diff --git a/src/Tgstation.Server.Api/Models/Byond.cs b/src/Tgstation.Server.Api/Models/Byond.cs
index f1b6baebeb..7327b27cbd 100644
--- a/src/Tgstation.Server.Api/Models/Byond.cs
+++ b/src/Tgstation.Server.Api/Models/Byond.cs
@@ -6,7 +6,7 @@ namespace Tgstation.Server.Api.Models
 	/// <summary>
 	/// Represents a BYOND installation
 	/// </summary>
-	[Model(RightsType.Byond)]
+	[Model(RightsType.Byond, RequiresInstance = true)]
 	public sealed class Byond
 	{
 		/// <summary>
diff --git a/src/Tgstation.Server.Api/Models/Chat.cs b/src/Tgstation.Server.Api/Models/Chat.cs
new file mode 100644
index 0000000000..543eae1230
--- /dev/null
+++ b/src/Tgstation.Server.Api/Models/Chat.cs
@@ -0,0 +1,71 @@
+using System.Collections.Generic;
+using Tgstation.Server.Api.Rights;
+
+namespace Tgstation.Server.Api.Models
+{
+	/// <summary>
+	/// Manage the server chat bots
+	/// </summary>
+	[Model(RightsType.Chat, RequiresInstance = true)]
+	public sealed class Chat
+	{
+		/// <summary>
+		/// If the IRC client is enabled
+		/// </summary>
+		[Permissions(WriteRight = ChatRights.SetIrcEnabled)]
+		public bool IrcEnabled { get; set; }
+
+		/// <summary>
+		/// The IRC server name
+		/// </summary>
+		[Permissions(ReadRight = ChatRights.SetIrcSettings, WriteRight = ChatRights.SetIrcSettings)]
+		public string IrcHost { get; set; }
+
+		/// <summary>
+		/// The IRC server port
+		/// </summary>
+		[Permissions(ReadRight = ChatRights.SetIrcSettings, WriteRight = ChatRights.SetIrcSettings)]
+		public ushort IrcPort { get; set; }
+
+		/// <summary>
+		/// The IRC server NickServ password
+		/// </summary>
+		[Permissions(ReadRight = ChatRights.SetIrcSettings, WriteRight = ChatRights.SetIrcSettings)]
+		public string IrcNickServPassword { get; set; }
+
+		/// <summary>
+		/// Channels the IRC client should join/listen/announce in and allow admin commands
+		/// </summary>
+		[Permissions(WriteRight = ChatRights.SetIrcChannels)]
+		public List<string> IrcAdminChannels { get; set; }
+
+		/// <summary>
+		/// Channels the IRC client should join/listen/announce in
+		/// </summary>
+		[Permissions(WriteRight = ChatRights.SetIrcChannels)]
+		public List<string> IrcGeneralChannels { get; set; }
+
+		/// <summary>
+		/// If the Discord bot is enabled
+		/// </summary>
+		[Permissions(WriteRight = ChatRights.SetDiscordEnabled)]
+		public bool DiscordEnabled { get; set; }
+
+		/// <summary>
+		/// The Discord bot token
+		/// </summary>
+		[Permissions(ReadRight = ChatRights.SetDiscordSettings, WriteRight = ChatRights.SetDiscordSettings)]
+		public string DiscordBotToken { get; set; }
+
+		/// <summary>
+		/// Channels the Discord bot should listen/announce in and allow admin commands
+		/// </summary>
+		[Permissions(WriteRight = ChatRights.SetDiscordChannels)]
+		public List<long> DiscordAdminChannels { get; set; }
+		/// <summary>
+		/// Channels the Discord bot should listen/announce in
+		/// </summary>
+		[Permissions(WriteRight = ChatRights.SetDiscordChannels)]
+		public List<long> DiscordGeneralChannels { get; set; }
+	}
+}
diff --git a/src/Tgstation.Server.Api/Models/DreamDaemon.cs b/src/Tgstation.Server.Api/Models/DreamDaemon.cs
index b36ee8b8bb..652256ef5b 100644
--- a/src/Tgstation.Server.Api/Models/DreamDaemon.cs
+++ b/src/Tgstation.Server.Api/Models/DreamDaemon.cs
@@ -7,7 +7,7 @@ namespace Tgstation.Server.Api.Models
 	/// <summary>
 	/// Represents an instance of BYOND's DreamDaemon game server. Create action starts the server. Delete action shuts down the server
 	/// </summary>
-	[Model(RightsType.DreamDaemon, CanCrud = true)]
+	[Model(RightsType.DreamDaemon, CanCrud = true, RequiresInstance = true)]
 	public sealed class DreamDaemon
 	{
 		/// <summary>
diff --git a/src/Tgstation.Server.Api/Models/DreamMaker.cs b/src/Tgstation.Server.Api/Models/DreamMaker.cs
index 7b9d561208..ca1baaea6d 100644
--- a/src/Tgstation.Server.Api/Models/DreamMaker.cs
+++ b/src/Tgstation.Server.Api/Models/DreamMaker.cs
@@ -6,7 +6,7 @@ namespace Tgstation.Server.Api.Models
     /// <summary>
     /// Represents the state of the DreamMaker compiler. Create action starts a new compile. Delete action cancels the current compile
     /// </summary>
-	[Model(RightsType.DreamMaker, ReadRight = DreamMakerRights.Read, CanCrud = true)]
+	[Model(RightsType.DreamMaker, ReadRight = DreamMakerRights.Read, CanCrud = true, RequiresInstance = true)]
     public sealed class DreamMaker
 	{
 		/// <summary>
diff --git a/src/Tgstation.Server.Api/Models/InstanceUser.cs b/src/Tgstation.Server.Api/Models/InstanceUser.cs
index 19b7557cd7..7218e9e344 100644
--- a/src/Tgstation.Server.Api/Models/InstanceUser.cs
+++ b/src/Tgstation.Server.Api/Models/InstanceUser.cs
@@ -5,7 +5,7 @@ namespace Tgstation.Server.Api.Models
 	/// <summary>
 	/// Represents a <see cref="User"/>s permissions in an <see cref="Instance"/>
 	/// </summary>
-	[Model(RightsType.InstanceUser, WriteRight = InstanceUserRights.WriteUsers)]
+	[Model(RightsType.InstanceUser, WriteRight = InstanceUserRights.WriteUsers, CanList = true, RequiresInstance = true)]
 	public sealed class InstanceUser
     {
         /// <summary>
diff --git a/src/Tgstation.Server.Api/Models/Repository.cs b/src/Tgstation.Server.Api/Models/Repository.cs
index b4b08ece85..d4411e7d45 100644
--- a/src/Tgstation.Server.Api/Models/Repository.cs
+++ b/src/Tgstation.Server.Api/Models/Repository.cs
@@ -6,7 +6,7 @@ namespace Tgstation.Server.Api.Models
 	/// <summary>
 	/// Represents a git repository
 	/// </summary>
-	[Model(RightsType.Repository, ReadRight = RepositoryRights.Read)]
+	[Model(RightsType.Repository, ReadRight = RepositoryRights.Read, RequiresInstance = true)]
 	public sealed class Repository
 	{
 		/// <summary>
@@ -48,10 +48,8 @@ namespace Tgstation.Server.Api.Models
 		/// <summary>
 		/// Associated list of GitHub pull request number -> sha for merged pull requests. Adding a <see langword="null"/> value to this list will merge the latest commit of the pull request numbered by the key
 		/// </summary>
-#pragma warning disable CA2227 // Collection properties should be read only
 		[Permissions(ComplexWrite = true)]
 		public Dictionary<int, string> PullRequests { get; set; }
-#pragma warning restore CA2227 // Collection properties should be read only
 		
 		/// <summary>
 		/// The username to access the git repository with
diff --git a/src/Tgstation.Server.Api/Rights/ChatRights.cs b/src/Tgstation.Server.Api/Rights/ChatRights.cs
new file mode 100644
index 0000000000..b354e6087f
--- /dev/null
+++ b/src/Tgstation.Server.Api/Rights/ChatRights.cs
@@ -0,0 +1,40 @@
+using System;
+
+namespace Tgstation.Server.Api.Rights
+{
+	/// <summary>
+	/// Rights for <see cref="Models.Chat"/>
+	/// </summary>
+	[Flags]
+	public enum ChatRights
+	{
+		/// <summary>
+		/// User has no rights
+		/// </summary>
+		None = 0,
+		/// <summary>
+		/// User can enable/disable the IRC client
+		/// </summary>
+		SetIrcEnabled = 1,
+		/// <summary>
+		/// User can change the IRC settings
+		/// </summary>
+		SetIrcSettings = 4,
+		/// <summary>
+		/// User can change the IRC channels
+		/// </summary>
+		SetIrcChannels = 8,
+		/// <summary>
+		/// User can enable/disable the Discord bot
+		/// </summary>
+		SetDiscordEnabled = 16,
+		/// <summary>
+		/// User can change the Discord settings
+		/// </summary>
+		SetDiscordSettings = 32,
+		/// <summary>
+		/// User can change the Discord channels
+		/// </summary>
+		SetDiscordChannels = 8,
+	}
+}
diff --git a/src/Tgstation.Server.Api/Tgstation.Server.Api.csproj b/src/Tgstation.Server.Api/Tgstation.Server.Api.csproj
index e9c7a313a0..55365cd82f 100644
--- a/src/Tgstation.Server.Api/Tgstation.Server.Api.csproj
+++ b/src/Tgstation.Server.Api/Tgstation.Server.Api.csproj
@@ -9,10 +9,12 @@
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <WarningsAsErrors />
     <DocumentationFile>bin\Release\netstandard2.0\Tgstation.Server.Api.xml</DocumentationFile>
+    <NoWarn>1701;1702;1705;CA2227</NoWarn>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
     <LangVersion>latest</LangVersion>
+    <NoWarn>1701;1702;1705;CA2227</NoWarn>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/src/Tgstation.Server.Client/Components/IInstanceUserClient.cs b/src/Tgstation.Server.Client/Components/IInstanceUserClient.cs
index 68eae0275d..65248e42d5 100644
--- a/src/Tgstation.Server.Client/Components/IInstanceUserClient.cs
+++ b/src/Tgstation.Server.Client/Components/IInstanceUserClient.cs
@@ -24,6 +24,6 @@ namespace Tgstation.Server.Client.Components
         /// <param name="instanceUser">The <see cref="InstanceUser"/> to update</param>
         /// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation</param>
         /// <returns>A <see cref="Task"/> representing the running operation</returns>
-        Task UpdateUser(InstanceUser instanceUser, CancellationToken cancellationToken);
+        Task Update(InstanceUser instanceUser, CancellationToken cancellationToken);
     }
 }
\ No newline at end of file
diff --git a/src/Tgstation.Server.Client/Components/ITokenClient.cs b/src/Tgstation.Server.Client/Components/ITokenClient.cs
index a563456217..01b9404b8c 100644
--- a/src/Tgstation.Server.Client/Components/ITokenClient.cs
+++ b/src/Tgstation.Server.Client/Components/ITokenClient.cs
@@ -33,12 +33,12 @@ namespace Tgstation.Server.Client.Components
 		Task<IReadOnlyDictionary<string, Token>> GetAllInfos(CancellationToken cancellationToken);
 
 		/// <summary>
-		/// Invalidate the specified active <see cref="Token"/> designated by <paramref name="tokenId"/>
+		/// Invalidate the specified active <paramref name="token"/>
 		/// </summary>
-		/// <param name="tokenId">The <see cref="Token.Id"/> of the <see cref="Token"/> to invalidate</param>
+		/// <param name="token">The <see cref="Token"/> to invalidate</param>
 		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation</param>
 		/// <returns>A <see cref="Task"/> representing the running operation</returns>
-		Task Invalidate(long tokenId, CancellationToken cancellationToken);
+		Task Invalidate(Token token, CancellationToken cancellationToken);
 
 		/// <summary>
 		/// Invalidate all active <see cref="Token"/>s for a <see cref="IServerClient"/>