diff --git a/.travis.yml b/.travis.yml
index 5b9cc6a5..4fce1a74 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -29,7 +29,6 @@ before_install:
 script:
   - docker-compose -f docker-compose.yml -f docker-compose.test.yml up -d
   - while true; do output=`docker-compose exec -T php pidof php-fpm | cat`; if [[ ! -z "${output}" ]]; then break; fi; sleep 1; done;
-  - docker-compose -f docker-compose.yml -f docker-compose.test.yml exec php php bin/console security:check
   - docker-compose -f docker-compose.yml -f docker-compose.test.yml exec php php bin/console doctrine:migration:migrate --no-interaction
   - docker-compose -f docker-compose.yml -f docker-compose.test.yml exec -e FIXTURES=test php php bin/console doctrine:fixtures:load --no-interaction
   - docker-compose -f docker-compose.yml -f docker-compose.test.yml exec php vendor/bin/behat
diff --git a/api/Dockerfile-php b/api/Dockerfile-php
index e316e63a..18474adc 100644
--- a/api/Dockerfile-php
+++ b/api/Dockerfile-php
@@ -46,7 +46,7 @@ RUN set -eux; \
 	\
 	apk del .build-deps
 
-COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
+COPY --from=composer:1.10.16 /usr/bin/composer /usr/bin/composer
 COPY docker/php/php.ini /usr/local/etc/php/php.ini
 
 # https://getcomposer.org/doc/03-cli.md#composer-allow-superuser
diff --git a/api/composer.json b/api/composer.json
index f4a4ce3f..c17e6820 100644
--- a/api/composer.json
+++ b/api/composer.json
@@ -11,13 +11,15 @@
         "ext-iconv": "*",
         "api-platform/api-pack": "^1.1",
         "defuse/php-encryption": "^2.2",
-        "digitalstate/core": "0.18.0",
+        "digitalstate/core": "0.19.0",
         "doctrine/doctrine-fixtures-bundle": "^3.0",
         "doctrine/doctrine-migrations-bundle": "^1.3",
         "guzzlehttp/guzzle": "^6.3",
+        "justinrainbow/json-schema": "^5.0",
         "knplabs/doctrine-behaviors": "^1.5",
         "lexik/jwt-authentication-bundle": "^2.6",
         "ramsey/uuid": "^3.8",
+        "scienta/doctrine-json-functions": "^4.1",
         "sensio/framework-extra-bundle": "^5.2",
         "sensiolabs/security-checker": "^5.0",
         "symfony/console": "^4.0",
@@ -66,8 +68,7 @@
         "auto-scripts": {
             "cache:clear": "symfony-cmd",
             "assets:install": "symfony-cmd",
-            "assets:install %PUBLIC_DIR%": "symfony-cmd",
-            "security-checker security:check": "script"
+            "assets:install %PUBLIC_DIR%": "symfony-cmd"
         },
         "post-install-cmd": [
             "@auto-scripts"
diff --git a/api/composer.lock b/api/composer.lock
index 66cee8e9..6f8805b8 100644
--- a/api/composer.lock
+++ b/api/composer.lock
@@ -1,10 +1,10 @@
 {
     "_readme": [
         "This file locks the dependencies of your project to a known state",
-        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "64c705e08bb8fa4487bd287a3cc01993",
+    "content-hash": "831670e819cf6fdd1ddf6ebaa837731b",
     "packages": [
         {
             "name": "api-platform/api-pack",
@@ -330,16 +330,16 @@
         },
         {
             "name": "digitalstate/core",
-            "version": "0.18.0",
+            "version": "0.19.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/DigitalState/Core.git",
-                "reference": "c94e4b990ef1a7f1adc76b89d06d95f6a47721ec"
+                "reference": "ddd320c3aacb7c5e7bdb962b5d2715abcb1dd9d2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/DigitalState/Core/zipball/c94e4b990ef1a7f1adc76b89d06d95f6a47721ec",
-                "reference": "c94e4b990ef1a7f1adc76b89d06d95f6a47721ec",
+                "url": "https://api.github.com/repos/DigitalState/Core/zipball/ddd320c3aacb7c5e7bdb962b5d2715abcb1dd9d2",
+                "reference": "ddd320c3aacb7c5e7bdb962b5d2715abcb1dd9d2",
                 "shasum": ""
             },
             "require": {
@@ -1947,6 +1947,72 @@
             ],
             "time": "2014-01-12T16:20:24+00:00"
         },
+        {
+            "name": "justinrainbow/json-schema",
+            "version": "5.2.10",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/justinrainbow/json-schema.git",
+                "reference": "2ba9c8c862ecd5510ed16c6340aa9f6eadb4f31b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/justinrainbow/json-schema/zipball/2ba9c8c862ecd5510ed16c6340aa9f6eadb4f31b",
+                "reference": "2ba9c8c862ecd5510ed16c6340aa9f6eadb4f31b",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.3.3"
+            },
+            "require-dev": {
+                "friendsofphp/php-cs-fixer": "~2.2.20||~2.15.1",
+                "json-schema/json-schema-test-suite": "1.2.0",
+                "phpunit/phpunit": "^4.8.35"
+            },
+            "bin": [
+                "bin/validate-json"
+            ],
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "5.0.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "JsonSchema\\": "src/JsonSchema/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Bruno Prieto Reis",
+                    "email": "bruno.p.reis@gmail.com"
+                },
+                {
+                    "name": "Justin Rainbow",
+                    "email": "justin.rainbow@gmail.com"
+                },
+                {
+                    "name": "Igor Wiedler",
+                    "email": "igor@wiedler.ch"
+                },
+                {
+                    "name": "Robert Schönthal",
+                    "email": "seroscho@googlemail.com"
+                }
+            ],
+            "description": "A library to validate a json schema.",
+            "homepage": "https://github.com/justinrainbow/json-schema",
+            "keywords": [
+                "json",
+                "schema"
+            ],
+            "time": "2020-05-27T16:41:55+00:00"
+        },
         {
             "name": "knplabs/doctrine-behaviors",
             "version": "1.6.0",
@@ -2997,6 +3063,68 @@
             ],
             "time": "2018-07-19T23:38:55+00:00"
         },
+        {
+            "name": "scienta/doctrine-json-functions",
+            "version": "4.1.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/ScientaNL/DoctrineJsonFunctions.git",
+                "reference": "6cab3f93a7415dbc889da15336c7605efbfe7bd4"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/ScientaNL/DoctrineJsonFunctions/zipball/6cab3f93a7415dbc889da15336c7605efbfe7bd4",
+                "reference": "6cab3f93a7415dbc889da15336c7605efbfe7bd4",
+                "shasum": ""
+            },
+            "require": {
+                "ext-pdo": "*",
+                "php": "^7.1"
+            },
+            "require-dev": {
+                "doctrine/coding-standard": "^5.0",
+                "doctrine/orm": "~2.6",
+                "phpunit/phpunit": "^6.5"
+            },
+            "suggest": {
+                "dunglas/doctrine-json-odm": "To serialize / deserialize objects as JSON documents."
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "4.1-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Scienta\\DoctrineJsonFunctions\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Doctrine Json Functions Contributors",
+                    "homepage": "https://github.com/ScientaNL/DoctrineJsonFunctions/contributors"
+                }
+            ],
+            "description": "A set of extensions to Doctrine 2 that add support for json query functions.",
+            "keywords": [
+                "database",
+                "doctrine",
+                "dql",
+                "json",
+                "mariadb",
+                "mysql",
+                "orm",
+                "postgres",
+                "postgresql",
+                "sqlite"
+            ],
+            "time": "2020-02-07T11:05:21+00:00"
+        },
         {
             "name": "sensio/framework-extra-bundle",
             "version": "v5.2.4",
@@ -6247,6 +6375,7 @@
                 "code",
                 "zf2"
             ],
+            "abandoned": "laminas/laminas-code",
             "time": "2018-08-13T20:36:59+00:00"
         },
         {
@@ -6301,6 +6430,7 @@
                 "events",
                 "zf2"
             ],
+            "abandoned": "laminas/laminas-eventmanager",
             "time": "2018-04-25T15:33:34+00:00"
         }
     ],
@@ -6936,6 +7066,7 @@
             ],
             "description": "Promoting the interoperability of container objects (DIC, SL, etc.)",
             "homepage": "https://github.com/container-interop/container-interop",
+            "abandoned": "psr/container",
             "time": "2017-02-14T19:40:03+00:00"
         },
         {
@@ -6943,12 +7074,12 @@
             "version": "0.9.1",
             "source": {
                 "type": "git",
-                "url": "https://github.com/njh/easyrdf.git",
+                "url": "https://github.com/easyrdf/easyrdf.git",
                 "reference": "acd09dfe0555fbcfa254291e433c45fdd4652566"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/njh/easyrdf/zipball/acd09dfe0555fbcfa254291e433c45fdd4652566",
+                "url": "https://api.github.com/repos/easyrdf/easyrdf/zipball/acd09dfe0555fbcfa254291e433c45fdd4652566",
                 "reference": "acd09dfe0555fbcfa254291e433c45fdd4652566",
                 "shasum": ""
             },
@@ -7096,72 +7227,6 @@
             "description": "A tool to automatically fix PHP code style",
             "time": "2019-01-04T18:29:47+00:00"
         },
-        {
-            "name": "justinrainbow/json-schema",
-            "version": "5.2.8",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/justinrainbow/json-schema.git",
-                "reference": "dcb6e1006bb5fd1e392b4daa68932880f37550d4"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/justinrainbow/json-schema/zipball/dcb6e1006bb5fd1e392b4daa68932880f37550d4",
-                "reference": "dcb6e1006bb5fd1e392b4daa68932880f37550d4",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=5.3.3"
-            },
-            "require-dev": {
-                "friendsofphp/php-cs-fixer": "~2.2.20",
-                "json-schema/json-schema-test-suite": "1.2.0",
-                "phpunit/phpunit": "^4.8.35"
-            },
-            "bin": [
-                "bin/validate-json"
-            ],
-            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "5.0.x-dev"
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "JsonSchema\\": "src/JsonSchema/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Bruno Prieto Reis",
-                    "email": "bruno.p.reis@gmail.com"
-                },
-                {
-                    "name": "Justin Rainbow",
-                    "email": "justin.rainbow@gmail.com"
-                },
-                {
-                    "name": "Igor Wiedler",
-                    "email": "igor@wiedler.ch"
-                },
-                {
-                    "name": "Robert Schönthal",
-                    "email": "seroscho@googlemail.com"
-                }
-            ],
-            "description": "A library to validate a json schema.",
-            "homepage": "https://github.com/justinrainbow/json-schema",
-            "keywords": [
-                "json",
-                "schema"
-            ],
-            "time": "2019-01-14T23:55:14+00:00"
-        },
         {
             "name": "league/html-to-markdown",
             "version": "4.8.1",
@@ -7883,5 +7948,6 @@
         "php": "^7.1.3",
         "ext-iconv": "*"
     },
-    "platform-dev": []
+    "platform-dev": [],
+    "plugin-api-version": "1.1.0"
 }
diff --git a/api/config/fixtures/dev/access/anonymous/access.yaml b/api/config/fixtures/dev/access/anonymous/access.yaml
index 7f5aaa3a..986ba357 100644
--- a/api/config/fixtures/dev/access/anonymous/access.yaml
+++ b/api/config/fixtures/dev/access/anonymous/access.yaml
@@ -3,6 +3,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: c11c546e-bd01-47cf-97da-e25388357b5a # Administration
   assignee: Anonymous
diff --git a/api/config/fixtures/dev/access/individual/access.yaml b/api/config/fixtures/dev/access/individual/access.yaml
index dfe7630b..3318fddf 100644
--- a/api/config/fixtures/dev/access/individual/access.yaml
+++ b/api/config/fixtures/dev/access/individual/access.yaml
@@ -2,6 +2,7 @@ objects: []
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: c11c546e-bd01-47cf-97da-e25388357b5a # Administration
   assignee: Individual
diff --git a/api/config/fixtures/dev/access/organization/access.yaml b/api/config/fixtures/dev/access/organization/access.yaml
index d49418a3..23d354ec 100644
--- a/api/config/fixtures/dev/access/organization/access.yaml
+++ b/api/config/fixtures/dev/access/organization/access.yaml
@@ -2,6 +2,7 @@ objects: []
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: c11c546e-bd01-47cf-97da-e25388357b5a # Administration
   assignee: Organization
diff --git a/api/config/fixtures/dev/access/role/access.yaml b/api/config/fixtures/dev/access/role/access.yaml
index ae9f15f6..2865f0c0 100644
--- a/api/config/fixtures/dev/access/role/access.yaml
+++ b/api/config/fixtures/dev/access/role/access.yaml
@@ -16,6 +16,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: c11c546e-bd01-47cf-97da-e25388357b5a # Administration
   assignee: Role
diff --git a/api/config/fixtures/dev/access/role/permission.yaml b/api/config/fixtures/dev/access/role/permission.yaml
index b1fce64d..a8d87349 100644
--- a/api/config/fixtures/dev/access/role/permission.yaml
+++ b/api/config/fixtures/dev/access/role/permission.yaml
@@ -3,7 +3,6 @@ objects:
     scope:
       type: owner
       entity: BusinessUnit
-      entity_uuid: ~ # Any BusinessUnit
     key: entity
     attributes: [BROWSE, READ, EDIT, ADD, DELETE]
 
@@ -11,7 +10,6 @@ objects:
     scope:
       type: owner
       entity: BusinessUnit
-      entity_uuid: ~ # Any BusinessUnit
     key: property
     attributes: [BROWSE, READ, EDIT]
 
diff --git a/api/config/fixtures/dev/access/staff/access.yaml b/api/config/fixtures/dev/access/staff/access.yaml
index 3546239f..0989c220 100644
--- a/api/config/fixtures/dev/access/staff/access.yaml
+++ b/api/config/fixtures/dev/access/staff/access.yaml
@@ -2,6 +2,7 @@ objects: []
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: c11c546e-bd01-47cf-97da-e25388357b5a # Administration
   assignee: Staff
diff --git a/api/config/fixtures/dev/access/system/access.yaml b/api/config/fixtures/dev/access/system/access.yaml
index 966ab3e9..a1596ff9 100644
--- a/api/config/fixtures/dev/access/system/access.yaml
+++ b/api/config/fixtures/dev/access/system/access.yaml
@@ -9,6 +9,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: System
   owner_uuid: ~
   assignee: System
diff --git a/api/config/fixtures/dev/category.yaml b/api/config/fixtures/dev/category.yaml
index b1bdef93..7b0aac8d 100644
--- a/api/config/fixtures/dev/category.yaml
+++ b/api/config/fixtures/dev/category.yaml
@@ -32,6 +32,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   slug: ~
diff --git a/api/config/fixtures/dev/config.yaml b/api/config/fixtures/dev/config.yaml
index bafb97d7..ee818382 100644
--- a/api/config/fixtures/dev/config.yaml
+++ b/api/config/fixtures/dev/config.yaml
@@ -73,6 +73,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: c11c546e-bd01-47cf-97da-e25388357b5a # Administration
   key: ~
diff --git a/api/config/fixtures/dev/metadata.yaml b/api/config/fixtures/dev/metadata.yaml
index 8130c481..16c78283 100644
--- a/api/config/fixtures/dev/metadata.yaml
+++ b/api/config/fixtures/dev/metadata.yaml
@@ -2,6 +2,7 @@ objects: []
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: c11c546e-bd01-47cf-97da-e25388357b5a # Administration
   title: {}
diff --git a/api/config/fixtures/dev/scenario.yaml b/api/config/fixtures/dev/scenario.yaml
index 5f9510c7..2dcf6ba6 100644
--- a/api/config/fixtures/dev/scenario.yaml
+++ b/api/config/fixtures/dev/scenario.yaml
@@ -89,6 +89,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   service: ~
diff --git a/api/config/fixtures/dev/service.yaml b/api/config/fixtures/dev/service.yaml
index 767d6041..c2c50ef1 100644
--- a/api/config/fixtures/dev/service.yaml
+++ b/api/config/fixtures/dev/service.yaml
@@ -40,6 +40,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   slug: ~
diff --git a/api/config/fixtures/dev/system/tenant.yaml b/api/config/fixtures/dev/system/tenant.yaml
index feb49483..a0dbc08a 100644
--- a/api/config/fixtures/dev/system/tenant.yaml
+++ b/api/config/fixtures/dev/system/tenant.yaml
@@ -3,4 +3,5 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   data: {}
diff --git a/api/config/fixtures/dev/workflow/bpmn/graffiti-report.bpmn b/api/config/fixtures/dev/workflow/bpmn/graffiti-report.bpmn
new file mode 100644
index 00000000..e2621126
--- /dev/null
+++ b/api/config/fixtures/dev/workflow/bpmn/graffiti-report.bpmn
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<bpmn:definitions xmlns:bpmn="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:camunda="http://camunda.org/schema/1.0/bpmn" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="Definitions_1" targetNamespace="http://bpmn.io/schema/bpmn" exporter="Camunda Modeler" exporterVersion="1.10.0">
+  <bpmn:process id="graffiti-report" isExecutable="true">
+    <bpmn:startEvent id="StartEvent_1" camunda:formKey="formio:graffiti-report">
+      <bpmn:outgoing>SequenceFlow_1q8gf6i</bpmn:outgoing>
+    </bpmn:startEvent>
+    <bpmn:sequenceFlow id="SequenceFlow_1q8gf6i" sourceRef="StartEvent_1" targetRef="Task_1um55u0" />
+    <bpmn:userTask id="Task_1um55u0" name="Review" camunda:formKey="formio:graffiti-report-review" camunda:assignee="Staff:5449ce65-5df0-440d-aead-21a77907e59a" camunda:candidateGroups="40cf4ba7-0c62-4cf6-827c-c7d37f1e1af2">
+      <bpmn:incoming>SequenceFlow_1q8gf6i</bpmn:incoming>
+      <bpmn:outgoing>SequenceFlow_0wplinc</bpmn:outgoing>
+    </bpmn:userTask>
+    <bpmn:endEvent id="EndEvent_128xq4h">
+      <bpmn:incoming>SequenceFlow_0wplinc</bpmn:incoming>
+    </bpmn:endEvent>
+    <bpmn:sequenceFlow id="SequenceFlow_0wplinc" sourceRef="Task_1um55u0" targetRef="EndEvent_128xq4h" />
+  </bpmn:process>
+  <bpmndi:BPMNDiagram id="BPMNDiagram_1">
+    <bpmndi:BPMNPlane id="BPMNPlane_1" bpmnElement="graffiti-report">
+      <bpmndi:BPMNShape id="_BPMNShape_StartEvent_2" bpmnElement="StartEvent_1">
+        <dc:Bounds x="173" y="102" width="36" height="36" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNEdge id="SequenceFlow_1q8gf6i_di" bpmnElement="SequenceFlow_1q8gf6i">
+        <di:waypoint xsi:type="dc:Point" x="209" y="120" />
+        <di:waypoint xsi:type="dc:Point" x="247" y="120" />
+        <di:waypoint xsi:type="dc:Point" x="247" y="120" />
+        <di:waypoint xsi:type="dc:Point" x="301" y="120" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="262" y="114" width="0" height="12" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNShape id="UserTask_0ysrbwn_di" bpmnElement="Task_1um55u0">
+        <dc:Bounds x="301" y="80" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="EndEvent_128xq4h_di" bpmnElement="EndEvent_128xq4h">
+        <dc:Bounds x="510" y="102" width="36" height="36" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="528" y="142" width="0" height="12" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNEdge id="SequenceFlow_0wplinc_di" bpmnElement="SequenceFlow_0wplinc">
+        <di:waypoint xsi:type="dc:Point" x="401" y="120" />
+        <di:waypoint xsi:type="dc:Point" x="510" y="120" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="455.5" y="99" width="0" height="12" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
+    </bpmndi:BPMNPlane>
+  </bpmndi:BPMNDiagram>
+</bpmn:definitions>
diff --git a/api/config/fixtures/dev/workflow/deployment.yaml b/api/config/fixtures/dev/workflow/deployment.yaml
index ad7dc56c..9bcd6f21 100644
--- a/api/config/fixtures/dev/workflow/deployment.yaml
+++ b/api/config/fixtures/dev/workflow/deployment.yaml
@@ -3,6 +3,10 @@ objects:
     files:
       - bpmn/pothole-report.bpmn
 
+  - name: Graffiti Report
+    files:
+      - bpmn/graffiti-report.bpmn
+
 prototype:
   name: ~
   source: ~
diff --git a/api/config/fixtures/test/access/anonymous/access.yaml b/api/config/fixtures/test/access/anonymous/access.yaml
index 052bd4cc..0de1a5c5 100644
--- a/api/config/fixtures/test/access/anonymous/access.yaml
+++ b/api/config/fixtures/test/access/anonymous/access.yaml
@@ -19,6 +19,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   assignee: Anonymous
diff --git a/api/config/fixtures/test/access/individual/access.yaml b/api/config/fixtures/test/access/individual/access.yaml
index 88bb188a..d2a6fec1 100644
--- a/api/config/fixtures/test/access/individual/access.yaml
+++ b/api/config/fixtures/test/access/individual/access.yaml
@@ -19,6 +19,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   assignee: Individual
diff --git a/api/config/fixtures/test/access/organization/access.yaml b/api/config/fixtures/test/access/organization/access.yaml
index ba555c77..cffa56c7 100644
--- a/api/config/fixtures/test/access/organization/access.yaml
+++ b/api/config/fixtures/test/access/organization/access.yaml
@@ -19,6 +19,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   assignee: Organization
diff --git a/api/config/fixtures/test/access/role/access.yaml b/api/config/fixtures/test/access/role/access.yaml
index fb18ad2b..ac545dfe 100644
--- a/api/config/fixtures/test/access/role/access.yaml
+++ b/api/config/fixtures/test/access/role/access.yaml
@@ -1,7 +1,15 @@
-objects: []
+objects:
+  - uuid: bf5488c4-0cfa-42b8-b21a-5cdf61adf335
+    assignee_uuid: 3762b831-1bb7-438d-9747-1b8657e59877
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: ef8b15dd-9260-4847-afc6-a61ef891312e
+    assignee_uuid: de3d2dea-ab7c-472d-85f0-c7df3db8a690
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   assignee: Role
diff --git a/api/config/fixtures/test/access/role/permission.yaml b/api/config/fixtures/test/access/role/permission.yaml
index a50e99b7..24eb0fea 100644
--- a/api/config/fixtures/test/access/role/permission.yaml
+++ b/api/config/fixtures/test/access/role/permission.yaml
@@ -1,4 +1,37 @@
-objects: []
+objects:
+  - access: bf5488c4-0cfa-42b8-b21a-5cdf61adf335
+    key: entity
+    attributes: [BROWSE, READ, EDIT, ADD, DELETE]
+    scope:
+      type: owner
+      entity: BusinessUnit
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - access: bf5488c4-0cfa-42b8-b21a-5cdf61adf335
+    key: property
+    attributes: [BROWSE, READ, EDIT]
+    scope:
+      type: owner
+      entity: BusinessUnit
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - access: ef8b15dd-9260-4847-afc6-a61ef891312e
+    key: entity
+    attributes: [BROWSE, READ, EDIT, ADD, DELETE]
+    scope:
+      type: property
+      property: data.en.attribute
+      value: string
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - access: ef8b15dd-9260-4847-afc6-a61ef891312e
+    key: property
+    attributes: [BROWSE, READ, EDIT]
+    scope:
+      type: property
+      property: data.en.attribute
+      value: string
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
 
 prototype:
   access: ~
diff --git a/api/config/fixtures/test/access/staff/access.yaml b/api/config/fixtures/test/access/staff/access.yaml
index c6f3874a..97822a5a 100644
--- a/api/config/fixtures/test/access/staff/access.yaml
+++ b/api/config/fixtures/test/access/staff/access.yaml
@@ -19,6 +19,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   assignee: Staff
diff --git a/api/config/fixtures/test/access/system/access.yaml b/api/config/fixtures/test/access/system/access.yaml
index e2b943a9..901078dd 100644
--- a/api/config/fixtures/test/access/system/access.yaml
+++ b/api/config/fixtures/test/access/system/access.yaml
@@ -11,6 +11,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: System
   owner_uuid: ~
   assignee: System
diff --git a/api/config/fixtures/test/category.yaml b/api/config/fixtures/test/category.yaml
index 2222b63b..c407b4e0 100644
--- a/api/config/fixtures/test/category.yaml
+++ b/api/config/fixtures/test/category.yaml
@@ -61,6 +61,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   slug: ~
diff --git a/api/config/fixtures/test/config.yaml b/api/config/fixtures/test/config.yaml
index 7e62e6df..b3ef2126 100644
--- a/api/config/fixtures/test/config.yaml
+++ b/api/config/fixtures/test/config.yaml
@@ -215,8 +215,117 @@ objects:
     value: start_data
     tenant: 92000deb-b847-4838-915c-b95d2b28e960 # Tenant 2
 
+  - uuid: 9999ba4e-ef33-41e3-8b7c-be05e4d46a9b
+    owner_uuid: ~
+    key: ds_api.user.username
+    value: system@system.ds
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: d2c40a9e-9db9-4e8a-bfe0-4dce0540bd08
+    owner_uuid: ~
+    key: ds_api.user.password
+    value: system
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 721d69c1-512f-4d93-a105-cbcf44654c6c
+    owner_uuid: ~
+    key: ds_api.user.uuid
+    value: d6a5c45e-2e14-4dd0-b1eb-7bd36db3fcf6 # System
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 5e296cc4-203b-4295-b90c-0f294fc82c7d
+    owner_uuid: ~
+    key: ds_api.user.roles
+    value: []
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: cb90bc72-baf0-4e57-8912-eae2091034df
+    owner_uuid: ~
+    key: ds_api.user.identity.roles
+    value: []
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: e9b10ad1-9d76-4b51-a6b9-5e74b0679fa4
+    owner_uuid: ~
+    key: ds_api.user.identity.type
+    value: System
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: eecbe53c-109e-4998-9baa-9c55e331a218
+    owner_uuid: ~
+    key: ds_api.user.identity.uuid
+    value: ~
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 39b1a45a-26be-4f1e-bf1c-1b8c472d215c
+    owner_uuid: ~
+    key: ds_api.user.tenant
+    value: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 86e89dd7-03ef-4ba4-a721-2968009a4d23
+    owner_uuid: ~
+    key: app.bpm.variables.api_url
+    value: api_url
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 833aa77b-726f-4aa0-a59b-c9813e5e8d82
+    owner_uuid: ~
+    key: app.bpm.variables.api_user
+    value: api_user
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 9a9c5298-3c76-4f45-8b0a-e98234ab8f2a
+    owner_uuid: ~
+    key: app.bpm.variables.api_key
+    value: api_key
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 5fc5cade-82de-49f1-adca-e3310f9fa1bb
+    owner_uuid: ~
+    key: app.bpm.variables.service_uuid
+    value: service_uuid
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 13bd6c35-84be-4309-99da-81ace8eb07de
+    owner_uuid: ~
+    key: app.bpm.variables.scenario_uuid
+    value: scenario_uuid
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 5f01d184-df91-42c4-9237-ae343b8e41f6
+    owner_uuid: ~
+    key: app.bpm.variables.scenario_custom_data
+    value: scenario_custom_data
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 33b74b4f-4f1a-4633-8b67-ef18f594ffb3
+    owner_uuid: ~
+    key: app.bpm.variables.identity
+    value: identity
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 11439bc9-098c-4189-818d-b93daf01fa48
+    owner_uuid: ~
+    key: app.bpm.variables.identity_uuid
+    value: identity_uuid
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 943f61a2-c90a-482a-b7b7-b1bf88f28523
+    owner_uuid: ~
+    key: app.bpm.variables.submission_uuid
+    value: submission_uuid
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: 0bfe25ba-d6c1-4401-a8e1-4afdd69cd5c2
+    owner_uuid: ~
+    key: app.bpm.variables.start_data
+    value: start_data
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   key: ~
diff --git a/api/config/fixtures/test/metadata.yaml b/api/config/fixtures/test/metadata.yaml
index bdd3feab..e7e66537 100644
--- a/api/config/fixtures/test/metadata.yaml
+++ b/api/config/fixtures/test/metadata.yaml
@@ -13,6 +13,7 @@ objects:
       identity: Identity
       owner: Owner
       session: Session
+      property: Property
     tenant: b6ac25fe-3cd6-4100-a054-6bba2fc9ef18 # Tenant 1
 
   - uuid: 50d8d791-1771-4f70-aaa7-188c181d3182
@@ -29,10 +30,12 @@ objects:
       identity: Identity
       owner: Owner
       session: Session
+      property: Property
     tenant: 92000deb-b847-4838-915c-b95d2b28e960 # Tenant 2
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   title: {}
diff --git a/api/config/fixtures/test/scenario.yaml b/api/config/fixtures/test/scenario.yaml
index b55cc983..8af7f1a5 100644
--- a/api/config/fixtures/test/scenario.yaml
+++ b/api/config/fixtures/test/scenario.yaml
@@ -51,6 +51,7 @@ objects:
 
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   service: ~
diff --git a/api/config/fixtures/test/service.yaml b/api/config/fixtures/test/service.yaml
index be7a05e2..0607edb1 100644
--- a/api/config/fixtures/test/service.yaml
+++ b/api/config/fixtures/test/service.yaml
@@ -55,8 +55,47 @@ objects:
       fr: Presentation ...
     tenant: 92000deb-b847-4838-915c-b95d2b28e960 # Tenant 2
 
+  - uuid: 3302e49b-03b0-40c9-8845-4243ca2c0051
+    owner_uuid: ~
+    slug: service-1
+    title:
+      en: Service 1
+      fr: Service 1
+    description:
+      en: Description ...
+      fr: Description ...
+    presentation:
+      en: Presentation ...
+      fr: Presentation ...
+    data:
+      en:
+        attribute: "string"
+      fr:
+        attribute: "string"
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
+  - uuid: dcdbbb1b-0762-4254-a1c5-33080749d5b3
+    owner_uuid: ~
+    slug: service-2
+    title:
+      en: Service 2
+      fr: Service 2
+    description:
+      en: Description ...
+      fr: Description ...
+    presentation:
+      en: Presentation ...
+      fr: Presentation ...
+    data:
+      en:
+        attribute: 123
+      fr:
+        attribute: 123
+    tenant: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
 prototype:
   uuid: ~
+  created_at: ~
   owner: BusinessUnit
   owner_uuid: ~
   slug: ~
diff --git a/api/config/fixtures/test/system/tenant.yaml b/api/config/fixtures/test/system/tenant.yaml
index 748d82c3..8566697b 100644
--- a/api/config/fixtures/test/system/tenant.yaml
+++ b/api/config/fixtures/test/system/tenant.yaml
@@ -3,6 +3,9 @@ objects:
 
   - uuid: 92000deb-b847-4838-915c-b95d2b28e960 # Tenant 2
 
+  - uuid: 64c82518-017d-4fb2-9fcf-3926da3616e6 # Tenant 0
+
 prototype:
   uuid: ~
+  created_at: ~
   data: {}
diff --git a/api/config/packages/api_platform.yaml b/api/config/packages/api_platform.yaml
index 73671610..5f1467a2 100644
--- a/api/config/packages/api_platform.yaml
+++ b/api/config/packages/api_platform.yaml
@@ -5,7 +5,7 @@ api_platform:
   mapping:
     paths: ['%kernel.project_dir%/src/Entity']
   title: Services
-  version: 0.18.2
+  version: 0.19.0
   collection:
     pagination:
       page_parameter_name: _page
diff --git a/api/config/packages/doctrine.yaml b/api/config/packages/doctrine.yaml
index 02aef9d4..4ede26bd 100644
--- a/api/config/packages/doctrine.yaml
+++ b/api/config/packages/doctrine.yaml
@@ -7,6 +7,18 @@ doctrine:
     server_version: '9.6'
     url: '%env(resolve:DATABASE_URL)%'
   orm:
+    dql:
+      string_functions:
+        JSON_EXTRACT_PATH: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonExtractPath
+        JSON_GET: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonGet
+        JSON_GET_PATH: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonGetPath
+        JSON_GET_PATH_TEXT: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonGetPathText
+        JSON_GET_TEXT: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonGetText
+        JSONB_CONTAINS: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonbContains
+        JSONB_EXISTS: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonbExists
+        JSONB_EXISTS_ALL: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonbExistsAll
+        JSONB_EXISTS_ANY: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonbExistsAny
+        JSONB_IS_CONTAINED: Scienta\DoctrineJsonFunctions\Query\AST\Functions\Postgresql\JsonbIsContained
     auto_generate_proxy_classes: '%kernel.debug%'
     naming_strategy: doctrine.orm.naming_strategy.underscore
     auto_mapping: true
diff --git a/api/config/tenant/loader/acl.yaml b/api/config/tenant/loader/acl.yaml
index 6f6130cb..0af652ff 100644
--- a/api/config/tenant/loader/acl.yaml
+++ b/api/config/tenant/loader/acl.yaml
@@ -25,13 +25,11 @@ objects:
       - scope:
           type: owner
           entity: BusinessUnit
-          entity_uuid: ~
         key: entity
         attributes: [BROWSE, READ, EDIT, ADD, DELETE]
       - scope:
           type: owner
           entity: BusinessUnit
-          entity_uuid: ~
         key: property
         attributes: [BROWSE, READ, EDIT]
       - scope:
diff --git a/api/features/api/access/add.feature b/api/features/api/access/add.feature
index fdae0d84..c6b827bb 100644
--- a/api/features/api/access/add.feature
+++ b/api/features/api/access/add.feature
@@ -10,6 +10,7 @@ Feature: Add accesses
     And I send a "POST" request to "/accesses" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "owner": "BusinessUnit",
       "ownerUuid": "325e1004-8516-4ca9-a4d3-d7505bd9a7fe",
       "assignee": "Anonymous",
@@ -22,9 +23,10 @@ Feature: Add accesses
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
     And the JSON node "id" should exist
-    And the JSON node "id" should be equal to the number 19
+    And the JSON node "id" should be equal to the number 21
     And the JSON node "uuid" should exist
     And the JSON node "createdAt" should exist
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should exist
     And the JSON node "owner" should exist
     And the JSON node "owner" should be equal to the string "BusinessUnit"
@@ -39,7 +41,7 @@ Feature: Add accesses
 
   Scenario: Read the added access
     When I add "Accept" header equal to "application/json"
-    And I send a "GET" request to "/accesses?id=19"
+    And I send a "GET" request to "/accesses?id=21"
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
diff --git a/api/features/api/access/edit.feature b/api/features/api/access/edit.feature
index aabcf740..d1185a18 100644
--- a/api/features/api/access/edit.feature
+++ b/api/features/api/access/edit.feature
@@ -10,6 +10,7 @@ Feature: Edit accesses
     And I send a "PUT" request to "/accesses/06dd7640-fcd3-4f42-90b6-659caa06d794" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "owner": "System",
       "ownerUuid": "aa18b644-a503-49fa-8f53-10f4c1f8e3a1",
       "assignee": "System",
@@ -20,6 +21,7 @@ Feature: Edit accesses
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "owner" should be equal to the string "System"
     And the JSON node "ownerUuid" should be equal to the string "aa18b644-a503-49fa-8f53-10f4c1f8e3a1"
     And the JSON node "assignee" should be equal to the string "System"
@@ -32,6 +34,7 @@ Feature: Edit accesses
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "owner" should be equal to the string "System"
     And the JSON node "ownerUuid" should be equal to the string "aa18b644-a503-49fa-8f53-10f4c1f8e3a1"
     And the JSON node "assignee" should be equal to the string "System"
@@ -46,7 +49,6 @@ Feature: Edit accesses
     {
       "id": 9999,
       "uuid": "1ac1b01e-4934-4b89-8a43-7d17a849be61",
-      "createdAt":"2000-01-01T12:00:00+00:00",
       "updatedAt":"2000-01-01T12:00:00+00:00",
       "version": 2,
       "tenant": "93377748-2abb-4e33-9027-5d8a5c281a41"
@@ -57,7 +59,6 @@ Feature: Edit accesses
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "06dd7640-fcd3-4f42-90b6-659caa06d794"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
 
@@ -69,7 +70,6 @@ Feature: Edit accesses
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "06dd7640-fcd3-4f42-90b6-659caa06d794"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
 
diff --git a/api/features/api/category/add.feature b/api/features/api/category/add.feature
index ddd61f04..938f4957 100644
--- a/api/features/api/category/add.feature
+++ b/api/features/api/category/add.feature
@@ -10,6 +10,7 @@ Feature: Add categories
     And I send a "POST" request to "/categories" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "owner": "BusinessUnit",
       "ownerUuid": "83bf8f26-7181-4bed-92f3-3ce5e4c286d7",
       "slug": "slug-add",
@@ -45,6 +46,7 @@ Feature: Add categories
     And the JSON node "id" should be equal to the number 5
     And the JSON node "uuid" should exist
     And the JSON node "createdAt" should exist
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should exist
     And the JSON node "deletedAt" should exist
     And the JSON node "deletedAt" should be null
diff --git a/api/features/api/category/edit.feature b/api/features/api/category/edit.feature
index 7002536a..3c1fe5a6 100644
--- a/api/features/api/category/edit.feature
+++ b/api/features/api/category/edit.feature
@@ -10,6 +10,7 @@ Feature: Edit categories
     And I send a "PUT" request to "/categories/70f36469-a65c-4d81-ae15-d66a2ef90df0" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "ownerUuid": "325e1004-8516-4ca9-a4d3-d7505bd9a7fe",
       "slug": "infrastructure-edit",
       "title": {
@@ -39,6 +40,7 @@ Feature: Edit categories
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "ownerUuid" should be equal to the string "325e1004-8516-4ca9-a4d3-d7505bd9a7fe"
     And the JSON node "slug" should be equal to the string "infrastructure-edit"
     And the JSON node "title.en" should be equal to "Infrastructure - edit"
@@ -59,6 +61,7 @@ Feature: Edit categories
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "ownerUuid" should be equal to the string "325e1004-8516-4ca9-a4d3-d7505bd9a7fe"
     And the JSON node "slug" should be equal to the string "infrastructure-edit"
     And the JSON node "title.en" should be equal to "Infrastructure - edit"
@@ -81,7 +84,6 @@ Feature: Edit categories
     {
       "id": 9999,
       "uuid": "25cfe5bb-b52d-4d33-9b54-5ed189cbcd2c",
-      "createdAt":"2000-01-01T12:00:00+00:00",
       "updatedAt":"2000-01-01T12:00:00+00:00",
       "deletedAt":"2000-01-01T12:00:00+00:00",
       "tenant": "95fecff7-b6c0-4a70-8896-b2f6f02da801"
@@ -92,7 +94,6 @@ Feature: Edit categories
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "70f36469-a65c-4d81-ae15-d66a2ef90df0"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "deletedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
@@ -105,7 +106,6 @@ Feature: Edit categories
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "70f36469-a65c-4d81-ae15-d66a2ef90df0"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "deletedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
diff --git a/api/features/api/config/edit.feature b/api/features/api/config/edit.feature
index 8813bb2c..ae3568eb 100644
--- a/api/features/api/config/edit.feature
+++ b/api/features/api/config/edit.feature
@@ -10,6 +10,7 @@ Feature: Edit configs
     And I send a "PUT" request to "/configs/4804b00d-cc69-4a2b-98c2-f8a0d9404764" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "value": "system2@system.ds",
       "version": 1
     }
@@ -17,6 +18,7 @@ Feature: Edit configs
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "value" should be equal to the string "system2@system.ds"
     And the JSON node "version" should be equal to the number 2
 
@@ -26,6 +28,7 @@ Feature: Edit configs
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "value" should be equal to the string "system2@system.ds"
     And the JSON node "version" should be equal to the number 2
 
@@ -37,7 +40,6 @@ Feature: Edit configs
     {
       "id": 9999,
       "uuid": "1ac1b01e-4934-4b89-8a43-7d17a849be61",
-      "createdAt":"2000-01-01T12:00:00+00:00",
       "updatedAt":"2000-01-01T12:00:00+00:00",
       "owner": "System",
       "ownerUuid": "5f8630dd-4739-4573-bcf6-9133416e4311",
@@ -51,7 +53,6 @@ Feature: Edit configs
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "4804b00d-cc69-4a2b-98c2-f8a0d9404764"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "owner" should be equal to "BusinessUnit"
     And the JSON node "ownerUuid" should be equal to "325e1004-8516-4ca9-a4d3-d7505bd9a7fe"
@@ -66,7 +67,6 @@ Feature: Edit configs
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "4804b00d-cc69-4a2b-98c2-f8a0d9404764"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "owner" should be equal to "BusinessUnit"
     And the JSON node "ownerUuid" should be equal to "325e1004-8516-4ca9-a4d3-d7505bd9a7fe"
diff --git a/api/features/api/metadata/add.feature b/api/features/api/metadata/add.feature
index b5fc8577..f67bf2c8 100644
--- a/api/features/api/metadata/add.feature
+++ b/api/features/api/metadata/add.feature
@@ -10,6 +10,7 @@ Feature: Add metadata
     And I send a "POST" request to "/metadata" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "owner": "BusinessUnit",
       "ownerUuid": "325e1004-8516-4ca9-a4d3-d7505bd9a7fe",
       "title": {
@@ -31,6 +32,7 @@ Feature: Add metadata
     And the JSON node "id" should be equal to the number 3
     And the JSON node "uuid" should exist
     And the JSON node "createdAt" should exist
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should exist
     And the JSON node "deletedAt" should exist
     And the JSON node "owner" should exist
diff --git a/api/features/api/metadata/edit.feature b/api/features/api/metadata/edit.feature
index 5c3a034e..3b3e9be8 100644
--- a/api/features/api/metadata/edit.feature
+++ b/api/features/api/metadata/edit.feature
@@ -10,6 +10,7 @@ Feature: Edit metadata
     And I send a "PUT" request to "/metadata/abe3bd7f-b0d4-4b77-97fa-f188a5b500a4" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "owner": "System",
       "ownerUuid": "aa18b644-a503-49fa-8f53-10f4c1f8e3a1",
       "title": {
@@ -27,6 +28,7 @@ Feature: Edit metadata
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "owner" should be equal to the string "System"
     And the JSON node "ownerUuid" should be equal to the string "aa18b644-a503-49fa-8f53-10f4c1f8e3a1"
     And the JSON node "title.en" should be equal to the string "Title - edit"
@@ -42,6 +44,7 @@ Feature: Edit metadata
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "owner" should be equal to the string "System"
     And the JSON node "ownerUuid" should be equal to the string "aa18b644-a503-49fa-8f53-10f4c1f8e3a1"
     And the JSON node "title.en" should be equal to the string "Title - edit"
@@ -59,7 +62,6 @@ Feature: Edit metadata
     {
       "id": 9999,
       "uuid": "421aebbb-e62e-4b87-bced-42921456131b",
-      "createdAt":"2000-01-01T12:00:00+00:00",
       "updatedAt":"2000-01-01T12:00:00+00:00",
       "version": 2,
       "tenant": "93377748-2abb-4e33-9027-5d8a5c281a41"
@@ -70,7 +72,6 @@ Feature: Edit metadata
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "abe3bd7f-b0d4-4b77-97fa-f188a5b500a4"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
 
@@ -82,7 +83,6 @@ Feature: Edit metadata
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "abe3bd7f-b0d4-4b77-97fa-f188a5b500a4"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
 
diff --git a/api/features/api/scenario/add.feature b/api/features/api/scenario/add.feature
index 1d5503aa..ddc971a0 100644
--- a/api/features/api/scenario/add.feature
+++ b/api/features/api/scenario/add.feature
@@ -10,6 +10,7 @@ Feature: Add scenarios
     And I send a "POST" request to "/scenarios" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "owner": "BusinessUnit",
       "ownerUuid": "83bf8f26-7181-4bed-92f3-3ce5e4c286d7",
       "service": "/services/7293e6d1-48e2-4761-b9c6-f77258cbe31a",
@@ -51,6 +52,7 @@ Feature: Add scenarios
     And the JSON node "id" should be equal to the number 3
     And the JSON node "uuid" should exist
     And the JSON node "createdAt" should exist
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should exist
     And the JSON node "deletedAt" should exist
     And the JSON node "deletedAt" should be null
diff --git a/api/features/api/scenario/edit.feature b/api/features/api/scenario/edit.feature
index b5c9035e..b95bc852 100644
--- a/api/features/api/scenario/edit.feature
+++ b/api/features/api/scenario/edit.feature
@@ -10,6 +10,7 @@ Feature: Edit scenarios
     And I send a "PUT" request to "/scenarios/2cb7402d-2a1d-49b3-af2a-3cf378193ffa" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "ownerUuid": "325e1004-8516-4ca9-a4d3-d7505bd9a7fe",
       "slug": "online-edit",
       "title": {
@@ -39,6 +40,7 @@ Feature: Edit scenarios
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "ownerUuid" should be equal to the string "325e1004-8516-4ca9-a4d3-d7505bd9a7fe"
     And the JSON node "slug" should be equal to the string "online-edit"
     And the JSON node "title.en" should be equal to "Report a Pothole Online - edit"
@@ -59,6 +61,7 @@ Feature: Edit scenarios
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "ownerUuid" should be equal to the string "325e1004-8516-4ca9-a4d3-d7505bd9a7fe"
     And the JSON node "slug" should be equal to the string "online-edit"
     And the JSON node "title.en" should be equal to "Report a Pothole Online - edit"
@@ -81,7 +84,6 @@ Feature: Edit scenarios
     {
       "id": 9999,
       "uuid": "002a4b0e-6f73-408f-8b04-3295a758feff",
-      "createdAt":"2000-01-01T12:00:00+00:00",
       "updatedAt":"2000-01-01T12:00:00+00:00",
       "deletedAt":"2000-01-01T12:00:00+00:00",
       "tenant": "20401625-f398-467b-ad31-955575f22d1e"
@@ -92,7 +94,6 @@ Feature: Edit scenarios
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "2cb7402d-2a1d-49b3-af2a-3cf378193ffa"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "deletedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
@@ -105,7 +106,6 @@ Feature: Edit scenarios
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "2cb7402d-2a1d-49b3-af2a-3cf378193ffa"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "deletedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
diff --git a/api/features/api/security/acl/services.feature b/api/features/api/security/acl/services.feature
new file mode 100644
index 00000000..137a492b
--- /dev/null
+++ b/api/features/api/security/acl/services.feature
@@ -0,0 +1,57 @@
+@api @security @acl @service
+Feature: Validate acl permissions on service endpoints
+
+  Scenario: Browse all services with permission scope `owner = BusinessUnit`
+    Given I am authenticated as the "system@system.ds" user with identity role "3762b831-1bb7-438d-9747-1b8657e59877" from the tenant "64c82518-017d-4fb2-9fcf-3926da3616e6"
+    When I add "Accept" header equal to "application/json"
+    And I send a "GET" request to "/services"
+    Then the response status code should be 200
+    And the header "Content-Type" should be equal to "application/json; charset=utf-8"
+    And the response should be in JSON
+    And the JSON should be valid according to this schema:
+    """
+    {
+      "type": "array",
+      "minItems": 2,
+      "maxItems": 2,
+      "items": {
+        "type": "object",
+        "properties": {
+          "uuid": {
+            "type": "string",
+            "enum": [
+              "3302e49b-03b0-40c9-8845-4243ca2c0051",
+              "dcdbbb1b-0762-4254-a1c5-33080749d5b3"
+            ]
+          }
+        }
+      }
+    }
+    """
+
+  Scenario: Browse all services with permission scope `data.en.attribute = "string"`
+    Given I am authenticated as the "system@system.ds" user with identity role "de3d2dea-ab7c-472d-85f0-c7df3db8a690" from the tenant "64c82518-017d-4fb2-9fcf-3926da3616e6"
+    When I add "Accept" header equal to "application/json"
+    And I send a "GET" request to "/services"
+    Then the response status code should be 200
+    And the header "Content-Type" should be equal to "application/json; charset=utf-8"
+    And the response should be in JSON
+    And the JSON should be valid according to this schema:
+    """
+    {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 1,
+      "items": {
+        "type": "object",
+        "properties": {
+          "uuid": {
+            "type": "string",
+            "enum": [
+              "3302e49b-03b0-40c9-8845-4243ca2c0051"
+            ]
+          }
+        }
+      }
+    }
+    """
diff --git a/api/features/api/service/add.feature b/api/features/api/service/add.feature
index 0dbee320..f9a68cbb 100644
--- a/api/features/api/service/add.feature
+++ b/api/features/api/service/add.feature
@@ -10,6 +10,7 @@ Feature: Add services
     And I send a "POST" request to "/services" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "owner": "BusinessUnit",
       "ownerUuid": "83bf8f26-7181-4bed-92f3-3ce5e4c286d7",
       "slug": "slug-add",
@@ -42,9 +43,10 @@ Feature: Add services
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
     And the JSON node "id" should exist
-    And the JSON node "id" should be equal to the number 5
+    And the JSON node "id" should be equal to the number 7
     And the JSON node "uuid" should exist
     And the JSON node "createdAt" should exist
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should exist
     And the JSON node "deletedAt" should exist
     And the JSON node "deletedAt" should be null
@@ -89,7 +91,7 @@ Feature: Add services
 
   Scenario: Read the added service
     When I add "Accept" header equal to "application/json"
-    And I send a "GET" request to "/services?id=5"
+    And I send a "GET" request to "/services?id=7"
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
diff --git a/api/features/api/service/edit.feature b/api/features/api/service/edit.feature
index c5de0c96..60ca505c 100644
--- a/api/features/api/service/edit.feature
+++ b/api/features/api/service/edit.feature
@@ -10,6 +10,7 @@ Feature: Edit services
     And I send a "PUT" request to "/services/7293e6d1-48e2-4761-b9c6-f77258cbe31a" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "ownerUuid": "325e1004-8516-4ca9-a4d3-d7505bd9a7fe",
       "slug": "report-pothole-edit",
       "title": {
@@ -39,6 +40,7 @@ Feature: Edit services
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "ownerUuid" should be equal to the string "325e1004-8516-4ca9-a4d3-d7505bd9a7fe"
     And the JSON node "slug" should be equal to the string "report-pothole-edit"
     And the JSON node "title.en" should be equal to "Report a Pothole - edit"
@@ -59,6 +61,7 @@ Feature: Edit services
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "ownerUuid" should be equal to the string "325e1004-8516-4ca9-a4d3-d7505bd9a7fe"
     And the JSON node "slug" should be equal to the string "report-pothole-edit"
     And the JSON node "title.en" should be equal to "Report a Pothole - edit"
@@ -81,7 +84,6 @@ Feature: Edit services
     {
       "id": 9999,
       "uuid": "002a4b0e-6f73-408f-8b04-3295a758feff",
-      "createdAt":"2000-01-01T12:00:00+00:00",
       "updatedAt":"2000-01-01T12:00:00+00:00",
       "deletedAt":"2000-01-01T12:00:00+00:00",
       "tenant": "20401625-f398-467b-ad31-955575f22d1e"
@@ -92,7 +94,6 @@ Feature: Edit services
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "7293e6d1-48e2-4761-b9c6-f77258cbe31a"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "deletedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
@@ -105,7 +106,6 @@ Feature: Edit services
     And the response should be in JSON
     And the JSON node "id" should be equal to the number 1
     And the JSON node "uuid" should be equal to the string "7293e6d1-48e2-4761-b9c6-f77258cbe31a"
-    And the JSON node "createdAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "deletedAt" should not contain "2000-01-01T12:00:00+00:00"
     And the JSON node "tenant" should be equal to "b6ac25fe-3cd6-4100-a054-6bba2fc9ef18"
diff --git a/api/features/api/system/tenant/add.feature b/api/features/api/system/tenant/add.feature
index ae37de8b..40c88b2c 100644
--- a/api/features/api/system/tenant/add.feature
+++ b/api/features/api/system/tenant/add.feature
@@ -10,6 +10,7 @@ Feature: Add tenant
     And I send a "POST" request to "/system/tenants" with body:
     """
     {
+      "createdAt": "2000-01-01 12:00:00",
       "uuid": "3b0f1019-e9b6-458d-b9ad-fd60c079ee7b",
       "data": {
           "user": {
@@ -66,17 +67,18 @@ Feature: Add tenant
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
     And the JSON node "id" should exist
-    And the JSON node "id" should be equal to the number 3
+    And the JSON node "id" should be equal to the number 4
     And the JSON node "uuid" should exist
     And the JSON node "uuid" should be equal to "3b0f1019-e9b6-458d-b9ad-fd60c079ee7b"
     And the JSON node "createdAt" should exist
+    And the JSON node "createdAt" should be equal to the string "2000-01-01T12:00:00+00:00"
     And the JSON node "updatedAt" should exist
     And the JSON node "version" should exist
     And the JSON node "version" should be equal to the number 1
 
   Scenario: Read the added tenant
     When I add "Accept" header equal to "application/json"
-    And I send a "GET" request to "/system/tenants?id=3"
+    And I send a "GET" request to "/system/tenants?id=4"
     Then the response status code should be 200
     And the header "Content-Type" should be equal to "application/json; charset=utf-8"
     And the response should be in JSON
diff --git a/api/features/api/system/tenant/browse.feature b/api/features/api/system/tenant/browse.feature
index 6e0b1697..f339c349 100644
--- a/api/features/api/system/tenant/browse.feature
+++ b/api/features/api/system/tenant/browse.feature
@@ -14,8 +14,8 @@ Feature: Browse tenants
     """
     {
       "type": "array",
-      "minItems": 2,
-      "maxItems": 2,
+      "minItems": 3,
+      "maxItems": 3,
       "items": {
         "type": "object",
         "properties": {
diff --git a/api/src/Controller/Scenario/SubmissionsController.php b/api/src/Controller/Scenario/SubmissionsController.php
index fcc9b015..b0b9cece 100644
--- a/api/src/Controller/Scenario/SubmissionsController.php
+++ b/api/src/Controller/Scenario/SubmissionsController.php
@@ -7,11 +7,11 @@
 use App\Service\ScenarioService;
 use App\Service\SubmissionService;
 use InvalidArgumentException;
-use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Serializer\SerializerInterface;
 use Symfony\Component\Validator\ConstraintViolationList;
 use function GuzzleHttp\json_decode;
 
@@ -37,18 +37,25 @@ final class SubmissionsController
      */
     private $submissionService;
 
+    /**
+     * @var \Symfony\Component\Serializer\SerializerInterface
+     */
+    private $serializer;
+
     /**
      * Constructor
      *
      * @param \Symfony\Component\HttpFoundation\RequestStack $requestStack
      * @param \App\Service\ScenarioService $scenarioService
      * @param \App\Service\SubmissionService $submissionService
+     * @param \Symfony\Component\Serializer\SerializerInterface $serializer
      */
-    public function __construct(RequestStack $requestStack, ScenarioService $scenarioService, SubmissionService $submissionService)
+    public function __construct(RequestStack $requestStack, ScenarioService $scenarioService, SubmissionService $submissionService, SerializerInterface $serializer)
     {
         $this->requestStack = $requestStack;
         $this->scenarioService = $scenarioService;
         $this->submissionService = $submissionService;
+        $this->serializer = $serializer;
     }
 
     /**
@@ -56,7 +63,7 @@ public function __construct(RequestStack $requestStack, ScenarioService $scenari
      *
      * @Route(path="/scenarios/{uuid}/submissions", methods={"POST"})
      * @param string $uuid
-     * @return \Symfony\Component\HttpFoundation\JsonResponse
+     * @return \Symfony\Component\HttpFoundation\Response
      * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
      */
     public function post($uuid)
@@ -90,7 +97,11 @@ public function post($uuid)
         $manager = $this->submissionService->getManager();
         $manager->persist($submission);
         $manager->flush();
-        $response = new JsonResponse($submission, Response::HTTP_CREATED);
+        $response = new Response(
+            $this->serializer->serialize($submission, 'json', ['item_operation_name' => 'get']),
+            Response::HTTP_CREATED,
+            ['Content-Type' => 'application/json']
+        );
 
         return $response;
     }
diff --git a/api/src/Entity/Category.php b/api/src/Entity/Category.php
index 504ed153..d4ed5221 100644
--- a/api/src/Entity/Category.php
+++ b/api/src/Entity/Category.php
@@ -101,8 +101,9 @@ class Category implements Identifiable, Uuidentifiable, Sluggable, Ownable, Tran
 
     /**
      * @var \DateTime
-     * @ApiProperty(writable=false)
-     * @Serializer\Groups({"category_output"})
+     * @ApiProperty
+     * @Serializer\Groups({"category_output", "category_input"})
+     * @Assert\DateTime
      */
     protected $createdAt;
 
diff --git a/api/src/Entity/Scenario.php b/api/src/Entity/Scenario.php
index 60c44847..8a535211 100644
--- a/api/src/Entity/Scenario.php
+++ b/api/src/Entity/Scenario.php
@@ -116,8 +116,9 @@ class Scenario implements Identifiable, Uuidentifiable, Sluggable, Ownable, Tran
 
     /**
      * @var \DateTime
-     * @ApiProperty(writable=false)
-     * @Serializer\Groups({"scenario_output"})
+     * @ApiProperty
+     * @Serializer\Groups({"scenario_output", "scenario_input"})
+     * @Assert\DateTime
      */
     protected $createdAt;
 
diff --git a/api/src/Entity/Service.php b/api/src/Entity/Service.php
index b4b910f6..71770bd0 100644
--- a/api/src/Entity/Service.php
+++ b/api/src/Entity/Service.php
@@ -103,8 +103,9 @@ class Service implements Identifiable, Uuidentifiable, Sluggable, Ownable, Trans
 
     /**
      * @var \DateTime
-     * @ApiProperty(writable=false)
-     * @Serializer\Groups({"service_output"})
+     * @ApiProperty
+     * @Serializer\Groups({"service_output", "service_input"})
+     * @Assert\DateTime
      */
     protected $createdAt;
 
diff --git a/api/src/Entity/Submission.php b/api/src/Entity/Submission.php
index c2ff6c48..13397039 100644
--- a/api/src/Entity/Submission.php
+++ b/api/src/Entity/Submission.php
@@ -91,8 +91,9 @@ class Submission implements Identifiable, Uuidentifiable, Ownable, Identitiable,
 
     /**
      * @var \DateTime
-     * @ApiProperty(writable=false)
-     * @Serializer\Groups({"submission_output"})
+     * @ApiProperty
+     * @Serializer\Groups({"submission_output", "submission_input"})
+     * @Assert\DateTime
      */
     protected $createdAt;
 
diff --git a/api/src/Fixture/Category.php b/api/src/Fixture/Category.php
index b03dee88..d0c0ac8c 100644
--- a/api/src/Fixture/Category.php
+++ b/api/src/Fixture/Category.php
@@ -4,6 +4,7 @@
 
 use App\Entity\Category as CategoryEntity;
 use App\Entity\Service;
+use DateTime;
 use Doctrine\Common\Persistence\ObjectManager;
 use Ds\Component\Database\Fixture\Yaml;
 
@@ -41,6 +42,12 @@ public function load(ObjectManager $manager)
                 ->setWeight($object->weight)
                 ->setTenant($object->tenant);
 
+            if (null !== $object->created_at) {
+                $date = new DateTime;
+                $date->setTimestamp($object->created_at);
+                $category->setCreatedAt($date);
+            }
+
             foreach ($object->services as $uuid) {
                 $service = $manager->getRepository(Service::class)->findOneBy(['uuid' => $uuid]);
                 $category->addService($service);
diff --git a/api/src/Fixture/Scenario.php b/api/src/Fixture/Scenario.php
index 8ee57a9f..c7982148 100644
--- a/api/src/Fixture/Scenario.php
+++ b/api/src/Fixture/Scenario.php
@@ -4,6 +4,7 @@
 
 use App\Entity\Service;
 use App\Entity\Scenario as ScenarioEntity;
+use DateTime;
 use Doctrine\Common\Persistence\ObjectManager;
 use Ds\Component\Database\Fixture\Yaml;
 
@@ -44,6 +45,13 @@ public function load(ObjectManager $manager)
                 ->setEnabled($object->enabled)
                 ->setWeight($object->weight)
                 ->setTenant($object->tenant);
+
+            if (null !== $object->created_at) {
+                $date = new DateTime;
+                $date->setTimestamp($object->created_at);
+                $scenario->setCreatedAt($date);
+            }
+
             $manager->persist($scenario);
         }
 
diff --git a/api/src/Fixture/Service.php b/api/src/Fixture/Service.php
index 41e72a89..f1dbd170 100644
--- a/api/src/Fixture/Service.php
+++ b/api/src/Fixture/Service.php
@@ -3,6 +3,7 @@
 namespace App\Fixture;
 
 use App\Entity\Service as ServiceEntity;
+use DateTime;
 use Doctrine\Common\Persistence\ObjectManager;
 use Ds\Component\Database\Fixture\Yaml;
 
@@ -39,6 +40,13 @@ public function load(ObjectManager $manager)
                 ->setEnabled($object->enabled)
                 ->setWeight($object->weight)
                 ->setTenant($object->tenant);
+
+            if (null !== $object->created_at) {
+                $date = new DateTime;
+                $date->setTimestamp($object->created_at);
+                $service->setCreatedAt($date);
+            }
+
             $manager->persist($service);
         }
 
diff --git a/api/src/Migration/Version0_19_0.php b/api/src/Migration/Version0_19_0.php
new file mode 100644
index 00000000..0f3121f1
--- /dev/null
+++ b/api/src/Migration/Version0_19_0.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Migration;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+use Doctrine\DBAL\Migrations\Version;
+use Ds\Component\Acl\Migration\Version0_19_0 as Acl;
+
+/**
+ * Class Version0_19_0
+ */
+final class Version0_19_0 extends AbstractMigration
+{
+    /**
+     * @var \Ds\Component\Acl\Migration\Version0_19_0
+     */
+    private $acl;
+
+    /**
+     * Constructor
+     *
+     * @param \Doctrine\DBAL\Migrations\Version  $version
+     */
+    public function __construct(Version $version)
+    {
+        parent::__construct($version);
+        $this->acl = new Acl($version);
+    }
+
+    /**
+     * Up migration
+     *
+     * @param \Doctrine\DBAL\Schema\Schema $schema
+     */
+    public function up(Schema $schema)
+    {
+        $this->acl->up($schema);
+    }
+
+    /**
+     * Down migration
+     *
+     * @param \Doctrine\DBAL\Schema\Schema $schema
+     */
+    public function down(Schema $schema)
+    {
+        $this->acl->down($schema);
+    }
+}
diff --git a/api/symfony.lock b/api/symfony.lock
index e08f1aca..67f9a301 100644
--- a/api/symfony.lock
+++ b/api/symfony.lock
@@ -245,6 +245,9 @@
     "ramsey/uuid": {
         "version": "3.8.0"
     },
+    "scienta/doctrine-json-functions": {
+        "version": "4.1.2"
+    },
     "sensio/framework-extra-bundle": {
         "version": "5.2",
         "recipe": {
diff --git a/docker-compose.yml b/docker-compose.yml
index 16ede600..407da904 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,7 +15,7 @@ services:
           - services_database
 
   php:
-    image: digitalstate/services:php-0.18.2
+    image: digitalstate/services:php-0.19.0
     depends_on:
       - database
     env_file:
@@ -44,7 +44,7 @@ services:
           - services_php
 
   api:
-    image: digitalstate/services:api-0.18.2
+    image: digitalstate/services:api-0.19.0
     depends_on:
       - php
     networks: