diff --git a/internal/gen/controller/api/services/list.pb.go b/internal/gen/controller/api/services/list.pb.go
new file mode 100644
index 0000000000..41a2421fdc
--- /dev/null
+++ b/internal/gen/controller/api/services/list.pb.go
@@ -0,0 +1,377 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
+// source: controller/api/services/v1/list.proto
+
+package services
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ResourceType represents the different list
+// endpoint resource types supported.
+type ResourceType int32
+
+const (
+	ResourceType_RESOURCE_TYPE_UNSPECIFIED        ResourceType = 0
+	ResourceType_RESOURCE_TYPE_ACCOUNT            ResourceType = 1
+	ResourceType_RESOURCE_TYPE_AUTH_METHOD        ResourceType = 2
+	ResourceType_RESOURCE_TYPE_AUTH_TOKEN         ResourceType = 3
+	ResourceType_RESOURCE_TYPE_CREDENTIAL         ResourceType = 4
+	ResourceType_RESOURCE_TYPE_CREDENTIAL_LIBRARY ResourceType = 5
+	ResourceType_RESOURCE_TYPE_CREDENTIAL_STORE   ResourceType = 6
+	ResourceType_RESOURCE_TYPE_GROUP              ResourceType = 7
+	ResourceType_RESOURCE_TYPE_HOST               ResourceType = 8
+	ResourceType_RESOURCE_TYPE_HOST_CATALOG       ResourceType = 9
+	ResourceType_RESOURCE_TYPE_HOST_SET           ResourceType = 10
+	ResourceType_RESOURCE_TYPE_MANAGED_GROUP      ResourceType = 11
+	ResourceType_RESOURCE_TYPE_ROLE               ResourceType = 12
+	ResourceType_RESOURCE_TYPE_SCOPE              ResourceType = 13
+	ResourceType_RESOURCE_TYPE_SESSION            ResourceType = 14
+	ResourceType_RESOURCE_TYPE_SESSION_RECORDING  ResourceType = 15
+	ResourceType_RESOURCE_TYPE_STORAGE_BUCKET     ResourceType = 16
+	ResourceType_RESOURCE_TYPE_TARGET             ResourceType = 17
+	ResourceType_RESOURCE_TYPE_USER               ResourceType = 18
+	ResourceType_RESOURCE_TYPE_WORKER             ResourceType = 19
+)
+
+// Enum value maps for ResourceType.
+var (
+	ResourceType_name = map[int32]string{
+		0:  "RESOURCE_TYPE_UNSPECIFIED",
+		1:  "RESOURCE_TYPE_ACCOUNT",
+		2:  "RESOURCE_TYPE_AUTH_METHOD",
+		3:  "RESOURCE_TYPE_AUTH_TOKEN",
+		4:  "RESOURCE_TYPE_CREDENTIAL",
+		5:  "RESOURCE_TYPE_CREDENTIAL_LIBRARY",
+		6:  "RESOURCE_TYPE_CREDENTIAL_STORE",
+		7:  "RESOURCE_TYPE_GROUP",
+		8:  "RESOURCE_TYPE_HOST",
+		9:  "RESOURCE_TYPE_HOST_CATALOG",
+		10: "RESOURCE_TYPE_HOST_SET",
+		11: "RESOURCE_TYPE_MANAGED_GROUP",
+		12: "RESOURCE_TYPE_ROLE",
+		13: "RESOURCE_TYPE_SCOPE",
+		14: "RESOURCE_TYPE_SESSION",
+		15: "RESOURCE_TYPE_SESSION_RECORDING",
+		16: "RESOURCE_TYPE_STORAGE_BUCKET",
+		17: "RESOURCE_TYPE_TARGET",
+		18: "RESOURCE_TYPE_USER",
+		19: "RESOURCE_TYPE_WORKER",
+	}
+	ResourceType_value = map[string]int32{
+		"RESOURCE_TYPE_UNSPECIFIED":        0,
+		"RESOURCE_TYPE_ACCOUNT":            1,
+		"RESOURCE_TYPE_AUTH_METHOD":        2,
+		"RESOURCE_TYPE_AUTH_TOKEN":         3,
+		"RESOURCE_TYPE_CREDENTIAL":         4,
+		"RESOURCE_TYPE_CREDENTIAL_LIBRARY": 5,
+		"RESOURCE_TYPE_CREDENTIAL_STORE":   6,
+		"RESOURCE_TYPE_GROUP":              7,
+		"RESOURCE_TYPE_HOST":               8,
+		"RESOURCE_TYPE_HOST_CATALOG":       9,
+		"RESOURCE_TYPE_HOST_SET":           10,
+		"RESOURCE_TYPE_MANAGED_GROUP":      11,
+		"RESOURCE_TYPE_ROLE":               12,
+		"RESOURCE_TYPE_SCOPE":              13,
+		"RESOURCE_TYPE_SESSION":            14,
+		"RESOURCE_TYPE_SESSION_RECORDING":  15,
+		"RESOURCE_TYPE_STORAGE_BUCKET":     16,
+		"RESOURCE_TYPE_TARGET":             17,
+		"RESOURCE_TYPE_USER":               18,
+		"RESOURCE_TYPE_WORKER":             19,
+	}
+)
+
+func (x ResourceType) Enum() *ResourceType {
+	p := new(ResourceType)
+	*p = x
+	return p
+}
+
+func (x ResourceType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ResourceType) Descriptor() protoreflect.EnumDescriptor {
+	return file_controller_api_services_v1_list_proto_enumTypes[0].Descriptor()
+}
+
+func (ResourceType) Type() protoreflect.EnumType {
+	return &file_controller_api_services_v1_list_proto_enumTypes[0]
+}
+
+func (x ResourceType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ResourceType.Descriptor instead.
+func (ResourceType) EnumDescriptor() ([]byte, []int) {
+	return file_controller_api_services_v1_list_proto_rawDescGZIP(), []int{0}
+}
+
+// ListRefreshToken is used to create refresh
+// tokens for list endpoints.
+type ListRefreshToken struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// When the refresh token was created.
+	CreatedTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"`
+	// When the refresh token was last used.
+	UpdatedTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=updated_time,json=updatedTime,proto3" json:"updated_time,omitempty"`
+	// The resource type listed. Used to ensure
+	// refresh tokens are not used between list methods.
+	ResourceType ResourceType `protobuf:"varint,3,opt,name=resource_type,json=resourceType,proto3,enum=controller.api.services.v1.ResourceType" json:"resource_type,omitempty"`
+	// A hash of the users grants
+	// at the time of the refresh token issuing.
+	GrantsHash []byte `protobuf:"bytes,4,opt,name=grants_hash,json=grantsHash,proto3" json:"grants_hash,omitempty"`
+	// The ID of the last item returned on the
+	// previous page.
+	LastItemId string `protobuf:"bytes,5,opt,name=last_item_id,json=lastItemId,proto3" json:"last_item_id,omitempty"`
+	// The updated_time of the last item returned on
+	// the previous page. This is needed
+	// in addition to the ID since it can change after
+	// the creation of the refresh token.
+	LastItemUpdatedTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=last_item_updated_time,json=lastItemUpdatedTime,proto3" json:"last_item_updated_time,omitempty"`
+}
+
+func (x *ListRefreshToken) Reset() {
+	*x = ListRefreshToken{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_services_v1_list_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListRefreshToken) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRefreshToken) ProtoMessage() {}
+
+func (x *ListRefreshToken) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_services_v1_list_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRefreshToken.ProtoReflect.Descriptor instead.
+func (*ListRefreshToken) Descriptor() ([]byte, []int) {
+	return file_controller_api_services_v1_list_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ListRefreshToken) GetCreatedTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedTime
+	}
+	return nil
+}
+
+func (x *ListRefreshToken) GetUpdatedTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.UpdatedTime
+	}
+	return nil
+}
+
+func (x *ListRefreshToken) GetResourceType() ResourceType {
+	if x != nil {
+		return x.ResourceType
+	}
+	return ResourceType_RESOURCE_TYPE_UNSPECIFIED
+}
+
+func (x *ListRefreshToken) GetGrantsHash() []byte {
+	if x != nil {
+		return x.GrantsHash
+	}
+	return nil
+}
+
+func (x *ListRefreshToken) GetLastItemId() string {
+	if x != nil {
+		return x.LastItemId
+	}
+	return ""
+}
+
+func (x *ListRefreshToken) GetLastItemUpdatedTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.LastItemUpdatedTime
+	}
+	return nil
+}
+
+var File_controller_api_services_v1_list_proto protoreflect.FileDescriptor
+
+var file_controller_api_services_v1_list_proto_rawDesc = []byte{
+	0x0a, 0x25, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69,
+	0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x6c, 0x69, 0x73,
+	0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1a, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
+	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xf3, 0x02, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66,
+	0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x3d, 0x0a, 0x0c, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0b, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x3d, 0x0a, 0x0c, 0x75, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0b, 0x75, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4d, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x28,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x67, 0x72, 0x61, 0x6e, 0x74, 0x73,
+	0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x67, 0x72, 0x61,
+	0x6e, 0x74, 0x73, 0x48, 0x61, 0x73, 0x68, 0x12, 0x20, 0x0a, 0x0c, 0x6c, 0x61, 0x73, 0x74, 0x5f,
+	0x69, 0x74, 0x65, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6c,
+	0x61, 0x73, 0x74, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64, 0x12, 0x4f, 0x0a, 0x16, 0x6c, 0x61, 0x73,
+	0x74, 0x5f, 0x69, 0x74, 0x65, 0x6d, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74,
+	0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x13, 0x6c, 0x61, 0x73, 0x74, 0x49, 0x74, 0x65, 0x6d, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x2a, 0xda, 0x04, 0x0a, 0x0c, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1d, 0x0a, 0x19, 0x52,
+	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x52, 0x45,
+	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x41, 0x43, 0x43, 0x4f,
+	0x55, 0x4e, 0x54, 0x10, 0x01, 0x12, 0x1d, 0x0a, 0x19, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
+	0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x41, 0x55, 0x54, 0x48, 0x5f, 0x4d, 0x45, 0x54, 0x48,
+	0x4f, 0x44, 0x10, 0x02, 0x12, 0x1c, 0x0a, 0x18, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x41, 0x55, 0x54, 0x48, 0x5f, 0x54, 0x4f, 0x4b, 0x45, 0x4e,
+	0x10, 0x03, 0x12, 0x1c, 0x0a, 0x18, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54,
+	0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x44, 0x45, 0x4e, 0x54, 0x49, 0x41, 0x4c, 0x10, 0x04,
+	0x12, 0x24, 0x0a, 0x20, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x43, 0x52, 0x45, 0x44, 0x45, 0x4e, 0x54, 0x49, 0x41, 0x4c, 0x5f, 0x4c, 0x49, 0x42,
+	0x52, 0x41, 0x52, 0x59, 0x10, 0x05, 0x12, 0x22, 0x0a, 0x1e, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52,
+	0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x44, 0x45, 0x4e, 0x54, 0x49,
+	0x41, 0x4c, 0x5f, 0x53, 0x54, 0x4f, 0x52, 0x45, 0x10, 0x06, 0x12, 0x17, 0x0a, 0x13, 0x52, 0x45,
+	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x47, 0x52, 0x4f, 0x55,
+	0x50, 0x10, 0x07, 0x12, 0x16, 0x0a, 0x12, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f,
+	0x54, 0x59, 0x50, 0x45, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x10, 0x08, 0x12, 0x1e, 0x0a, 0x1a, 0x52,
+	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x48, 0x4f, 0x53,
+	0x54, 0x5f, 0x43, 0x41, 0x54, 0x41, 0x4c, 0x4f, 0x47, 0x10, 0x09, 0x12, 0x1a, 0x0a, 0x16, 0x52,
+	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x48, 0x4f, 0x53,
+	0x54, 0x5f, 0x53, 0x45, 0x54, 0x10, 0x0a, 0x12, 0x1f, 0x0a, 0x1b, 0x52, 0x45, 0x53, 0x4f, 0x55,
+	0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x41, 0x4e, 0x41, 0x47, 0x45, 0x44,
+	0x5f, 0x47, 0x52, 0x4f, 0x55, 0x50, 0x10, 0x0b, 0x12, 0x16, 0x0a, 0x12, 0x52, 0x45, 0x53, 0x4f,
+	0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x4f, 0x4c, 0x45, 0x10, 0x0c,
+	0x12, 0x17, 0x0a, 0x13, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x53, 0x43, 0x4f, 0x50, 0x45, 0x10, 0x0d, 0x12, 0x19, 0x0a, 0x15, 0x52, 0x45, 0x53,
+	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x45, 0x53, 0x53, 0x49,
+	0x4f, 0x4e, 0x10, 0x0e, 0x12, 0x23, 0x0a, 0x1f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x52, 0x45,
+	0x43, 0x4f, 0x52, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x0f, 0x12, 0x20, 0x0a, 0x1c, 0x52, 0x45, 0x53,
+	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x54, 0x4f, 0x52, 0x41,
+	0x47, 0x45, 0x5f, 0x42, 0x55, 0x43, 0x4b, 0x45, 0x54, 0x10, 0x10, 0x12, 0x18, 0x0a, 0x14, 0x52,
+	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x54, 0x41, 0x52,
+	0x47, 0x45, 0x54, 0x10, 0x11, 0x12, 0x16, 0x0a, 0x12, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
+	0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x53, 0x45, 0x52, 0x10, 0x12, 0x12, 0x18, 0x0a,
+	0x14, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x57,
+	0x4f, 0x52, 0x4b, 0x45, 0x52, 0x10, 0x13, 0x42, 0x4d, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
+	0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
+	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_controller_api_services_v1_list_proto_rawDescOnce sync.Once
+	file_controller_api_services_v1_list_proto_rawDescData = file_controller_api_services_v1_list_proto_rawDesc
+)
+
+func file_controller_api_services_v1_list_proto_rawDescGZIP() []byte {
+	file_controller_api_services_v1_list_proto_rawDescOnce.Do(func() {
+		file_controller_api_services_v1_list_proto_rawDescData = protoimpl.X.CompressGZIP(file_controller_api_services_v1_list_proto_rawDescData)
+	})
+	return file_controller_api_services_v1_list_proto_rawDescData
+}
+
+var file_controller_api_services_v1_list_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_controller_api_services_v1_list_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_controller_api_services_v1_list_proto_goTypes = []interface{}{
+	(ResourceType)(0),             // 0: controller.api.services.v1.ResourceType
+	(*ListRefreshToken)(nil),      // 1: controller.api.services.v1.ListRefreshToken
+	(*timestamppb.Timestamp)(nil), // 2: google.protobuf.Timestamp
+}
+var file_controller_api_services_v1_list_proto_depIdxs = []int32{
+	2, // 0: controller.api.services.v1.ListRefreshToken.created_time:type_name -> google.protobuf.Timestamp
+	2, // 1: controller.api.services.v1.ListRefreshToken.updated_time:type_name -> google.protobuf.Timestamp
+	0, // 2: controller.api.services.v1.ListRefreshToken.resource_type:type_name -> controller.api.services.v1.ResourceType
+	2, // 3: controller.api.services.v1.ListRefreshToken.last_item_updated_time:type_name -> google.protobuf.Timestamp
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_controller_api_services_v1_list_proto_init() }
+func file_controller_api_services_v1_list_proto_init() {
+	if File_controller_api_services_v1_list_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_controller_api_services_v1_list_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListRefreshToken); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_controller_api_services_v1_list_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_controller_api_services_v1_list_proto_goTypes,
+		DependencyIndexes: file_controller_api_services_v1_list_proto_depIdxs,
+		EnumInfos:         file_controller_api_services_v1_list_proto_enumTypes,
+		MessageInfos:      file_controller_api_services_v1_list_proto_msgTypes,
+	}.Build()
+	File_controller_api_services_v1_list_proto = out.File
+	file_controller_api_services_v1_list_proto_rawDesc = nil
+	file_controller_api_services_v1_list_proto_goTypes = nil
+	file_controller_api_services_v1_list_proto_depIdxs = nil
+}
diff --git a/internal/proto/controller/api/services/v1/list.proto b/internal/proto/controller/api/services/v1/list.proto
new file mode 100644
index 0000000000..f38ba91a01
--- /dev/null
+++ b/internal/proto/controller/api/services/v1/list.proto
@@ -0,0 +1,58 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package controller.api.services.v1;
+
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/hashicorp/boundary/internal/gen/controller/api/services;services";
+
+// ListRefreshToken is used to create refresh
+// tokens for list endpoints.
+message ListRefreshToken {
+  // When the refresh token was created.
+  google.protobuf.Timestamp created_time = 1;
+  // When the refresh token was last used.
+  google.protobuf.Timestamp updated_time = 2;
+  // The resource type listed. Used to ensure
+  // refresh tokens are not used between list methods.
+  ResourceType resource_type = 3;
+  // A hash of the users grants
+  // at the time of the refresh token issuing.
+  bytes grants_hash = 4;
+  // The ID of the last item returned on the
+  // previous page.
+  string last_item_id = 5;
+  // The updated_time of the last item returned on
+  // the previous page. This is needed
+  // in addition to the ID since it can change after
+  // the creation of the refresh token.
+  google.protobuf.Timestamp last_item_updated_time = 6;
+}
+
+// ResourceType represents the different list
+// endpoint resource types supported.
+enum ResourceType {
+  RESOURCE_TYPE_UNSPECIFIED = 0;
+  RESOURCE_TYPE_ACCOUNT = 1;
+  RESOURCE_TYPE_AUTH_METHOD = 2;
+  RESOURCE_TYPE_AUTH_TOKEN = 3;
+  RESOURCE_TYPE_CREDENTIAL = 4;
+  RESOURCE_TYPE_CREDENTIAL_LIBRARY = 5;
+  RESOURCE_TYPE_CREDENTIAL_STORE = 6;
+  RESOURCE_TYPE_GROUP = 7;
+  RESOURCE_TYPE_HOST = 8;
+  RESOURCE_TYPE_HOST_CATALOG = 9;
+  RESOURCE_TYPE_HOST_SET = 10;
+  RESOURCE_TYPE_MANAGED_GROUP = 11;
+  RESOURCE_TYPE_ROLE = 12;
+  RESOURCE_TYPE_SCOPE = 13;
+  RESOURCE_TYPE_SESSION = 14;
+  RESOURCE_TYPE_SESSION_RECORDING = 15;
+  RESOURCE_TYPE_STORAGE_BUCKET = 16;
+  RESOURCE_TYPE_TARGET = 17;
+  RESOURCE_TYPE_USER = 18;
+  RESOURCE_TYPE_WORKER = 19;
+}