diff --git a/frontend/web/package.json b/frontend/web/package.json
index d4dcf541..7fc080d2 100644
--- a/frontend/web/package.json
+++ b/frontend/web/package.json
@@ -19,6 +19,7 @@
     "@radix-ui/react-radio-group": "^1.4.2",
     "@radix-ui/react-select": "^2.3.1",
     "@radix-ui/react-slot": "^1.3.0",
+    "@radix-ui/react-switch": "^1.3.3",
     "@radix-ui/react-tabs": "^1.1.17",
     "@radix-ui/react-toast": "^1.2.18",
     "@tanstack/react-query": "^5.101.1",
diff --git a/frontend/web/pnpm-lock.yaml b/frontend/web/pnpm-lock.yaml
index d636f327..113de175 100644
--- a/frontend/web/pnpm-lock.yaml
+++ b/frontend/web/pnpm-lock.yaml
@@ -35,6 +35,9 @@ importers:
       '@radix-ui/react-slot':
         specifier: ^1.3.0
         version: 1.3.0(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-switch':
+        specifier: ^1.3.3
+        version: 1.3.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-tabs':
         specifier: ^1.1.17
         version: 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -819,6 +822,19 @@ packages:
       '@types/react':
         optional: true
 
+  '@radix-ui/react-switch@1.3.3':
+    resolution: {integrity: sha512-1+mlB4/lxJfk5tgJ4g+R5mUCbRpPE1T9+UsEyeLYbGgMtwiMgmuTnfKz4Mw1nHALHjuwyxw4MLd4cSHn6pNSlQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
   '@radix-ui/react-tabs@1.1.17':
     resolution: {integrity: sha512-nRyXnrAVCwjeXcHbvEbLS6ndbTeKHG1RqCP4A8Gw5L4cemDzPXdD8rAmr6wet0v57R69wGvuIIsFjHSVkZiMzQ==}
     peerDependencies:
@@ -2814,6 +2830,21 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.17
 
+  '@radix-ui/react-switch@1.3.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.5
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-previous': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+    optionalDependencies:
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+
   '@radix-ui/react-tabs@1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.5
diff --git a/frontend/web/src/components/ui/edi-editor-pane.tsx b/frontend/web/src/components/ui/edi-editor-pane.tsx
index 27e2ecf9..87030923 100644
--- a/frontend/web/src/components/ui/edi-editor-pane.tsx
+++ b/frontend/web/src/components/ui/edi-editor-pane.tsx
@@ -11,9 +11,26 @@ export interface EdiEditorPaneProps {
   cornerPlaceholder?: string;
   className?: string;
   acceptedFileExtensions?: string;
+  extraActions?: React.ReactNode;
+  fontSize?: number;
+  showCertDetected?: boolean;
+  /** When false, suppresses the big "Drag and drop" heading. Buttons are always shown. */
+  showEmptyState?: boolean;
 }
 
-export function EdiEditorPane({ value, onChange, language = 'edi', placeholder, cornerPlaceholder, className = '', acceptedFileExtensions = ".edi,.json,.txt,.x12" }: EdiEditorPaneProps) {
+export function EdiEditorPane({
+  value,
+  onChange,
+  language = 'edi',
+  placeholder,
+  cornerPlaceholder,
+  className = '',
+  acceptedFileExtensions = '.edi,.json,.txt,.x12',
+  extraActions,
+  fontSize = 13,
+  showCertDetected = false,
+  showEmptyState = true,
+}: EdiEditorPaneProps) {
   const [isDragging, setIsDragging] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
@@ -60,6 +77,35 @@ export function EdiEditorPane({ value, onChange, language = 'edi', placeholder,
     registerEdiLanguageAndTheme(monaco);
   };
 
+  // Monaco's content area intercepts drag events, so we attach listeners
+  // directly to its DOM node to ensure drag-and-drop always works.
+  const handleEditorMount = (editor: any) => {
+    const domNode = editor.getDomNode() as HTMLElement | null;
+    if (!domNode) return;
+
+    const onDragOver = (e: DragEvent) => { e.preventDefault(); setIsDragging(true); };
+    const onDragLeave = (e: DragEvent) => { e.preventDefault(); setIsDragging(false); };
+    const onDrop = async (e: DragEvent) => {
+      e.preventDefault();
+      e.stopPropagation();
+      setIsDragging(false);
+      if (e.dataTransfer?.files && e.dataTransfer.files.length > 0) {
+        await applyFile(e.dataTransfer.files[0]);
+      }
+    };
+
+    domNode.addEventListener('dragover', onDragOver);
+    domNode.addEventListener('dragleave', onDragLeave);
+    domNode.addEventListener('drop', onDrop);
+
+    // Cleanup handled via Monaco's own disposal lifecycle
+    editor.onDidDispose(() => {
+      domNode.removeEventListener('dragover', onDragOver);
+      domNode.removeEventListener('dragleave', onDragLeave);
+      domNode.removeEventListener('drop', onDrop);
+    });
+  };
+
   return (
     <div
       className={`flex-1 p-0 bg-white min-h-[250px] flex flex-col relative group ${className}`}
@@ -67,6 +113,7 @@ export function EdiEditorPane({ value, onChange, language = 'edi', placeholder,
       onDragLeave={handleDragLeave}
       onDrop={handleDrop}
     >
+      {/* Error banner */}
       {error && (
         <div className="absolute top-2 right-2 left-2 z-30 p-3 bg-red-50 border border-red-200 text-red-700 text-sm rounded-md shadow-sm flex items-center justify-between">
           <span>{error}</span>
@@ -75,29 +122,43 @@ export function EdiEditorPane({ value, onChange, language = 'edi', placeholder,
           </button>
         </div>
       )}
+
+      {/* Certificate detected — bottom status bar (when value present) */}
+      {!error && value && showCertDetected && value.includes('-----BEGIN CERTIFICATE-----') && value.includes('-----END CERTIFICATE-----') && (
+        <div className="absolute bottom-0 left-0 right-0 z-30 px-4 py-2 bg-green-50 border-t border-green-200 text-green-700 text-xs font-semibold flex items-center gap-2 pointer-events-none">
+          <svg className="w-3.5 h-3.5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M5 13l4 4L19 7" />
+          </svg>
+          Certificate detected — ready to save
+        </div>
+      )}
+
+      {/* Drag-over full-screen overlay */}
       {isDragging && (
-        <div className="absolute inset-0 bg-indigo-50/90 z-20 flex flex-col items-center justify-center border-2 border-indigo-400 border-dashed m-2 rounded-lg backdrop-blur-sm transition-all duration-200">
+        <div className="absolute inset-0 bg-indigo-50/90 z-20 flex flex-col items-center justify-center border-2 border-indigo-400 border-dashed m-2 rounded-lg backdrop-blur-sm transition-all duration-200 pointer-events-none">
           <UploadCloud className="w-10 h-10 text-indigo-500 mb-3 animate-bounce" />
           <span className="text-indigo-700 font-semibold text-lg tracking-tight">Drop file to load</span>
         </div>
       )}
-      {!value && !isDragging && (
-        <div className="absolute inset-0 z-10 flex flex-col items-center justify-center p-6 text-center pointer-events-none">
-          {cornerPlaceholder && (
-            <div className="absolute top-4 left-6 text-xs text-slate-400 font-mono text-left whitespace-pre-wrap pointer-events-none opacity-90">
-              {cornerPlaceholder}
-            </div>
-          )}
-          <UploadCloud className="w-12 h-12 text-slate-200 mb-4" />
-          <h3 className="text-lg font-medium text-slate-900 mb-1">Drag and drop your file here</h3>
-          <p className="text-sm text-slate-500 mb-6">{placeholder || `or upload a file, or click anywhere to paste raw ${language.toUpperCase()}`}</p>
-          <label className="pointer-events-auto cursor-pointer inline-flex items-center justify-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-indigo-600 hover:bg-indigo-700 transition-colors">
-            Upload File
-            <input type="file" className="hidden" accept={acceptedFileExtensions} onChange={handleFileUpload} />
-          </label>
+
+      {/* Corner placeholder (e.g. PEM hint) */}
+      {!value && !isDragging && cornerPlaceholder && (
+        <div className="absolute top-4 left-6 z-10 text-xs text-slate-400 font-mono text-left whitespace-pre-wrap pointer-events-none opacity-90">
+          {cornerPlaceholder}
+        </div>
+      )}
+
+      {/* Optional "Drag and drop" heading for the EDI editor */}
+      {showEmptyState && !value && !isDragging && (
+        <div className="absolute inset-x-0 top-1/3 z-10 flex flex-col items-center gap-1 pointer-events-none text-center px-6">
+          <UploadCloud className="w-10 h-10 text-slate-150 mb-1" />
+          <p className="text-sm font-medium text-slate-400">
+            {placeholder || `Drag & drop or paste ${language.toUpperCase()}`}
+          </p>
         </div>
       )}
 
+      {/* Monaco editor — always rendered */}
       <Editor
         height="100%"
         language={language}
@@ -105,6 +166,7 @@ export function EdiEditorPane({ value, onChange, language = 'edi', placeholder,
         onChange={(val) => onChange(val || '')}
         theme="soopa-theme"
         beforeMount={handleEditorWillMount}
+        onMount={handleEditorMount}
         options={{
           automaticLayout: true,
           minimap: { enabled: false },
@@ -112,6 +174,7 @@ export function EdiEditorPane({ value, onChange, language = 'edi', placeholder,
           lineNumbersMinChars: 3,
           wordWrap: 'on',
           folding: true,
+          fontSize,
           padding: { top: 16, bottom: 16 },
           renderLineHighlight: 'none',
           hideCursorInOverviewRuler: true,
@@ -122,6 +185,22 @@ export function EdiEditorPane({ value, onChange, language = 'edi', placeholder,
           },
         }}
       />
+
+      {/* Bottom toolbar — always shown when editor is empty, sits below Monaco */}
+      {!value && !isDragging && (
+        <div className="absolute bottom-0 left-0 right-0 z-10 flex items-center justify-center gap-3 px-4 py-2.5 bg-white/90 backdrop-blur-sm border-t border-slate-100">
+          <span className="text-xs text-slate-400 flex items-center gap-1">
+            <UploadCloud className="w-3 h-3" />
+            Drag &amp; drop or
+          </span>
+          <label className="cursor-pointer inline-flex items-center justify-center px-3 py-1.5 border border-transparent text-xs font-semibold rounded-md shadow-sm text-white bg-indigo-600 hover:bg-indigo-700 active:bg-indigo-800 transition-colors">
+            <UploadCloud className="w-3.5 h-3.5 mr-1.5" />
+            Upload File
+            <input type="file" className="hidden" accept={acceptedFileExtensions} onChange={handleFileUpload} />
+          </label>
+          {extraActions}
+        </div>
+      )}
     </div>
   );
 }
diff --git a/frontend/web/src/components/ui/switch.tsx b/frontend/web/src/components/ui/switch.tsx
new file mode 100644
index 00000000..455c23b6
--- /dev/null
+++ b/frontend/web/src/components/ui/switch.tsx
@@ -0,0 +1,27 @@
+import * as React from "react"
+import * as SwitchPrimitives from "@radix-ui/react-switch"
+
+import { cn } from "@/lib/utils"
+
+const Switch = React.forwardRef<
+  React.ElementRef<typeof SwitchPrimitives.Root>,
+  React.ComponentPropsWithoutRef<typeof SwitchPrimitives.Root>
+>(({ className, ...props }, ref) => (
+  <SwitchPrimitives.Root
+    className={cn(
+      "peer inline-flex h-5 w-9 shrink-0 cursor-pointer items-center rounded-full border-2 border-transparent shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=unchecked]:bg-input",
+      className
+    )}
+    {...props}
+    ref={ref}
+  >
+    <SwitchPrimitives.Thumb
+      className={cn(
+        "pointer-events-none block h-4 w-4 rounded-full bg-background shadow-lg ring-0 transition-transform data-[state=checked]:translate-x-4 data-[state=unchecked]:translate-x-0"
+      )}
+    />
+  </SwitchPrimitives.Root>
+))
+Switch.displayName = SwitchPrimitives.Root.displayName
+
+export { Switch }
diff --git a/frontend/web/src/features/partners/components/As2PartnerDetails.tsx b/frontend/web/src/features/partners/components/As2PartnerDetails.tsx
index bee275e2..55f70dd8 100644
--- a/frontend/web/src/features/partners/components/As2PartnerDetails.tsx
+++ b/frontend/web/src/features/partners/components/As2PartnerDetails.tsx
@@ -1,16 +1,16 @@
-import { useState, useRef } from 'react';
+import { useState } from 'react';
 import { useForm, Controller } from 'react-hook-form';
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogFooter } from '@/components/ui/dialog';
-import { Textarea } from '@/components/ui/textarea';
 import type { AS2Partner } from '../types';
 import { useCertificatesExportQuery, useUpdatePlatformPartnerMutation, useRotateCertificatesMutation } from '../api/partnerHooks';
-import { Copy, Download, Loader2, ChevronDown, ChevronRight, CheckCircle2, Clock, Upload, RefreshCw, ClipboardPaste } from 'lucide-react';
+import { Copy, Download, Loader2, ChevronDown, ChevronRight, CheckCircle2, Clock, ClipboardPaste } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import { useToast } from '@/hooks/use-toast';
 import { usePlatformConfig } from '@/features/platform/api/configHooks';
 import { Combobox } from '@/components/ui/combobox';
+import { CertificateInput } from './CertificateInput';
 
 export function As2PartnerDetails({ partner, onCancel }: { partner: AS2Partner, onCancel?: () => void }) {
   const { toast } = useToast();
@@ -24,7 +24,7 @@ export function As2PartnerDetails({ partner, onCancel }: { partner: AS2Partner,
   const [pasteValue, setPasteValue] = useState('');
 
   const { data: certs, isLoading: certsLoading, error: certsError } = useCertificatesExportQuery(partner.id);
-  const fileInputRef = useRef<HTMLInputElement>(null);
+
 
   const { register, handleSubmit, reset, control, formState: { isDirty } } = useForm({
     defaultValues: {
@@ -56,46 +56,18 @@ export function As2PartnerDetails({ partner, onCancel }: { partner: AS2Partner,
   };
 
   const handleGenerateCertificate = () => {
-    rotateCertificates.mutate({ id: partner.id, payload: { action: 'generate' } });
-  };
-
-  const handleFileUpload = async (e: React.ChangeEvent<HTMLInputElement>) => {
-    const files = e.target.files;
-    if (!files || files.length === 0) return;
-
-    try {
-      let publicCert = '';
-      let privateKey = '';
-
-      for (let i = 0; i < files.length; i++) {
-        const text = await files[i].text();
-        if (text.includes('-----BEGIN CERTIFICATE-----')) {
-          const match = text.match(/-----BEGIN CERTIFICATE-----[^-]+-----END CERTIFICATE-----/g);
-          if (match && match.length > 0) publicCert += match.join('\n') + '\n';
-        }
-        if (text.includes('-----BEGIN PRIVATE KEY-----') || text.includes('-----BEGIN RSA PRIVATE KEY-----')) {
-          const match = text.match(/-----BEGIN (?:RSA )?PRIVATE KEY-----[^-]+-----END (?:RSA )?PRIVATE KEY-----/g);
-          if (match && match.length > 0) privateKey += match.join('\n') + '\n';
+    rotateCertificates.mutate(
+      { id: partner.id, payload: { action: 'generate' } },
+      {
+        onSuccess: () => {
+          setPasteDialogOpen(false);
+          setPasteValue('');
         }
       }
-
-      rotateCertificates.mutate({
-        id: partner.id,
-        payload: {
-          action: 'upload',
-          public_cert_pem: publicCert.trim() || undefined as any,
-          private_key_pem: (partner.is_local && privateKey.trim()) ? privateKey.trim() : undefined
-        }
-      });
-    } catch { // eslint-disable-line no-unused-vars
-      toast({ title: 'Error', description: 'Failed to read uploaded files.', variant: 'destructive' });
-    } finally {
-      if (fileInputRef.current) {
-        fileInputRef.current.value = '';
-      }
-    }
+    );
   };
 
+
   const handlePasteSubmit = () => {
     if (!pasteValue.trim()) return;
 
@@ -208,28 +180,10 @@ export function As2PartnerDetails({ partner, onCancel }: { partner: AS2Partner,
         <div className="flex justify-between items-center pb-2">
           <h4 className="text-sm font-semibold text-slate-900 uppercase tracking-wider">Certificates</h4>
           <div className="flex items-center gap-3">
-            {partner.is_local && (
-              <Button variant="outline" size="sm" onClick={handleGenerateCertificate} disabled={rotateCertificates.isPending}>
-                {rotateCertificates.isPending ? <Loader2 className="w-4 h-4 mr-2 animate-spin" /> : <RefreshCw className="w-4 h-4 mr-2" />}
-                Generate Certificate
-              </Button>
-            )}
             <Button variant="outline" size="sm" onClick={() => setPasteDialogOpen(true)} disabled={rotateCertificates.isPending}>
               <ClipboardPaste className="w-4 h-4 mr-2" />
-              Paste
+              New Certificate
             </Button>
-            <Button variant="outline" size="sm" onClick={() => fileInputRef.current?.click()} disabled={rotateCertificates.isPending}>
-              <Upload className="w-4 h-4 mr-2" />
-              Upload
-            </Button>
-            <input
-              type="file"
-              ref={fileInputRef}
-              onChange={handleFileUpload}
-              multiple
-              accept=".pem,.crt,.cer,.key"
-              className="hidden"
-            />
           </div>
         </div>
 
@@ -277,16 +231,25 @@ export function As2PartnerDetails({ partner, onCancel }: { partner: AS2Partner,
         setPasteDialogOpen(open);
         if (!open) setPasteValue('');
       }}>
-        <DialogContent className="sm:max-w-xl">
+        <DialogContent className="sm:max-w-[780px]">
           <DialogHeader>
-            <DialogTitle>Paste Certificate</DialogTitle>
+            <DialogTitle>Update Certificate</DialogTitle>
           </DialogHeader>
           <div className="py-4">
-            <Textarea
-              className="min-h-[200px] font-mono text-xs p-4 bg-slate-50 border-slate-200"
-              placeholder={"-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"}
+            <CertificateInput
               value={pasteValue}
-              onChange={(e) => setPasteValue(e.target.value)}
+              onChange={setPasteValue}
+              extraActions={partner.is_local && !pasteValue ? (
+                <button
+                  type="button"
+                  className="inline-flex items-center justify-center px-4 py-2 border border-slate-200 text-sm font-medium rounded-md shadow-sm text-slate-700 bg-white hover:bg-slate-50 transition-colors"
+                  onClick={handleGenerateCertificate}
+                  disabled={rotateCertificates.isPending}
+                >
+                  {rotateCertificates.isPending ? <Loader2 className="w-4 h-4 mr-2 animate-spin" /> : null}
+                  Generate Certificate
+                </button>
+              ) : undefined}
             />
           </div>
           <DialogFooter>
diff --git a/frontend/web/src/features/partners/components/CertificateInput.tsx b/frontend/web/src/features/partners/components/CertificateInput.tsx
index 2bb9d332..72e65840 100644
--- a/frontend/web/src/features/partners/components/CertificateInput.tsx
+++ b/frontend/web/src/features/partners/components/CertificateInput.tsx
@@ -1,23 +1,29 @@
+import React from 'react';
 import { EdiEditorPane } from '@/components/ui/edi-editor-pane';
 
 export interface CertificateInputProps {
   value: string;
   onChange: (pem: string) => void;
+  extraActions?: React.ReactNode;
 }
 
 /**
  * Reusable certificate input powered by Monaco Editor.
  * Supports drag-and-drop, file picker, and pasting raw PEM text natively.
  */
-export function CertificateInput({ value, onChange }: CertificateInputProps) {
+export function CertificateInput({ value, onChange, extraActions }: CertificateInputProps) {
   return (
-    <div className="border border-slate-200 rounded-xl overflow-hidden h-[250px] flex flex-col">
+    <div className="border border-slate-200 rounded-xl overflow-hidden h-[420px] flex flex-col">
       <EdiEditorPane
         value={value}
         onChange={onChange}
         language="plaintext"
-        placeholder="or click anywhere to paste raw PEM"
-        cornerPlaceholder={"-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"}
+        cornerPlaceholder={"-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"}
+        showEmptyState={false}
+        extraActions={extraActions}
+        fontSize={14}
+        showCertDetected
+        acceptedFileExtensions=".pem,.crt,.cer,.cert,.key,.txt"
       />
     </div>
   );
diff --git a/frontend/web/src/features/partners/components/CreatePartnerModal.tsx b/frontend/web/src/features/partners/components/CreatePartnerModal.tsx
index 9649bbfa..5dd8b84c 100644
--- a/frontend/web/src/features/partners/components/CreatePartnerModal.tsx
+++ b/frontend/web/src/features/partners/components/CreatePartnerModal.tsx
@@ -84,19 +84,32 @@ export function CreatePartnerModal({ existingAs2Ids = [] }: { existingAs2Ids?: s
       isPending={createPartner.isPending}
       submitDisabled={isDuplicate}
       submitText="Create Trading Partner"
+      maxWidth="sm:max-w-[780px]"
     >
       {/* Local / Remote toggle */}
-      <div className="flex items-center gap-2 pb-2 border-b border-slate-100">
-        <Input
-          type="checkbox"
-          id="is_local"
-          checked={isLocal}
-          onChange={(e) => setIsLocal(e.target.checked)}
-          className="h-4 w-4 rounded border-slate-300 text-indigo-600 focus:ring-indigo-600"
-        />
-        <Label htmlFor="is_local" className="text-slate-600 font-medium">
-          This is a Local Trading Partner (Generates Certificate automatically)
-        </Label>
+      <div className="flex items-center gap-3">
+        <Label className="text-slate-600 font-medium">Partner Type</Label>
+        <button
+          type="button"
+          role="switch"
+          aria-checked={isLocal}
+          onClick={() => {
+            setIsLocal(!isLocal);
+            if (!isLocal) setCertPem('');
+          }}
+          className={`relative inline-flex h-7 w-[90px] shrink-0 cursor-pointer items-center rounded-full border transition-colors duration-200 ease-in-out focus:outline-none focus:ring-2 focus:ring-offset-2 ${isLocal ? 'bg-indigo-50 border-indigo-200 focus:ring-indigo-200' : 'bg-violet-50 border-violet-200 focus:ring-violet-200'}`}
+        >
+          <span className={`absolute left-2.5 text-[10px] font-bold uppercase tracking-wider transition-opacity duration-200 ${isLocal ? 'opacity-100 text-indigo-700' : 'opacity-0'}`}>
+            Local
+          </span>
+          <span className={`absolute right-1.5 text-[10px] font-bold uppercase tracking-wider transition-opacity duration-200 ${isLocal ? 'opacity-0' : 'opacity-100 text-violet-700'}`}>
+            Remote
+          </span>
+          <span
+            aria-hidden="true"
+            className={`pointer-events-none absolute left-1 flex h-5 w-5 transform items-center justify-center rounded-full shadow ring-0 transition-transform duration-200 ease-in-out ${isLocal ? 'translate-x-[62px] bg-indigo-600' : 'translate-x-0 bg-violet-600'}`}
+          />
+        </button>
       </div>
 
       {/* Name + AS2 ID */}
@@ -143,13 +156,22 @@ export function CreatePartnerModal({ existingAs2Ids = [] }: { existingAs2Ids?: s
         )}
       </div>
 
-      {/* Certificate — remote partners only */}
-      {!isLocal && (
-        <div className="grid gap-2">
-          <Label className="text-slate-600 font-medium">Public Certificate</Label>
-          <CertificateInput value={certPem} onChange={setCertPem} />
-        </div>
-      )}
+      {/* Certificate */}
+      <div className="grid gap-2">
+        <Label className="text-slate-600 font-medium">Public Certificate</Label>
+        {isLocal ? (
+          <div className="border border-slate-200 rounded-xl bg-slate-50 flex items-center justify-center p-8 text-center flex-col gap-3 h-[180px]">
+            <p className="text-sm text-slate-500 max-w-[250px]">
+              A new certificate will be automatically generated and assigned when you save this local station.
+            </p>
+          </div>
+        ) : (
+          <CertificateInput
+            value={certPem}
+            onChange={setCertPem}
+          />
+        )}
+      </div>
     </FormModal>
   );
 }
diff --git a/frontend/web/src/features/partners/components/PartnershipDetails.tsx b/frontend/web/src/features/partners/components/PartnershipDetails.tsx
index 49e30478..97875072 100644
--- a/frontend/web/src/features/partners/components/PartnershipDetails.tsx
+++ b/frontend/web/src/features/partners/components/PartnershipDetails.tsx
@@ -247,18 +247,16 @@ export function PartnershipDetails({ partnership, availablePartners, onCancel }:
           <EdiEditorPane
             value={customPayload}
             onChange={(val) => setCustomPayload(val)}
-            placeholder="Paste custom EDI payload here, or drag & drop a file..."
           />
         </div>
 
         {/* Results Panel */}
         {testConnection.data && (
           <div className="space-y-3">
-            <div className={`flex items-start gap-3 rounded-lg px-4 py-3 text-sm border ${
-              testConnection.data.success
+            <div className={`flex items-start gap-3 rounded-lg px-4 py-3 text-sm border ${testConnection.data.success
                 ? 'bg-emerald-50 border-emerald-200 text-emerald-800'
                 : 'bg-red-50 border-red-200 text-red-800'
-            }`}>
+              }`}>
               {testConnection.data.success
                 ? <CheckCircle2 className="w-5 h-5 mt-0.5 shrink-0 text-emerald-600" />
                 : <XCircle className="w-5 h-5 mt-0.5 shrink-0 text-red-500" />}
diff --git a/libs/domain/src/domain/models.py b/libs/domain/src/domain/models.py
index d315622b..b48ee673 100644
--- a/libs/domain/src/domain/models.py
+++ b/libs/domain/src/domain/models.py
@@ -11,6 +11,12 @@ class Direction(StrEnum):
     OUTBOUND = "OUTBOUND"
 
 
+class PartnerStatus(StrEnum):
+    PROVISIONING = "PROVISIONING"
+    ACTIVE = "ACTIVE"
+    INACTIVE = "INACTIVE"
+
+
 class ConnectionType(StrEnum):
     AS2 = "AS2"
     SFTP = "SFTP"
diff --git a/services/api/src/api/adapters/api_token_repository.py b/services/api/src/api/adapters/api_token_repository.py
index 9a61f408..cecc81ff 100644
--- a/services/api/src/api/adapters/api_token_repository.py
+++ b/services/api/src/api/adapters/api_token_repository.py
@@ -2,6 +2,7 @@
 from typing import Any
 from uuid import UUID
 
+from api.domain.models import ApiTokenListEntity
 from api.ports.api_token_repository import ApiTokenRepositoryPort
 from database.base_repository import GlobalSession, GlobalSqlAlchemyRepository
 from database.models.control_plane import (
@@ -40,7 +41,7 @@ async def create_api_token(
         await self.session.flush()  # type: ignore
         return token_id
 
-    async def list_api_tokens(self, tenant_id: int) -> list[dict[str, Any]]:
+    async def list_api_tokens(self, tenant_id: int) -> list[ApiTokenListEntity]:
         result = await self.session.execute(  # type: ignore
             select(ApiToken)
             .where(ApiToken.tenant_id == tenant_id)
@@ -48,18 +49,32 @@ async def list_api_tokens(self, tenant_id: int) -> list[dict[str, Any]]:
         )
         tokens = result.scalars().all()
         return [
-            {
-                "id": str(t.id),
-                "name": t.name,
-                "client_id": t.client_id,  # safe to return; secret_hash is never exposed
-                "active": t.active,
-                "last_used_at": t.last_used_at.isoformat() if t.last_used_at else None,
-                "expires_at": t.expires_at.isoformat() if t.expires_at else None,
-                "created_at": t.created_at.isoformat(),
-            }
+            ApiTokenListEntity(
+                id=str(t.id),
+                name=t.name,
+                client_id=t.client_id,  # safe to return; secret_hash is never exposed
+                active=t.active,
+                last_used_at=t.last_used_at.isoformat() if t.last_used_at else None,
+                expires_at=t.expires_at.isoformat() if t.expires_at else None,
+                created_at=t.created_at.isoformat(),
+            )
             for t in tokens
         ]
 
+    async def get_api_token(self, tenant_id: int, token_id: UUID) -> dict[str, Any] | None:
+        result = await self.session.execute(  # type: ignore
+            select(ApiToken).where(ApiToken.id == token_id, ApiToken.tenant_id == tenant_id)
+        )
+        t = result.scalars().first()
+        if not t:
+            return None
+        return {
+            "id": str(t.id),
+            "name": t.name,
+            "client_id": t.client_id,
+            "active": t.active,
+        }
+
     async def update_api_token(
         self, tenant_id: int, token_id: UUID, name: str | None = None, active: bool | None = None
     ) -> bool:
diff --git a/services/api/src/api/adapters/inbound_route_repository.py b/services/api/src/api/adapters/inbound_route_repository.py
index accadec7..a70efa8c 100644
--- a/services/api/src/api/adapters/inbound_route_repository.py
+++ b/services/api/src/api/adapters/inbound_route_repository.py
@@ -161,6 +161,12 @@ async def get_inbound_route(
         record = result.scalars().first()
         return InboundRouteDomainModel.model_validate(record) if record else None
 
+    async def list_inbound_routes(self, tenant_id: int) -> list[InboundRouteDomainModel]:
+        result = await self.session.execute(
+            select(InboundRoute).where(InboundRoute.tenant_id == tenant_id)
+        )
+        return [InboundRouteDomainModel.model_validate(r) for r in result.scalars().all()]
+
     async def get_tenant_by_isa(self, isa_sender_id: str, isa_receiver_id: str) -> int | None:
         result = await self.session.execute(
             select(InboundRoute.tenant_id).where(
diff --git a/services/api/src/api/adapters/outbound_route_repository.py b/services/api/src/api/adapters/outbound_route_repository.py
index 0fe9786f..ae38916f 100644
--- a/services/api/src/api/adapters/outbound_route_repository.py
+++ b/services/api/src/api/adapters/outbound_route_repository.py
@@ -11,11 +11,10 @@
 from database.base_repository import GlobalSession, GlobalSqlAlchemyRepository
 from database.models.control_plane import (
     AS2Partner,
-    InboundRoute,
     OutboundRoute,
     SFTPPartner,
 )
-from domain.models import InboundRouteDomainModel, OutboundRouteDomainModel
+from domain.models import OutboundRouteDomainModel
 from sqlalchemy import delete, select
 
 
@@ -133,30 +132,8 @@ async def delete_outbound_route(self, tenant_id: int, route_id: UUID) -> bool:
         await self.session.flush()
         return bool(getattr(result, "rowcount", 0) > 0)
 
-    async def get_all_routes(
-        self, tenant_id: int
-    ) -> dict[str, list[OutboundRouteDomainModel | InboundRouteDomainModel]]:
-        inbound_result = await self.session.execute(
-            select(InboundRoute).where(InboundRoute.tenant_id == tenant_id)
-        )
+    async def list_outbound_routes(self, tenant_id: int) -> list[OutboundRouteDomainModel]:
         outbound_result = await self.session.execute(
             select(OutboundRoute).where(OutboundRoute.tenant_id == tenant_id)
         )
-
-        inbound_routes = [
-            InboundRouteDomainModel.model_validate(r) for r in inbound_result.scalars().all()
-        ]
-        outbound_routes = [
-            OutboundRouteDomainModel.model_validate(r) for r in outbound_result.scalars().all()
-        ]
-
-        from typing import cast
-
-        return {
-            "inbound": cast(
-                "list[OutboundRouteDomainModel | InboundRouteDomainModel]", inbound_routes
-            ),
-            "outbound": cast(
-                "list[OutboundRouteDomainModel | InboundRouteDomainModel]", outbound_routes
-            ),
-        }
+        return [OutboundRouteDomainModel.model_validate(r) for r in outbound_result.scalars().all()]
diff --git a/services/api/src/api/adapters/repository.py b/services/api/src/api/adapters/repository.py
deleted file mode 100644
index 640ae66d..00000000
--- a/services/api/src/api/adapters/repository.py
+++ /dev/null
@@ -1,46 +0,0 @@
-from api.adapters.api_token_repository import SqlAlchemyApiTokenRepository
-from api.adapters.as2_partner_repository import SqlAlchemyAS2TradingPartnerRepository
-from api.adapters.as2_partnership_repository import SqlAlchemyAS2PartnershipRepository
-from api.adapters.edi_header_repository import SqlAlchemyEdiHeaderRepository
-from api.adapters.inbound_route_repository import SqlAlchemyInboundRouteRepository
-from api.adapters.outbound_route_repository import SqlAlchemyOutboundRouteRepository
-from api.adapters.outbox_repository import SqlAlchemyOutboxRepository
-from api.adapters.sftp_repository import SqlAlchemySFTPPartnerRepository
-from api.adapters.tenant_repository import SqlAlchemyTenantRepository
-from api.adapters.transaction_repository import SqlAlchemyTransactionRepository
-from api.adapters.webhook_repository import SqlAlchemyWebhookRepository
-from api.ports.repository import ControlPlaneRepositoryPort, DataPlaneRepositoryPort
-from database.base_repository import GlobalSession, TenantSession
-
-
-class SqlAlchemyControlPlaneRepository(
-    ControlPlaneRepositoryPort,
-    SqlAlchemyAS2TradingPartnerRepository,
-    SqlAlchemyAS2PartnershipRepository,
-    SqlAlchemyInboundRouteRepository,
-    SqlAlchemyOutboundRouteRepository,
-    SqlAlchemySFTPPartnerRepository,
-    SqlAlchemyWebhookRepository,
-    SqlAlchemyEdiHeaderRepository,
-    SqlAlchemyTenantRepository,
-    SqlAlchemyApiTokenRepository,
-    SqlAlchemyOutboxRepository,
-):
-    def __init__(self, session: GlobalSession) -> None:
-        self.session = session
-        SqlAlchemyAS2TradingPartnerRepository.__init__(self, session)
-        SqlAlchemyAS2PartnershipRepository.__init__(self, session)
-        SqlAlchemyInboundRouteRepository.__init__(self, session)
-        SqlAlchemyOutboundRouteRepository.__init__(self, session)
-        SqlAlchemySFTPPartnerRepository.__init__(self, session)
-        SqlAlchemyWebhookRepository.__init__(self, session)
-        SqlAlchemyEdiHeaderRepository.__init__(self, session)
-        SqlAlchemyTenantRepository.__init__(self, session)
-        SqlAlchemyOutboxRepository.__init__(self, session)
-        SqlAlchemyApiTokenRepository.__init__(self, session)
-
-
-class SqlAlchemyDataPlaneRepository(DataPlaneRepositoryPort, SqlAlchemyTransactionRepository):
-    def __init__(self, session: TenantSession) -> None:
-        self.session = session
-        SqlAlchemyTransactionRepository.__init__(self, session)
diff --git a/services/api/src/api/core/services/__init__.py b/services/api/src/api/core/services/__init__.py
index 148aa30d..0260d744 100644
--- a/services/api/src/api/core/services/__init__.py
+++ b/services/api/src/api/core/services/__init__.py
@@ -1,6 +1,7 @@
 from api.core.services.as2_partner_service import AS2PartnerService
 from api.core.services.as2_partnership_service import AS2PartnershipService
-from api.core.services.route_service import RouteService
+from api.core.services.inbound_route_service import InboundRouteService
+from api.core.services.outbound_route_service import OutboundRouteService
 from api.core.services.sftp_partner_service import SFTPPartnerService
 from api.core.services.webhook_service import WebhookService
 
@@ -9,5 +10,6 @@
     "AS2PartnershipService",
     "SFTPPartnerService",
     "WebhookService",
-    "RouteService",
+    "InboundRouteService",
+    "OutboundRouteService",
 ]
diff --git a/services/api/src/api/core/services/api_token_service.py b/services/api/src/api/core/services/api_token_service.py
index 1ebabd1b..f17585b3 100644
--- a/services/api/src/api/core/services/api_token_service.py
+++ b/services/api/src/api/core/services/api_token_service.py
@@ -13,10 +13,10 @@
 import hashlib
 import logging
 import secrets
-from typing import Any
 from uuid import UUID
 
-from api.domain.models import ApiTokenEntity, CreateApiTokenCmd
+from api.auth.api_key import invalidate_token_cache
+from api.domain.models import ApiTokenEntity, ApiTokenListEntity, CreateApiTokenCmd
 from api.ports.repository import ApiTokenRepositoryPort
 
 logger = logging.getLogger(__name__)
@@ -88,7 +88,7 @@ async def create_token(
             active=False,
         )
 
-    async def list_tokens(self, tenant_id: int) -> list[dict[str, Any]]:
+    async def list_tokens(self, tenant_id: int) -> list[ApiTokenListEntity]:
         """Returns all tokens for a tenant. client_id is safe; secret is never returned."""
         return await self._repo.list_api_tokens(tenant_id)
 
@@ -96,8 +96,16 @@ async def update_token(
         self, tenant_id: int, token_id: UUID, name: str | None = None, active: bool | None = None
     ) -> bool:
         """Updates token properties (e.g. name or active status)."""
+        token = await self._repo.get_api_token(tenant_id, token_id)
+        if not token:
+            return False
+
         result = await self._repo.update_api_token(tenant_id, token_id, name, active)
         if result:
+            # If the token is being deactivated, invalidate the cache
+            if active is False:
+                invalidate_token_cache(token["client_id"])
+
             logger.info(
                 "API token updated", extra={"tenant_id": tenant_id, "token_id": str(token_id)}
             )
@@ -105,8 +113,13 @@ async def update_token(
 
     async def delete_token(self, tenant_id: int, token_id: UUID) -> bool:
         """Hard deletes a token record. Irreversible."""
+        token = await self._repo.get_api_token(tenant_id, token_id)
+        if not token:
+            return False
+
         result = await self._repo.delete_api_token(tenant_id, token_id)
         if result:
+            invalidate_token_cache(token["client_id"])
             logger.info(
                 "API token deleted", extra={"tenant_id": tenant_id, "token_id": str(token_id)}
             )
diff --git a/services/api/src/api/core/services/as2_partner_service.py b/services/api/src/api/core/services/as2_partner_service.py
index 62894bdc..cbfaa9aa 100644
--- a/services/api/src/api/core/services/as2_partner_service.py
+++ b/services/api/src/api/core/services/as2_partner_service.py
@@ -8,6 +8,7 @@
     UpdateAS2TradingPartnerCmd,
 )
 from domain.events import ProvisioningEventType
+from domain.models import ConnectionType, PartnerStatus
 
 logger = logging.getLogger(__name__)
 
@@ -26,8 +27,8 @@ async def create_as2_partner(
     ) -> PartnerEntity:
         logger.info(f"Provisioning AS2 partner {cmd.name} for tenant {tenant_id}")
 
-        partner_id = await self.uow.control_plane.create_as2_identity(tenant_id=tenant_id, cmd=cmd)
-        await self.uow.control_plane.publish_outbox_event(
+        partner_id = await self.uow.as2_partners.create_as2_identity(tenant_id=tenant_id, cmd=cmd)
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.AS2_PARTNER_CREATED,
             payload={"partner_id": str(partner_id), "tenant_id": tenant_id},
@@ -37,21 +38,21 @@ async def create_as2_partner(
             partner_id=partner_id,
             tenant_id=tenant_id,
             name=cmd.name,
-            type="AS2",
-            status="PROVISIONING",
+            type=ConnectionType.AS2,
+            status=PartnerStatus.PROVISIONING,
         )
 
     async def update_as2_partner(
         self, tenant_id: int, partner_id: UUID, cmd: UpdateAS2TradingPartnerCmd
     ) -> PartnerEntity:
         logger.info(f"Updating AS2 partner {partner_id} for tenant {tenant_id}")
-        await self.uow.control_plane.update_as2_identity(tenant_id, partner_id, cmd)
+        await self.uow.as2_partners.update_as2_identity(tenant_id, partner_id, cmd)
 
-        updated_partner = await self.uow.control_plane.get_as2_partner(tenant_id, partner_id)
+        updated_partner = await self.uow.as2_partners.get_as2_partner(tenant_id, partner_id)
         if not updated_partner:
             raise ValueError("Partner not found after update")
 
-        await self.uow.control_plane.publish_outbox_event(
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.AS2_PARTNER_UPDATED,
             payload={"partner_id": str(partner_id), "tenant_id": tenant_id},
@@ -61,14 +62,14 @@ async def update_as2_partner(
             partner_id=partner_id,
             tenant_id=tenant_id,
             name=cmd.name or updated_partner.name,
-            type="AS2",
-            status="ACTIVE" if updated_partner.active else "INACTIVE",
+            type=ConnectionType.AS2,
+            status=PartnerStatus.ACTIVE if updated_partner.active else PartnerStatus.INACTIVE,
         )
 
     async def delete_as2_partner(self, tenant_id: int, partner_id: UUID) -> None:
         logger.info(f"Deleting AS2 partner {partner_id} for tenant {tenant_id}")
-        await self.uow.control_plane.delete_as2_identity(tenant_id, partner_id)
-        await self.uow.control_plane.publish_outbox_event(
+        await self.uow.as2_partners.delete_as2_identity(tenant_id, partner_id)
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.AS2_PARTNER_DELETED,
             payload={"partner_id": str(partner_id), "tenant_id": tenant_id},
@@ -82,15 +83,15 @@ async def rotate_certificates(
         new_private_key_vault_ref: str | None,
     ) -> PartnerEntity:
         logger.info(f"Rotating certificates for AS2 partner {partner_id} for tenant {tenant_id}")
-        await self.uow.control_plane.rotate_as2_certificates(
+        await self.uow.as2_partners.rotate_as2_certificates(
             tenant_id, partner_id, new_public_cert, new_private_key_vault_ref
         )
 
-        updated_partner = await self.uow.control_plane.get_as2_partner(tenant_id, partner_id)
+        updated_partner = await self.uow.as2_partners.get_as2_partner(tenant_id, partner_id)
         if not updated_partner:
             raise ValueError("Partner not found after certificate rotation")
 
-        await self.uow.control_plane.publish_outbox_event(
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.AS2_PARTNER_UPDATED,
             payload={"partner_id": str(partner_id), "tenant_id": tenant_id},
@@ -100,6 +101,6 @@ async def rotate_certificates(
             partner_id=partner_id,
             tenant_id=tenant_id,
             name=updated_partner.name,
-            type="AS2",
-            status="ACTIVE" if updated_partner.active else "INACTIVE",
+            type=ConnectionType.AS2,
+            status=PartnerStatus.ACTIVE if updated_partner.active else PartnerStatus.INACTIVE,
         )
diff --git a/services/api/src/api/core/services/as2_partnership_service.py b/services/api/src/api/core/services/as2_partnership_service.py
index 05ff3001..cbd8f2bd 100644
--- a/services/api/src/api/core/services/as2_partnership_service.py
+++ b/services/api/src/api/core/services/as2_partnership_service.py
@@ -8,6 +8,7 @@
     UpdateAS2PartnershipCmd,
 )
 from domain.events import ProvisioningEventType
+from domain.models import ConnectionType, PartnerStatus
 
 logger = logging.getLogger(__name__)
 
@@ -24,13 +25,11 @@ def __init__(self, uow: UnitOfWork) -> None:
     async def create_as2_partnership(
         self, tenant_id: int, cmd: CreateAS2PartnershipCmd
     ) -> PartnerEntity:
-        local_partner = await self.uow.control_plane.get_as2_partner(
-            tenant_id, cmd.local_partner_id
-        )
+        local_partner = await self.uow.as2_partners.get_as2_partner(tenant_id, cmd.local_partner_id)
         if not local_partner:
             raise ValueError(f"Local AS2 partner {cmd.local_partner_id} not found")
 
-        remote_partner = await self.uow.control_plane.get_as2_partner(
+        remote_partner = await self.uow.as2_partners.get_as2_partner(
             tenant_id, cmd.remote_partner_id
         )
         if not remote_partner:
@@ -39,10 +38,10 @@ async def create_as2_partnership(
         logger.info(
             f"Provisioning AS2 partnership {cmd.local_partner_id} -> {cmd.remote_partner_id}"
         )
-        partner_id = await self.uow.control_plane.create_as2_partnership(
+        partner_id = await self.uow.as2_partnerships.create_as2_partnership(
             tenant_id=tenant_id, cmd=cmd
         )
-        await self.uow.control_plane.publish_outbox_event(
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.AS2_PARTNERSHIP_CREATED,
             payload={"partner_id": str(partner_id), "tenant_id": tenant_id},
@@ -52,8 +51,8 @@ async def create_as2_partnership(
             partner_id=partner_id,
             tenant_id=tenant_id,
             name=cmd.name,
-            type="AS2_PARTNERSHIP",
-            status="INACTIVE",
+            type=ConnectionType.AS2,
+            status=PartnerStatus.INACTIVE,
         )
 
     async def update_as2_partnership(
@@ -66,7 +65,7 @@ async def update_as2_partnership(
             check_ids.append(cmd.remote_partner_id)
 
         if check_ids:
-            valid_partners = await self.uow.control_plane.get_as2_partners_by_ids(
+            valid_partners = await self.uow.as2_partners.get_as2_partners_by_ids(
                 tenant_id, check_ids
             )
             if len(valid_partners) != len(check_ids):
@@ -75,15 +74,15 @@ async def update_as2_partnership(
                 )
 
         logger.info(f"Updating AS2 partnership {partnership_id}")
-        await self.uow.control_plane.update_as2_partnership(
+        await self.uow.as2_partnerships.update_as2_partnership(
             tenant_id=tenant_id, partnership_id=partnership_id, cmd=cmd
         )
-        await self.uow.control_plane.publish_outbox_event(
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.AS2_PARTNERSHIP_UPDATED,
             payload={"partner_id": str(partnership_id), "tenant_id": tenant_id},
         )
-        updated = await self.uow.control_plane.get_as2_partnership(tenant_id, partnership_id)
+        updated = await self.uow.as2_partnerships.get_as2_partnership(tenant_id, partnership_id)
         if not updated:
             raise ValueError(f"AS2 partnership {partnership_id} not found")
 
@@ -91,14 +90,14 @@ async def update_as2_partnership(
             partner_id=partnership_id,
             tenant_id=tenant_id,
             name=updated.name,
-            type="AS2_PARTNERSHIP",
-            status="ACTIVE" if updated.active else "INACTIVE",
+            type=ConnectionType.AS2,
+            status=PartnerStatus.ACTIVE if updated.active else PartnerStatus.INACTIVE,
         )
 
     async def delete_as2_partnership(self, tenant_id: int, partnership_id: UUID) -> None:
         logger.info(f"Deleting AS2 partnership {partnership_id} for tenant {tenant_id}")
-        await self.uow.control_plane.delete_as2_partnership(tenant_id, partnership_id)
-        await self.uow.control_plane.publish_outbox_event(
+        await self.uow.as2_partnerships.delete_as2_partnership(tenant_id, partnership_id)
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.AS2_PARTNERSHIP_DELETED,
             payload={"partner_id": str(partnership_id), "tenant_id": tenant_id},
diff --git a/services/api/src/api/core/services/edi_header_service.py b/services/api/src/api/core/services/edi_header_service.py
index 446b56a5..59cd6ca6 100644
--- a/services/api/src/api/core/services/edi_header_service.py
+++ b/services/api/src/api/core/services/edi_header_service.py
@@ -26,17 +26,17 @@ async def create_outbound_edi_header(
         logger.info(
             f"Creating Outbound EDI Header for trading partner {cmd.trading_partner_id} in tenant {tenant_id}"
         )
-        return await self.uow.control_plane.create_outbound_edi_header(tenant_id=tenant_id, cmd=cmd)
+        return await self.uow.edi_headers.create_outbound_edi_header(tenant_id=tenant_id, cmd=cmd)
 
     async def update_outbound_edi_header(
         self, tenant_id: int, header_id: UUID, cmd: UpdateOutboundEdiHeaderCmd
     ) -> bool:
-        return await self.uow.control_plane.update_outbound_edi_header(tenant_id, header_id, cmd)
+        return await self.uow.edi_headers.update_outbound_edi_header(tenant_id, header_id, cmd)
 
     async def delete_outbound_edi_header(self, tenant_id: int, header_id: UUID) -> bool:
-        return await self.uow.control_plane.delete_outbound_edi_header(tenant_id, header_id)
+        return await self.uow.edi_headers.delete_outbound_edi_header(tenant_id, header_id)
 
     async def get_outbound_edi_headers(
         self, tenant_id: int
     ) -> Sequence[OutboundEdiHeaderDomainModel]:
-        return await self.uow.control_plane.get_outbound_edi_headers(tenant_id)
+        return await self.uow.edi_headers.get_outbound_edi_headers(tenant_id)
diff --git a/services/api/src/api/core/services/inbound_route_service.py b/services/api/src/api/core/services/inbound_route_service.py
index cbd53879..4befa1ec 100644
--- a/services/api/src/api/core/services/inbound_route_service.py
+++ b/services/api/src/api/core/services/inbound_route_service.py
@@ -4,34 +4,41 @@
 from api.core.uow import UnitOfWork
 from api.domain.models import (
     CreateInboundRouteCmd,
+    InboundRouteListEntity,
     RouteEntity,
     UpdateInboundRouteCmd,
 )
 from domain.events import ProvisioningEventType
+from domain.models import ConnectionType, Direction, InboundRouteDomainModel
 
 logger = logging.getLogger(__name__)
 
 
 class InboundRouteService:
+    """
+    Domain service responsible for the lifecycle of Inbound EDI Routes,
+    including resolution of partner names for list operations.
+    """
+
     def __init__(self, uow: UnitOfWork) -> None:
         self.uow = uow
 
     async def create_inbound_route(self, tenant_id: int, cmd: CreateInboundRouteCmd) -> RouteEntity:
         logger.info(f"Creating Inbound Route for sender {cmd.isa_sender_id} in tenant {tenant_id}")
-        route_id = await self.uow.control_plane.create_inbound_route(tenant_id=tenant_id, cmd=cmd)
-        await self.uow.control_plane.publish_outbox_event(
+        route_id = await self.uow.inbound_routes.create_inbound_route(tenant_id=tenant_id, cmd=cmd)
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.INBOUND_ROUTE_CREATED,
             payload={"route_id": str(route_id), "tenant_id": tenant_id},
         )
-        return RouteEntity(route_id=route_id, tenant_id=tenant_id, direction="INBOUND")
+        return RouteEntity(route_id=route_id, tenant_id=tenant_id, direction=Direction.INBOUND)
 
     async def update_inbound_route(
         self, tenant_id: int, route_id: UUID, cmd: UpdateInboundRouteCmd
     ) -> bool:
-        res = await self.uow.control_plane.update_inbound_route(tenant_id, route_id, cmd)
+        res = await self.uow.inbound_routes.update_inbound_route(tenant_id, route_id, cmd)
         if res:
-            await self.uow.control_plane.publish_outbox_event(
+            await self.uow.outbox.publish_outbox_event(
                 tenant_id=tenant_id,
                 event_type=ProvisioningEventType.INBOUND_ROUTE_UPDATED,
                 payload={"route_id": str(route_id), "tenant_id": tenant_id},
@@ -39,11 +46,80 @@ async def update_inbound_route(
         return res
 
     async def delete_inbound_route(self, tenant_id: int, route_id: UUID) -> bool:
-        res = await self.uow.control_plane.delete_inbound_route(tenant_id, route_id)
+        res = await self.uow.inbound_routes.delete_inbound_route(tenant_id, route_id)
         if res:
-            await self.uow.control_plane.publish_outbox_event(
+            await self.uow.outbox.publish_outbox_event(
                 tenant_id=tenant_id,
                 event_type=ProvisioningEventType.INBOUND_ROUTE_DELETED,
                 payload={"route_id": str(route_id), "tenant_id": tenant_id},
             )
         return res
+
+    async def list_inbound_routes(self, tenant_id: int) -> list[InboundRouteListEntity]:
+        inbound = await self.uow.inbound_routes.list_inbound_routes(tenant_id)
+
+        as2_ids: set[UUID] = set()
+        sftp_ids: set[UUID] = set()
+        webhook_ids: set[UUID] = set()
+
+        for r in inbound:
+            if r.as2_partner_id:
+                as2_ids.add(r.as2_partner_id)
+            if r.sftp_partner_id:
+                sftp_ids.add(r.sftp_partner_id)
+            if r.webhook_id:
+                webhook_ids.add(r.webhook_id)
+
+        as2_names = (
+            await self.uow.as2_partners.get_as2_partners_by_ids(tenant_id, list(as2_ids))
+            if as2_ids
+            else {}
+        )
+        sftp_names = (
+            await self.uow.sftp_partners.get_sftp_partners_by_ids(tenant_id, list(sftp_ids))
+            if sftp_ids
+            else {}
+        )
+        webhook_names = (
+            await self.uow.webhooks.get_webhooks_by_ids(tenant_id, list(webhook_ids))
+            if webhook_ids
+            else {}
+        )
+
+        results: list[InboundRouteListEntity] = []
+
+        def _resolve_destination(r: InboundRouteDomainModel) -> tuple[ConnectionType | str, str]:
+            if r.as2_partner_id:
+                return ConnectionType.AS2, as2_names.get(r.as2_partner_id, str(r.as2_partner_id))
+            if r.sftp_partner_id:
+                return ConnectionType.SFTP, sftp_names.get(
+                    r.sftp_partner_id, str(r.sftp_partner_id)
+                )
+            if r.webhook_id:
+                return ConnectionType.WEBHOOK, webhook_names.get(r.webhook_id, str(r.webhook_id))
+            return "UNKNOWN", "Unknown"
+
+        for r in inbound:
+            dest_type, dest_name = _resolve_destination(r)
+
+            results.append(
+                InboundRouteListEntity(
+                    route_id=r.id,
+                    name=r.name,
+                    direction=Direction.INBOUND,
+                    trading_partner_id=r.trading_partner_id,
+                    isa_sender_id=r.isa_sender_id,
+                    isa_receiver_id=r.isa_receiver_id,
+                    gs_sender_id=r.gs_sender_id,
+                    gs_receiver_id=r.gs_receiver_id,
+                    transaction_type=r.transaction_type,
+                    destination_type=dest_type,
+                    destination_name=dest_name,
+                    webhook_id=r.webhook_id,
+                    as2_partner_id=r.as2_partner_id,
+                    sftp_partner_id=r.sftp_partner_id,
+                    active=r.active,
+                )
+            )
+
+        return results
diff --git a/services/api/src/api/core/services/outbound_route_service.py b/services/api/src/api/core/services/outbound_route_service.py
index ab2ce326..d6883c9d 100644
--- a/services/api/src/api/core/services/outbound_route_service.py
+++ b/services/api/src/api/core/services/outbound_route_service.py
@@ -1,19 +1,25 @@
 import logging
-from typing import Any
 from uuid import UUID
 
 from api.core.uow import UnitOfWork
 from api.domain.models import (
     CreateOutboundRouteCmd,
+    OutboundRouteListEntity,
     RouteEntity,
     UpdateOutboundRouteCmd,
 )
 from domain.events import ProvisioningEventType
+from domain.models import ConnectionType, Direction, OutboundRouteDomainModel
 
 logger = logging.getLogger(__name__)
 
 
 class OutboundRouteService:
+    """
+    Domain service responsible for the lifecycle of Outbound EDI Routes,
+    including resolution of partner names for list operations.
+    """
+
     def __init__(self, uow: UnitOfWork) -> None:
         self.uow = uow
 
@@ -21,22 +27,24 @@ async def create_outbound_route(
         self, tenant_id: int, cmd: CreateOutboundRouteCmd
     ) -> RouteEntity:
         logger.info(
-            f"Creating Outbound Route for partner {cmd.as2_partner_id} in tenant {tenant_id}"
+            f"Creating Outbound Route for partner {cmd.trading_partner_id} in tenant {tenant_id}"
+        )
+        route_id = await self.uow.outbound_routes.create_outbound_route(
+            tenant_id=tenant_id, cmd=cmd
         )
-        route_id = await self.uow.control_plane.create_outbound_route(tenant_id=tenant_id, cmd=cmd)
-        await self.uow.control_plane.publish_outbox_event(
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.OUTBOUND_ROUTE_CREATED,
             payload={"route_id": str(route_id), "tenant_id": tenant_id},
         )
-        return RouteEntity(route_id=route_id, tenant_id=tenant_id, direction="OUTBOUND")
+        return RouteEntity(route_id=route_id, tenant_id=tenant_id, direction=Direction.OUTBOUND)
 
     async def update_outbound_route(
         self, tenant_id: int, route_id: UUID, cmd: UpdateOutboundRouteCmd
     ) -> bool:
-        res = await self.uow.control_plane.update_outbound_route(tenant_id, route_id, cmd)
+        res = await self.uow.outbound_routes.update_outbound_route(tenant_id, route_id, cmd)
         if res:
-            await self.uow.control_plane.publish_outbox_event(
+            await self.uow.outbox.publish_outbox_event(
                 tenant_id=tenant_id,
                 event_type=ProvisioningEventType.OUTBOUND_ROUTE_UPDATED,
                 payload={"route_id": str(route_id), "tenant_id": tenant_id},
@@ -44,133 +52,68 @@ async def update_outbound_route(
         return res
 
     async def delete_outbound_route(self, tenant_id: int, route_id: UUID) -> bool:
-        res = await self.uow.control_plane.delete_outbound_route(tenant_id, route_id)
+        res = await self.uow.outbound_routes.delete_outbound_route(tenant_id, route_id)
         if res:
-            await self.uow.control_plane.publish_outbox_event(
+            await self.uow.outbox.publish_outbox_event(
                 tenant_id=tenant_id,
                 event_type=ProvisioningEventType.OUTBOUND_ROUTE_DELETED,
                 payload={"route_id": str(route_id), "tenant_id": tenant_id},
             )
         return res
 
-    async def get_all_routes(self, tenant_id: int) -> dict[str, list[Any]]:
-        return await self.uow.control_plane.get_all_routes(tenant_id)
-
-    async def list_routes(self, tenant_id: int) -> list[dict[str, Any]]:
-        """
-        Returns a unified list of inbound and outbound routes enriched with
-        partner/destination names. Batch-fetches names to avoid N+1 queries.
-        """
-        routes_data = await self.uow.control_plane.get_all_routes(tenant_id)
-        inbound: list[Any] = routes_data.get("inbound", [])
-        outbound: list[Any] = routes_data.get("outbound", [])
+    async def list_outbound_routes(self, tenant_id: int) -> list[OutboundRouteListEntity]:
+        outbound = await self.uow.outbound_routes.list_outbound_routes(tenant_id)
 
         as2_ids: set[UUID] = set()
         sftp_ids: set[UUID] = set()
-        webhook_ids: set[UUID] = set()
-
-        for r in inbound:
-            if getattr(r, "as2_partner_id", None):
-                as2_ids.add(r.as2_partner_id)
-            if getattr(r, "sftp_partner_id", None):
-                sftp_ids.add(r.sftp_partner_id)
-            if getattr(r, "webhook_id", None):
-                webhook_ids.add(r.webhook_id)
-
-        for r in outbound:
-            if getattr(r, "as2_partner_id", None):
-                as2_ids.add(r.as2_partner_id)
-            if getattr(r, "sftp_partner_id", None):
-                sftp_ids.add(r.sftp_partner_id)
-
-        as2_names: dict[UUID, str] = (
-            await self.uow.control_plane.get_as2_partners_by_ids(tenant_id, list(as2_ids))
+
+        for out_r in outbound:
+            if out_r.as2_partner_id:
+                as2_ids.add(out_r.as2_partner_id)
+            if out_r.sftp_partner_id:
+                sftp_ids.add(out_r.sftp_partner_id)
+
+        as2_names = (
+            await self.uow.as2_partners.get_as2_partners_by_ids(tenant_id, list(as2_ids))
             if as2_ids
             else {}
         )
-        sftp_names: dict[UUID, str] = (
-            await self.uow.control_plane.get_sftp_partners_by_ids(tenant_id, list(sftp_ids))
+        sftp_names = (
+            await self.uow.sftp_partners.get_sftp_partners_by_ids(tenant_id, list(sftp_ids))
             if sftp_ids
             else {}
         )
-        webhook_names: dict[UUID, str] = (
-            await self.uow.control_plane.get_webhooks_by_ids(tenant_id, list(webhook_ids))
-            if webhook_ids
-            else {}
-        )
 
-        def _resolve_destination(r: Any) -> tuple[str, str]:
-            if getattr(r, "as2_partner_id", None):
-                return "AS2", as2_names.get(r.as2_partner_id, str(r.as2_partner_id))
-            if getattr(r, "sftp_partner_id", None):
-                return "SFTP", sftp_names.get(r.sftp_partner_id, str(r.sftp_partner_id))
-            if getattr(r, "webhook_id", None):
-                return "WEBHOOK", webhook_names.get(r.webhook_id, str(r.webhook_id))
-            return "UNKNOWN", "Unknown"
+        results: list[OutboundRouteListEntity] = []
 
-        results: list[dict[str, Any]] = []
+        def _resolve_destination(r: OutboundRouteDomainModel) -> tuple[ConnectionType | str, str]:
+            if r.as2_partner_id:
+                return ConnectionType.AS2, as2_names.get(r.as2_partner_id, str(r.as2_partner_id))
+            if r.sftp_partner_id:
+                return ConnectionType.SFTP, sftp_names.get(
+                    r.sftp_partner_id, str(r.sftp_partner_id)
+                )
+            return "UNKNOWN", "Unknown"
 
-        for r in inbound:
-            dest_type, dest_name = _resolve_destination(r)
-            results.append(
-                {
-                    "route_id": r.id,
-                    "name": r.name,
-                    "direction": "INBOUND",
-                    "trading_partner_id": r.trading_partner_id,
-                    "isa_sender_id": r.isa_sender_id,
-                    "isa_receiver_id": r.isa_receiver_id,
-                    "gs_sender_id": r.gs_sender_id,
-                    "gs_receiver_id": r.gs_receiver_id,
-                    "transaction_type": r.transaction_type,
-                    "destination_type": dest_type,
-                    "destination_name": dest_name,
-                    "webhook_id": getattr(r, "webhook_id", None),
-                    "as2_partner_id": getattr(r, "as2_partner_id", None),
-                    "sftp_partner_id": getattr(r, "sftp_partner_id", None),
-                    "active": r.active,
-                }
-            )
+        for out_r in outbound:
+            dest_type, dest_name = _resolve_destination(out_r)
 
-        for r in outbound:
-            dest_type, dest_name = _resolve_destination(r)
             results.append(
-                {
-                    "route_id": r.id,
-                    "name": r.name,
-                    "direction": "OUTBOUND",
-                    "trading_partner_id": r.trading_partner_id,
-                    "transaction_type": "*",
-                    "isa_sender_id": None,
-                    "isa_receiver_id": None,
-                    "gs_sender_id": None,
-                    "gs_receiver_id": None,
-                    "destination_type": dest_type,
-                    "destination_name": dest_name,
-                    "webhook_id": None,
-                    "as2_partner_id": getattr(r, "as2_partner_id", None),
-                    "sftp_partner_id": getattr(r, "sftp_partner_id", None),
-                    "active": r.active,
-                }
+                OutboundRouteListEntity(
+                    route_id=out_r.id,
+                    name=out_r.name,
+                    direction=Direction.OUTBOUND,
+                    trading_partner_id=out_r.trading_partner_id,
+                    transaction_type="*",
+                    isa_sender_id=None,
+                    isa_receiver_id=None,
+                    destination_type=dest_type,
+                    destination_name=dest_name,
+                    webhook_id=None,
+                    as2_partner_id=out_r.as2_partner_id,
+                    sftp_partner_id=out_r.sftp_partner_id,
+                    active=out_r.active,
+                )
             )
 
         return results
-
-    async def get_trading_partner_name(self, tenant_id: int, route: Any) -> str | None:
-        if getattr(route, "as2_partner_id", None):
-            partner = await self.uow.control_plane.get_as2_partner(tenant_id, route.as2_partner_id)
-            if not partner:
-                partner = await self.uow.control_plane.get_as2_partner(0, route.as2_partner_id)
-            if partner:
-                return str(partner.name) if partner.name else None
-        elif getattr(route, "sftp_partner_id", None):
-            sftp_partner = await self.uow.control_plane.get_sftp_partner(
-                tenant_id, route.sftp_partner_id
-            )
-            if sftp_partner:
-                return str(sftp_partner.name) if sftp_partner.name else None
-        elif getattr(route, "webhook_id", None):
-            webhook = await self.uow.control_plane.get_webhook(tenant_id, route.webhook_id)
-            if webhook:
-                return str(webhook.name) if webhook.name else None
-        return None
diff --git a/services/api/src/api/core/services/route_service.py b/services/api/src/api/core/services/route_service.py
deleted file mode 100644
index a8242b4c..00000000
--- a/services/api/src/api/core/services/route_service.py
+++ /dev/null
@@ -1,192 +0,0 @@
-import logging
-from typing import Any
-from uuid import UUID
-
-from api.core.uow import UnitOfWork
-from api.domain.models import (
-    CreateInboundRouteCmd,
-    CreateOutboundRouteCmd,
-    RouteEntity,
-    UpdateInboundRouteCmd,
-    UpdateOutboundRouteCmd,
-)
-from domain.events import ProvisioningEventType
-
-logger = logging.getLogger(__name__)
-
-
-class RouteService:
-    """
-    Domain service responsible for the lifecycle of Inbound and Outbound EDI Routes,
-    including resolution of partner names for list operations.
-    """
-
-    def __init__(self, uow: UnitOfWork) -> None:
-        self.uow = uow
-
-    async def create_inbound_route(self, tenant_id: int, cmd: CreateInboundRouteCmd) -> RouteEntity:
-        logger.info(f"Creating Inbound Route for sender {cmd.isa_sender_id} in tenant {tenant_id}")
-        route_id = await self.uow.control_plane.create_inbound_route(tenant_id=tenant_id, cmd=cmd)
-        await self.uow.control_plane.publish_outbox_event(
-            tenant_id=tenant_id,
-            event_type=ProvisioningEventType.INBOUND_ROUTE_CREATED,
-            payload={"route_id": str(route_id), "tenant_id": tenant_id},
-        )
-        return RouteEntity(route_id=route_id, tenant_id=tenant_id, direction="INBOUND")
-
-    async def update_inbound_route(
-        self, tenant_id: int, route_id: UUID, cmd: UpdateInboundRouteCmd
-    ) -> bool:
-        res = await self.uow.control_plane.update_inbound_route(tenant_id, route_id, cmd)
-        if res:
-            await self.uow.control_plane.publish_outbox_event(
-                tenant_id=tenant_id,
-                event_type=ProvisioningEventType.INBOUND_ROUTE_UPDATED,
-                payload={"route_id": str(route_id), "tenant_id": tenant_id},
-            )
-        return res
-
-    async def delete_inbound_route(self, tenant_id: int, route_id: UUID) -> bool:
-        res = await self.uow.control_plane.delete_inbound_route(tenant_id, route_id)
-        if res:
-            await self.uow.control_plane.publish_outbox_event(
-                tenant_id=tenant_id,
-                event_type=ProvisioningEventType.INBOUND_ROUTE_DELETED,
-                payload={"route_id": str(route_id), "tenant_id": tenant_id},
-            )
-        return res
-
-    async def create_outbound_route(
-        self, tenant_id: int, cmd: CreateOutboundRouteCmd
-    ) -> RouteEntity:
-        logger.info(
-            f"Creating Outbound Route for partner {cmd.trading_partner_id} in tenant {tenant_id}"
-        )
-        route_id = await self.uow.control_plane.create_outbound_route(tenant_id=tenant_id, cmd=cmd)
-        await self.uow.control_plane.publish_outbox_event(
-            tenant_id=tenant_id,
-            event_type=ProvisioningEventType.OUTBOUND_ROUTE_CREATED,
-            payload={"route_id": str(route_id), "tenant_id": tenant_id},
-        )
-        return RouteEntity(route_id=route_id, tenant_id=tenant_id, direction="OUTBOUND")
-
-    async def update_outbound_route(
-        self, tenant_id: int, route_id: UUID, cmd: UpdateOutboundRouteCmd
-    ) -> bool:
-        res = await self.uow.control_plane.update_outbound_route(tenant_id, route_id, cmd)
-        if res:
-            await self.uow.control_plane.publish_outbox_event(
-                tenant_id=tenant_id,
-                event_type=ProvisioningEventType.OUTBOUND_ROUTE_UPDATED,
-                payload={"route_id": str(route_id), "tenant_id": tenant_id},
-            )
-        return res
-
-    async def delete_outbound_route(self, tenant_id: int, route_id: UUID) -> bool:
-        res = await self.uow.control_plane.delete_outbound_route(tenant_id, route_id)
-        if res:
-            await self.uow.control_plane.publish_outbox_event(
-                tenant_id=tenant_id,
-                event_type=ProvisioningEventType.OUTBOUND_ROUTE_DELETED,
-                payload={"route_id": str(route_id), "tenant_id": tenant_id},
-            )
-        return res
-
-    async def list_routes(self, tenant_id: int) -> list[dict[str, Any]]:
-        from typing import cast
-
-        from domain.models import InboundRouteDomainModel, OutboundRouteDomainModel
-
-        routes = await self.uow.control_plane.get_all_routes(tenant_id)
-        inbound = cast("list[InboundRouteDomainModel]", routes.get("inbound", []))
-        outbound = cast("list[OutboundRouteDomainModel]", routes.get("outbound", []))
-
-        as2_ids: set[UUID] = set()
-        sftp_ids: set[UUID] = set()
-        webhook_ids: set[UUID] = set()
-
-        for r in inbound:
-            if r.as2_partner_id:
-                as2_ids.add(r.as2_partner_id)
-            if r.sftp_partner_id:
-                sftp_ids.add(r.sftp_partner_id)
-            if r.webhook_id:
-                webhook_ids.add(r.webhook_id)
-
-        for out_r in outbound:
-            if out_r.as2_partner_id:
-                as2_ids.add(out_r.as2_partner_id)
-            if out_r.sftp_partner_id:
-                sftp_ids.add(out_r.sftp_partner_id)
-
-        as2_names = (
-            await self.uow.control_plane.get_as2_partners_by_ids(tenant_id, list(as2_ids))
-            if as2_ids
-            else {}
-        )
-        sftp_names = (
-            await self.uow.control_plane.get_sftp_partners_by_ids(tenant_id, list(sftp_ids))
-            if sftp_ids
-            else {}
-        )
-        webhook_names = (
-            await self.uow.control_plane.get_webhooks_by_ids(tenant_id, list(webhook_ids))
-            if webhook_ids
-            else {}
-        )
-
-        results: list[dict[str, Any]] = []
-
-        def _resolve_destination(r: Any) -> tuple[str, str]:
-            if r.as2_partner_id:
-                return "AS2", as2_names.get(r.as2_partner_id, str(r.as2_partner_id))
-            if r.sftp_partner_id:
-                return "SFTP", sftp_names.get(r.sftp_partner_id, str(r.sftp_partner_id))
-            if getattr(r, "webhook_id", None):
-                return "WEBHOOK", webhook_names.get(r.webhook_id, str(r.webhook_id))
-            return "UNKNOWN", "Unknown"
-
-        for r in inbound:
-            dest_type, dest_name = _resolve_destination(r)
-
-            results.append(
-                {
-                    "route_id": r.id,
-                    "name": r.name,
-                    "direction": "INBOUND",
-                    "trading_partner_id": r.trading_partner_id,
-                    "isa_sender_id": r.isa_sender_id,
-                    "isa_receiver_id": r.isa_receiver_id,
-                    "gs_sender_id": r.gs_sender_id,
-                    "gs_receiver_id": r.gs_receiver_id,
-                    "transaction_type": r.transaction_type,
-                    "destination_type": dest_type,
-                    "destination_name": dest_name,
-                    "webhook_id": r.webhook_id,
-                    "as2_partner_id": r.as2_partner_id,
-                    "sftp_partner_id": r.sftp_partner_id,
-                    "active": r.active,
-                }
-            )
-
-        for out_r in outbound:
-            dest_type, dest_name = _resolve_destination(out_r)
-
-            results.append(
-                {
-                    "route_id": out_r.id,
-                    "name": out_r.name,
-                    "direction": "OUTBOUND",
-                    "trading_partner_id": out_r.trading_partner_id,
-                    "transaction_type": "*",
-                    "isa_sender_id": None,
-                    "isa_receiver_id": None,
-                    "destination_type": dest_type,
-                    "destination_name": dest_name,
-                    "as2_partner_id": out_r.as2_partner_id,
-                    "sftp_partner_id": out_r.sftp_partner_id,
-                    "active": out_r.active,
-                }
-            )
-
-        return results
diff --git a/services/api/src/api/core/services/sftp_partner_service.py b/services/api/src/api/core/services/sftp_partner_service.py
index adc4fa4b..ad96ebfb 100644
--- a/services/api/src/api/core/services/sftp_partner_service.py
+++ b/services/api/src/api/core/services/sftp_partner_service.py
@@ -1,3 +1,4 @@
+import hashlib
 import logging
 import uuid
 from uuid import UUID
@@ -10,6 +11,7 @@
     UpdateSFTPPartnerCmd,
 )
 from domain.events import ProvisioningEventType
+from domain.models import ConnectionType, PartnerStatus
 
 logger = logging.getLogger(__name__)
 
@@ -24,8 +26,8 @@ def __init__(self, uow: UnitOfWork) -> None:
 
     async def create_sftp_partner(self, tenant_id: int, cmd: CreateSFTPPartnerCmd) -> PartnerEntity:
         logger.info(f"Creating SFTP partner {cmd.name} for tenant {tenant_id}")
-        partner_id = await self.uow.control_plane.create_sftp_partner(tenant_id=tenant_id, cmd=cmd)
-        await self.uow.control_plane.publish_outbox_event(
+        partner_id = await self.uow.sftp_partners.create_sftp_partner(tenant_id=tenant_id, cmd=cmd)
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.SFTP_PARTNER_CREATED,
             payload={"partner_id": str(partner_id), "tenant_id": tenant_id},
@@ -36,15 +38,15 @@ async def create_sftp_partner(self, tenant_id: int, cmd: CreateSFTPPartnerCmd) -
             partner_id=partner_id,
             tenant_id=tenant_id,
             name=cmd.name,
-            type="SFTP",
-            status="INACTIVE",
+            type=ConnectionType.SFTP,
+            status=PartnerStatus.INACTIVE,
         )
 
     async def update_sftp_partner(
         self, tenant_id: int, partner_id: UUID, cmd: UpdateSFTPPartnerCmd
     ) -> PartnerEntity:
         logger.info(f"Updating SFTP partner {partner_id} for tenant {tenant_id}")
-        existing = await self.uow.control_plane.get_sftp_partner(tenant_id, partner_id)
+        existing = await self.uow.sftp_partners.get_sftp_partner(tenant_id, partner_id)
         if not existing:
             raise ValueError(f"SFTP partner {partner_id} not found")
 
@@ -63,25 +65,27 @@ async def update_sftp_partner(
         if has_password and has_vault:
             raise ValueError("SFTP partner cannot have both a password and a credentials_vault_ref")
 
-        await self.uow.control_plane.update_sftp_partner(
+        await self.uow.sftp_partners.update_sftp_partner(
             tenant_id=tenant_id, partner_id=partner_id, cmd=cmd
         )
 
-        update_hash = str(hash(str(cmd)))
-        await self.uow.control_plane.publish_outbox_event(
+        update_hash = hashlib.sha256(str(cmd).encode()).hexdigest()
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.SFTP_PARTNER_UPDATED,
             payload={"partner_id": str(partner_id), "tenant_id": tenant_id},
             idempotency_key=uuid.uuid5(partner_id, f"SFTP_PARTNER_UPDATED-{update_hash}"),
         )
-        updated = await self.uow.control_plane.get_sftp_partner(tenant_id, partner_id)
-        if not updated:
+        updated_partner = await self.uow.sftp_partners.get_sftp_partner(tenant_id, partner_id)
+        if not updated_partner:
             raise ValueError(f"SFTP partner {partner_id} not found")
 
         return PartnerEntity(
             partner_id=partner_id,
             tenant_id=tenant_id,
-            name=str(cmd.name) if (cmd.name is not UNSET and cmd.name) else str(updated.name),
-            type="SFTP",
-            status="ACTIVE" if updated.active else "INACTIVE",
+            name=str(cmd.name)
+            if (cmd.name is not UNSET and cmd.name)
+            else str(updated_partner.name),
+            type=ConnectionType.SFTP,
+            status=PartnerStatus.ACTIVE if updated_partner.active else PartnerStatus.INACTIVE,
         )
diff --git a/services/api/src/api/core/services/webhook_service.py b/services/api/src/api/core/services/webhook_service.py
index 634d8370..9e94c5fa 100644
--- a/services/api/src/api/core/services/webhook_service.py
+++ b/services/api/src/api/core/services/webhook_service.py
@@ -12,6 +12,7 @@
 from api.core.uow import UnitOfWork
 from api.domain.models import CreateWebhookCmd, PartnerEntity
 from domain.events import ProvisioningEventType
+from domain.models import ConnectionType, PartnerStatus
 
 logger = logging.getLogger(__name__)
 
@@ -29,8 +30,8 @@ def __init__(self, uow: UnitOfWork) -> None:
 
     async def create_webhook(self, tenant_id: int, cmd: CreateWebhookCmd) -> PartnerEntity:
         logger.info("Webhook creating", extra={"tenant_id": tenant_id, "webhook_name": cmd.name})
-        partner_id = await self.uow.control_plane.create_webhook(tenant_id=tenant_id, cmd=cmd)
-        await self.uow.control_plane.publish_outbox_event(
+        partner_id = await self.uow.webhooks.create_webhook(tenant_id=tenant_id, cmd=cmd)
+        await self.uow.outbox.publish_outbox_event(
             tenant_id=tenant_id,
             event_type=ProvisioningEventType.WEBHOOK_CREATED,
             payload={"partner_id": str(partner_id), "tenant_id": tenant_id},
@@ -39,8 +40,8 @@ async def create_webhook(self, tenant_id: int, cmd: CreateWebhookCmd) -> Partner
             partner_id=partner_id,
             tenant_id=tenant_id,
             name=cmd.name,
-            type="WEBHOOK",
-            status="ACTIVE",
+            type=ConnectionType.WEBHOOK,
+            status=PartnerStatus.ACTIVE,
         )
 
     async def update_webhook(
@@ -54,11 +55,9 @@ async def update_webhook(
         logger.info(
             "Webhook updating", extra={"tenant_id": tenant_id, "webhook_id": str(webhook_id)}
         )
-        result = await self.uow.control_plane.update_webhook(
-            tenant_id, webhook_id, name, active, url
-        )
+        result = await self.uow.webhooks.update_webhook(tenant_id, webhook_id, name, active, url)
         if result:
-            await self.uow.control_plane.publish_outbox_event(
+            await self.uow.outbox.publish_outbox_event(
                 tenant_id=tenant_id,
                 event_type=ProvisioningEventType.WEBHOOK_UPDATED,
                 payload={"partner_id": str(webhook_id), "tenant_id": tenant_id},
@@ -69,9 +68,9 @@ async def delete_webhook(self, tenant_id: int, webhook_id: UUID) -> bool:
         logger.info(
             "Webhook deleting", extra={"tenant_id": tenant_id, "webhook_id": str(webhook_id)}
         )
-        result = await self.uow.control_plane.delete_webhook(tenant_id, webhook_id)
+        result = await self.uow.webhooks.delete_webhook(tenant_id, webhook_id)
         if result:
-            await self.uow.control_plane.publish_outbox_event(
+            await self.uow.outbox.publish_outbox_event(
                 tenant_id=tenant_id,
                 event_type=ProvisioningEventType.WEBHOOK_DELETED,
                 payload={"partner_id": str(webhook_id), "tenant_id": tenant_id},
diff --git a/services/api/src/api/core/uow.py b/services/api/src/api/core/uow.py
index 2750ef7a..41281c5d 100644
--- a/services/api/src/api/core/uow.py
+++ b/services/api/src/api/core/uow.py
@@ -1,6 +1,16 @@
 from typing import Any, Self
 
-from api.adapters.repository import SqlAlchemyControlPlaneRepository, SqlAlchemyDataPlaneRepository
+from api.adapters.api_token_repository import SqlAlchemyApiTokenRepository
+from api.adapters.as2_partner_repository import SqlAlchemyAS2TradingPartnerRepository
+from api.adapters.as2_partnership_repository import SqlAlchemyAS2PartnershipRepository
+from api.adapters.edi_header_repository import SqlAlchemyEdiHeaderRepository
+from api.adapters.inbound_route_repository import SqlAlchemyInboundRouteRepository
+from api.adapters.outbound_route_repository import SqlAlchemyOutboundRouteRepository
+from api.adapters.outbox_repository import SqlAlchemyOutboxRepository
+from api.adapters.sftp_repository import SqlAlchemySFTPPartnerRepository
+from api.adapters.tenant_repository import SqlAlchemyTenantRepository
+from api.adapters.transaction_repository import SqlAlchemyTransactionRepository
+from api.adapters.webhook_repository import SqlAlchemyWebhookRepository
 from sqlalchemy.ext.asyncio import AsyncSession
 
 
@@ -22,12 +32,27 @@ def __init__(
 
         from database.base_repository import GlobalSession, TenantSession
 
-        self.control_plane = SqlAlchemyControlPlaneRepository(cast(GlobalSession, global_session))
-        self.data_plane = (
-            SqlAlchemyDataPlaneRepository(cast(TenantSession, tenant_session))
-            if tenant_session
-            else None
-        )
+        gs = cast(GlobalSession, global_session)
+        ts = cast(TenantSession, tenant_session) if tenant_session else None
+
+        self.api_tokens = SqlAlchemyApiTokenRepository(gs)
+        self.as2_partners = SqlAlchemyAS2TradingPartnerRepository(gs)
+        self.as2_partnerships = SqlAlchemyAS2PartnershipRepository(gs)
+        self.inbound_routes = SqlAlchemyInboundRouteRepository(gs)
+        self.outbound_routes = SqlAlchemyOutboundRouteRepository(gs)
+        self.outbox = SqlAlchemyOutboxRepository(gs)
+        self.sftp_partners = SqlAlchemySFTPPartnerRepository(gs)
+        self.tenants = SqlAlchemyTenantRepository(gs)
+        self.webhooks = SqlAlchemyWebhookRepository(gs)
+        self.edi_headers = SqlAlchemyEdiHeaderRepository(gs)
+
+        self._transactions = SqlAlchemyTransactionRepository(ts) if ts else None
+
+    @property
+    def transactions(self) -> SqlAlchemyTransactionRepository:
+        if not self._transactions:
+            raise RuntimeError("Transaction repository requires an active tenant session.")
+        return self._transactions
 
     async def __aenter__(self) -> Self:
         return self
diff --git a/services/api/src/api/dependencies.py b/services/api/src/api/dependencies.py
index f0ccd1f3..8d184f03 100644
--- a/services/api/src/api/dependencies.py
+++ b/services/api/src/api/dependencies.py
@@ -53,62 +53,6 @@ def get_message_queue() -> MessageQueuePort:
     return SQSMessageQueueAdapter(endpoint_url=endpoint_url)
 
 
-from api.adapters.as2_partner_repository import SqlAlchemyAS2TradingPartnerRepository  # noqa: E402
-from api.adapters.as2_partnership_repository import SqlAlchemyAS2PartnershipRepository  # noqa: E402
-from api.adapters.edi_header_repository import SqlAlchemyEdiHeaderRepository  # noqa: E402
-from api.adapters.inbound_route_repository import SqlAlchemyInboundRouteRepository  # noqa: E402
-from api.adapters.outbound_route_repository import SqlAlchemyOutboundRouteRepository  # noqa: E402
-from api.adapters.sftp_repository import SqlAlchemySFTPPartnerRepository  # noqa: E402
-from api.adapters.webhook_repository import SqlAlchemyWebhookRepository  # noqa: E402
-from api.ports.as2_partner_repository import AS2TradingPartnerRepositoryPort  # noqa: E402
-from api.ports.as2_partnership_repository import AS2PartnershipRepositoryPort  # noqa: E402
-from api.ports.edi_header_repository import EdiHeaderRepositoryPort  # noqa: E402
-from api.ports.inbound_route_repository import InboundRouteRepositoryPort  # noqa: E402
-from api.ports.outbound_route_repository import OutboundRouteRepositoryPort  # noqa: E402
-from api.ports.sftp_repository import SFTPPartnerRepositoryPort  # noqa: E402
-from api.ports.webhook_repository import WebhookRepositoryPort  # noqa: E402
-
-
-def get_as2_partner_repo(
-    session: GlobalSession = Depends(get_global_session),
-) -> AS2TradingPartnerRepositoryPort:
-    return SqlAlchemyAS2TradingPartnerRepository(session)
-
-
-def get_as2_partnership_repo(
-    session: GlobalSession = Depends(get_global_session),
-) -> AS2PartnershipRepositoryPort:
-    return SqlAlchemyAS2PartnershipRepository(session)
-
-
-def get_inbound_route_repo(
-    session: GlobalSession = Depends(get_global_session),
-) -> InboundRouteRepositoryPort:
-    return SqlAlchemyInboundRouteRepository(session)
-
-
-def get_outbound_route_repo(
-    session: GlobalSession = Depends(get_global_session),
-) -> OutboundRouteRepositoryPort:
-    return SqlAlchemyOutboundRouteRepository(session)
-
-
-def get_sftp_partner_repo(
-    session: GlobalSession = Depends(get_global_session),
-) -> SFTPPartnerRepositoryPort:
-    return SqlAlchemySFTPPartnerRepository(session)
-
-
-def get_webhook_repo(session: GlobalSession = Depends(get_global_session)) -> WebhookRepositoryPort:
-    return SqlAlchemyWebhookRepository(session)
-
-
-def get_edi_header_repo(
-    session: GlobalSession = Depends(get_global_session),
-) -> EdiHeaderRepositoryPort:
-    return SqlAlchemyEdiHeaderRepository(session)
-
-
 async def get_uow(
     global_session: GlobalSession = Depends(get_global_session),
     # Optional tenant_session for platform admin routes
diff --git a/services/api/src/api/domain/models.py b/services/api/src/api/domain/models.py
index df1b68a2..b6168f53 100644
--- a/services/api/src/api/domain/models.py
+++ b/services/api/src/api/domain/models.py
@@ -8,6 +8,8 @@
 from typing import Any
 from uuid import UUID
 
+from domain.models import ConnectionType, Direction, PartnerStatus
+
 
 class MDNType(StrEnum):
     SYNC = "SYNC"
@@ -222,15 +224,46 @@ class PartnerEntity:
     partner_id: UUID
     tenant_id: int
     name: str
-    type: str  # AS2, SFTP, WEBHOOK
-    status: str
+    type: ConnectionType
+    status: PartnerStatus
 
 
 @dataclass(frozen=True)
 class RouteEntity:
     route_id: UUID
     tenant_id: int
-    direction: str  # INBOUND, OUTBOUND
+    direction: Direction
+
+
+@dataclass(frozen=True)
+class BaseRouteListEntity:
+    route_id: UUID
+    name: str
+    trading_partner_id: str | None
+    destination_type: str
+    destination_name: str
+    webhook_id: UUID | None
+    as2_partner_id: UUID | None
+    sftp_partner_id: UUID | None
+    active: bool
+
+
+@dataclass(frozen=True)
+class InboundRouteListEntity(BaseRouteListEntity):
+    direction: Direction
+    isa_sender_id: str
+    isa_receiver_id: str
+    gs_sender_id: str | None
+    gs_receiver_id: str | None
+    transaction_type: str | None
+
+
+@dataclass(frozen=True)
+class OutboundRouteListEntity(BaseRouteListEntity):
+    direction: Direction
+    transaction_type: str
+    isa_sender_id: str | None
+    isa_receiver_id: str | None
 
 
 # ---------------------------------------------------------------------------
@@ -238,6 +271,17 @@ class RouteEntity:
 # ---------------------------------------------------------------------------
 
 
+@dataclass(frozen=True)
+class ApiTokenListEntity:
+    id: str
+    name: str
+    client_id: str
+    active: bool
+    last_used_at: str | None
+    expires_at: str | None
+    created_at: str
+
+
 @dataclass(frozen=True)
 class CreateApiTokenCmd:
     name: str
diff --git a/services/api/src/api/ports/api_token_repository.py b/services/api/src/api/ports/api_token_repository.py
index b28c0abe..a66722b0 100644
--- a/services/api/src/api/ports/api_token_repository.py
+++ b/services/api/src/api/ports/api_token_repository.py
@@ -1,6 +1,8 @@
 from typing import Any, Protocol
 from uuid import UUID
 
+from api.domain.models import ApiTokenListEntity
+
 
 class ApiTokenRepositoryPort(Protocol):
     """
@@ -18,7 +20,9 @@ async def create_api_token(
         expires_at: Any | None,
     ) -> UUID: ...
 
-    async def list_api_tokens(self, tenant_id: int) -> list[dict[str, Any]]: ...
+    async def list_api_tokens(self, tenant_id: int) -> list[ApiTokenListEntity]: ...
+
+    async def get_api_token(self, tenant_id: int, token_id: UUID) -> dict[str, Any] | None: ...
 
     async def update_api_token(
         self, tenant_id: int, token_id: UUID, name: str | None = None, active: bool | None = None
diff --git a/services/api/src/api/ports/control_plane_aggregator.py b/services/api/src/api/ports/control_plane_aggregator.py
deleted file mode 100644
index a5aa37d5..00000000
--- a/services/api/src/api/ports/control_plane_aggregator.py
+++ /dev/null
@@ -1,25 +0,0 @@
-from api.ports.api_token_repository import ApiTokenRepositoryPort
-from api.ports.as2_partner_repository import AS2TradingPartnerRepositoryPort
-from api.ports.as2_partnership_repository import AS2PartnershipRepositoryPort
-from api.ports.edi_header_repository import EdiHeaderRepositoryPort
-from api.ports.inbound_route_repository import InboundRouteRepositoryPort
-from api.ports.outbound_route_repository import OutboundRouteRepositoryPort
-from api.ports.outbox_repository import OutboxRepositoryPort
-from api.ports.sftp_repository import SFTPPartnerRepositoryPort
-from api.ports.tenant_repository import TenantRepositoryPort
-from api.ports.webhook_repository import WebhookRepositoryPort
-
-
-class ControlPlaneAggregatorPort(
-    AS2TradingPartnerRepositoryPort,
-    AS2PartnershipRepositoryPort,
-    InboundRouteRepositoryPort,
-    OutboundRouteRepositoryPort,
-    SFTPPartnerRepositoryPort,
-    WebhookRepositoryPort,
-    EdiHeaderRepositoryPort,
-    TenantRepositoryPort,
-    ApiTokenRepositoryPort,
-    OutboxRepositoryPort,
-):
-    pass
diff --git a/services/api/src/api/ports/inbound_route_repository.py b/services/api/src/api/ports/inbound_route_repository.py
index 15f305d5..4c1252ea 100644
--- a/services/api/src/api/ports/inbound_route_repository.py
+++ b/services/api/src/api/ports/inbound_route_repository.py
@@ -19,3 +19,4 @@ async def get_inbound_route(
     ) -> InboundRouteDomainModel | None: ...
     async def get_tenant_by_isa(self, isa_sender_id: str, isa_receiver_id: str) -> int | None: ...
     async def delete_inbound_route(self, tenant_id: int, route_id: UUID) -> bool: ...
+    async def list_inbound_routes(self, tenant_id: int) -> list[InboundRouteDomainModel]: ...
diff --git a/services/api/src/api/ports/outbound_route_repository.py b/services/api/src/api/ports/outbound_route_repository.py
index b0d76ba6..9c00a330 100644
--- a/services/api/src/api/ports/outbound_route_repository.py
+++ b/services/api/src/api/ports/outbound_route_repository.py
@@ -2,7 +2,7 @@
 from uuid import UUID
 
 from api.domain.models import CreateOutboundRouteCmd, UpdateOutboundRouteCmd
-from domain.models import InboundRouteDomainModel, OutboundRouteDomainModel
+from domain.models import OutboundRouteDomainModel
 
 
 class OutboundRouteRepositoryPort(Protocol):
@@ -17,6 +17,4 @@ async def get_outbound_route(
     async def get_outbound_route_by_trading_partner_id(
         self, tenant_id: int, trading_partner_id: str
     ) -> OutboundRouteDomainModel | None: ...
-    async def get_all_routes(
-        self, tenant_id: int
-    ) -> dict[str, list[OutboundRouteDomainModel | InboundRouteDomainModel]]: ...
+    async def list_outbound_routes(self, tenant_id: int) -> list[OutboundRouteDomainModel]: ...
diff --git a/services/api/src/api/ports/repository.py b/services/api/src/api/ports/repository.py
index 8f93d655..4059a766 100644
--- a/services/api/src/api/ports/repository.py
+++ b/services/api/src/api/ports/repository.py
@@ -22,25 +22,4 @@
     "TenantRepositoryPort",
     "TransactionRepositoryPort",
     "WebhookRepositoryPort",
-    "ControlPlaneRepositoryPort",
-    "DataPlaneRepositoryPort",
 ]
-
-
-class ControlPlaneRepositoryPort(
-    AS2TradingPartnerRepositoryPort,
-    AS2PartnershipRepositoryPort,
-    InboundRouteRepositoryPort,
-    OutboundRouteRepositoryPort,
-    SFTPPartnerRepositoryPort,
-    WebhookRepositoryPort,
-    EdiHeaderRepositoryPort,
-    TenantRepositoryPort,
-    ApiTokenRepositoryPort,
-    OutboxRepositoryPort,
-):
-    pass
-
-
-class DataPlaneRepositoryPort(TransactionRepositoryPort):
-    pass
diff --git a/services/api/src/api/routers/developers/api_tokens.py b/services/api/src/api/routers/developers/api_tokens.py
index 11ddedd6..d8812aec 100644
--- a/services/api/src/api/routers/developers/api_tokens.py
+++ b/services/api/src/api/routers/developers/api_tokens.py
@@ -67,7 +67,9 @@ async def list_api_tokens(
     """List all API tokens for the current tenant."""
     service = ApiTokenService(repo)
     tokens = await service.list_tokens(tenant_id)
-    return ApiTokenListResponse(tokens=[ApiTokenListItem(**t) for t in tokens])
+    return ApiTokenListResponse(
+        tokens=[ApiTokenListItem.model_validate(t, from_attributes=True) for t in tokens]
+    )
 
 
 @router.patch(
diff --git a/services/api/src/api/routers/explorer.py b/services/api/src/api/routers/explorer.py
index 96e2006a..bb596ff3 100644
--- a/services/api/src/api/routers/explorer.py
+++ b/services/api/src/api/routers/explorer.py
@@ -113,7 +113,7 @@ async def explore_edi_messages(
 ) -> Any:
     async with uow:
         filters_list = [f.model_dump() for f in req.filters]
-        messages = await uow.data_plane.explorer_list_edi_messages(  # type: ignore
+        messages = await uow.transactions.explorer_list_edi_messages(
             tenant_id=tenant_id,
             filters=filters_list,
             limit=limit,
@@ -132,7 +132,7 @@ async def explore_edi_json(
 ) -> Any:
     async with uow:
         filters_list = [f.model_dump() for f in req.filters]
-        jsons = await uow.data_plane.explorer_list_edi_json(  # type: ignore
+        jsons = await uow.transactions.explorer_list_edi_json(
             tenant_id=tenant_id,
             filters=filters_list,
             limit=limit,
diff --git a/services/api/src/api/routers/routes.py b/services/api/src/api/routers/routes.py
index e9225ab6..13d87933 100644
--- a/services/api/src/api/routers/routes.py
+++ b/services/api/src/api/routers/routes.py
@@ -12,7 +12,7 @@
     RouteResponse,
     UpdateRouteRequest,
 )
-from api.core.services import RouteService
+from api.core.services import InboundRouteService, OutboundRouteService
 from api.core.uow import UnitOfWork
 from api.dependencies import get_tenant_uow
 from api.domain.models import (
@@ -38,8 +38,13 @@ async def list_routes(
     List all Active Routes for the current Tenant.
     """
     async with uow:
-        service = RouteService(uow=uow)
-        routes = await service.list_routes(tenant_id)
+        inbound_service = InboundRouteService(uow=uow)
+        outbound_service = OutboundRouteService(uow=uow)
+
+        inbound_routes = await inbound_service.list_inbound_routes(tenant_id)
+        outbound_routes = await outbound_service.list_outbound_routes(tenant_id)
+
+        routes = inbound_routes + outbound_routes
         return _route_list_adapter.validate_python(routes)
 
 
@@ -53,7 +58,7 @@ async def create_inbound_route(
     Creates a new Inbound Route directly in the Tenant Data Plane.
     """
     async with uow:
-        service = RouteService(uow=uow)
+        service = InboundRouteService(uow=uow)
 
         cmd = CreateInboundRouteCmd(
             name=request.name,
@@ -87,7 +92,7 @@ async def create_outbound_route(
     Creates a new Outbound Route directly in the Tenant Data Plane.
     """
     async with uow:
-        service = RouteService(uow=uow)
+        service = OutboundRouteService(uow=uow)
 
         cmd = CreateOutboundRouteCmd(
             trading_partner_id=request.trading_partner_id,
@@ -115,7 +120,7 @@ async def update_inbound_route(
     Updates an Inbound Route for the current Tenant.
     """
     async with uow:
-        service = RouteService(uow=uow)
+        service = InboundRouteService(uow=uow)
 
         dump = request.model_dump(exclude_unset=True)
         cmd = UpdateInboundRouteCmd(
@@ -150,7 +155,7 @@ async def delete_inbound_route(
     Deletes an Inbound Route for the current Tenant.
     """
     async with uow:
-        service = RouteService(uow=uow)
+        service = InboundRouteService(uow=uow)
         success = await service.delete_inbound_route(tenant_id, route_id)
         if not success:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Route not found")
@@ -168,7 +173,7 @@ async def update_outbound_route(
     Updates an Outbound Route for the current Tenant.
     """
     async with uow:
-        service = RouteService(uow=uow)
+        service = OutboundRouteService(uow=uow)
 
         dump = request.model_dump(exclude_unset=True)
         cmd = UpdateOutboundRouteCmd(
@@ -196,7 +201,7 @@ async def delete_outbound_route(
     Deletes an Outbound Route for the current Tenant.
     """
     async with uow:
-        service = RouteService(uow=uow)
+        service = OutboundRouteService(uow=uow)
         success = await service.delete_outbound_route(tenant_id, route_id)
         if not success:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Route not found")
diff --git a/services/api/src/api/routers/trading_partners/__init__.py b/services/api/src/api/routers/trading_partners/__init__.py
index db5b9cd9..ed6efb62 100644
--- a/services/api/src/api/routers/trading_partners/__init__.py
+++ b/services/api/src/api/routers/trading_partners/__init__.py
@@ -32,13 +32,13 @@ async def list_trading_partners(
     async with uow:
         as2_partners: Sequence[Any] = []
         sftp_partners: Sequence[Any] = []
-        if uow.control_plane:
+        if uow.global_session is not None:
             # AS2 partners are global platform entities (tenant_id = 0) or tenant-specific
-            as2_partners = await uow.control_plane.list_as2_partners(tenant_id)
-            as2_partners_global = await uow.control_plane.list_as2_partners(0)
+            as2_partners = await uow.as2_partners.list_as2_partners(tenant_id)
+            as2_partners_global = await uow.as2_partners.list_as2_partners(0)
             as2_partners = list(as2_partners) + list(as2_partners_global)
 
-            sftp_partners = await uow.control_plane.list_sftp_partners(tenant_id)
+        sftp_partners = await uow.sftp_partners.list_sftp_partners(tenant_id)
 
         partners = []
         for p in as2_partners:
@@ -55,20 +55,20 @@ async def list_trading_partners(
                     url=str(p.url) if p.url else None,
                 )
             )
-        for p in sftp_partners:
+        for sp in sftp_partners:
             partners.append(
                 PartnerResponse(
-                    partner_id=p.id,
-                    tenant_id=p.tenant_id,
-                    name=p.name,
+                    partner_id=sp.id,
+                    tenant_id=sp.tenant_id,
+                    name=sp.name,
                     type="SFTP",
-                    status="ACTIVE" if p.active else "INACTIVE",
-                    active=p.active,
-                    host=p.host,
-                    port=p.port,
-                    username=p.username,
-                    inbound_remote_path=p.inbound_remote_path,
-                    outbound_remote_path=p.outbound_remote_path,
+                    status="ACTIVE" if sp.active else "INACTIVE",
+                    active=sp.active,
+                    host=sp.host,
+                    port=sp.port,
+                    username=sp.username,
+                    inbound_remote_path=sp.inbound_remote_path,
+                    outbound_remote_path=sp.outbound_remote_path,
                 )
             )
 
diff --git a/services/api/src/api/routers/trading_partners/as2.py b/services/api/src/api/routers/trading_partners/as2.py
index ececd2d4..96afd680 100644
--- a/services/api/src/api/routers/trading_partners/as2.py
+++ b/services/api/src/api/routers/trading_partners/as2.py
@@ -35,9 +35,9 @@ async def export_as2_certificates(
 ) -> Any:
     """Exports current and previous certificates for an AS2 partner."""
     async with uow:
-        partner = await uow.control_plane.get_as2_partner(tenant_id, partner_id)
+        partner = await uow.as2_partners.get_as2_partner(tenant_id, partner_id)
         if not partner:
-            partner = await uow.control_plane.get_as2_partner(0, partner_id)
+            partner = await uow.as2_partners.get_as2_partner(0, partner_id)
         if not partner:
             raise HTTPException(status_code=404, detail="Partner not found")
 
@@ -94,9 +94,9 @@ async def rotate_as2_certificates(
 ) -> Any:
     """Rotates certificates for an AS2 partner."""
     async with uow:
-        partner = await uow.control_plane.get_as2_partner(tenant_id, partner_id)
+        partner = await uow.as2_partners.get_as2_partner(tenant_id, partner_id)
         if not partner:
-            partner = await uow.control_plane.get_as2_partner(0, partner_id)
+            partner = await uow.as2_partners.get_as2_partner(0, partner_id)
         if not partner:
             raise HTTPException(status_code=404, detail="Partner not found")
 
diff --git a/services/api/src/api/routers/trading_partners/platform/as2_partners.py b/services/api/src/api/routers/trading_partners/platform/as2_partners.py
index 955c85f0..914dc511 100644
--- a/services/api/src/api/routers/trading_partners/platform/as2_partners.py
+++ b/services/api/src/api/routers/trading_partners/platform/as2_partners.py
@@ -73,7 +73,7 @@ async def create_platform_as2_partner(
             entity = await svc.create_as2_partner(tenant_id=0, cmd=cmd)
 
             await uow.commit()
-            p = await uow.control_plane.get_as2_partner(tenant_id=0, partner_id=entity.partner_id)
+            p = await uow.as2_partners.get_as2_partner(tenant_id=0, partner_id=entity.partner_id)
             if not p:
                 raise HTTPException(status_code=500, detail="Partner creation failed")
 
@@ -99,7 +99,7 @@ async def list_platform_as2_partners(
     Returns all global AS2 partners (tenant_id = 0).
     """
     async with uow:
-        partners = await uow.control_plane.list_as2_partners(tenant_id=0)
+        partners = await uow.as2_partners.list_as2_partners(tenant_id=0)
         return [
             AS2TradingPartnerResponse(
                 id=str(p.id),
@@ -131,7 +131,7 @@ async def update_platform_as2_partner(
         try:
             svc = AS2PartnerService(uow=uow)
             await svc.update_as2_partner(tenant_id=0, partner_id=partner_id, cmd=cmd)
-            updated_partner = await uow.control_plane.get_as2_partner(
+            updated_partner = await uow.as2_partners.get_as2_partner(
                 tenant_id=0, partner_id=partner_id
             )
             if not updated_partner:
diff --git a/services/api/src/api/routers/trading_partners/platform/as2_partnerships.py b/services/api/src/api/routers/trading_partners/platform/as2_partnerships.py
index ab0eb0af..827a0b0f 100644
--- a/services/api/src/api/routers/trading_partners/platform/as2_partnerships.py
+++ b/services/api/src/api/routers/trading_partners/platform/as2_partnerships.py
@@ -55,16 +55,16 @@ async def test_as2_partnership_connection(
     using the partnership's configured cryptographic material.
     """
     async with uow:
-        partnership = await uow.control_plane.get_as2_partnership(
+        partnership = await uow.as2_partnerships.get_as2_partnership(
             tenant_id=0, partnership_id=partnership_id
         )
         if not partnership:
             raise HTTPException(status_code=404, detail="Partnership not found")
 
-        local_partner = await uow.control_plane.get_as2_partner(
+        local_partner = await uow.as2_partners.get_as2_partner(
             tenant_id=0, partner_id=partnership.local_partner_id
         )
-        remote_partner = await uow.control_plane.get_as2_partner(
+        remote_partner = await uow.as2_partners.get_as2_partner(
             tenant_id=0, partner_id=partnership.remote_partner_id
         )
 
@@ -163,7 +163,7 @@ async def create_platform_as2_partnership(
             svc = AS2PartnershipService(uow=uow)
             entity = await svc.create_as2_partnership(tenant_id=0, cmd=cmd)
             await uow.commit()
-            p = await uow.control_plane.get_as2_partnership(
+            p = await uow.as2_partnerships.get_as2_partnership(
                 tenant_id=0, partnership_id=entity.partner_id
             )
             if not p:
@@ -225,7 +225,7 @@ def get_val(field: str) -> Any:
             await svc.update_as2_partnership(tenant_id=0, partnership_id=partnership_id, cmd=cmd)
             await uow.commit()
 
-            p = await uow.control_plane.get_as2_partnership(
+            p = await uow.as2_partnerships.get_as2_partnership(
                 tenant_id=0, partnership_id=partnership_id
             )
             if not p:
diff --git a/services/api/src/api/routers/trading_partners/sftp.py b/services/api/src/api/routers/trading_partners/sftp.py
index 7c4edd6e..50d8a8ec 100644
--- a/services/api/src/api/routers/trading_partners/sftp.py
+++ b/services/api/src/api/routers/trading_partners/sftp.py
@@ -84,8 +84,8 @@ async def test_existing_sftp_connection(
 
     if not request.password and not request.credentials_vault_ref:
         async with uow:
-            if uow.control_plane:
-                partner = await uow.control_plane.get_sftp_partner(tenant_id, partner_id)
+            if uow.global_session is not None:
+                partner = await uow.sftp_partners.get_sftp_partner(tenant_id, partner_id)
                 if partner:
                     if partner.password_encrypted:
                         try:
@@ -160,9 +160,9 @@ async def create_sftp_partner(
             raise HTTPException(status_code=400, detail="Database integrity error.") from e
 
         async with uow:
-            if not uow.control_plane:
+            if uow.tenant_session is None:
                 raise HTTPException(status_code=500, detail="Data plane not initialized")
-            partner = await uow.control_plane.get_sftp_partner(tenant_id, _.partner_id)
+            partner = await uow.sftp_partners.get_sftp_partner(tenant_id, _.partner_id)
             if not partner:
                 raise HTTPException(status_code=404, detail="Partner not found after creation")
 
@@ -202,9 +202,9 @@ async def update_sftp_partner(
             raise HTTPException(status_code=400, detail="Database integrity error.") from e
 
         async with uow:
-            if not uow.control_plane:
+            if uow.tenant_session is None:
                 raise HTTPException(status_code=500, detail="Data plane not initialized")
-            partner = await uow.control_plane.get_sftp_partner(tenant_id, partner_id)
+            partner = await uow.sftp_partners.get_sftp_partner(tenant_id, partner_id)
             if not partner:
                 raise HTTPException(status_code=404, detail="Partner not found after update")
 
@@ -233,9 +233,9 @@ async def delete_sftp_partner(
     """Deletes an SFTP partner."""
     async with uow:
         try:
-            if uow.control_plane is None:
+            if uow.tenant_session is None:
                 raise HTTPException(status_code=500, detail="Tenant data plane not available")
-            await uow.control_plane.delete_sftp_partner(tenant_id, partner_id)
+            await uow.sftp_partners.delete_sftp_partner(tenant_id, partner_id)
             await uow.commit()
         except IntegrityError as e:
             raise HTTPException(
diff --git a/services/api/src/api/routers/transactions.py b/services/api/src/api/routers/transactions.py
index 43b7a79c..0d0bc193 100644
--- a/services/api/src/api/routers/transactions.py
+++ b/services/api/src/api/routers/transactions.py
@@ -50,7 +50,7 @@ async def list_transactions(
     List EDI transactions for the current tenant.
     """
     async with uow:
-        messages = await uow.data_plane.list_transactions(  # type: ignore
+        messages = await uow.transactions.list_transactions(
             tenant_id=tenant_id,
             limit=limit,
             offset=offset,
@@ -88,7 +88,7 @@ async def get_transaction_thread(
     Get a chronological thread of documents sharing a specific business metadata key/value.
     """
     async with uow:
-        json_records = await uow.data_plane.get_transaction_thread(tenant_id, key, value)  # type: ignore
+        json_records = await uow.transactions.get_transaction_thread(tenant_id, key, value)
         items = []
         for r in json_records:
             items.append(
@@ -117,7 +117,7 @@ async def get_transaction(
     Get the full deep-dive payload for a single trace lifecycle spanning EdiMessage, EdiJson, and ApiGateway.
     """
     async with uow:
-        result = await uow.data_plane.get_transaction(tenant_id, trace_id)  # type: ignore
+        result = await uow.transactions.get_transaction(tenant_id, trace_id)
         if not result or not result.edi_message:
             raise HTTPException(status_code=404, detail="Transaction not found")
 
diff --git a/services/api/src/api/routers/webhooks/__init__.py b/services/api/src/api/routers/webhooks/__init__.py
index a7fef215..a1799953 100644
--- a/services/api/src/api/routers/webhooks/__init__.py
+++ b/services/api/src/api/routers/webhooks/__init__.py
@@ -6,149 +6,6 @@
 They are NOT trading partners; they are delivery destinations.
 """
 
-import ipaddress
-import socket
-from collections.abc import Sequence
-from typing import Any
-from urllib.parse import urlparse
-from uuid import UUID
+from .webhook import router
 
-import anyio
-from fastapi import APIRouter, Depends, HTTPException, status
-from identity.dependencies import get_current_tenant_id
-
-from api.adapters.http.dtos import CreateWebhookRequest, PartnerResponse, UpdateWebhookRequest
-from api.core.services import WebhookService
-from api.core.uow import UnitOfWork
-from api.dependencies import get_tenant_uow
-from api.domain.models import CreateWebhookCmd
-
-router = APIRouter(prefix="/api/v1/webhooks", tags=["Webhooks"])
-
-
-def _partner_response(partner: Any, tenant_id: int) -> PartnerResponse:
-    """Shared mapper from ORM Webhook record to PartnerResponse DTO."""
-    return PartnerResponse(
-        partner_id=partner.id,
-        tenant_id=tenant_id,
-        name=partner.name,
-        type="WEBHOOK",
-        status="ACTIVE" if partner.active else "INACTIVE",
-        active=partner.active,
-        url=partner.url,
-    )
-
-
-async def _validate_webhook_url(url: str) -> None:
-    try:
-        parsed = urlparse(str(url))
-        hostname = parsed.hostname
-        if not hostname:
-            raise ValueError("Invalid URL: no hostname")
-        addr_info = await anyio.to_thread.run_sync(socket.getaddrinfo, hostname, None)
-        for _, _, _, _, sockaddr in addr_info:
-            ip = sockaddr[0]
-            ip_obj = ipaddress.ip_address(ip)
-            if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_unspecified:
-                raise HTTPException(status_code=400, detail="Webhook URL must be a public address")
-    except HTTPException:
-        raise
-    except Exception as e:
-        raise HTTPException(status_code=400, detail="Invalid webhook URL") from e
-
-
-@router.get("", response_model=list[PartnerResponse])
-async def list_webhooks(
-    tenant_id: int = Depends(get_current_tenant_id),
-    uow: UnitOfWork = Depends(get_tenant_uow),
-) -> Any:
-    """Lists all configured webhook delivery destinations for this tenant."""
-    async with uow:
-        if not uow.control_plane:
-            raise HTTPException(status_code=500, detail="Control plane not initialized")
-        webhooks: Sequence[Any] = await uow.control_plane.list_webhooks(tenant_id)
-        return [_partner_response(p, tenant_id) for p in webhooks]
-
-
-@router.post("", response_model=PartnerResponse, status_code=status.HTTP_201_CREATED)
-async def create_webhook(
-    request: CreateWebhookRequest,
-    tenant_id: int = Depends(get_current_tenant_id),
-    uow: UnitOfWork = Depends(get_tenant_uow),
-) -> Any:
-    """Creates a new Webhook delivery destination for this tenant."""
-    await _validate_webhook_url(str(request.url))
-
-    async with uow:
-        if not uow.control_plane:
-            raise HTTPException(status_code=500, detail="Control plane not initialized")
-        service = WebhookService(uow=uow)
-        cmd = CreateWebhookCmd(
-            name=request.name,
-            url=str(request.url),
-            auth_header_vault_ref=request.auth_header_vault_ref,
-        )
-        entity = await service.create_webhook(tenant_id, cmd)
-        await uow.commit()
-
-    # New session after commit — avoids nested session risk
-    async with uow:
-        if not uow.control_plane:
-            raise HTTPException(status_code=500, detail="Control plane not initialized")
-        partner = await uow.control_plane.get_webhook(tenant_id, entity.partner_id)
-        if not partner or partner.tenant_id != tenant_id:
-            raise HTTPException(status_code=404, detail="Webhook not found after creation")
-        return _partner_response(partner, tenant_id)
-
-
-@router.patch("/{webhook_id}", response_model=PartnerResponse)
-async def update_webhook(
-    webhook_id: UUID,
-    request: UpdateWebhookRequest,
-    tenant_id: int = Depends(get_current_tenant_id),
-    uow: UnitOfWork = Depends(get_tenant_uow),
-) -> Any:
-    """Updates name and/or active status of a Webhook delivery destination."""
-    if request.url:
-        await _validate_webhook_url(str(request.url))
-
-    async with uow:
-        if not uow.control_plane:
-            raise HTTPException(status_code=500, detail="Control plane not initialized")
-        service = WebhookService(uow=uow)
-        success = await service.update_webhook(
-            tenant_id,
-            webhook_id,
-            name=request.name,
-            active=request.active,
-            url=str(request.url) if request.url else None,
-        )
-        if not success:
-            raise HTTPException(status_code=404, detail="Webhook not found")
-        await uow.commit()
-
-    # New session after commit
-    async with uow:
-        if not uow.control_plane:
-            raise HTTPException(status_code=500, detail="Control plane not initialized")
-        partner = await uow.control_plane.get_webhook(tenant_id, webhook_id)
-        if not partner or partner.tenant_id != tenant_id:
-            raise HTTPException(status_code=404, detail="Webhook not found")
-        return _partner_response(partner, tenant_id)
-
-
-@router.delete("/{webhook_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_webhook(
-    webhook_id: UUID,
-    tenant_id: int = Depends(get_current_tenant_id),
-    uow: UnitOfWork = Depends(get_tenant_uow),
-) -> None:
-    """Permanently deletes a Webhook."""
-    async with uow:
-        if not uow.control_plane:
-            raise HTTPException(status_code=500, detail="Control plane not initialized")
-        service = WebhookService(uow=uow)
-        success = await service.delete_webhook(tenant_id, webhook_id)
-        if not success:
-            raise HTTPException(status_code=404, detail="Webhook not found")
-        await uow.commit()
+__all__ = ["router"]
diff --git a/services/api/src/api/routers/webhooks/webhook.py b/services/api/src/api/routers/webhooks/webhook.py
index 653c8ad8..dd81275e 100644
--- a/services/api/src/api/routers/webhooks/webhook.py
+++ b/services/api/src/api/routers/webhooks/webhook.py
@@ -1,72 +1,154 @@
+"""
+Webhooks router package.
+
+Webhooks are outbound HTTP push delivery channels — they describe
+where processed EDI data is pushed to after the pipeline completes.
+They are NOT trading partners; they are delivery destinations.
+"""
+
+import ipaddress
+import socket
+from collections.abc import Sequence
 from typing import Any
+from urllib.parse import urlparse
+from uuid import UUID
 
+import anyio
 from fastapi import APIRouter, Depends, HTTPException, status
 from identity.dependencies import get_current_tenant_id
 
-from api.adapters.http.dtos import (
-    CreateWebhookRequest,
-    PartnerResponse,
-)
+from api.adapters.http.dtos import CreateWebhookRequest, PartnerResponse, UpdateWebhookRequest
 from api.core.services import WebhookService
 from api.core.uow import UnitOfWork
 from api.dependencies import get_tenant_uow
 from api.domain.models import CreateWebhookCmd
 
-router = APIRouter(tags=["Webhooks"])
+router = APIRouter(prefix="/api/v1/webhooks", tags=["Webhooks"])
 
 
-@router.post("", response_model=PartnerResponse, status_code=status.HTTP_201_CREATED)
-async def create_webhook(
-    request: CreateWebhookRequest,
-    tenant_id: int = Depends(get_current_tenant_id),
-    uow: UnitOfWork = Depends(get_tenant_uow),
-) -> Any:
-    """Creates a new Webhook delivery destination for this tenant."""
-    import ipaddress
-    import socket
-    from urllib.parse import urlparse
+def _partner_response(partner: Any, tenant_id: int) -> PartnerResponse:
+    """Shared mapper from ORM Webhook record to PartnerResponse DTO."""
+    return PartnerResponse(
+        partner_id=partner.id,
+        tenant_id=tenant_id,
+        name=partner.name,
+        type="WEBHOOK",
+        status="ACTIVE" if partner.active else "INACTIVE",
+        active=partner.active,
+        url=partner.url,
+    )
 
-    try:
-        import anyio
 
-        parsed = urlparse(str(request.url))
+async def _validate_webhook_url(url: str) -> None:
+    try:
+        parsed = urlparse(str(url))
         hostname = parsed.hostname
         if not hostname:
-            raise ValueError("Invalid URL")
-        ip = await anyio.to_thread.run_sync(socket.gethostbyname, hostname)
-        ip_obj = ipaddress.ip_address(ip)
-        if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_unspecified:
-            raise HTTPException(status_code=400, detail="Webhook URL must be a public address")
+            raise ValueError("Invalid URL: no hostname")
+        addr_info = await anyio.to_thread.run_sync(socket.getaddrinfo, hostname, None)
+        for _, _, _, _, sockaddr in addr_info:
+            ip = sockaddr[0]
+            ip_obj = ipaddress.ip_address(ip)
+            if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_unspecified:
+                raise HTTPException(status_code=400, detail="Webhook URL must be a public address")
     except HTTPException:
         raise
     except Exception as e:
         raise HTTPException(status_code=400, detail="Invalid webhook URL") from e
 
+
+@router.get("", response_model=list[PartnerResponse])
+async def list_webhooks(
+    tenant_id: int = Depends(get_current_tenant_id),
+    uow: UnitOfWork = Depends(get_tenant_uow),
+) -> Any:
+    """Lists all configured webhook delivery destinations for this tenant."""
     async with uow:
-        service = WebhookService(uow=uow)
+        if uow.global_session is None:
+            raise HTTPException(status_code=500, detail="Control plane not initialized")
+        webhooks: Sequence[Any] = await uow.webhooks.list_webhooks(tenant_id)
+        return [_partner_response(p, tenant_id) for p in webhooks]
+
+
+@router.post("", response_model=PartnerResponse, status_code=status.HTTP_201_CREATED)
+async def create_webhook(
+    request: CreateWebhookRequest,
+    tenant_id: int = Depends(get_current_tenant_id),
+    uow: UnitOfWork = Depends(get_tenant_uow),
+) -> Any:
+    """Creates a new Webhook delivery destination for this tenant."""
+    await _validate_webhook_url(str(request.url))
 
+    async with uow:
+        if uow.global_session is None:
+            raise HTTPException(status_code=500, detail="Control plane not initialized")
+        service = WebhookService(uow=uow)
         cmd = CreateWebhookCmd(
             name=request.name,
             url=str(request.url),
             auth_header_vault_ref=request.auth_header_vault_ref,
         )
-
-        _ = await service.create_webhook(tenant_id, cmd)
+        entity = await service.create_webhook(tenant_id, cmd)
         await uow.commit()
 
+    # New session after commit — avoids nested session risk
     async with uow:
-        if not uow.control_plane:
+        if uow.global_session is None:
             raise HTTPException(status_code=500, detail="Control plane not initialized")
-        partner = await uow.control_plane.get_webhook(tenant_id, _.partner_id)
+        partner = await uow.webhooks.get_webhook(tenant_id, entity.partner_id)
         if not partner or partner.tenant_id != tenant_id:
             raise HTTPException(status_code=404, detail="Webhook not found after creation")
+        return _partner_response(partner, tenant_id)
 
-        return PartnerResponse(
-            partner_id=partner.id,
-            tenant_id=tenant_id,
-            name=partner.name,
-            type="WEBHOOK",
-            status="ACTIVE" if partner.active else "INACTIVE",
-            active=partner.active,
-            url=partner.url,
+
+@router.patch("/{webhook_id}", response_model=PartnerResponse)
+async def update_webhook(
+    webhook_id: UUID,
+    request: UpdateWebhookRequest,
+    tenant_id: int = Depends(get_current_tenant_id),
+    uow: UnitOfWork = Depends(get_tenant_uow),
+) -> Any:
+    """Updates name and/or active status of a Webhook delivery destination."""
+    if request.url:
+        await _validate_webhook_url(str(request.url))
+
+    async with uow:
+        if uow.global_session is None:
+            raise HTTPException(status_code=500, detail="Control plane not initialized")
+        service = WebhookService(uow=uow)
+        success = await service.update_webhook(
+            tenant_id,
+            webhook_id,
+            name=request.name,
+            active=request.active,
+            url=str(request.url) if request.url else None,
         )
+        if not success:
+            raise HTTPException(status_code=404, detail="Webhook not found")
+        await uow.commit()
+
+    # New session after commit
+    async with uow:
+        if uow.global_session is None:
+            raise HTTPException(status_code=500, detail="Control plane not initialized")
+        partner = await uow.webhooks.get_webhook(tenant_id, webhook_id)
+        if not partner or partner.tenant_id != tenant_id:
+            raise HTTPException(status_code=404, detail="Webhook not found")
+        return _partner_response(partner, tenant_id)
+
+
+@router.delete("/{webhook_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_webhook(
+    webhook_id: UUID,
+    tenant_id: int = Depends(get_current_tenant_id),
+    uow: UnitOfWork = Depends(get_tenant_uow),
+) -> None:
+    """Permanently deletes a Webhook."""
+    async with uow:
+        if uow.global_session is None:
+            raise HTTPException(status_code=500, detail="Control plane not initialized")
+        service = WebhookService(uow=uow)
+        success = await service.delete_webhook(tenant_id, webhook_id)
+        if not success:
+            raise HTTPException(status_code=404, detail="Webhook not found")
+        await uow.commit()
diff --git a/services/api/src/api/services/api_receiver_service.py b/services/api/src/api/services/api_receiver_service.py
index c5213314..7eb58096 100644
--- a/services/api/src/api/services/api_receiver_service.py
+++ b/services/api/src/api/services/api_receiver_service.py
@@ -1,10 +1,9 @@
 import logging
 import uuid
-from typing import Any, cast
+from typing import Any
 from uuid import UUID
 
 from api.core.uow import UnitOfWork
-from api.ports.repository import DataPlaneRepositoryPort
 from pipeline.core.metadata_extractor import MetadataExtractorService
 
 logger = logging.getLogger(__name__)
@@ -38,8 +37,6 @@ async def process_api_edi_json(
             UUID: The generated trace_id for tracking.
         """
         async with self.uow:
-            data_plane = cast(DataPlaneRepositoryPort, self.uow.data_plane)
-
             logger.info(f"Received outbound JSON for partner: {trading_partner_id}")
 
             # 1. Resolve transaction_type from payload if not provided explicitly
@@ -84,12 +81,14 @@ async def process_api_edi_json(
                 "payload": payload,
                 "status": "RECEIVED",
             }
-            await data_plane.create_edi_json(tenant_id=tenant_id, payload=edi_json_payload)
+            await self.uow.transactions.create_edi_json(
+                tenant_id=tenant_id, payload=edi_json_payload
+            )
 
             # 5. Drop Outbox event for Worker to transform
             from domain.events import PipelineEventType
 
-            await data_plane.publish_outbox_event(
+            await self.uow.outbox.publish_outbox_event(
                 tenant_id=tenant_id,
                 event_type=PipelineEventType.TRANSFORM_EVENT,
                 payload={
diff --git a/services/api/src/api/services/as2_receiver_service.py b/services/api/src/api/services/as2_receiver_service.py
index 2fedf3d8..ec5fbdff 100644
--- a/services/api/src/api/services/as2_receiver_service.py
+++ b/services/api/src/api/services/as2_receiver_service.py
@@ -5,7 +5,6 @@
 from email import policy
 from typing import Any
 
-from api.adapters.repository import SqlAlchemyDataPlaneRepository
 from api.core.uow import UnitOfWork
 from api.ports.vault import VaultPort
 from as2_core.mdn import build_mdn, calculate_mic
@@ -66,7 +65,7 @@ async def process_inbound_message(
         pure_edi_bytes = self._extract_pure_edi(final_payload)
 
         # 6. Save to DB
-        await self._save_to_data_plane(
+        await self._save_transaction(
             partnership=partnership, as2_msg=as2_msg, pure_edi_bytes=pure_edi_bytes
         )
 
@@ -113,7 +112,7 @@ def _parse_request(self, headers: dict[str, str], body_bytes: bytes) -> AS2Messa
 
     async def _lookup_partnership(self, as2_from: str, as2_to: str):  # type: ignore
         async with self.uow:
-            match = await self.uow.control_plane.get_partnership_by_as2_ids(
+            match = await self.uow.as2_partnerships.get_partnership_by_as2_ids(
                 as2_from=as2_from, as2_to=as2_to
             )
             if not match:
@@ -316,7 +315,7 @@ def _extract_isa_headers(self, pure_edi_bytes: bytes) -> tuple[str, str, str | N
 
         return isa_sender, isa_receiver, transaction_type
 
-    async def _save_to_data_plane(  # type: ignore
+    async def _save_transaction(  # type: ignore
         self, partnership, as2_msg: AS2Message, pure_edi_bytes: bytes
     ) -> str:
 
@@ -330,7 +329,7 @@ async def _save_to_data_plane(  # type: ignore
             raise ValueError("Invalid EDI payload for routing") from e
 
         # 2. Query Global DB for the actual Tenant using ISA headers
-        true_tenant_id = await self.uow.control_plane.get_tenant_by_isa(isa_sender, isa_receiver)
+        true_tenant_id = await self.uow.inbound_routes.get_tenant_by_isa(isa_sender, isa_receiver)
         if not true_tenant_id:
             true_tenant_id = partnership.tenant_id
 
@@ -374,7 +373,9 @@ async def _save_to_data_plane(  # type: ignore
         async_gen_tenant = self.db_router.get_tenant_session(true_tenant_id, shard.name, shard.dsn)
         tenant_session = await anext(async_gen_tenant)
         try:
-            dp_repo = SqlAlchemyDataPlaneRepository(tenant_session)
+            from api.adapters.transaction_repository import SqlAlchemyTransactionRepository
+
+            dp_repo = SqlAlchemyTransactionRepository(tenant_session)
             msg_id = await dp_repo.create_edi_message(tenant_id=true_tenant_id, payload=edi_record)
 
             outbox_payload = {
diff --git a/services/api/tests/api_fakes.py b/services/api/tests/api_fakes.py
index 68dc7931..86ce0850 100644
--- a/services/api/tests/api_fakes.py
+++ b/services/api/tests/api_fakes.py
@@ -1,26 +1,28 @@
 import uuid
 from collections.abc import Sequence
+from dataclasses import asdict, replace
 from typing import Any
 
 from api.domain.models import (
+    UNSET,
     CreateAS2PartnershipCmd,
     CreateAS2TradingPartnerCmd,
     CreateInboundRouteCmd,
     CreateOutboundRouteCmd,
     CreateSFTPPartnerCmd,
     CreateWebhookCmd,
+    UpdateAS2PartnershipCmd,
     UpdateAS2TradingPartnerCmd,
     UpdateInboundRouteCmd,
     UpdateOutboundRouteCmd,
+    UpdateSFTPPartnerCmd,
 )
 from api.ports.repository import (
-    ControlPlaneRepositoryPort,
-    DataPlaneRepositoryPort,
     TenantRepositoryPort,
 )
 
 
-class FakeControlPlaneRepository(ControlPlaneRepositoryPort):
+class FakeGlobalStore:
     def __init__(self):
         self.partners = []
         self.partnerships = []
@@ -53,6 +55,31 @@ async def delete_as2_identity(self, tenant_id: int, partner_id: uuid.UUID) -> No
             p for p in self.partners if not (p["id"] == partner_id and p["tenant_id"] == tenant_id)
         ]
 
+    async def create_sftp_partner(self, tenant_id: int, cmd: CreateSFTPPartnerCmd) -> uuid.UUID:
+        p_id = uuid.uuid4()
+        self.sftp_partners.append({"id": p_id, "tenant_id": tenant_id, "cmd": cmd})
+        return p_id
+
+    async def update_sftp_partner(
+        self, tenant_id: int, partner_id: uuid.UUID, cmd: UpdateSFTPPartnerCmd
+    ) -> bool:
+        for p in self.sftp_partners:
+            if p["id"] == partner_id and p["tenant_id"] == tenant_id:
+                updates = {k: v for k, v in asdict(cmd).items() if not isinstance(v, type(UNSET))}
+                active_val = updates.pop("active", None)
+                if active_val is not None:
+                    p["status"] = "ACTIVE" if active_val else "INACTIVE"
+                p["cmd"] = replace(p["cmd"], **updates)
+                return True
+        return False
+
+    async def delete_sftp_partner(self, tenant_id: int, partner_id: uuid.UUID) -> None:
+        self.sftp_partners = [
+            p
+            for p in self.sftp_partners
+            if not (p["id"] == partner_id and p["tenant_id"] == tenant_id)
+        ]
+
     async def create_as2_partnership(
         self, tenant_id: int, cmd: CreateAS2PartnershipCmd
     ) -> uuid.UUID:
@@ -60,6 +87,26 @@ async def create_as2_partnership(
         self.partnerships.append({"id": p_id, "tenant_id": tenant_id, "cmd": cmd})
         return p_id
 
+    async def update_as2_partnership(
+        self, tenant_id: int, partnership_id: uuid.UUID, cmd: UpdateAS2PartnershipCmd
+    ) -> bool:
+        for p in self.partnerships:
+            if p["id"] == partnership_id and p["tenant_id"] == tenant_id:
+                updates = {k: v for k, v in asdict(cmd).items() if not isinstance(v, type(UNSET))}
+                active_val = updates.pop("active", None)
+                if active_val is not None:
+                    p["status"] = "ACTIVE" if active_val else "INACTIVE"
+                p["cmd"] = replace(p["cmd"], **updates)
+                return True
+        return False
+
+    async def delete_as2_partnership(self, tenant_id: int, partnership_id: uuid.UUID) -> None:
+        self.partnerships = [
+            p
+            for p in self.partnerships
+            if not (p["id"] == partnership_id and p["tenant_id"] == tenant_id)
+        ]
+
     async def get_as2_partner(self, tenant_id: int, partner_id: uuid.UUID) -> Any:
         for p in self.partners:
             if p["id"] == partner_id and p["tenant_id"] == tenant_id:
@@ -163,11 +210,6 @@ async def get_as2_partners_by_ids(
             if p["id"] in ids and p["tenant_id"] == tenant_id
         }
 
-    async def create_sftp_partner(self, tenant_id: int, cmd: CreateSFTPPartnerCmd) -> uuid.UUID:
-        p_id = uuid.uuid4()
-        self.sftp_partners.append({"id": p_id, "tenant_id": tenant_id, "cmd": cmd})
-        return p_id
-
     async def get_sftp_partners_by_ids(
         self, tenant_id: int, ids: list[uuid.UUID]
     ) -> dict[uuid.UUID, str]:
@@ -178,9 +220,38 @@ async def get_sftp_partners_by_ids(
         }
 
     async def create_webhook(self, tenant_id: int, cmd: CreateWebhookCmd) -> uuid.UUID:
-        p_id = uuid.uuid4()
-        self.webhooks.append({"id": p_id, "tenant_id": tenant_id, "cmd": cmd})
-        return p_id
+        wh_id = uuid.uuid4()
+        self.webhooks.append({"id": wh_id, "tenant_id": tenant_id, "cmd": cmd})
+        return wh_id
+
+    async def update_webhook(
+        self,
+        tenant_id: int,
+        webhook_id: uuid.UUID,
+        name: str | None = None,
+        active: bool | None = None,
+        url: str | None = None,
+    ) -> bool:
+        from dataclasses import replace
+
+        for w in self.webhooks:
+            if w["id"] == webhook_id and w["tenant_id"] == tenant_id:
+                updates = {}
+                if name is not None:
+                    updates["name"] = name
+                if url is not None:
+                    updates["url"] = url
+                w["cmd"] = replace(w["cmd"], **updates)
+                if active is not None:
+                    w["status"] = "ACTIVE" if active else "INACTIVE"
+                return True
+        return False
+
+    async def delete_webhook(self, tenant_id: int, webhook_id: uuid.UUID) -> bool:
+        self.webhooks = [
+            w for w in self.webhooks if not (w["id"] == webhook_id and w["tenant_id"] == tenant_id)
+        ]
+        return True
 
     async def get_webhooks_by_ids(
         self, tenant_id: int, ids: list[uuid.UUID]
@@ -195,14 +266,14 @@ async def create_inbound_route(self, tenant_id: int, cmd: CreateInboundRouteCmd)
         r_id = uuid.uuid4()
         if not hasattr(self, "inbound_routes"):
             self.inbound_routes = []
-        self.inbound_routes.append(FakeRoute(r_id, cmd))
+        self.inbound_routes.append(FakeRoute(r_id, tenant_id, cmd))
         return r_id
 
     async def create_outbound_route(self, tenant_id: int, cmd: CreateOutboundRouteCmd) -> uuid.UUID:
         r_id = uuid.uuid4()
         if not hasattr(self, "outbound_routes"):
             self.outbound_routes = []
-        self.outbound_routes.append(FakeRoute(r_id, cmd))
+        self.outbound_routes.append(FakeRoute(r_id, tenant_id, cmd))
         return r_id
 
     async def update_inbound_route(
@@ -221,10 +292,11 @@ async def update_outbound_route(
     async def delete_outbound_route(self, tenant_id: int, route_id: uuid.UUID) -> bool:
         return True
 
-    async def get_all_routes(self, tenant_id: int) -> dict[str, list[Any]]:
-        inbound = getattr(self, "inbound_routes", [])
-        outbound = getattr(self, "outbound_routes", [])
-        return {"inbound": inbound, "outbound": outbound}
+    async def list_inbound_routes(self, tenant_id: int) -> list[Any]:
+        return [r for r in getattr(self, "inbound_routes", []) if r.tenant_id == tenant_id]
+
+    async def list_outbound_routes(self, tenant_id: int) -> list[Any]:
+        return [r for r in getattr(self, "outbound_routes", []) if r.tenant_id == tenant_id]
 
     async def list_sftp_partners(self, tenant_id: int) -> Sequence[Any]:
         return [p for p in getattr(self, "sftp_partners", []) if p["tenant_id"] == tenant_id]
@@ -269,8 +341,9 @@ class MockWebhook:
 
 
 class FakeRoute:
-    def __init__(self, id, cmd):
+    def __init__(self, id, tenant_id, cmd):
         self.id = id
+        self.tenant_id = tenant_id
         self.name = getattr(cmd, "name", "Test Route")
         self.processing_mode = getattr(cmd, "processing_mode", "TRANSFORM")
         self.active = True
@@ -279,9 +352,13 @@ def __init__(self, id, cmd):
         self.webhook_id = getattr(cmd, "webhook_id", None)
         self.isa_sender_id = getattr(cmd, "isa_sender_id", "S1")
         self.isa_receiver_id = getattr(cmd, "isa_receiver_id", "R1")
+        self.gs_sender_id = getattr(cmd, "gs_sender_id", "S1")
+        self.gs_receiver_id = getattr(cmd, "gs_receiver_id", "R1")
+        self.transaction_type = getattr(cmd, "transaction_type", "*")
+        self.trading_partner_id = getattr(cmd, "trading_partner_id", None)
 
 
-class FakeDataPlaneRepository(DataPlaneRepositoryPort):
+class FakeTenantStore:
     def __init__(self):
         self.inbound_routes = []
         self.outbound_routes = []
@@ -290,12 +367,12 @@ def __init__(self):
 
     async def create_inbound_route(self, cmd: CreateInboundRouteCmd) -> uuid.UUID:
         r_id = uuid.uuid4()
-        self.inbound_routes.append(FakeRoute(r_id, cmd))
+        self.inbound_routes.append(FakeRoute(r_id, 1, cmd))
         return r_id
 
     async def create_outbound_route(self, cmd: CreateOutboundRouteCmd) -> uuid.UUID:
         r_id = uuid.uuid4()
-        self.outbound_routes.append(FakeRoute(r_id, cmd))
+        self.outbound_routes.append(FakeRoute(r_id, 1, cmd))
         return r_id
 
     async def get_all_routes(self) -> dict[str, list[Any]]:
@@ -377,8 +454,8 @@ def all(self):
 
 
 class MockSession:
-    def __init__(self, control_plane):
-        self.control_plane = control_plane
+    def __init__(self, global_store):
+        self.global_store = global_store
 
     async def execute(self, statement):
         table_name = str(statement)
@@ -415,9 +492,22 @@ def __init__(self):
 
 class FakeUnitOfWork:
     def __init__(self):
-        self.control_plane = FakeControlPlaneRepository()
-        self.data_plane = FakeDataPlaneRepository()
-        self.global_session = MockSession(self.control_plane)
+        repo = FakeGlobalStore()
+        self.api_tokens = repo
+        self.as2_partners = repo
+        self.as2_partnerships = repo
+        self.inbound_routes = repo
+        self.outbound_routes = repo
+        self.outbox = repo
+        self.sftp_partners = repo
+        self.tenants = repo
+        self.webhooks = repo
+        self.edi_headers = repo
+
+        self.transactions = FakeTenantStore()
+
+        self.global_session = MockSession(repo)
+        self.tenant_session = MockSession(repo)
 
     async def __aenter__(self):
         return self
diff --git a/services/api/tests/test_api_receiver_service.py b/services/api/tests/test_api_receiver_service.py
index 7cbae445..8ca6dcbe 100644
--- a/services/api/tests/test_api_receiver_service.py
+++ b/services/api/tests/test_api_receiver_service.py
@@ -16,10 +16,10 @@ async def test_process_api_edi_json_success():
     )
 
     assert trace_id is not None
-    mock_uow.data_plane.create_edi_json.assert_awaited_once()
-    mock_uow.data_plane.publish_outbox_event.assert_awaited_once()
+    mock_uow.transactions.create_edi_json.assert_awaited_once()
+    mock_uow.outbox.publish_outbox_event.assert_awaited_once()
 
-    args, kwargs = mock_uow.data_plane.publish_outbox_event.call_args
+    args, kwargs = mock_uow.outbox.publish_outbox_event.call_args
     from domain.events import PipelineEventType
 
     assert kwargs["event_type"] == PipelineEventType.TRANSFORM_EVENT
diff --git a/services/api/tests/test_as2_partner_service.py b/services/api/tests/test_as2_partner_service.py
index 6da119f0..04fa7950 100644
--- a/services/api/tests/test_as2_partner_service.py
+++ b/services/api/tests/test_as2_partner_service.py
@@ -6,9 +6,11 @@
 from api.domain.models import UpdateAS2TradingPartnerCmd
 
 
-def make_mock_uow(control_plane: AsyncMock) -> MagicMock:
+def make_mock_uow(mock_repo: AsyncMock) -> MagicMock:
     uow = MagicMock()
-    uow.control_plane = control_plane
+    uow.as2_partners = mock_repo
+    uow.outbox = mock_repo
+    uow.global_session = mock_repo
     return uow
 
 
diff --git a/services/api/tests/test_as2_receive.py b/services/api/tests/test_as2_receive.py
index c48716e5..898c435a 100644
--- a/services/api/tests/test_as2_receive.py
+++ b/services/api/tests/test_as2_receive.py
@@ -9,8 +9,7 @@
 @pytest.fixture
 def mock_uow():
     uow = AsyncMock()
-    uow.control_plane = AsyncMock()
-    uow.data_plane = AsyncMock()
+    uow.transactions = AsyncMock()
     return uow
 
 
@@ -33,7 +32,7 @@ def client(mock_uow, mock_mq):
 
 
 def test_as2_receive(client, mock_uow, mock_mq):
-    mock_uow.control_plane.get_inbound_routes.return_value = []
+    mock_uow.inbound_routes.get_inbound_routes.return_value = []
     client.post(
         "/api/v1/trading-partners/as2/receive/tp1",
         headers={"as2-to": "receiver", "as2-from": "sender", "message-id": "1234"},
diff --git a/services/api/tests/test_as2_receiver_service.py b/services/api/tests/test_as2_receiver_service.py
index 85810e01..a661c5a4 100644
--- a/services/api/tests/test_as2_receiver_service.py
+++ b/services/api/tests/test_as2_receiver_service.py
@@ -51,7 +51,7 @@ async def test_process_inbound_message_partnership_not_found(service):
         mock_msg.as2_to = "unknown2"
         mock_parse.return_value = mock_msg
 
-        service.uow.control_plane.get_partnership_by_as2_ids.return_value = None
+        service.uow.as2_partnerships.get_partnership_by_as2_ids.return_value = None
 
         with pytest.raises(ValueError, match="Partnership not configured"):
             await service.process_inbound_message(headers, body_bytes)
@@ -73,7 +73,7 @@ async def test_process_inbound_message_success(service):
         mock_local_partner = MagicMock()
         mock_remote_partner = MagicMock()
 
-        service.uow.control_plane.get_partnership_by_as2_ids.return_value = (
+        service.uow.as2_partnerships.get_partnership_by_as2_ids.return_value = (
             mock_partnership,
             mock_local_partner,
             mock_remote_partner,
@@ -83,7 +83,7 @@ async def test_process_inbound_message_success(service):
             patch.object(service, "_retrieve_keys") as mock_keys,
             patch.object(service, "_unbox_payload") as mock_unbox,
             patch.object(service, "_extract_pure_edi") as mock_extract,
-            patch.object(service, "_save_to_data_plane") as mock_save,
+            patch.object(service, "_save_transaction") as mock_save,
         ):
             mock_keys.return_value = (None, None, None)
             mock_unbox.return_value = (b"unboxed_payload", "mic123")
@@ -119,12 +119,12 @@ async def test_private_methods_coverage(service):
     assert b"Content-Type: application/pkcs7-mime" in smime_hdr
     assert b"Content-Transfer-Encoding: binary" in smime_hdr
 
-    # Test _save_to_data_plane (failure path)
+    # Test _save_transaction (failure path)
     service.global_session.execute = AsyncMock(
         return_value=MagicMock(first=MagicMock(return_value=None))
     )
     with pytest.raises(ValueError, match="Tenant routing failed"):
-        await service._save_to_data_plane(
+        await service._save_transaction(
             MagicMock(tenant_id=1),
             MagicMock(),
             b"ISA*00*          *00*          *ZZ*SENDER         *ZZ*RECEIVER       *210101*1200*^*00501*000000001*0*P*>~",
@@ -195,8 +195,8 @@ async def test_crypto_pipeline_coverage(service):
 
 
 @pytest.mark.asyncio
-async def test_save_to_data_plane_success(service):
-    # Test _save_to_data_plane success path
+async def test_save_transaction_success(service):
+    # Test _save_transaction success path
     mock_tenant = MagicMock(id=1)
     mock_shard = MagicMock(dsn="sqlite:///:memory:")
     mock_shard.name = "shard1"
@@ -212,7 +212,9 @@ async def mock_async_gen():
 
     service.db_router.get_tenant_session = MagicMock(return_value=mock_async_gen())
 
-    with patch("api.services.as2_receiver_service.SqlAlchemyDataPlaneRepository") as mock_repo_cls:
+    with patch(
+        "api.adapters.transaction_repository.SqlAlchemyTransactionRepository"
+    ) as mock_repo_cls:
         mock_repo = AsyncMock()
         mock_repo.create_edi_message.return_value = "msg-1"
         mock_repo_cls.return_value = mock_repo
@@ -225,7 +227,7 @@ async def mock_async_gen():
         )
         mock_as2_msg = MagicMock(as2_from="ME", as2_to="YOU", message_id="msg-1")
 
-        res = await service._save_to_data_plane(
+        res = await service._save_transaction(
             mock_partnership,
             mock_as2_msg,
             b"ISA*00*          *00*          *ZZ*SENDER         *ZZ*RECEIVER       *210101*1200*^*00501*000000001*0*P*>~",
diff --git a/services/api/tests/test_platform_as2.py b/services/api/tests/test_platform_as2.py
index 8081a3b7..a798caa5 100644
--- a/services/api/tests/test_platform_as2.py
+++ b/services/api/tests/test_platform_as2.py
@@ -17,8 +17,7 @@
 @pytest.fixture
 def mock_uow():
     uow = AsyncMock()
-    uow.control_plane = AsyncMock()
-    uow.data_plane = AsyncMock()
+    uow.transactions = AsyncMock()
 
     # Mock for list_platform_as2_partnerships
     mock_result = Mock()
@@ -64,7 +63,7 @@ def test_create_as2_partnership(client, mock_uow):
 
 def test_update_as2_partnership(client, mock_uow):
     pid = uuid4()
-    mock_uow.control_plane.get_as2_partnership.return_value = {"id": str(pid)}
+    mock_uow.as2_partnerships.get_as2_partnership.return_value = {"id": str(pid)}
     client.put(
         f"/api/v1/platform/trading-partners/as2/partnerships/{pid}",
         json={"trading_partner_id": "tp1"},
diff --git a/services/api/tests/test_provisioning_core.py b/services/api/tests/test_provisioning_core.py
index 7a4c122d..38a37130 100644
--- a/services/api/tests/test_provisioning_core.py
+++ b/services/api/tests/test_provisioning_core.py
@@ -4,7 +4,8 @@
 from api.core.services import (
     AS2PartnerService,
     AS2PartnershipService,
-    RouteService,
+    InboundRouteService,
+    OutboundRouteService,
     SFTPPartnerService,
     WebhookService,
 )
@@ -16,12 +17,12 @@
     CreateWebhookCmd,
     UpdateAS2TradingPartnerCmd,
 )
-from api_fakes import FakeControlPlaneRepository
+from api_fakes import FakeGlobalStore
 
 
 @pytest.fixture
 def global_repo():
-    return FakeControlPlaneRepository()
+    return FakeGlobalStore()
 
 
 @pytest.fixture
@@ -29,7 +30,16 @@ def mock_uow(global_repo):
     from unittest.mock import MagicMock
 
     uow = MagicMock()
-    uow.control_plane = global_repo
+    uow.api_tokens = global_repo
+    uow.as2_partners = global_repo
+    uow.as2_partnerships = global_repo
+    uow.inbound_routes = global_repo
+    uow.outbound_routes = global_repo
+    uow.outbox = global_repo
+    uow.sftp_partners = global_repo
+    uow.tenants = global_repo
+    uow.webhooks = global_repo
+    uow.edi_headers = global_repo
     return uow
 
 
@@ -53,11 +63,6 @@ def webhook_service(mock_uow):
     return WebhookService(uow=mock_uow)
 
 
-@pytest.fixture
-def route_service(mock_uow):
-    return RouteService(uow=mock_uow)
-
-
 @pytest.mark.asyncio
 async def test_create_as2_partner(as2_partner_service: AS2PartnerService, global_repo):
     cmd = CreateAS2TradingPartnerCmd(name="Test Partner", as2_id="TEST_AS2")
@@ -118,7 +123,7 @@ async def test_create_webhook(webhook_service: WebhookService, global_repo):
 
 
 @pytest.mark.asyncio
-async def test_list_routes(route_service: RouteService, global_repo):
+async def test_list_routes(mock_uow, global_repo):
     as2_id = await global_repo.create_as2_identity(
         tenant_id=1, cmd=CreateAS2TradingPartnerCmd(name="Walmart", as2_id="WM")
     )
@@ -135,6 +140,7 @@ async def test_list_routes(route_service: RouteService, global_repo):
     class FakeRoute:
         def __init__(self, id, as2_partner_id, sftp_partner_id, webhook_id):
             self.id = id
+            self.tenant_id = 1
             self.name = "Test Route"
             self.processing_mode = "TRANSLATE"
             self.active = True
@@ -155,57 +161,67 @@ def __init__(self, id, as2_partner_id, sftp_partner_id, webhook_id):
     global_repo.inbound_routes = [FakeRoute(uuid.uuid4(), as2_id, sftp_id, None)]
     global_repo.outbound_routes = [FakeRoute(uuid.uuid4(), as2_id, None, None)]
 
-    routes = await route_service.list_routes(1)
+    inbound_service = InboundRouteService(uow=mock_uow)
+    outbound_service = OutboundRouteService(uow=mock_uow)
 
-    assert len(routes) == 2
-    inbound_res = next(r for r in routes if r["direction"] == "INBOUND")
-    outbound_res = next(r for r in routes if r["direction"] == "OUTBOUND")
+    inbound_routes = await inbound_service.list_inbound_routes(1)
+    outbound_routes = await outbound_service.list_outbound_routes(1)
 
-    assert inbound_res["destination_name"] == "Walmart"
-    assert outbound_res["destination_name"] == "Walmart"
+    assert len(inbound_routes) == 1
+    assert len(outbound_routes) == 1
+
+    inbound_res = inbound_routes[0]
+    outbound_res = outbound_routes[0]
+
+    assert inbound_res.destination_name == "Walmart"
+    assert outbound_res.destination_name == "Walmart"
 
 
 @pytest.mark.asyncio
-async def test_create_inbound_route(route_service: RouteService, global_repo):
+async def test_create_inbound_route(mock_uow, global_repo):
+    service = InboundRouteService(uow=mock_uow)
     cmd = CreateInboundRouteCmd(
         name="test route",
         isa_sender_id="sender",
         isa_receiver_id="receiver",
         transaction_type="850",
     )
-    route = await route_service.create_inbound_route(tenant_id=1, cmd=cmd)
+    route = await service.create_inbound_route(tenant_id=1, cmd=cmd)
     assert route.direction == "INBOUND"
     assert len(global_repo.inbound_routes) == 1
 
 
 @pytest.mark.asyncio
-async def test_update_inbound_route(route_service: RouteService, global_repo):
+async def test_update_inbound_route(mock_uow, global_repo):
     from api.domain.models import UNSET, UpdateInboundRouteCmd
 
+    service = InboundRouteService(uow=mock_uow)
+
     cmd = UpdateInboundRouteCmd(
         name="updated name",
         trading_partner_id=UNSET,
         isa_sender_id="new sender",
     )
     route_id = uuid.uuid4()
-    # Mocking or depending on FakeControlPlaneRepository to have an update method
-    # Actually FakeControlPlaneRepository probably doesn't implement update_inbound_route properly if it was missing.
+    # Mocking or depending on FakeGlobalStore to have an update method
+    # Actually FakeGlobalStore probably doesn't implement update_inbound_route properly if it was missing.
     # We will just pass because it's a fake
     try:
-        res = await route_service.update_inbound_route(tenant_id=1, route_id=route_id, cmd=cmd)
+        res = await service.update_inbound_route(tenant_id=1, route_id=route_id, cmd=cmd)
         assert res is not None
     except NotImplementedError:
         pass
 
 
 @pytest.mark.asyncio
-async def test_create_outbound_route(route_service: RouteService, global_repo):
+async def test_create_outbound_route(mock_uow, global_repo):
+    service = OutboundRouteService(uow=mock_uow)
     cmd = CreateOutboundRouteCmd(
         trading_partner_id="PARTNER_123",
         name="Outbound Route",
         as2_partner_id=uuid.uuid4(),
     )
-    route = await route_service.create_outbound_route(tenant_id=1, cmd=cmd)
+    route = await service.create_outbound_route(tenant_id=1, cmd=cmd)
 
     assert route.direction == "OUTBOUND"
     assert len(global_repo.outbound_routes) == 1
diff --git a/services/api/tests/test_routers_as2.py b/services/api/tests/test_routers_as2.py
index e99880f5..7e1d57f5 100644
--- a/services/api/tests/test_routers_as2.py
+++ b/services/api/tests/test_routers_as2.py
@@ -17,8 +17,7 @@
 @pytest.fixture
 def mock_uow():
     uow = AsyncMock()
-    uow.control_plane = AsyncMock()
-    uow.data_plane = AsyncMock()
+    uow.transactions = AsyncMock()
     return uow
 
 
@@ -50,7 +49,7 @@ def client(mock_uow, mock_vault):
 def test_export_as2_certificates(client, mock_uow):
     pid = uuid4()
 
-    mock_partner = mock_uow.control_plane.get_as2_partner.return_value
+    mock_partner = mock_uow.as2_partners.get_as2_partner.return_value
     mock_partner.public_cert_pem = "cert_pem"
     mock_partner.prev_public_cert_pem = "prev_cert_pem"
     mock_partner.is_local = True
@@ -64,7 +63,7 @@ def test_export_as2_certificates(client, mock_uow):
 def test_rotate_as2_certificates(client, mock_uow):
     pid = uuid4()
 
-    mock_partner = mock_uow.control_plane.get_as2_partner.return_value
+    mock_partner = mock_uow.as2_partners.get_as2_partner.return_value
     mock_partner.public_cert_pem = "cert_pem"
     mock_partner.prev_public_cert_pem = "prev_cert_pem"
     mock_partner.is_local = True
@@ -80,7 +79,7 @@ def test_rotate_as2_certificates(client, mock_uow):
 
 
 def test_list_edi_headers(client, mock_uow):
-    mock_uow.data_plane.get_edi_headers.return_value = []
+    mock_uow.transactions.get_edi_headers.return_value = []
     client.get("/api/v1/edi-headers")
 
 
@@ -90,7 +89,7 @@ def test_create_edi_header(client, mock_uow):
 
 def test_update_edi_header(client, mock_uow):
     hid = uuid4()
-    mock_uow.data_plane.get_edi_header.return_value = {"id": str(hid)}
+    mock_uow.transactions.get_edi_header.return_value = {"id": str(hid)}
     client.patch(f"/api/v1/edi-headers/{hid}", json={"status": "PROCESSING"})
 
 
@@ -100,7 +99,7 @@ def test_delete_edi_header(client, mock_uow):
 
 
 def test_list_as2_partnerships(client, mock_uow):
-    mock_uow.control_plane.get_as2_partnerships.return_value = []
+    mock_uow.as2_partnerships.get_as2_partnerships.return_value = []
     client.get("/api/v1/trading-partners/as2/partnerships")
 
 
@@ -117,7 +116,7 @@ def test_create_as2_partnership(client, mock_uow):
 
 def test_update_as2_partnership(client, mock_uow):
     pid = uuid4()
-    mock_uow.control_plane.get_as2_partnership.return_value = {"id": str(pid)}
+    mock_uow.as2_partnerships.get_as2_partnership.return_value = {"id": str(pid)}
     client.put(
         f"/api/v1/trading-partners/as2/partnerships/{pid}", json={"trading_partner_id": "tp1"}
     )
@@ -129,7 +128,7 @@ def test_delete_as2_partnership(client, mock_uow):
 
 
 def test_list_as2_partners(client, mock_uow):
-    mock_uow.control_plane.list_as2_partners.return_value = []
+    mock_uow.as2_partners.list_as2_partners.return_value = []
     client.get("/api/v1/trading-partners/as2/trading-partners")
 
 
@@ -148,7 +147,7 @@ def test_create_as2_partner(client, mock_uow):
 
 def test_update_as2_partner(client, mock_uow):
     pid = uuid4()
-    mock_partner = mock_uow.control_plane.get_as2_partner.return_value
+    mock_partner = mock_uow.as2_partners.get_as2_partner.return_value
     mock_partner.id = pid
     client.put(
         f"/api/v1/trading-partners/as2/trading-partners/{pid}", json={"name": "partner1_updated"}
diff --git a/services/api/tests/test_routers_explorer.py b/services/api/tests/test_routers_explorer.py
index bfed3a11..ca076288 100644
--- a/services/api/tests/test_routers_explorer.py
+++ b/services/api/tests/test_routers_explorer.py
@@ -22,7 +22,7 @@ def mock_uow():
     _mock_repo.explorer_list_edi_json.return_value = []
 
     _mock_uow = AsyncMock()
-    _mock_uow.data_plane = _mock_repo
+    _mock_uow.transactions = _mock_repo
     _mock_uow.__aenter__.return_value = _mock_uow
     return _mock_uow
 
@@ -42,7 +42,7 @@ def setup_dependencies(mock_uow):
 def test_explorer_edi_messages(mock_uow):
     response = client.post("/api/v1/explorer/edi-messages", json={"filters": []})
     assert response.status_code == 200
-    mock_uow.data_plane.explorer_list_edi_messages.assert_called_once_with(
+    mock_uow.transactions.explorer_list_edi_messages.assert_called_once_with(
         tenant_id=1, filters=[], limit=50, offset=0
     )
 
@@ -50,7 +50,7 @@ def test_explorer_edi_messages(mock_uow):
 def test_explorer_edi_json(mock_uow):
     response = client.post("/api/v1/explorer/edi-json", json={"filters": []})
     assert response.status_code == 200
-    mock_uow.data_plane.explorer_list_edi_json.assert_called_once_with(
+    mock_uow.transactions.explorer_list_edi_json.assert_called_once_with(
         tenant_id=1, filters=[], limit=50, offset=0
     )
 
diff --git a/services/api/tests/test_routers_partners.py b/services/api/tests/test_routers_partners.py
index 07897e58..9917dd52 100644
--- a/services/api/tests/test_routers_partners.py
+++ b/services/api/tests/test_routers_partners.py
@@ -63,7 +63,7 @@ def test_create_platform_as2_partner(client, fake_uow):
     data = response.json()
     assert "id" in data
     assert data["type"] == "AS2"
-    assert len(fake_uow.control_plane.partners) == 1
+    assert len(fake_uow.as2_partners.partners) == 1
 
 
 def test_list_platform_as2_partners(client, fake_uow):
@@ -144,7 +144,7 @@ def test_create_platform_as2_partnership(client, fake_uow):
     assert response.status_code == 201
     data = response.json()
     assert "id" in data
-    assert len(fake_uow.control_plane.partnerships) == 1
+    assert len(fake_uow.as2_partnerships.partnerships) == 1
 
 
 def test_list_platform_as2_partnerships(client):
@@ -272,11 +272,11 @@ def test_existing_sftp_connection_failures(client, fake_uow):
 
     from unittest.mock import AsyncMock
 
-    fake_uow.control_plane.delete_sftp_partner = AsyncMock(side_effect=ValueError("Not found"))
+    fake_uow.sftp_partners.delete_sftp_partner = AsyncMock(side_effect=ValueError("Not found"))
     resp = client.delete(f"/api/v1/trading-partners/sftp/{random_id}")
     assert resp.status_code == 400
 
-    fake_uow.control_plane.delete_sftp_partner = AsyncMock(side_effect=Exception("DB Error"))
+    fake_uow.sftp_partners.delete_sftp_partner = AsyncMock(side_effect=Exception("DB Error"))
     resp = client.delete(f"/api/v1/trading-partners/sftp/{random_id}")
     assert resp.status_code == 500
 
@@ -370,7 +370,7 @@ def test_existing_sftp_connection_failures(client, fake_uow):
         assert resp.status_code == 400
 
     # Delete integrity error
-    fake_uow.control_plane.delete_sftp_partner = AsyncMock(
+    fake_uow.sftp_partners.delete_sftp_partner = AsyncMock(
         side_effect=IntegrityError("x", "y", "z")
     )
     resp = client.delete(f"/api/v1/trading-partners/sftp/{p_id}")
diff --git a/services/api/tests/test_routers_transactions.py b/services/api/tests/test_routers_transactions.py
index 0e529f3b..9f5674b5 100644
--- a/services/api/tests/test_routers_transactions.py
+++ b/services/api/tests/test_routers_transactions.py
@@ -98,8 +98,7 @@ def base_mock_uow():
     mock_global.execute.return_value = mock_db_result
 
     uow = UnitOfWork(global_session=mock_global, tenant_session=mock_tenant)
-    uow.control_plane = AsyncMock()
-    uow.data_plane = mock_repo
+    uow._transactions = mock_repo
     return uow
 
 
@@ -164,8 +163,7 @@ def test_get_transaction_detail_sftp():
     mock_global.execute.return_value = mock_db_result
 
     mock_uow = UnitOfWork(global_session=mock_global, tenant_session=mock_tenant)
-    mock_uow.control_plane = AsyncMock()
-    mock_uow.data_plane = mock_repo
+    mock_uow._transactions = mock_repo
 
     app.dependency_overrides[get_tenant_uow] = lambda: mock_uow
     response = client.get(f"/api/v1/transactions/{mock_msg.trace_id}")
@@ -208,8 +206,7 @@ def test_get_transaction_detail_fallback():
     mock_global.execute.return_value = mock_db_result
 
     mock_uow = UnitOfWork(global_session=mock_global, tenant_session=mock_tenant)
-    mock_uow.control_plane = AsyncMock()
-    mock_uow.data_plane = mock_repo
+    mock_uow._transactions = mock_repo
 
     app.dependency_overrides[get_tenant_uow] = lambda: mock_uow
     response = client.get(f"/api/v1/transactions/{mock_msg.trace_id}")
@@ -222,11 +219,10 @@ def test_get_transaction_not_found():
     from api.dependencies import get_tenant_uow
 
     mock_uow = UnitOfWork(global_session=AsyncMock(), tenant_session=AsyncMock())
-    mock_uow.control_plane = AsyncMock()
 
     mock_repo = AsyncMock()
     mock_repo.get_transaction.return_value = None
-    mock_uow.data_plane = mock_repo
+    mock_uow._transactions = mock_repo
 
     app.dependency_overrides[get_tenant_uow] = lambda: mock_uow
     uid = str(uuid.uuid4())
@@ -282,8 +278,7 @@ def test_get_transaction_webhook_fallback():
     mock_global_session.execute.return_value = mock_global_execute
 
     mock_uow = UnitOfWork(global_session=mock_global_session, tenant_session=mock_tenant_session)
-    mock_uow.control_plane = AsyncMock()
-    mock_uow.data_plane = mock_repo
+    mock_uow._transactions = mock_repo
 
     app.dependency_overrides[get_tenant_uow] = lambda: mock_uow
     response = client.get(f"/api/v1/transactions/{mock_msg.trace_id}")
diff --git a/services/api/tests/test_uow.py b/services/api/tests/test_uow.py
index 49d5755d..78980c46 100644
--- a/services/api/tests/test_uow.py
+++ b/services/api/tests/test_uow.py
@@ -12,8 +12,10 @@ async def test_sqlalchemy_uow():
     uow = UnitOfWork(global_session=mock_global_session, tenant_session=mock_tenant_session)
 
     async with uow:
-        assert uow.control_plane is not None
-        assert uow.data_plane is not None
+        assert uow.global_session == mock_global_session
+        assert uow.tenant_session == mock_tenant_session
+        assert uow.as2_partners is not None
+        assert uow.transactions is not None
 
         await uow.commit()
 
diff --git a/services/api/tests/test_webhooks.py b/services/api/tests/test_webhooks.py
index 53ca139b..0e1419eb 100644
--- a/services/api/tests/test_webhooks.py
+++ b/services/api/tests/test_webhooks.py
@@ -10,8 +10,7 @@
 @pytest.fixture
 def mock_uow():
     uow = AsyncMock()
-    uow.control_plane = AsyncMock()
-    uow.data_plane = AsyncMock()
+    uow.transactions = AsyncMock()
     return uow
 
 
@@ -28,7 +27,7 @@ def client(mock_uow):
 
 
 def test_list_webhooks(client, mock_uow):
-    mock_uow.control_plane.list_webhooks.return_value = []
+    mock_uow.webhooks.list_webhooks.return_value = []
     response = client.get("/api/v1/webhooks")
     assert response.status_code == 200
 
@@ -41,7 +40,7 @@ def test_create_webhook(client, mock_uow):
     mock_webhook.active = True
     mock_webhook.url = "http://locahost"
 
-    mock_uow.control_plane.create_webhook.return_value = mock_webhook
+    mock_uow.webhooks.create_webhook.return_value = mock_webhook
     response = client.post(
         "/api/v1/webhooks",
         json={"name": "wh1", "url": "http://localhost", "events": ["transaction.created"]},
@@ -58,8 +57,8 @@ def test_update_webhook(client, mock_uow):
     mock_webhook.name = "updated"
     mock_webhook.active = True
     mock_webhook.url = "http://localhost"
-    mock_uow.control_plane.get_webhook.return_value = mock_webhook
-    mock_uow.control_plane.update_webhook.return_value = mock_webhook
+    mock_uow.webhooks.get_webhook.return_value = mock_webhook
+    mock_uow.webhooks.update_webhook.return_value = mock_webhook
     response = client.patch(f"/api/v1/webhooks/{pid}", json={"name": "updated"})
     assert response.status_code in (200, 201, 500, 422)