diff --git a/spec/openapi.dashboard-api.yaml b/spec/openapi.dashboard-api.yaml
index 09bbedd64..90d0b3763 100644
--- a/spec/openapi.dashboard-api.yaml
+++ b/spec/openapi.dashboard-api.yaml
@@ -1889,12 +1889,12 @@ paths:
         "500":
           $ref: "#/components/responses/500"
 
-  /admin/v1/projects/{teamID}:
+  /v1/management/projects/{teamID}:
     parameters:
       - $ref: "#/components/parameters/teamID"
     put:
       operationId: upsertProject
-      summary: Create or reconcile a project.
+      summary: Create or reconcile a project (v1).
       tags: [workspace-admin]
       security:
         - AdminJWTAuth: []
@@ -1929,7 +1929,7 @@ paths:
           $ref: "#/components/responses/501"
     delete:
       operationId: deleteProject
-      summary: Delete a project and its control-plane state.
+      summary: Delete a project and its control-plane state (v1).
       tags: [workspace-admin]
       security:
         - AdminJWTAuth: []
@@ -1945,13 +1945,13 @@ paths:
         "501":
           $ref: "#/components/responses/501"
 
-  /admin/v1/projects/{teamID}/members/{userId}:
+  /v1/management/projects/{teamID}/members/{userId}:
     parameters:
       - $ref: "#/components/parameters/teamID"
       - $ref: "#/components/parameters/userId"
     put:
       operationId: upsertProjectMember
-      summary: Reconcile an opaque user UUID as a project member.
+      summary: Reconcile an opaque user UUID as a project member (v1).
       tags: [workspace-admin]
       security:
         - AdminJWTAuth: []
@@ -1976,7 +1976,7 @@ paths:
           $ref: "#/components/responses/501"
     delete:
       operationId: deleteProjectMember
-      summary: Remove a project member.
+      summary: Remove a project member (v1).
       tags: [workspace-admin]
       security:
         - AdminJWTAuth: []
@@ -1994,12 +1994,12 @@ paths:
         "501":
           $ref: "#/components/responses/501"
 
-  /admin/v1/projects/{teamID}/limits:
+  /v1/management/projects/{teamID}/limits:
     parameters:
       - $ref: "#/components/parameters/teamID"
     put:
       operationId: upsertProjectLimits
-      summary: Reconcile effective limits for a project.
+      summary: Reconcile effective limits for a project (v1).
       tags: [workspace-admin]
       security:
         - AdminJWTAuth: []
@@ -2023,12 +2023,12 @@ paths:
         "501":
           $ref: "#/components/responses/501"
 
-  /admin/v1/users/{userId}:
+  /v1/management/users/{userId}:
     parameters:
       - $ref: "#/components/parameters/userId"
     delete:
       operationId: purgeUser
-      summary: Purge shard-local membership and access-token state for an opaque user UUID.
+      summary: Purge shard-local membership and access-token state for an opaque user UUID (v1).
       tags: [workspace-admin]
       security:
         - AdminJWTAuth: []
diff --git a/spec/openapi.infra.yaml b/spec/openapi.infra.yaml
index 4a26b3a42..7ae8dd32d 100644
--- a/spec/openapi.infra.yaml
+++ b/spec/openapi.infra.yaml
@@ -298,7 +298,9 @@ components:
           items:
             type: string
         egressProxy:
-          $ref: "#/components/schemas/SandboxEgressProxyConfig"
+          allOf:
+            - $ref: "#/components/schemas/SandboxEgressProxyConfig"
+          x-not-implemented: true
         maskRequestHost:
           type: string
           description: Specify host mask which will be used for all sandbox requests
@@ -328,7 +330,9 @@ components:
           items:
             type: string
         egressProxy:
-          $ref: "#/components/schemas/SandboxEgressProxyConfig"
+          allOf:
+            - $ref: "#/components/schemas/SandboxEgressProxyConfig"
+          x-not-implemented: true
         rules:
           type: object
           description: Per-domain transform rules. Replaces all existing rules when provided.
@@ -365,6 +369,7 @@ components:
     SandboxEgressProxyConfig:
       type: object
       nullable: true
+      x-not-implemented: true
       description: >-
         SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the
         proxy after allow/deny filtering; the sandbox is unaware. Domain-matched
diff --git a/src/core/shared/contracts/dashboard-api.types.ts b/src/core/shared/contracts/dashboard-api.types.ts
index abe271801..5c02822c5 100644
--- a/src/core/shared/contracts/dashboard-api.types.ts
+++ b/src/core/shared/contracts/dashboard-api.types.ts
@@ -1106,7 +1106,7 @@ export interface paths {
     patch?: never
     trace?: never
   }
-  '/admin/v1/projects/{teamID}': {
+  '/v1/management/projects/{teamID}': {
     parameters: {
       query?: never
       header?: never
@@ -1117,17 +1117,17 @@ export interface paths {
       cookie?: never
     }
     get?: never
-    /** Create or reconcile a project. */
+    /** Create or reconcile a project (v1). */
     put: operations['upsertProject']
     post?: never
-    /** Delete a project and its control-plane state. */
+    /** Delete a project and its control-plane state (v1). */
     delete: operations['deleteProject']
     options?: never
     head?: never
     patch?: never
     trace?: never
   }
-  '/admin/v1/projects/{teamID}/members/{userId}': {
+  '/v1/management/projects/{teamID}/members/{userId}': {
     parameters: {
       query?: never
       header?: never
@@ -1140,17 +1140,17 @@ export interface paths {
       cookie?: never
     }
     get?: never
-    /** Reconcile an opaque user UUID as a project member. */
+    /** Reconcile an opaque user UUID as a project member (v1). */
     put: operations['upsertProjectMember']
     post?: never
-    /** Remove a project member. */
+    /** Remove a project member (v1). */
     delete: operations['deleteProjectMember']
     options?: never
     head?: never
     patch?: never
     trace?: never
   }
-  '/admin/v1/projects/{teamID}/limits': {
+  '/v1/management/projects/{teamID}/limits': {
     parameters: {
       query?: never
       header?: never
@@ -1161,7 +1161,7 @@ export interface paths {
       cookie?: never
     }
     get?: never
-    /** Reconcile effective limits for a project. */
+    /** Reconcile effective limits for a project (v1). */
     put: operations['upsertProjectLimits']
     post?: never
     delete?: never
@@ -1170,7 +1170,7 @@ export interface paths {
     patch?: never
     trace?: never
   }
-  '/admin/v1/users/{userId}': {
+  '/v1/management/users/{userId}': {
     parameters: {
       query?: never
       header?: never
@@ -1183,7 +1183,7 @@ export interface paths {
     get?: never
     put?: never
     post?: never
-    /** Purge shard-local membership and access-token state for an opaque user UUID. */
+    /** Purge shard-local membership and access-token state for an opaque user UUID (v1). */
     delete: operations['purgeUser']
     options?: never
     head?: never