diff --git a/docs/helpers/env_vars.yaml b/docs/helpers/env_vars.yaml
index 8c3f1f49de..fa59cf793f 100644
--- a/docs/helpers/env_vars.yaml
+++ b/docs/helpers/env_vars.yaml
@@ -635,7 +635,7 @@ APP_PROVIDER_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 APP_PROVIDER_GRPC_PROTOCOL:
-  name: APP_PROVIDER_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;APP_PROVIDER_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GPRC service.
@@ -901,7 +901,7 @@ APP_REGISTRY_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 APP_REGISTRY_GRPC_PROTOCOL:
-  name: APP_REGISTRY_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;APP_REGISTRY_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -1316,7 +1316,7 @@ AUTH_APP_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 AUTH_APP_GRPC_PROTOCOL:
-  name: AUTH_APP_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;AUTH_APP_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -1528,7 +1528,7 @@ AUTH_BASIC_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 AUTH_BASIC_GRPC_PROTOCOL:
-  name: AUTH_BASIC_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;AUTH_BASIC_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -2022,7 +2022,7 @@ AUTH_BEARER_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 AUTH_BEARER_GRPC_PROTOCOL:
-  name: AUTH_BEARER_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;AUTH_BEARER_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -2228,7 +2228,7 @@ AUTH_MACHINE_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 AUTH_MACHINE_GRPC_PROTOCOL:
-  name: AUTH_MACHINE_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;AUTH_MACHINE_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -2379,7 +2379,7 @@ AUTH_SERVICE_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 AUTH_SERVICE_GRPC_PROTOCOL:
-  name: AUTH_SERVICE_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;AUTH_SERVICE_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -2746,6 +2746,16 @@ COLLABORATION_APP_INSECURE:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+COLLABORATION_APP_LICENSE_CHECK_ENABLE:
+  name: COLLABORATION_APP_LICENSE_CHECK_ENABLE
+  defaultValue: "false"
+  type: bool
+  description: Enable license checking to edit files. Needs to be enabled when using
+    Microsoft365 with the business flow.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 COLLABORATION_APP_LOCKNAME:
   name: COLLABORATION_APP_LOCKNAME
   defaultValue: com.github.owncloud.collaboration
@@ -2849,6 +2859,15 @@ COLLABORATION_GRPC_ADDR:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+COLLABORATION_GRPC_PROTOCOL:
+  name: OCIS_GRPC_PROTOCOL;COLLABORATION_GRPC_PROTOCOL
+  defaultValue: tcp
+  type: string
+  description: The transport protocol of the GRPC service.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 COLLABORATION_HTTP_ADDR:
   name: COLLABORATION_HTTP_ADDR
   defaultValue: 127.0.0.1:9300
@@ -2946,7 +2965,31 @@ COLLABORATION_WOPI_DISABLE_CHAT:
   name: COLLABORATION_WOPI_DISABLE_CHAT;OCIS_WOPI_DISABLE_CHAT
   defaultValue: "false"
   type: bool
-  description: Disable chat in the frontend.
+  description: Disable chat in the office web frontend. This feature applies to OnlyOffice
+    and Microsoft.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+COLLABORATION_WOPI_PROXY_SECRET:
+  name: COLLABORATION_WOPI_PROXY_SECRET
+  defaultValue: ""
+  type: string
+  description: Optional, the secret to authenticate against the ownCloud Office365
+    WOPI proxy. This secret can be obtained from ownCloud via the office365 proxy
+    subscription.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+COLLABORATION_WOPI_PROXY_URL:
+  name: COLLABORATION_WOPI_PROXY_URL
+  defaultValue: ""
+  type: string
+  description: The URL to the ownCloud Office365 WOPI proxy. Optional. To use this
+    feature, you need an office365 proxy subscription. If you become part of the Microsoft
+    CSP program (https://learn.microsoft.com/en-us/partner-center/enroll/csp-overview),
+    you can use WebOffice without a proxy.
   introductionVersion: '%%NEXT%%'
   deprecationVersion: ""
   removalVersion: ""
@@ -2965,9 +3008,9 @@ COLLABORATION_WOPI_SRC:
   name: COLLABORATION_WOPI_SRC
   defaultValue: https://localhost:9300
   type: string
-  description: The WOPISrc base URL containing schema, host and port. Set this to
-    the schema and domain where the collaboration service is reachable for the wopi
-    app, such as https://office.owncloud.test.
+  description: The WOPI source base URL containing schema, host and port. Set this
+    to the schema and domain where the collaboration service is reachable for the
+    wopi app, such as https://office.owncloud.test.
   introductionVersion: 6.0.0
   deprecationVersion: ""
   removalVersion: ""
@@ -4032,6 +4075,66 @@ FRONTEND_UPLOAD_MAX_CHUNK_SIZE:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GATEWAY_APP_REGISTRY_ENDPOINT:
+  name: GATEWAY_APP_REGISTRY_ENDPOINT
+  defaultValue: com.owncloud.api.app-registry
+  type: string
+  description: The endpoint of the app-registry service. Can take a service name or
+    a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+GATEWAY_AUTH_APP_ENDPOINT:
+  name: GATEWAY_AUTH_APP_ENDPOINT
+  defaultValue: com.owncloud.api.auth-app
+  type: string
+  description: The endpoint of the auth-app service. Can take a service name or a
+    gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+GATEWAY_AUTH_BASIC_ENDPOINT:
+  name: GATEWAY_AUTH_BASIC_ENDPOINT
+  defaultValue: com.owncloud.api.auth-basic
+  type: string
+  description: The endpoint of the auth-basic service. Can take a service name or
+    a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+GATEWAY_AUTH_BEARER_ENDPOINT:
+  name: GATEWAY_AUTH_BEARER_ENDPOINT
+  defaultValue: ""
+  type: string
+  description: The endpoint of the auth-bearer service. Can take a service name or
+    a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+GATEWAY_AUTH_MACHINE_ENDPOINT:
+  name: GATEWAY_AUTH_MACHINE_ENDPOINT
+  defaultValue: com.owncloud.api.auth-machine
+  type: string
+  description: The endpoint of the auth-machine service. Can take a service name or
+    a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+GATEWAY_AUTH_SERVICE_ENDPOINT:
+  name: GATEWAY_AUTH_SERVICE_ENDPOINT
+  defaultValue: com.owncloud.api.auth-service
+  type: string
+  description: The endpoint of the auth-service service. Can take a service name or
+    a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GATEWAY_COMMIT_SHARE_TO_STORAGE_GRANT:
   name: GATEWAY_COMMIT_SHARE_TO_STORAGE_GRANT
   defaultValue: "true"
@@ -4172,6 +4275,16 @@ GATEWAY_FRONTEND_PUBLIC_URL:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GATEWAY_GROUPS_ENDPOINT:
+  name: GATEWAY_GROUPS_ENDPOINT
+  defaultValue: com.owncloud.api.groups
+  type: string
+  description: The endpoint of the groups service. Can take a service name or a gRPC
+    URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GATEWAY_GRPC_ADDR:
   name: OCIS_GATEWAY_GRPC_ADDR;GATEWAY_GRPC_ADDR
   defaultValue: 127.0.0.1:9142
@@ -4182,7 +4295,7 @@ GATEWAY_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 GATEWAY_GRPC_PROTOCOL:
-  name: GATEWAY_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;GATEWAY_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -4236,6 +4349,26 @@ GATEWAY_LOG_PRETTY:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GATEWAY_OCM_ENDPOINT:
+  name: GATEWAY_OCM_ENDPOINT
+  defaultValue: com.owncloud.api.ocm
+  type: string
+  description: The endpoint of the ocm service. Can take a service name or a gRPC
+    URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+GATEWAY_PERMISSIONS_ENDPOINT:
+  name: GATEWAY_PERMISSIONS_ENDPOINT
+  defaultValue: com.owncloud.api.settings
+  type: string
+  description: The endpoint of the permissions service. Can take a service name or
+    a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GATEWAY_PROVIDER_CACHE_AUTH_PASSWORD:
   name: OCIS_CACHE_AUTH_PASSWORD;GATEWAY_PROVIDER_CACHE_AUTH_PASSWORD
   defaultValue: ""
@@ -4319,6 +4452,16 @@ GATEWAY_SHARE_FOLDER_NAME:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GATEWAY_SHARING_ENDPOINT:
+  name: GATEWAY_SHARING_ENDPOINT
+  defaultValue: com.owncloud.api.sharing
+  type: string
+  description: The endpoint of the shares service. Can take a service name or a gRPC
+    URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GATEWAY_SKIP_USER_GROUPS_IN_TOKEN:
   name: GATEWAY_SKIP_USER_GROUPS_IN_TOKEN
   defaultValue: "false"
@@ -4329,6 +4472,16 @@ GATEWAY_SKIP_USER_GROUPS_IN_TOKEN:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GATEWAY_STORAGE_PUBLIC_LINK_ENDPOINT:
+  name: GATEWAY_STORAGE_PUBLIC_LINK_ENDPOINT
+  defaultValue: com.owncloud.api.storage-publiclink
+  type: string
+  description: The endpoint of the storage-publiclink service. Can take a service
+    name or a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GATEWAY_STORAGE_REGISTRY_CONFIG_JSON:
   name: GATEWAY_STORAGE_REGISTRY_CONFIG_JSON
   defaultValue: ""
@@ -4357,6 +4510,26 @@ GATEWAY_STORAGE_REGISTRY_RULES:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GATEWAY_STORAGE_SHARES_ENDPOINT:
+  name: GATEWAY_STORAGE_SHARES_ENDPOINT
+  defaultValue: com.owncloud.api.storage-shares
+  type: string
+  description: The endpoint of the storag-shares service. Can take a service name
+    or a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+GATEWAY_STORAGE_USERS_ENDPOINT:
+  name: GATEWAY_STORAGE_USERS_ENDPOINT
+  defaultValue: com.owncloud.api.storage-users
+  type: string
+  description: The endpoint of the storage-users service. Can take a service name
+    or a gRPC URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GATEWAY_STORAGE_USERS_MOUNT_ID:
   name: GATEWAY_STORAGE_USERS_MOUNT_ID
   defaultValue: ""
@@ -4415,6 +4588,16 @@ GATEWAY_TRANSFER_EXPIRES:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GATEWAY_USERS_ENDPOINT:
+  name: GATEWAY_USERS_ENDPOINT
+  defaultValue: com.owncloud.api.users
+  type: string
+  description: The endpoint of the users service. Can take a service name or a gRPC
+    URI with the dns, kubernetes or unix protocol.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GRAPH_APPLICATION_DISPLAYNAME:
   name: GRAPH_APPLICATION_DISPLAYNAME
   defaultValue: ownCloud Infinite Scale
@@ -4446,6 +4629,17 @@ GRAPH_ASSIGN_DEFAULT_USER_ROLE:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GRAPH_AVAILABLE_ROLES:
+  name: GRAPH_AVAILABLE_ROLES
+  defaultValue: '[b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5 a8d5fe5e-96e3-418d-825b-534dbdf22b99
+    fb6c3e19-e378-47e5-b277-9732f9de6e21 58c63c02-1d89-4572-916a-870abc5a1b7d 2d00ce52-1fc2-4dbc-8b95-a73b73395f5a
+    1c996275-f1c9-4e71-abdf-a42f6495e960 312c0871-5ef7-4b3a-85b6-0e4074c64049]'
+  type: '[]string'
+  description: A comma separated list of roles that are available for assignment.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GRAPH_CACHE_AUTH_PASSWORD:
   name: OCIS_CACHE_AUTH_PASSWORD;GRAPH_CACHE_AUTH_PASSWORD
   defaultValue: ""
@@ -5368,6 +5562,17 @@ GRAPH_TRACING_TYPE:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+GRAPH_TRANSLATION_PATH:
+  name: OCIS_TRANSLATION_PATH;GRAPH_TRANSLATION_PATH
+  defaultValue: ""
+  type: string
+  description: (optional) Set this to a path with custom translations to overwrite
+    the builtin translations. Note that file and folder naming rules apply, see the
+    documentation for more details.
+  introductionVersion: '%%NEXT%%'
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 GRAPH_USER_ENABLED_ATTRIBUTE:
   name: OCIS_LDAP_USER_ENABLED_ATTRIBUTE;GRAPH_USER_ENABLED_ATTRIBUTE
   defaultValue: ownCloudUserEnabled
@@ -5447,7 +5652,7 @@ GROUPS_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 GROUPS_GRPC_PROTOCOL:
-  name: GROUPS_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;GROUPS_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -5917,10 +6122,10 @@ IDM_ADMIN_USER_ID:
   removalVersion: ""
   deprecationInfo: ""
 IDM_CREATE_DEMO_USERS:
-  name: IDM_CREATE_DEMO_USERS
+  name: SETTINGS_SETUP_DEFAULT_ASSIGNMENTS;IDM_CREATE_DEMO_USERS
   defaultValue: "false"
   type: bool
-  description: Flag to enable or disable the creation of the demo users.
+  description: The default role assignments the demo users should be setup.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -7272,7 +7477,7 @@ NOTIFICATIONS_SMTP_ENCRYPTION:
     'ssl', 'ssltls', 'tls' and 'none'.
   introductionVersion: pre5.0
   deprecationVersion: 5.0.0
-  removalVersion: 7.0.0
+  removalVersion: '%%NEXT_PRODUCTION_VERSION%%'
   deprecationInfo: The NOTIFICATIONS_SMTP_ENCRYPTION values 'ssl' and 'tls' are deprecated
     and will be removed in the future.
 NOTIFICATIONS_SMTP_HOST:
@@ -7692,12 +7897,12 @@ OCDAV_WEBDAV_NAMESPACE:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_ADMIN_USER_ID:
-  name: OCIS_ADMIN_USER_ID;IDM_ADMIN_USER_ID
+  name: OCIS_ADMIN_USER_ID;STORAGE_USERS_PURGE_TRASH_BIN_USER_ID
   defaultValue: ""
   type: string
-  description: ID of the user that should receive admin privileges. Consider that
-    the UUID can be encoded in some LDAP deployment configurations like in .ldif files.
-    These need to be decoded beforehand.
+  description: ID of the user who collects all necessary information for deletion.
+    Consider that the UUID can be encoded in some LDAP deployment configurations like
+    in .ldif files. These need to be decoded beforehand.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -7713,7 +7918,7 @@ OCIS_ASSET_THEMES_PATH:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_ASYNC_UPLOADS:
-  name: OCIS_ASYNC_UPLOADS
+  name: OCIS_ASYNC_UPLOADS;SEARCH_EVENTS_ASYNC_UPLOADS
   defaultValue: "true"
   type: bool
   description: Enable asynchronous file uploads.
@@ -7983,7 +8188,7 @@ OCIS_ENABLE_RESHARING:
   removalVersion: ""
   deprecationInfo: Resharing will be removed in the future.
 OCIS_EVENTS_AUTH_PASSWORD:
-  name: OCIS_EVENTS_AUTH_PASSWORD;FRONTEND_EVENTS_AUTH_PASSWORD
+  name: OCIS_EVENTS_AUTH_PASSWORD;SEARCH_EVENTS_AUTH_PASSWORD
   defaultValue: ""
   type: string
   description: The password to authenticate with the events broker. The events broker
@@ -7993,7 +8198,7 @@ OCIS_EVENTS_AUTH_PASSWORD:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_EVENTS_AUTH_USERNAME:
-  name: OCIS_EVENTS_AUTH_USERNAME;FRONTEND_EVENTS_AUTH_USERNAME
+  name: OCIS_EVENTS_AUTH_USERNAME;SEARCH_EVENTS_AUTH_USERNAME
   defaultValue: ""
   type: string
   description: The username to authenticate with the events broker. The events broker
@@ -8003,18 +8208,18 @@ OCIS_EVENTS_AUTH_USERNAME:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_EVENTS_CLUSTER:
-  name: OCIS_EVENTS_CLUSTER;FRONTEND_EVENTS_CLUSTER
+  name: OCIS_EVENTS_CLUSTER;SEARCH_EVENTS_CLUSTER
   defaultValue: ocis-cluster
   type: string
   description: The clusterID of the event system. The event system is the message
     queuing service. It is used as message broker for the microservice architecture.
     Mandatory when using NATS as event system.
-  introductionVersion: "5.0"
+  introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
 OCIS_EVENTS_ENABLE_TLS:
-  name: OCIS_EVENTS_ENABLE_TLS;NATS_EVENTS_ENABLE_TLS
+  name: OCIS_EVENTS_ENABLE_TLS;SEARCH_EVENTS_ENABLE_TLS
   defaultValue: "false"
   type: bool
   description: Enable TLS for the connection to the events broker. The events broker
@@ -8024,21 +8229,21 @@ OCIS_EVENTS_ENABLE_TLS:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_EVENTS_ENDPOINT:
-  name: OCIS_EVENTS_ENDPOINT;FRONTEND_EVENTS_ENDPOINT
+  name: OCIS_EVENTS_ENDPOINT;SEARCH_EVENTS_ENDPOINT
   defaultValue: 127.0.0.1:9233
   type: string
   description: The address of the event system. The event system is the message queuing
     service. It is used as message broker for the microservice architecture.
-  introductionVersion: "5.0"
+  introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
 OCIS_EVENTS_TLS_ROOT_CA_CERTIFICATE:
-  name: OCIS_EVENTS_TLS_ROOT_CA_CERTIFICATE;ANTIVIRUS_EVENTS_TLS_ROOT_CA_CERTIFICATE
+  name: OCIS_EVENTS_TLS_ROOT_CA_CERTIFICATE;SEARCH_EVENTS_TLS_ROOT_CA_CERTIFICATE
   defaultValue: ""
   type: string
   description: The root CA certificate used to validate the server's TLS certificate.
-    If provided ANTIVIRUS_EVENTS_TLS_INSECURE will be seen as false.
+    If provided SEARCH_EVENTS_TLS_INSECURE will be seen as false.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8075,6 +8280,15 @@ OCIS_GRPC_CLIENT_TLS_MODE:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+OCIS_GRPC_PROTOCOL:
+  name: OCIS_GRPC_PROTOCOL;STORAGE_PUBLICLINK_GRPC_PROTOCOL
+  defaultValue: ""
+  type: string
+  description: The transport protocol of the GRPC service.
+  introductionVersion: pre5.0
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 OCIS_HTTP_TLS_CERTIFICATE:
   name: OCIS_HTTP_TLS_CERTIFICATE
   defaultValue: ""
@@ -8107,17 +8321,16 @@ OCIS_HTTP_TLS_KEY:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_INSECURE:
-  name: OCIS_INSECURE;NATS_TLS_SKIP_VERIFY_CLIENT_CERT
+  name: OCIS_INSECURE;SEARCH_EXTRACTOR_CS3SOURCE_INSECURE
   defaultValue: "false"
   type: bool
-  description: Whether the NATS server should skip the client certificate verification
-    during the TLS handshake.
+  description: Ignore untrusted SSL certificates when connecting to the CS3 source.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
 OCIS_JWT_SECRET:
-  name: OCIS_JWT_SECRET;GROUPS_JWT_SECRET
+  name: OCIS_JWT_SECRET;SEARCH_JWT_SECRET
   defaultValue: ""
   type: string
   description: The secret to mint and validate jwt tokens.
@@ -8181,8 +8394,8 @@ OCIS_KEYCLOAK_USER_REALM:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_BIND_DN:
-  name: OCIS_LDAP_BIND_DN;GROUPS_LDAP_BIND_DN
-  defaultValue: uid=reva,ou=sysusers,o=libregraph-idm
+  name: OCIS_LDAP_BIND_DN;IDP_LDAP_BIND_DN
+  defaultValue: uid=idp,ou=sysusers,o=libregraph-idm
   type: string
   description: LDAP DN to use for simple bind authentication with the target LDAP
     server.
@@ -8191,7 +8404,7 @@ OCIS_LDAP_BIND_DN:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_BIND_PASSWORD:
-  name: OCIS_LDAP_BIND_PASSWORD;GROUPS_LDAP_BIND_PASSWORD
+  name: OCIS_LDAP_BIND_PASSWORD;IDP_LDAP_BIND_PASSWORD
   defaultValue: ""
   type: string
   description: Password to use for authenticating the 'bind_dn'.
@@ -8200,12 +8413,12 @@ OCIS_LDAP_BIND_PASSWORD:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_CACERT:
-  name: OCIS_LDAP_CACERT;GROUPS_LDAP_CACERT
+  name: OCIS_LDAP_CACERT;IDP_LDAP_TLS_CACERT
   defaultValue: /var/lib/ocis/idm/ldap.crt
   type: string
   description: Path/File name for the root CA certificate (in PEM format) used to
     validate TLS server certificates of the LDAP service. If not defined, the root
-    directory derives from $OCIS_BASE_DATA_PATH:/idm.
+    directory derives from $OCIS_BASE_DATA_PATH:/idp.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8330,7 +8543,7 @@ OCIS_LDAP_GROUP_SCOPE:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_INSECURE:
-  name: OCIS_LDAP_INSECURE;GROUPS_LDAP_INSECURE
+  name: OCIS_LDAP_INSECURE;IDP_INSECURE
   defaultValue: "false"
   type: bool
   description: Disable TLS certificate validation for the LDAP connections. Do not
@@ -8352,17 +8565,16 @@ OCIS_LDAP_SERVER_WRITE_ENABLED:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_URI:
-  name: OCIS_LDAP_URI;GROUPS_LDAP_URI
+  name: OCIS_LDAP_URI;IDP_LDAP_URI
   defaultValue: ldaps://localhost:9235
   type: string
-  description: URI of the LDAP Server to connect to. Supported URI schemes are 'ldaps://'
-    and 'ldap://'
+  description: Url of the LDAP service to use as IDP.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_USER_BASE_DN:
-  name: OCIS_LDAP_USER_BASE_DN;GROUPS_LDAP_USER_BASE_DN
+  name: OCIS_LDAP_USER_BASE_DN;IDP_LDAP_BASE_DN
   defaultValue: ou=users,o=libregraph-idm
   type: string
   description: Search base DN for looking up LDAP users.
@@ -8371,7 +8583,7 @@ OCIS_LDAP_USER_BASE_DN:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_USER_ENABLED_ATTRIBUTE:
-  name: OCIS_LDAP_USER_ENABLED_ATTRIBUTE;GRAPH_USER_ENABLED_ATTRIBUTE
+  name: OCIS_LDAP_USER_ENABLED_ATTRIBUTE;IDP_USER_ENABLED_ATTRIBUTE
   defaultValue: ownCloudUserEnabled
   type: string
   description: LDAP Attribute to use as a flag telling if the user is enabled or disabled.
@@ -8380,7 +8592,7 @@ OCIS_LDAP_USER_ENABLED_ATTRIBUTE:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_USER_FILTER:
-  name: OCIS_LDAP_USER_FILTER;GROUPS_LDAP_USER_FILTER
+  name: OCIS_LDAP_USER_FILTER;IDP_LDAP_FILTER
   defaultValue: ""
   type: string
   description: LDAP filter to add to the default filters for user search like '(objectclass=ownCloud)'.
@@ -8389,11 +8601,10 @@ OCIS_LDAP_USER_FILTER:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_USER_OBJECTCLASS:
-  name: OCIS_LDAP_USER_OBJECTCLASS;GROUPS_LDAP_USER_OBJECTCLASS
+  name: OCIS_LDAP_USER_OBJECTCLASS;IDP_LDAP_OBJECTCLASS
   defaultValue: inetOrgPerson
   type: string
-  description: The object class to use for users in the default user search filter
-    ('inetOrgPerson').
+  description: LDAP User ObjectClass like 'inetOrgPerson'.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8408,11 +8619,10 @@ OCIS_LDAP_USER_SCHEMA_DISPLAYNAME:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_USER_SCHEMA_ID:
-  name: OCIS_LDAP_USER_SCHEMA_ID;GROUPS_LDAP_USER_SCHEMA_ID
-  defaultValue: ownclouduuid
+  name: OCIS_LDAP_USER_SCHEMA_ID;IDP_LDAP_UUID_ATTRIBUTE
+  defaultValue: ownCloudUUID
   type: string
-  description: LDAP Attribute to use as the unique id for users. This should be a
-    stable globally unique id like a UUID.
+  description: LDAP User UUID attribute like 'uid'.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8429,10 +8639,10 @@ OCIS_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_USER_SCHEMA_MAIL:
-  name: OCIS_LDAP_USER_SCHEMA_MAIL;GROUPS_LDAP_USER_SCHEMA_MAIL
+  name: OCIS_LDAP_USER_SCHEMA_MAIL;IDP_LDAP_EMAIL_ATTRIBUTE
   defaultValue: mail
   type: string
-  description: LDAP Attribute to use for the email address of users.
+  description: LDAP User email attribute like 'mail'.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8448,16 +8658,16 @@ OCIS_LDAP_USER_SCHEMA_USER_TYPE:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_USER_SCHEMA_USERNAME:
-  name: OCIS_LDAP_USER_SCHEMA_USERNAME;GROUPS_LDAP_USER_SCHEMA_USERNAME
-  defaultValue: uid
+  name: OCIS_LDAP_USER_SCHEMA_USERNAME;IDP_LDAP_NAME_ATTRIBUTE
+  defaultValue: displayName
   type: string
-  description: LDAP Attribute to use for username of users.
+  description: LDAP User name attribute like 'displayName'.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LDAP_USER_SCOPE:
-  name: OCIS_LDAP_USER_SCOPE;GROUPS_LDAP_USER_SCOPE
+  name: OCIS_LDAP_USER_SCOPE;IDP_LDAP_SCOPE
   defaultValue: sub
   type: string
   description: LDAP search scope to use when looking up users. Supported scopes are
@@ -8467,7 +8677,7 @@ OCIS_LDAP_USER_SCOPE:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LOG_COLOR:
-  name: OCIS_LOG_COLOR;NATS_LOG_COLOR
+  name: OCIS_LOG_COLOR;SEARCH_LOG_COLOR
   defaultValue: "false"
   type: bool
   description: Activates colorized log output.
@@ -8476,7 +8686,7 @@ OCIS_LOG_COLOR:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LOG_FILE:
-  name: OCIS_LOG_FILE;NATS_LOG_FILE
+  name: OCIS_LOG_FILE;SEARCH_LOG_FILE
   defaultValue: ""
   type: string
   description: The path to the log file. Activates logging to this file if set.
@@ -8485,7 +8695,7 @@ OCIS_LOG_FILE:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LOG_LEVEL:
-  name: OCIS_LOG_LEVEL;NATS_LOG_LEVEL
+  name: OCIS_LOG_LEVEL;SEARCH_LOG_LEVEL
   defaultValue: ""
   type: string
   description: 'The log level. Valid values are: ''panic'', ''fatal'', ''error'',
@@ -8495,7 +8705,7 @@ OCIS_LOG_LEVEL:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_LOG_PRETTY:
-  name: OCIS_LOG_PRETTY;NATS_LOG_PRETTY
+  name: OCIS_LOG_PRETTY;SEARCH_LOG_PRETTY
   defaultValue: "false"
   type: bool
   description: Activates pretty log output.
@@ -8504,11 +8714,11 @@ OCIS_LOG_PRETTY:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_MACHINE_AUTH_API_KEY:
-  name: OCIS_MACHINE_AUTH_API_KEY;FRONTEND_MACHINE_AUTH_API_KEY
+  name: OCIS_MACHINE_AUTH_API_KEY;IDP_MACHINE_AUTH_API_KEY
   defaultValue: ""
   type: string
-  description: The machine auth API key used to validate internal requests necessary
-    to access resources from other services.
+  description: Machine auth API key used to validate internal requests necessary for
+    the access to resources from other services.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8525,11 +8735,10 @@ OCIS_OIDC_CLIENT_ID:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_OIDC_ISSUER:
-  name: OCIS_URL;OCIS_OIDC_ISSUER;GROUPS_IDP_URL
+  name: OCIS_URL;OCIS_OIDC_ISSUER;IDP_ISS
   defaultValue: https://localhost:9200
   type: string
-  description: The identity provider value to set in the group IDs of the CS3 group
-    objects for groups returned by this group provider.
+  description: The OIDC issuer URL to use.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8602,7 +8811,7 @@ OCIS_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_PERSISTENT_STORE:
-  name: OCIS_PERSISTENT_STORE;POSTPROCESSING_STORE
+  name: OCIS_PERSISTENT_STORE;EVENTHISTORY_STORE
   defaultValue: nats-js-kv
   type: string
   description: 'The type of the store. Supported values are: ''memory'', ''ocmem'',
@@ -8613,7 +8822,7 @@ OCIS_PERSISTENT_STORE:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_PERSISTENT_STORE_AUTH_PASSWORD:
-  name: OCIS_PERSISTENT_STORE_AUTH_PASSWORD;POSTPROCESSING_STORE_AUTH_PASSWORD
+  name: OCIS_PERSISTENT_STORE_AUTH_PASSWORD;EVENTHISTORY_STORE_AUTH_PASSWORD
   defaultValue: ""
   type: string
   description: The password to authenticate with the store. Only applies when store
@@ -8623,7 +8832,7 @@ OCIS_PERSISTENT_STORE_AUTH_PASSWORD:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_PERSISTENT_STORE_AUTH_USERNAME:
-  name: OCIS_PERSISTENT_STORE_AUTH_USERNAME;POSTPROCESSING_STORE_AUTH_USERNAME
+  name: OCIS_PERSISTENT_STORE_AUTH_USERNAME;EVENTHISTORY_STORE_AUTH_USERNAME
   defaultValue: ""
   type: string
   description: The username to authenticate with the store. Only applies when store
@@ -8633,7 +8842,7 @@ OCIS_PERSISTENT_STORE_AUTH_USERNAME:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_PERSISTENT_STORE_NODES:
-  name: OCIS_PERSISTENT_STORE_NODES;POSTPROCESSING_STORE_NODES
+  name: OCIS_PERSISTENT_STORE_NODES;EVENTHISTORY_STORE_NODES
   defaultValue: '[127.0.0.1:9233]'
   type: '[]string'
   description: A list of nodes to access the configured store. This has no effect
@@ -8645,22 +8854,22 @@ OCIS_PERSISTENT_STORE_NODES:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_PERSISTENT_STORE_SIZE:
-  name: OCIS_PERSISTENT_STORE_SIZE;POSTPROCESSING_STORE_SIZE
+  name: OCIS_PERSISTENT_STORE_SIZE;EVENTHISTORY_STORE_SIZE
   defaultValue: "0"
   type: int
   description: The maximum quantity of items in the store. Only applies when store
-    type 'ocmem' is configured. Defaults to 512 which is derived from the ocmem package
-    though not exclicitly set as default.
+    type 'ocmem' is configured. Defaults to 512 which is derived and used from the
+    ocmem package though no explicit default was set.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
 OCIS_PERSISTENT_STORE_TTL:
-  name: OCIS_PERSISTENT_STORE_TTL;POSTPROCESSING_STORE_TTL
-  defaultValue: 0s
+  name: OCIS_PERSISTENT_STORE_TTL;EVENTHISTORY_STORE_TTL
+  defaultValue: 336h0m0s
   type: Duration
-  description: Time to live for events in the store. See the Environment Variable
-    Types description for more details.
+  description: Time to live for events in the store. Defaults to '336h' (2 weeks).
+    See the Environment Variable Types description for more details.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8706,7 +8915,7 @@ OCIS_REVA_GATEWAY_TLS_MODE:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_SERVICE_ACCOUNT_ID:
-  name: OCIS_SERVICE_ACCOUNT_ID;FRONTEND_SERVICE_ACCOUNT_ID
+  name: OCIS_SERVICE_ACCOUNT_ID;SEARCH_SERVICE_ACCOUNT_ID
   defaultValue: ""
   type: string
   description: The ID of the service account the service should use. See the 'auth-service'
@@ -8716,7 +8925,7 @@ OCIS_SERVICE_ACCOUNT_ID:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_SERVICE_ACCOUNT_SECRET:
-  name: OCIS_SERVICE_ACCOUNT_SECRET;FRONTEND_SERVICE_ACCOUNT_SECRET
+  name: OCIS_SERVICE_ACCOUNT_SECRET;SEARCH_SERVICE_ACCOUNT_SECRET
   defaultValue: ""
   type: string
   description: The service account secret.
@@ -8786,7 +8995,7 @@ OCIS_SYSTEM_USER_ID:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_SYSTEM_USER_IDP:
-  name: OCIS_SYSTEM_USER_IDP;SHARING_PUBLIC_CS3_SYSTEM_USER_IDP
+  name: OCIS_SYSTEM_USER_IDP;SETTINGS_SYSTEM_USER_IDP
   defaultValue: internal
   type: string
   description: IDP of the oCIS STORAGE-SYSTEM system user.
@@ -8795,7 +9004,7 @@ OCIS_SYSTEM_USER_IDP:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_TRACING_COLLECTOR:
-  name: OCIS_TRACING_COLLECTOR;NATS_TRACING_COLLECTOR
+  name: OCIS_TRACING_COLLECTOR;SEARCH_TRACING_COLLECTOR
   defaultValue: ""
   type: string
   description: The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces.
@@ -8805,7 +9014,7 @@ OCIS_TRACING_COLLECTOR:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_TRACING_ENABLED:
-  name: OCIS_TRACING_ENABLED;NATS_TRACING_ENABLED
+  name: OCIS_TRACING_ENABLED;SEARCH_TRACING_ENABLED
   defaultValue: "false"
   type: bool
   description: Activates tracing.
@@ -8814,7 +9023,7 @@ OCIS_TRACING_ENABLED:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_TRACING_ENDPOINT:
-  name: OCIS_TRACING_ENDPOINT;NATS_TRACING_ENDPOINT
+  name: OCIS_TRACING_ENDPOINT;SEARCH_TRACING_ENDPOINT
   defaultValue: ""
   type: string
   description: The endpoint of the tracing agent.
@@ -8823,7 +9032,7 @@ OCIS_TRACING_ENDPOINT:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_TRACING_TYPE:
-  name: OCIS_TRACING_TYPE;NATS_TRACING_TYPE
+  name: OCIS_TRACING_TYPE;SEARCH_TRACING_TYPE
   defaultValue: ""
   type: string
   description: The type of tracing. Defaults to '', which is the same as 'jaeger'.
@@ -8842,22 +9051,21 @@ OCIS_TRANSFER_SECRET:
   removalVersion: ""
   deprecationInfo: ""
 OCIS_TRANSLATION_PATH:
-  name: OCIS_TRANSLATION_PATH;NOTIFICATIONS_TRANSLATION_PATH
+  name: OCIS_TRANSLATION_PATH;GRAPH_TRANSLATION_PATH
   defaultValue: ""
   type: string
   description: (optional) Set this to a path with custom translations to overwrite
     the builtin translations. Note that file and folder naming rules apply, see the
     documentation for more details.
-  introductionVersion: pre5.0
+  introductionVersion: '%%NEXT%%'
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
 OCIS_URL:
-  name: OCIS_URL;OCIS_OIDC_ISSUER;GROUPS_IDP_URL
+  name: OCIS_URL;OCIS_OIDC_ISSUER;IDP_ISS
   defaultValue: https://localhost:9200
   type: string
-  description: The identity provider value to set in the group IDs of the CS3 group
-    objects for groups returned by this group provider.
+  description: The OIDC issuer URL to use.
   introductionVersion: pre5.0
   deprecationVersion: ""
   removalVersion: ""
@@ -8866,7 +9074,8 @@ OCIS_WOPI_DISABLE_CHAT:
   name: COLLABORATION_WOPI_DISABLE_CHAT;OCIS_WOPI_DISABLE_CHAT
   defaultValue: "false"
   type: bool
-  description: Disable chat in the frontend.
+  description: Disable chat in the office web frontend. This feature applies to OnlyOffice
+    and Microsoft.
   introductionVersion: '%%NEXT%%'
   deprecationVersion: ""
   removalVersion: ""
@@ -8956,6 +9165,76 @@ OCM_DEBUG_ZPAGES:
   deprecationVersion: ""
   removalVersion: ""
   deprecationInfo: ""
+OCM_EVENTS_AUTH_PASSWORD:
+  name: OCIS_EVENTS_AUTH_PASSWORD;OCM_EVENTS_AUTH_PASSWORD
+  defaultValue: ""
+  type: string
+  description: The password to authenticate with the events broker. The events broker
+    is the ocis service which receives and delivers events between the services.
+  introductionVersion: "5.0"
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+OCM_EVENTS_AUTH_USERNAME:
+  name: OCIS_EVENTS_AUTH_USERNAME;OCM_EVENTS_AUTH_USERNAME
+  defaultValue: ""
+  type: string
+  description: The username to authenticate with the events broker. The events broker
+    is the ocis service which receives and delivers events between the services.
+  introductionVersion: "5.0"
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+OCM_EVENTS_CLUSTER:
+  name: OCIS_EVENTS_CLUSTER;OCM_EVENTS_CLUSTER
+  defaultValue: ocis-cluster
+  type: string
+  description: The clusterID of the event system. The event system is the message
+    queuing service. It is used as message broker for the microservice architecture.
+    Mandatory when using NATS as event system.
+  introductionVersion: pre5.0
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+OCM_EVENTS_ENABLE_TLS:
+  name: OCIS_EVENTS_ENABLE_TLS;OCM_EVENTS_ENABLE_TLS
+  defaultValue: "false"
+  type: bool
+  description: Enable TLS for the connection to the events broker. The events broker
+    is the ocis service which receives and delivers events between the services.
+  introductionVersion: pre5.0
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+OCM_EVENTS_ENDPOINT:
+  name: OCIS_EVENTS_ENDPOINT;OCM_EVENTS_ENDPOINT
+  defaultValue: 127.0.0.1:9233
+  type: string
+  description: The address of the event system. The event system is the message queuing
+    service. It is used as message broker for the microservice architecture.
+  introductionVersion: pre5.0
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+OCM_EVENTS_TLS_INSECURE:
+  name: OCIS_INSECURE;OCM_EVENTS_TLS_INSECURE
+  defaultValue: "false"
+  type: bool
+  description: Whether to verify the server TLS certificates.
+  introductionVersion: pre5.0
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
+OCM_EVENTS_TLS_ROOT_CA_CERTIFICATE:
+  name: OCIS_EVENTS_TLS_ROOT_CA_CERTIFICATE;OCM_EVENTS_TLS_ROOT_CA_CERTIFICATE
+  defaultValue: ""
+  type: string
+  description: The root CA certificate used to validate the server's TLS certificate.
+    If provided OCM_EVENTS_TLS_INSECURE will be seen as false.
+  introductionVersion: pre5.0
+  deprecationVersion: ""
+  removalVersion: ""
+  deprecationInfo: ""
 OCM_GRPC_ADDR:
   name: OCM_GRPC_ADDR
   defaultValue: 127.0.0.1:9282
@@ -8966,7 +9245,7 @@ OCM_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 OCM_GRPC_PROTOCOL:
-  name: OCM_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;OCM_GRPC_PROTOCOL
   defaultValue: ""
   type: string
   description: The transport protocol of the GRPC service.
@@ -9089,8 +9368,9 @@ OCM_OCM_INVITE_MANAGER_JSON_FILE:
   name: OCM_OCM_INVITE_MANAGER_JSON_FILE
   defaultValue: /var/lib/ocis/storage/ocm/ocminvites.json
   type: string
-  description: Path to the JSON file where OCM invite data will be stored. If not
-    defined, the root directory derives from $OCIS_BASE_DATA_PATH:/storage.
+  description: Path to the JSON file where OCM invite data will be stored. This file
+    is maintained by the instance and must not be changed manually. If not defined,
+    the root directory derives from $OCIS_BASE_DATA_PATH:/storage/ocm.
   introductionVersion: "5.0"
   deprecationVersion: ""
   removalVersion: ""
@@ -11536,7 +11816,7 @@ SHARING_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 SHARING_GRPC_PROTOCOL:
-  name: SHARING_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;SHARING_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -12315,7 +12595,7 @@ STORAGE_PUBLICLINK_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 STORAGE_PUBLICLINK_GRPC_PROTOCOL:
-  name: STORAGE_PUBLICLINK_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;STORAGE_PUBLICLINK_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -12476,7 +12756,7 @@ STORAGE_SHARES_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 STORAGE_SHARES_GRPC_PROTOCOL:
-  name: STORAGE_SHARES_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;STORAGE_SHARES_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GRPC service.
@@ -12748,7 +13028,7 @@ STORAGE_SYSTEM_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 STORAGE_SYSTEM_GRPC_PROTOCOL:
-  name: STORAGE_SYSTEM_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;STORAGE_SYSTEM_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GPRC service.
@@ -13269,7 +13549,7 @@ STORAGE_USERS_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 STORAGE_USERS_GRPC_PROTOCOL:
-  name: STORAGE_USERS_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;STORAGE_USERS_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GPRC service.
@@ -14984,7 +15264,7 @@ USERS_GRPC_ADDR:
   removalVersion: ""
   deprecationInfo: ""
 USERS_GRPC_PROTOCOL:
-  name: USERS_GRPC_PROTOCOL
+  name: OCIS_GRPC_PROTOCOL;USERS_GRPC_PROTOCOL
   defaultValue: tcp
   type: string
   description: The transport protocol of the GPRC service.
@@ -15501,7 +15781,7 @@ WEB_ASSET_PATH:
     the builtin assets.
   introductionVersion: pre5.0
   deprecationVersion: 5.1.0
-  removalVersion: 7.0.0
+  removalVersion: '%%NEXT_PRODUCTION_VERSION%%'
   deprecationInfo: The WEB_ASSET_PATH is deprecated and will be removed in the future.
 WEB_ASSET_THEMES_PATH:
   name: OCIS_ASSET_THEMES_PATH;WEB_ASSET_THEMES_PATH