
             }
         }
-        return manager.serializer(g).writeVertexLabels(labels);
+        return manager.serializer().writeVertexLabels(labels);
     }
 
     @GET
@@ -161,7 +161,7 @@ public class VertexLabelAPI extends API {
 
         HugeGraph g = graph(manager, graphSpace, graph);
         VertexLabel vertexLabel = g.schema().getVertexLabel(name);
-        return manager.serializer(g).writeVertexLabel(vertexLabel);
+        return manager.serializer().writeVertexLabel(vertexLabel);
     }
 
     @DELETE
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/CountAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/CountAPI.java
index 6e4a1fe17..e14f0a43d 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/CountAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/CountAPI.java
@@ -85,7 +85,7 @@ public class CountAPI extends API {
         long count = traverser.count(sourceId, steps, 
request.containsTraversed,
                                      request.dedupSize);
 
-        return manager.serializer(g).writeMap(ImmutableMap.of("count", count));
+        return manager.serializer().writeMap(ImmutableMap.of("count", count));
     }
 
     private static List<EdgeStep> steps(HugeGraph graph, CountRequest request) 
{
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/EdgesAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/EdgesAPI.java
index 4aea4fb1b..b3d718d4f 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/EdgesAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/EdgesAPI.java
@@ -76,7 +76,7 @@ public class EdgesAPI extends API {
         HugeGraph g = graph(manager, graphSpace, graph);
 
         Iterator<Edge> edges = g.edges(ids);
-        return manager.serializer(g).writeEdges(edges, false);
+        return manager.serializer().writeEdges(edges, false);
     }
 
     @GET
@@ -93,7 +93,7 @@ public class EdgesAPI extends API {
 
         HugeGraph g = graph(manager, graphSpace, graph);
         List<Shard> shards = g.metadata(HugeType.EDGE_OUT, "splits", 
splitSize);
-        return manager.serializer(g).writeList("shards", shards);
+        return manager.serializer().writeList("shards", shards);
     }
 
     @GET
@@ -122,6 +122,6 @@ public class EdgesAPI extends API {
         }
         Iterator<Edge> edges = g.edges(query);
 
-        return manager.serializer(g).writeEdges(edges, query.paging());
+        return manager.serializer().writeEdges(edges, query.paging());
     }
 }
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/NeighborRankAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/NeighborRankAPI.java
index dbefbad55..08396aa0b 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/NeighborRankAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/NeighborRankAPI.java
@@ -87,7 +87,7 @@ public class NeighborRankAPI extends API {
         traverser = new NeighborRankTraverser(g, request.alpha,
                                               request.capacity);
         List<Map<Id, Double>> ranks = traverser.neighborRank(sourceId, steps);
-        return manager.serializer(g).writeList("ranks", ranks);
+        return manager.serializer().writeList("ranks", ranks);
     }
 
     private static List<NeighborRankTraverser.Step> steps(HugeGraph graph,
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/PersonalRankAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/PersonalRankAPI.java
index c2b2db514..45393e2a2 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/PersonalRankAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/PersonalRankAPI.java
@@ -102,7 +102,7 @@ public class PersonalRankAPI extends API {
         Map<Id, Double> ranks = traverser.personalRank(sourceId, request.label,
                                                        request.withLabel);
         ranks = HugeTraverser.topN(ranks, request.sorted, request.limit);
-        return manager.serializer(g).writeMap(ranks);
+        return manager.serializer().writeMap(ranks);
     }
 
     private static class RankRequest {
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/VerticesAPI.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/VerticesAPI.java
index 4963b87db..762bbf81c 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/VerticesAPI.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/traversers/VerticesAPI.java
@@ -76,7 +76,7 @@ public class VerticesAPI extends API {
         HugeGraph g = graph(manager, graphSpace, graph);
 
         Iterator<Vertex> vertices = g.vertices(ids);
-        return manager.serializer(g).writeVertices(vertices, false);
+        return manager.serializer().writeVertices(vertices, false);
     }
 
     @GET
@@ -93,7 +93,7 @@ public class VerticesAPI extends API {
 
         HugeGraph g = graph(manager, graphSpace, graph);
         List<Shard> shards = g.metadata(HugeType.VERTEX, "splits", splitSize);
-        return manager.serializer(g).writeList("shards", shards);
+        return manager.serializer().writeList("shards", shards);
     }
 
     @GET
@@ -122,6 +122,6 @@ public class VerticesAPI extends API {
         }
         Iterator<Vertex> vertices = g.vertices(query);
 
-        return manager.serializer(g).writeVertices(vertices, query.paging());
+        return manager.serializer().writeVertices(vertices, query.paging());
     }
 }
diff --git 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/HugeGraphAuthProxy.java
 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/HugeGraphAuthProxy.java
index a4769bb4d..c987aef4a 100644
--- 
a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/HugeGraphAuthProxy.java
+++ 
b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/HugeGraphAuthProxy.java
@@ -1559,7 +1559,6 @@ public final class HugeGraphAuthProxy implements 
HugeGraph {
         @Override
         public Id createGroup(HugeGroup group) {
             this.updateCreator(group);
-            verifyUserPermission(HugePermission.WRITE, group);
             this.invalidRoleCache();
             return this.authManager.createGroup(group);
         }
@@ -1567,35 +1566,29 @@ public final class HugeGraphAuthProxy implements 
HugeGraph {
         @Override
         public Id updateGroup(HugeGroup group) {
             this.updateCreator(group);
-            verifyUserPermission(HugePermission.WRITE, group);
             this.invalidRoleCache();
             return this.authManager.updateGroup(group);
         }
 
         @Override
         public HugeGroup deleteGroup(Id id) {
-            verifyUserPermission(HugePermission.DELETE,
-                                 this.authManager.getGroup(id));
             this.invalidRoleCache();
             return this.authManager.deleteGroup(id);
         }
 
         @Override
         public HugeGroup getGroup(Id id) {
-            return verifyUserPermission(HugePermission.READ,
-                                        this.authManager.getGroup(id));
+            return this.authManager.getGroup(id);
         }
 
         @Override
         public List<HugeGroup> listGroups(List<Id> ids) {
-            return verifyUserPermission(HugePermission.READ,
-                                        this.authManager.listGroups(ids));
+            return this.authManager.listGroups(ids);
         }
 
         @Override
         public List<HugeGroup> listAllGroups(long limit) {
-            return verifyUserPermission(HugePermission.READ,
-                                        this.authManager.listAllGroups(limit));
+            return this.authManager.listAllGroups(limit);
         }
 
         @Override
diff --git 
a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/LoginApiTest.java
 
b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/LoginApiTest.java
index 3721d37cd..0b6df9343 100644
--- 
a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/LoginApiTest.java
+++ 
b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/LoginApiTest.java
@@ -35,8 +35,8 @@ import jakarta.ws.rs.core.Response;
 
 public class LoginApiTest extends BaseApiTest {
 
-    private static final String PATH = 
"graphspaces/DEFAULT/graphs/hugegraph/auth";
-    private static final String USER_PATH = 
"graphspaces/DEFAULT/graphs/hugegraph/auth/users";
+    private static final String PATH = "/auth";
+    private static final String USER_PATH = "graphspaces/DEFAULT/auth/users";
     private String userId4Test;
 
     @Before
diff --git 
a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/ManagerApiTest.java
 
b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/ManagerApiTest.java
index 9c4d6eda8..afae0c94a 100644
--- 
a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/ManagerApiTest.java
+++ 
b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/ManagerApiTest.java
@@ -38,7 +38,7 @@ import jakarta.ws.rs.core.Response;
 
 public class ManagerApiTest extends BaseApiTest {
 
-    private static final String USER_PATH = 
"graphspaces/DEFAULT/graphs/hugegraph/auth/users";
+    private static final String USER_PATH = "graphspaces/DEFAULT/auth/users";
     private static final int NO_LIMIT = -1;
 
     // Helper method to build manager path with graphspace
diff --git 
a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/ProjectApiTest.java
 
b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/ProjectApiTest.java
index 6f7ffe821..90e6fc5a1 100644
--- 
a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/ProjectApiTest.java
+++ 
b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/ProjectApiTest.java
@@ -37,7 +37,7 @@ import jakarta.ws.rs.core.Response;
 
 public class ProjectApiTest extends BaseApiTest {
 
-    private static final String PATH = 
"graphspaces/DEFAULT/graphs/hugegraph/auth/projects";
+    private static final String PATH = "graphspaces/DEFAULT/auth/projects";
 
     @BeforeClass
     public static void setUpClass() {
diff --git 
a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/UserApiTest.java
 
b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/UserApiTest.java
index dd4534b06..9200026d4 100644
--- 
a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/UserApiTest.java
+++ 
b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/api/UserApiTest.java
@@ -32,7 +32,7 @@ import jakarta.ws.rs.core.Response;
 
 public class UserApiTest extends BaseApiTest {
 
-    private static final String PATH = 
"graphspaces/DEFAULT/graphs/hugegraph/auth/users";
+    private static final String PATH = "graphspaces/DEFAULT/auth/users";
     private static final int NO_LIMIT = -1;
 
     @Override

Reply via email to