diff --git a/README.md b/README.md
index 57e26746..add2c8b2 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,8 @@ The following parameters can be set in config files or in env variables:
 - GROUPS_API_URL: TC groups API base URL
 - COPILOT_RESOURCE_ROLE_IDS: copilot resource role ids allowed to upload attachment
 - HEALTH_CHECK_TIMEOUT: health check timeout in milliseconds
-
+- SCOPES: the configurable M2M token scopes, refer `config/default.js` for more details
+- M2M_AUDIT_HANDLE: the audit name used when perform create/update operation using M2M token
 
 Set the following environment variables so that the app can get TC M2M token (use 'set' insted of 'export' for Windows OS):
 
@@ -44,46 +45,30 @@ Set the following environment variables so that the app can get TC M2M token (us
 - export AUTH0_URL=https://topcoder-dev.auth0.com/oauth/token
 - export AUTH0_AUDIENCE=https://m2m.topcoder-dev.com/
 
+Also properly configure AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, ATTACHMENT_S3_BUCKET, IS_LOCAL_DB config parameters.
 
-Also properly configure AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, ATTACHMENT_S3_BUCKET config parameters.
-
+## DynamoDB Setup
+We can use DynamoDB setup on Docker for testing purpose. Just run `docker-compose up` in `local` folder.
+You can also use your own AWS DynamoDB service for testing purpose.
 
-## DynamoDB Setup with Docker
-We will use DynamoDB setup on Docker.
-Note that you may need to modify regions in `local/init-dynamodb.sh` and `local/config`.
+## AWS S3 Setup
+Go to https://console.aws.amazon.com/ and login. Choose S3 from Service folder and click `Create bucket`. Following the instruction to create S3 bucket.
 
-Just run `docker-compose up` in local folder
+## Mock api
+For postman verification, please use the mock api under mock-api folder. It provides mock endpoint to fetch challenge resources and groups.
+Go to `mock-api` folder and run command `npm run start` to start the mock-api listening on port 4000
 
-If you have already installed aws-cli in your local machine, you can execute `./local/init-dynamodb.sh` to
-create the table. If not you can still create table following `Create Table via awscli in Docker`.
-
-## Create Table via awscli in Docker
+## Create Tables
 1. Make sure DynamoDB are running as per instructions above.
-
-2. Run the following commands
-```
-docker exec -ti dynamodb sh
-```
-Next
-```
-./init-dynamodb.sh
-```
-
-3. Now the tables have been created, you can use following command to verify
-```
-aws dynamodb scan --table-name Challenge --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name ChallengeType --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name ChallengeSetting --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name AuditLog --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name Phase --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name TimelineTemplate --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name Attachment --endpoint-url http://localhost:7777
-```
+2. Make sure you have configured all config parameters. Refer [Configuration](#configuration)
+3. Run `npm run create-tables` to create tables.
 
 ## Scripts
 1. Drop/delete tables: `npm run drop-tables`
 2. Creating tables: `npm run create-tables`
 3. Seed/Insert data to tables: `npm run seed-tables`
+4. Initialize database in default environment: `npm run init-db`
+5. View table data in default environment: `npm run view-data <ModelName>`, ModelName can be `Challenge`, `ChallengeType`, `ChallengeSetting`, `AuditLog`, `Phase`, `TimelineTemplate`or `Attachment`
 
 ### Notes
 - The seed data are located in `src/scripts/seed`
@@ -93,9 +78,11 @@ aws dynamodb scan --table-name Attachment --endpoint-url http://localhost:7777
 - Install dependencies `npm install`
 - Run lint `npm run lint`
 - Run lint fix `npm run lint:fix`
+- Create tables `npm run create-tables`
 - Clear and init db `npm run init-db`
 - Start app `npm start`
 - App is running at `http://localhost:3000`
+- Start mock-api, go to `mock-api` folder and `npm start`, mock api is running at `http://localhost:4000`
 
 ## Verification
 Refer to the verification document `Verification.md`
diff --git a/Verification.md b/Verification.md
index 39477095..1cb66cf7 100644
--- a/Verification.md
+++ b/Verification.md
@@ -5,18 +5,7 @@
 - run tests from up to down in order
 
 ## DynamoDB Verification
-1. Open a new console and run the command `docker exec -ti dynamodb sh` to use `aws-cli`
-
-2. On the console you opened in step 1, run these following commands you can verify the data that inserted into database during the executing of postman tests
-```
-aws dynamodb scan --table-name Challenge --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name ChallengeType --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name ChallengeSetting --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name AuditLog --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name Phase --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name TimelineTemplate --endpoint-url http://localhost:7777
-aws dynamodb scan --table-name Attachment --endpoint-url http://localhost:7777
-```
+Run command `npm run view-data <ModelName>` to view table data, ModelName can be `Challenge`, `ChallengeType`, `ChallengeSetting`, `AuditLog`, `Phase`, `TimelineTemplate`or `Attachment`
 
 ## S3 Verification
 
diff --git a/app-routes.js b/app-routes.js
index 0cba6d8b..d99154ea 100644
--- a/app-routes.js
+++ b/app-routes.js
@@ -45,7 +45,13 @@ module.exports = (app) => {
 
         actions.push((req, res, next) => {
           if (req.authUser.isMachine) {
-            next(new errors.ForbiddenError('M2M is not supported.'))
+            // M2M
+            if (!req.authUser.scopes || !helper.checkIfExists(def.scopes, req.authUser.scopes)) {
+              next(new errors.ForbiddenError('You are not allowed to perform this action!'))
+            } else {
+              req.authUser.handle = config.M2M_AUDIT_HANDLE
+              next()
+            }
           } else {
             req.authUser.userId = String(req.authUser.userId)
             // User roles authorization
@@ -74,7 +80,10 @@ module.exports = (app) => {
           if (!req.authUser) {
             next()
           } else if (req.authUser.isMachine) {
-            next(new errors.ForbiddenError('M2M is not supported.'))
+            if (!def.scopes || !req.authUser.scopes || !helper.checkIfExists(def.scopes, req.authUser.scopes)) {
+              req.authUser = undefined
+            }
+            next()
           } else {
             req.authUser.userId = String(req.authUser.userId)
             next()
diff --git a/config/default.js b/config/default.js
index fdf01480..cb37066f 100644
--- a/config/default.js
+++ b/config/default.js
@@ -33,11 +33,55 @@ module.exports = {
   FILE_UPLOAD_SIZE_LIMIT: process.env.FILE_UPLOAD_SIZE_LIMIT
     ? Number(process.env.FILE_UPLOAD_SIZE_LIMIT) : 50 * 1024 * 1024, // 50M
   CHALLENGES_API_URL: process.env.CHALLENGES_API_URL || 'http://localhost:4000/v5/challenges',
-  GROUPS_API_URL: process.env.GROUPS_API_URL || 'http://api.topcoder-dev.com/v5/groups',
+  GROUPS_API_URL: process.env.GROUPS_API_URL || 'http://localhost:4000/v5/groups',
   // copilot resource role ids allowed to upload attachment
   COPILOT_RESOURCE_ROLE_IDS: process.env.COPILOT_RESOURCE_ROLE_IDS
     ? process.env.COPILOT_RESOURCE_ROLE_IDS.split(',') : ['10ba038e-48da-487b-96e8-8d3b99b6d18b'],
 
   // health check timeout in milliseconds
-  HEALTH_CHECK_TIMEOUT: process.env.HEALTH_CHECK_TIMEOUT || 3000
+  HEALTH_CHECK_TIMEOUT: process.env.HEALTH_CHECK_TIMEOUT || 3000,
+
+  SCOPES: {
+    CHALLENGES: {
+      READ: process.env.SCOPE_CHALLENGES_READ || 'read:challenges',
+      CREATE: process.env.SCOPE_CHALLENGES_CREATE || 'create:challenges',
+      UPDATE: process.env.SCOPE_CHALLENGES_UPDATE || 'update:challenges',
+      ALL: process.env.SCOPE_CHALLENGES_ALL || 'all:challenges'
+    },
+    CHALLENGE_TYPES: {
+      CREATE: process.env.SCOPE_CHALLENGE_TYPES_CREATE || 'create:challenge_types',
+      UPDATE: process.env.SCOPE_CHALLENGE_TYPES_UPDATE || 'update:challenge_types',
+      ALL: process.env.SCOPE_CHALLENGE_TYPES_ALL || 'all:challenge_types'
+    },
+    CHALLENGE_SETTINGS: {
+      READ: process.env.SCOPE_CHALLENGE_SETTINGS_READ || 'read:challenge_settings',
+      CREATE: process.env.SCOPE_CHALLENGE_SETTINGS_CREATE || 'create:challenge_settings',
+      UPDATE: process.env.SCOPE_CHALLENGE_SETTINGS_UPDATE || 'update:challenge_settings',
+      ALL: process.env.SCOPE_CHALLENGE_SETTINGS_ALL || 'all:challenge_settings'
+    },
+    CHALLENGE_AUDIT_LOGS: {
+      READ: process.env.SCOPE_CHALLENGE_AUDIT_LOGS_READ || 'read:challenge_audit_logs'
+    },
+    CHALLENGE_PHASES: {
+      READ: process.env.SCOPE_CHALLENGE_PHASES_READ || 'read:challenge_phases',
+      CREATE: process.env.SCOPE_CHALLENGE_PHASES_CREATE || 'create:challenge_phases',
+      DELETE: process.env.SCOPE_CHALLENGE_PHASES_DELETE || 'delete:challenge_phases',
+      UPDATE: process.env.SCOPE_CHALLENGE_PHASES_UPDATE || 'update:challenge_phases',
+      ALL: process.env.SCOPE_CHALLENGE_PHASES_ALL || 'all:challenge_phases'
+    },
+    TIMELINE_TEMPLATES: {
+      READ: process.env.SCOPE_TIMELINE_TEMPLATES_READ || 'read:timeline_templates',
+      CREATE: process.env.SCOPE_TIMELINE_TEMPLATES_CREATE || 'create:timeline_templates',
+      DELETE: process.env.SCOPE_TIMELINE_TEMPLATES_DELETE || 'delete:timeline_templates',
+      UPDATE: process.env.SCOPE_TIMELINE_TEMPLATES_UPDATE || 'update:timeline_templates',
+      ALL: process.env.SCOPE_TIMELINE_TEMPLATES_ALL || 'all:timeline_templates'
+    },
+    CHALLENGE_ATTACHMENTS: {
+      READ: process.env.SCOPE_CHALLENGE_ATTACHMENTS_READ || 'read:challenge_attachments',
+      CREATE: process.env.SCOPE_CHALLENGE_ATTACHMENTS_CREATE || 'create:challenge_attachments',
+      ALL: process.env.SCOPE_CHALLENGE_ATTACHMENTS_ALL || 'all:challenge_attachments'
+    }
+  },
+
+  M2M_AUDIT_HANDLE: process.env.M2M_AUDIT_HANDLE || 'TopcoderService'
 }
diff --git a/docs/swagger.yaml b/docs/swagger.yaml
index 90dfaa1c..32516605 100644
--- a/docs/swagger.yaml
+++ b/docs/swagger.yaml
@@ -21,12 +21,16 @@ info:
 
     ## Access levels
 
+    - M2M token is supported, all non-public-accessed endpoint can be accessed using M2M token with proper scopes.
+
     - Only admins and copilots can create/update an entity.
 
     - Copilots can **only** update entities they have created. (eg. copilot A
     cannot update a challenge created by copilot B)
 
     - Non-admin users can access challenges with groups only if they belong to any of the groups
+
+    - It will be considered as admin user if using valid M2M token(having read challenge scope) to list challenges or retrieve challenge by id
 host: api.topcoder.com
 basePath: /v5
 schemes:
diff --git a/docs/topcoder-challenge-api.postman_collection.json b/docs/topcoder-challenge-api.postman_collection.json
index 0c8f206b..f7622a18 100644
--- a/docs/topcoder-challenge-api.postman_collection.json
+++ b/docs/topcoder-challenge-api.postman_collection.json
@@ -1,6 +1,6 @@
 {
 	"info": {
-		"_postman_id": "4e17ab44-cafe-4aba-a5e5-060ac0204a20",
+		"_postman_id": "ff61aad3-5167-4ac5-b054-ee2ff3a3eb90",
 		"name": "topcoder-challenge-api",
 		"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
 	},
@@ -732,6 +732,109 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "create using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "020107ea-175f-4298-a6d6-b7a9520f0695",
+										"exec": [
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"TEST_SETTING_M2M_ID\", pm.response.json().id);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_settings_create}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"setting-name-by-m2m\"\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challengeSettings",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeSettings"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure create using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "020107ea-175f-4298-a6d6-b7a9520f0695",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_create}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"setting-name-by-m2m-failure\"\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challengeSettings",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeSettings"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -774,10 +877,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings?name=-NAME-&page=2&perPage=2",
 									"host": [
@@ -839,10 +938,6 @@
 										"value": "Bearer {{copilot1_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings?invalid=-NAME-&page=2&perPage=2",
 									"host": [
@@ -904,10 +999,6 @@
 										"value": "Bearer invalid"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings?name=-NAME-&page=2&perPage=2",
 									"host": [
@@ -964,10 +1055,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings?name=-NAME-&page=2&perPage=2",
 									"host": [
@@ -1029,10 +1116,128 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
+								"url": {
+									"raw": "{{URL}}/challengeSettings?name=-NAME-&page=2&perPage=2",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeSettings"
+									],
+									"query": [
+										{
+											"key": "name",
+											"value": "-NAME-"
+										},
+										{
+											"key": "page",
+											"value": "2"
+										},
+										{
+											"key": "perPage",
+											"value": "2"
+										}
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "search challenge setting using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "1ac29d3f-3e7b-4de4-893c-8d5117b96f9e",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_settings_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challengeSettings?name=-NAME-&page=2&perPage=2",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeSettings"
+									],
+									"query": [
+										{
+											"key": "name",
+											"value": "-NAME-"
+										},
+										{
+											"key": "page",
+											"value": "2"
+										},
+										{
+											"key": "perPage",
+											"value": "2"
+										}
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure search challenge setting using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "1ac29d3f-3e7b-4de4-893c-8d5117b96f9e",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
 								"url": {
 									"raw": "{{URL}}/challengeSettings?name=-NAME-&page=2&perPage=2",
 									"host": [
@@ -1100,10 +1305,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings/{{SETTINGA_ID}}",
 									"host": [
@@ -1152,10 +1353,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings/{{SETTINGB_ID}}",
 									"host": [
@@ -1204,10 +1401,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings/invalid-id",
 									"host": [
@@ -1251,10 +1444,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings/{{SETTINGB_ID}}",
 									"host": [
@@ -1303,10 +1492,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings/{{SETTINGB_ID}}",
 									"host": [
@@ -1355,10 +1540,6 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings/{{SETTINGB_ID}}",
 									"host": [
@@ -1407,10 +1588,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeSettings/11111111-a41a-4b80-b6dd-90f3816ada99",
 									"host": [
@@ -1423,6 +1600,102 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "get challenge setting using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "44216e96-53cb-4b0a-93f8-cb64e2cfe3e5",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_settings_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challengeSettings/{{SETTINGA_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeSettings",
+										"{{SETTINGA_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure get challenge setting using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "44216e96-53cb-4b0a-93f8-cb64e2cfe3e5",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challengeSettings/{{SETTINGA_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeSettings",
+										"{{SETTINGA_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -1892,6 +2165,110 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "update challenge setting using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "45556ec6-f562-47e9-818f-24f5c60f5b10",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_settings_update}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"update-name-by-m2m\"\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challengeSettings/{{TEST_SETTING_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeSettings",
+										"{{TEST_SETTING_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure update challenge setting using m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "45556ec6-f562-47e9-818f-24f5c60f5b10",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"update-name-by-m2m\"\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challengeSettings/{{TEST_SETTING_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeSettings",
+										"{{TEST_SETTING_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -2523,23 +2900,18 @@
 								}
 							},
 							"response": []
-						}
-					],
-					"_postman_isSubFolder": true
-				},
-				{
-					"name": "search challenge types",
-					"item": [
+						},
 						{
-							"name": "search challenge types 1",
+							"name": "create using m2m",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "d83820cb-38d7-440a-af4f-215caf579bec",
+										"id": "986df394-b29e-42a6-83da-592eb3db1442",
 										"exec": [
-											"pm.test(\"Status code is 200\", function () {",
-											"    pm.response.to.have.status(200);",
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"TEST_TYPE_M2M_ID\", pm.response.json().id);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -2547,59 +2919,50 @@
 								}
 							],
 							"request": {
-								"method": "GET",
+								"method": "POST",
 								"header": [
 									{
 										"key": "Accept",
-										"value": "application/json",
-										"type": "text"
+										"type": "text",
+										"value": "application/json"
 									},
 									{
 										"key": "Content-Type",
-										"value": "application/json",
-										"type": "text"
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_types_create}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": ""
+									"raw": "{\n\t\"name\": \"create-by-m2m\",\n\t\"isActive\": false\n}"
 								},
 								"url": {
-									"raw": "{{URL}}/challengeTypes?name=-name-&description=cri&isActive=true",
+									"raw": "{{URL}}/challengeTypes",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"challengeTypes"
-									],
-									"query": [
-										{
-											"key": "name",
-											"value": "-name-"
-										},
-										{
-											"key": "description",
-											"value": "cri"
-										},
-										{
-											"key": "isActive",
-											"value": "true"
-										}
 									]
 								}
 							},
 							"response": []
 						},
 						{
-							"name": "search challenge types 2",
+							"name": "failure create using forbidden m2m 403",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "990241ce-362e-47d7-b619-6cf8f862a4bf",
+										"id": "986df394-b29e-42a6-83da-592eb3db1442",
 										"exec": [
-											"pm.test(\"Status code is 200\", function () {",
-											"    pm.response.to.have.status(200);",
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(403);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -2607,23 +2970,132 @@
 								}
 							],
 							"request": {
-								"method": "GET",
+								"method": "POST",
 								"header": [
 									{
 										"key": "Accept",
-										"value": "application/json",
-										"type": "text"
+										"type": "text",
+										"value": "application/json"
 									},
 									{
 										"key": "Content-Type",
-										"value": "application/json",
-										"type": "text"
-									}
-								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"create-by-m2m\",\n\t\"isActive\": false\n}"
 								},
+								"url": {
+									"raw": "{{URL}}/challengeTypes",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeTypes"
+									]
+								}
+							},
+							"response": []
+						}
+					],
+					"_postman_isSubFolder": true
+				},
+				{
+					"name": "search challenge types",
+					"item": [
+						{
+							"name": "search challenge types 1",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "d83820cb-38d7-440a-af4f-215caf579bec",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"value": "application/json",
+										"type": "text"
+									},
+									{
+										"key": "Content-Type",
+										"value": "application/json",
+										"type": "text"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challengeTypes?name=-name-&description=cri&isActive=true",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeTypes"
+									],
+									"query": [
+										{
+											"key": "name",
+											"value": "-name-"
+										},
+										{
+											"key": "description",
+											"value": "cri"
+										},
+										{
+											"key": "isActive",
+											"value": "true"
+										}
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "search challenge types 2",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "990241ce-362e-47d7-b619-6cf8f862a4bf",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"value": "application/json",
+										"type": "text"
+									},
+									{
+										"key": "Content-Type",
+										"value": "application/json",
+										"type": "text"
+									}
+								],
 								"url": {
 									"raw": "{{URL}}/challengeTypes?isActive=true&page=2&perPage=2",
 									"host": [
@@ -2680,10 +3152,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeTypes?invalid=test",
 									"host": [
@@ -2738,10 +3206,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeTypes/{{TYPEA_ID}}",
 									"host": [
@@ -2785,10 +3249,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeTypes/{{TYPEB_ID}}",
 									"host": [
@@ -2832,10 +3292,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeTypes/invalid-id",
 									"host": [
@@ -2879,10 +3335,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengeTypes/{{SETTINGA_ID}}",
 									"host": [
@@ -3317,6 +3769,110 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "partial update challenge type using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "c6ad399d-6048-445e-a0c1-b99395ce0b76",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PATCH",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_types_update}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"patch-by-m2m\",\n\t\"description\": \"patch-description\"\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challengeTypes/{{TEST_TYPE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeTypes",
+										"{{TEST_TYPE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure partial update challenge type using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "c6ad399d-6048-445e-a0c1-b99395ce0b76",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PATCH",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"patch-by-m2m\",\n\t\"description\": \"patch-description\"\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challengeTypes/{{TEST_TYPE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengeTypes",
+										"{{TEST_TYPE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -3786,29 +4342,17 @@
 								}
 							},
 							"response": []
-						}
-					],
-					"_postman_isSubFolder": true
-				}
-			]
-		},
-		{
-			"name": "ChallengePhases",
-			"item": [
-				{
-					"name": "create challenge phase",
-					"item": [
+						},
 						{
-							"name": "create phase 1",
+							"name": "update challenge type using m2m",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
 										"exec": [
-											"pm.test(\"Status code is 201\", function () {",
-											"    pm.response.to.have.status(201);",
-											"    pm.environment.set(\"PHASEA_ID\", pm.response.json().id);",
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -3816,7 +4360,7 @@
 								}
 							],
 							"request": {
-								"method": "POST",
+								"method": "PUT",
 								"header": [
 									{
 										"key": "Accept",
@@ -3831,20 +4375,84 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{m2m_challenge_types_update}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"name\": \"phase-1\",\n\t\"description\": \"has-description\",\n\t\"isActive\": true,\n\t\"duration\": 10000\n}\n"
+									"raw": "{\n\t\"name\": \"update-by-m2m\",\n\t\"isActive\": false\n}"
 								},
 								"url": {
-									"raw": "{{URL}}/challengePhases",
+									"raw": "{{URL}}/challengeTypes/{{TEST_TYPE_M2M_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
-										"challengePhases"
+										"challengeTypes",
+										"{{TEST_TYPE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						}
+					],
+					"_postman_isSubFolder": true
+				}
+			]
+		},
+		{
+			"name": "ChallengePhases",
+			"item": [
+				{
+					"name": "create challenge phase",
+					"item": [
+						{
+							"name": "create phase 1",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"PHASEA_ID\", pm.response.json().id);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"phase-1\",\n\t\"description\": \"has-description\",\n\t\"isActive\": true,\n\t\"duration\": 10000\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/challengePhases",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases"
 									]
 								}
 							},
@@ -4255,6 +4863,109 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "create phase using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"TEST_PHASE_M2M_ID\", pm.response.json().id);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_phases_create}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"phase-by-m2m\",\n\t\"description\": \"m2m-description\",\n\t\"isActive\": true,\n\t\"duration\": 10000\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/challengePhases",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure create phase using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"phase-by-m2m\",\n\t\"description\": \"m2m-description\",\n\t\"isActive\": true,\n\t\"duration\": 10000\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/challengePhases",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -4297,10 +5008,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases?name=ph",
 									"host": [
@@ -4354,10 +5061,6 @@
 										"value": "Bearer {{copilot1_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases",
 									"host": [
@@ -4405,10 +5108,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases?invalid=test",
 									"host": [
@@ -4457,10 +5156,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases",
 									"host": [
@@ -4508,10 +5203,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases",
 									"host": [
@@ -4559,10 +5250,6 @@
 										"value": "Bearer {{expire_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases",
 									"host": [
@@ -4610,10 +5297,6 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases",
 									"host": [
@@ -4625,20 +5308,14 @@
 								}
 							},
 							"response": []
-						}
-					],
-					"_postman_isSubFolder": true
-				},
-				{
-					"name": "get challenge phase",
-					"item": [
+						},
 						{
-							"name": "get challenge phase by copilot",
+							"name": "search challenge phases using m2m",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
+										"id": "7fbd663d-76fb-4c4d-b7b6-0baf9ca6b86e",
 										"exec": [
 											"pm.test(\"Status code is 200\", function () {",
 											"    pm.response.to.have.status(200);",
@@ -4663,37 +5340,38 @@
 									},
 									{
 										"key": "Authorization",
-										"value": "Bearer {{copilot1_token}}",
-										"type": "text"
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_phases_read}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
-									"raw": "{{URL}}/challengePhases/{{PHASEA_ID}}",
+									"raw": "{{URL}}/challengePhases?name=ph",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
-										"challengePhases",
-										"{{PHASEA_ID}}"
+										"challengePhases"
+									],
+									"query": [
+										{
+											"key": "name",
+											"value": "ph"
+										}
 									]
 								}
 							},
 							"response": []
 						},
 						{
-							"name": "get challenge phase by admin",
+							"name": "failure search challenge phases using forbidden m2m 403",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
+										"id": "7fbd663d-76fb-4c4d-b7b6-0baf9ca6b86e",
 										"exec": [
-											"pm.test(\"Status code is 200\", function () {",
-											"    pm.response.to.have.status(200);",
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -4716,36 +5394,43 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{m2m_challenges_read}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
-									"raw": "{{URL}}/challengePhases/{{PHASEB_ID}}",
+									"raw": "{{URL}}/challengePhases?name=ph",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
-										"challengePhases",
-										"{{PHASEB_ID}}"
+										"challengePhases"
+									],
+									"query": [
+										{
+											"key": "name",
+											"value": "ph"
+										}
 									]
 								}
 							},
 							"response": []
-						},
+						}
+					],
+					"_postman_isSubFolder": true
+				},
+				{
+					"name": "get challenge phase",
+					"item": [
 						{
-							"name": "get challenge phase invalid id 400",
+							"name": "get challenge phase by copilot",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
 										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
 										"exec": [
-											"pm.test(\"Status code is 400\", function () {",
-											"    pm.response.to.have.status(400);",
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -4767,14 +5452,106 @@
 									},
 									{
 										"key": "Authorization",
-										"type": "text",
-										"value": "Bearer {{admin_token}}"
-									}
+										"value": "Bearer {{copilot1_token}}",
+										"type": "text"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challengePhases/{{PHASEA_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases",
+										"{{PHASEA_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "get challenge phase by admin",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challengePhases/{{PHASEB_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases",
+										"{{PHASEB_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "get challenge phase invalid id 400",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
+										"exec": [
+											"pm.test(\"Status code is 400\", function () {",
+											"    pm.response.to.have.status(400);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases/invalid-id",
 									"host": [
@@ -4818,10 +5595,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases/{{PHASEB_ID}}",
 									"host": [
@@ -4870,10 +5643,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases/{{PHASEB_ID}}",
 									"host": [
@@ -4922,10 +5691,6 @@
 										"value": "Bearer {{expire_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases/{{PHASEB_ID}}",
 									"host": [
@@ -4974,10 +5739,6 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases/{{PHASEB_ID}}",
 									"host": [
@@ -5026,10 +5787,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challengePhases/{{TYPEA_ID}}",
 									"host": [
@@ -5042,6 +5799,102 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "get challenge phase using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_phases_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challengePhases/{{TEST_PHASE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases",
+										"{{TEST_PHASE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure get challenge phase using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challengePhases/{{TEST_PHASE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases",
+										"{{TEST_PHASE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -5464,20 +6317,14 @@
 								}
 							},
 							"response": []
-						}
-					],
-					"_postman_isSubFolder": true
-				},
-				{
-					"name": "update challenge phase",
-					"item": [
+						},
 						{
-							"name": "update challenge phase 1",
+							"name": "partial update challenge phase using m2m",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
+										"id": "c6ad399d-6048-445e-a0c1-b99395ce0b76",
 										"exec": [
 											"pm.test(\"Status code is 200\", function () {",
 											"    pm.response.to.have.status(200);",
@@ -5488,7 +6335,7 @@
 								}
 							],
 							"request": {
-								"method": "PUT",
+								"method": "PATCH",
 								"header": [
 									{
 										"key": "Accept",
@@ -5503,36 +6350,36 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{m2m_challenge_phases_update}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"name\": \"new-phase-1\",\n\t\"isActive\": true,\n\t\"duration\": 20000\n}\n"
+									"raw": "{\n\t\"name\": \"update-phase-by-m2m\",\n\t\"isActive\": true,\n\t\"duration\": 50000\n}\n"
 								},
 								"url": {
-									"raw": "{{URL}}/challengePhases/{{PHASEA_ID}}",
+									"raw": "{{URL}}/challengePhases/{{TEST_PHASE_M2M_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"challengePhases",
-										"{{PHASEA_ID}}"
+										"{{TEST_PHASE_M2M_ID}}"
 									]
 								}
 							},
 							"response": []
 						},
 						{
-							"name": "update challenge phase 2",
+							"name": "failure partial update challenge phase using forbidden m2m 403",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
+										"id": "c6ad399d-6048-445e-a0c1-b99395ce0b76",
 										"exec": [
-											"pm.test(\"Status code is 200\", function () {",
-											"    pm.response.to.have.status(200);",
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -5540,7 +6387,7 @@
 								}
 							],
 							"request": {
-								"method": "PUT",
+								"method": "PATCH",
 								"header": [
 									{
 										"key": "Accept",
@@ -5555,36 +6402,42 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{m2m_challenges_read}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"name\": \"new-PHASE-2\",\n\t\"predecessor\": \"{{PHASEA_ID}}\",\n\t\"description\": \"add-description-in-put\",\n\t\"isActive\": true,\n\t\"duration\": 10000\n}\n"
+									"raw": "{\n\t\"name\": \"update-phase-by-m2m\",\n\t\"isActive\": true,\n\t\"duration\": 50000\n}\n"
 								},
 								"url": {
-									"raw": "{{URL}}/challengePhases/{{PHASEB_ID}}",
+									"raw": "{{URL}}/challengePhases/{{TEST_PHASE_M2M_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"challengePhases",
-										"{{PHASEB_ID}}"
+										"{{TEST_PHASE_M2M_ID}}"
 									]
 								}
 							},
 							"response": []
-						},
+						}
+					],
+					"_postman_isSubFolder": true
+				},
+				{
+					"name": "update challenge phase",
+					"item": [
 						{
-							"name": "update challenge phase invalid id 400",
+							"name": "update challenge phase 1",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
 										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
 										"exec": [
-											"pm.test(\"Status code is 400\", function () {",
-											"    pm.response.to.have.status(400);",
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -5615,7 +6468,111 @@
 									"raw": "{\n\t\"name\": \"new-phase-1\",\n\t\"isActive\": true,\n\t\"duration\": 20000\n}\n"
 								},
 								"url": {
-									"raw": "{{URL}}/challengePhases/invalid-id",
+									"raw": "{{URL}}/challengePhases/{{PHASEA_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases",
+										"{{PHASEA_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "update challenge phase 2",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"new-PHASE-2\",\n\t\"predecessor\": \"{{PHASEA_ID}}\",\n\t\"description\": \"add-description-in-put\",\n\t\"isActive\": true,\n\t\"duration\": 10000\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/challengePhases/{{PHASEB_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases",
+										"{{PHASEB_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "update challenge phase invalid id 400",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
+										"exec": [
+											"pm.test(\"Status code is 400\", function () {",
+											"    pm.response.to.have.status(400);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"new-phase-1\",\n\t\"isActive\": true,\n\t\"duration\": 20000\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/challengePhases/invalid-id",
 									"host": [
 										"{{URL}}"
 									],
@@ -5933,6 +6890,110 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "update challenge phase using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_phases_update}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"new-phase-by-m2m\",\n\t\"isActive\": true,\n\t\"duration\": 20000\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/challengePhases/{{TEST_PHASE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases",
+										"{{TEST_PHASE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure update challenge phase using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"new-phase-by-m2m\",\n\t\"isActive\": true,\n\t\"duration\": 20000\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/challengePhases/{{TEST_PHASE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challengePhases",
+										"{{TEST_PHASE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -6298,29 +7359,17 @@
 								}
 							},
 							"response": []
-						}
-					],
-					"_postman_isSubFolder": true
-				}
-			]
-		},
-		{
-			"name": "TimelineTemplates",
-			"item": [
-				{
-					"name": "create timeline template",
-					"item": [
+						},
 						{
-							"name": "create timeline template",
+							"name": "delete challenge phase using m2m",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"id": "e547ddc3-44a5-413e-a9e7-f98bb2262398",
 										"exec": [
-											"pm.test(\"Status code is 201\", function () {",
-											"    pm.response.to.have.status(201);",
-											"    pm.environment.set(\"TEMPLATEA_ID\", pm.response.json().id);",
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -6328,7 +7377,7 @@
 								}
 							],
 							"request": {
-								"method": "POST",
+								"method": "DELETE",
 								"header": [
 									{
 										"key": "Accept",
@@ -6343,36 +7392,36 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{m2m_challenge_phases_delete}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"name\": \"template-1\",\n    \"description\": \"desc-1\",\n    \"isActive\": true,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEA_ID}}\",\n        \"name\": \"new-phase-1\",\n        \"isActive\": true,\n        \"duration\": 20000\n      },\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+									"raw": ""
 								},
 								"url": {
-									"raw": "{{URL}}/timelineTemplates",
+									"raw": "{{URL}}/challengePhases/{{TEST_PHASE_M2M_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
-										"timelineTemplates"
+										"challengePhases",
+										"{{TEST_PHASE_M2M_ID}}"
 									]
 								}
 							},
 							"response": []
 						},
 						{
-							"name": "create inactive timeline template",
+							"name": "failure delete challenge phase using forbidden m2m 403",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"id": "e547ddc3-44a5-413e-a9e7-f98bb2262398",
 										"exec": [
-											"pm.test(\"Status code is 201\", function () {",
-											"    pm.response.to.have.status(201);",
-											"    pm.environment.set(\"TEMPLATEB_ID\", pm.response.json().id);",
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -6380,7 +7429,7 @@
 								}
 							],
 							"request": {
-								"method": "POST",
+								"method": "DELETE",
 								"header": [
 									{
 										"key": "Accept",
@@ -6395,36 +7444,152 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{m2m_challenges_read}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"name\": \"template-2\",\n    \"isActive\": false,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+									"raw": ""
 								},
 								"url": {
-									"raw": "{{URL}}/timelineTemplates",
+									"raw": "{{URL}}/challengePhases/{{TEST_PHASE_M2M_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
-										"timelineTemplates"
+										"challengePhases",
+										"{{TEST_PHASE_M2M_ID}}"
 									]
 								}
 							},
 							"response": []
-						},
-						{
-							"name": "create timeline template for delete testing later",
-							"event": [
-								{
-									"listen": "test",
-									"script": {
-										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
-										"exec": [
-											"pm.test(\"Status code is 201\", function () {",
-											"    pm.response.to.have.status(201);",
-											"    pm.environment.set(\"TEMPLATEC_ID\", pm.response.json().id);",
+						}
+					],
+					"_postman_isSubFolder": true
+				}
+			]
+		},
+		{
+			"name": "TimelineTemplates",
+			"item": [
+				{
+					"name": "create timeline template",
+					"item": [
+						{
+							"name": "create timeline template",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"TEMPLATEA_ID\", pm.response.json().id);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"template-1\",\n    \"description\": \"desc-1\",\n    \"isActive\": true,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEA_ID}}\",\n        \"name\": \"new-phase-1\",\n        \"isActive\": true,\n        \"duration\": 20000\n      },\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "create inactive timeline template",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"TEMPLATEB_ID\", pm.response.json().id);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"template-2\",\n    \"isActive\": false,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "create timeline template for delete testing later",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"TEMPLATEC_ID\", pm.response.json().id);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -6720,6 +7885,109 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "create timeline template using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"TEST_TEMPLATE_M2M_ID\", pm.response.json().id);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_timeline_templates_create}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"template-by-m2m\",\n    \"description\": \"desc-by-m2m\",\n    \"isActive\": true,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEA_ID}}\",\n        \"name\": \"new-phase-1\",\n        \"isActive\": true,\n        \"duration\": 20000\n      },\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure create timeline template using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_create}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"template-by-m2m\",\n    \"description\": \"desc-by-m2m\",\n    \"isActive\": true,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEA_ID}}\",\n        \"name\": \"new-phase-1\",\n        \"isActive\": true,\n        \"duration\": 20000\n      },\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -6762,10 +8030,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates?name=1",
 									"host": [
@@ -6819,10 +8083,6 @@
 										"value": "Bearer {{copilot1_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates?name=LA",
 									"host": [
@@ -6876,10 +8136,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates?invalid=test",
 									"host": [
@@ -6928,10 +8184,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates?name=1",
 									"host": [
@@ -6985,10 +8237,6 @@
 										"value": "Bearer invalid"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates?name=1",
 									"host": [
@@ -7042,10 +8290,6 @@
 										"value": "Bearer {{expire_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates?name=1",
 									"host": [
@@ -7099,10 +8343,6 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates?name=1",
 									"host": [
@@ -7120,11 +8360,117 @@
 								}
 							},
 							"response": []
-						}
-					],
-					"_postman_isSubFolder": true
-				},
-				{
+						},
+						{
+							"name": "search timeline template using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "7fbd663d-76fb-4c4d-b7b6-0baf9ca6b86e",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_timeline_templates_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/timelineTemplates?name=1",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates"
+									],
+									"query": [
+										{
+											"key": "name",
+											"value": "1"
+										}
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure search timeline template using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "7fbd663d-76fb-4c4d-b7b6-0baf9ca6b86e",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/timelineTemplates?name=1",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates"
+									],
+									"query": [
+										{
+											"key": "name",
+											"value": "1"
+										}
+									]
+								}
+							},
+							"response": []
+						}
+					],
+					"_postman_isSubFolder": true
+				},
+				{
 					"name": "get timeline template",
 					"item": [
 						{
@@ -7162,10 +8508,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEA_ID}}",
 									"host": [
@@ -7214,10 +8556,6 @@
 										"value": "Bearer {{copilot1_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEB_ID}}",
 									"host": [
@@ -7266,10 +8604,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/invalid-id",
 									"host": [
@@ -7318,10 +8652,6 @@
 										"value": "Bearer {{expire_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEA_ID}}",
 									"host": [
@@ -7370,10 +8700,6 @@
 										"value": "Bearer invalid"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEA_ID}}",
 									"host": [
@@ -7417,10 +8743,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEA_ID}}",
 									"host": [
@@ -7469,10 +8791,6 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEA_ID}}",
 									"host": [
@@ -7521,10 +8839,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/{{SETTINGA_ID}}",
 									"host": [
@@ -7537,6 +8851,102 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "get timeline template using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_timeline_templates_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/timelineTemplates/{{TEST_TEMPLATE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates",
+										"{{TEST_TEMPLATE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure get timeline template using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "3e3dd07c-3ce6-47fe-86eb-a0a01ea1cfec",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/timelineTemplates/{{TEST_TEMPLATE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates",
+										"{{TEST_TEMPLATE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -7959,20 +9369,14 @@
 								}
 							},
 							"response": []
-						}
-					],
-					"_postman_isSubFolder": true
-				},
-				{
-					"name": "update timeline template",
-					"item": [
+						},
 						{
-							"name": "update timeline template 1",
+							"name": "partial update timeline template using m2m token",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
-										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
+										"id": "c6ad399d-6048-445e-a0c1-b99395ce0b76",
 										"exec": [
 											"pm.test(\"Status code is 200\", function () {",
 											"    pm.response.to.have.status(200);",
@@ -7983,7 +9387,7 @@
 								}
 							],
 							"request": {
-								"method": "PUT",
+								"method": "PATCH",
 								"header": [
 									{
 										"key": "Accept",
@@ -7998,28 +9402,34 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{m2m_timeline_templates_update}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"name\": \"template-1\",\n    \"description\": \"desc-1\",\n    \"isActive\": true,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEA_ID}}\",\n        \"name\": \"new-phase-1\",\n        \"isActive\": true,\n        \"duration\": 20000\n      },\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+									"raw": "{\n\t\"name\": \"new-template-m2m\",\n    \"description\": \"new-desc-m2m\"\n}\n"
 								},
 								"url": {
-									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEA_ID}}",
+									"raw": "{{URL}}/timelineTemplates/{{TEST_TEMPLATE_M2M_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"timelineTemplates",
-										"{{TEMPLATEA_ID}}"
+										"{{TEST_TEMPLATE_M2M_ID}}"
 									]
 								}
 							},
 							"response": []
-						},
+						}
+					],
+					"_postman_isSubFolder": true
+				},
+				{
+					"name": "update timeline template",
+					"item": [
 						{
-							"name": "update timeline template 2",
+							"name": "update timeline template 1",
 							"event": [
 								{
 									"listen": "test",
@@ -8055,7 +9465,59 @@
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"name\": \"template-2\",\n    \"isActive\": false,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+									"raw": "{\n\t\"name\": \"template-1\",\n    \"description\": \"desc-1\",\n    \"isActive\": true,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEA_ID}}\",\n        \"name\": \"new-phase-1\",\n        \"isActive\": true,\n        \"duration\": 20000\n      },\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEA_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates",
+										"{{TEMPLATEA_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "update timeline template 2",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "4ea1db72-9445-4dae-a372-fcd7c8c9de80",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"template-2\",\n    \"isActive\": false,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
 								},
 								"url": {
 									"raw": "{{URL}}/timelineTemplates/{{TEMPLATEB_ID}}",
@@ -8485,6 +9947,110 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "update timeline template using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_timeline_templates_update}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"update-template-by-m2m\",\n    \"description\": \"update-desc-by-m2m\",\n    \"isActive\": false,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEA_ID}}\",\n        \"name\": \"new-phase-1\",\n        \"isActive\": true,\n        \"duration\": 20000\n      },\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates/{{TEST_TEMPLATE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates",
+										"{{TEST_TEMPLATE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure update timeline template using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "09e1d09d-b72f-4809-ac29-c458b90cb631",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"name\": \"update-template-by-m2m\",\n    \"description\": \"update-desc-by-m2m\",\n    \"isActive\": false,\n    \"phases\": [\n      {\n        \"id\": \"{{PHASEA_ID}}\",\n        \"name\": \"new-phase-1\",\n        \"isActive\": true,\n        \"duration\": 20000\n      },\n      {\n        \"id\": \"{{PHASEB_ID}}\",\n        \"name\": \"new-PHASE-2\",\n        \"description\": \"add-description-in-put\",\n\t    \"predecessor\": \"{{PHASEA_ID}}\",\n    \t\"isActive\": true,\n\t    \"duration\": 10000\n      }\n    ]\n}\n"
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates/{{TEST_TEMPLATE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates",
+										"{{TEST_TEMPLATE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -8850,6 +10416,110 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "delete timeline template using m2m token",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "e547ddc3-44a5-413e-a9e7-f98bb2262398",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "DELETE",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_timeline_templates_delete}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": ""
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates/{{TEST_TEMPLATE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates",
+										"{{TEST_TEMPLATE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure delete timeline template using forbidden m2m token 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "e547ddc3-44a5-413e-a9e7-f98bb2262398",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "DELETE",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": ""
+								},
+								"url": {
+									"raw": "{{URL}}/timelineTemplates/{{TEST_TEMPLATE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"timelineTemplates",
+										"{{TEST_TEMPLATE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -8900,7 +10570,7 @@
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 2000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Code\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 500\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 250\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type\",\n\t\"tags\": [\"tag1\", \"tag2\"],\n\t\"projectId\": 123,\n\t\"forumId\": 456,\n\t\"status\": \"Draft\"\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 2000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Challenge prizes\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 500\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 250\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type\",\n\t\"tags\": [\"tag1\", \"tag2\"],\n\t\"projectId\": 123,\n\t\"forumId\": 456,\n\t\"status\": \"Draft\"\n}"
 								},
 								"url": {
 									"raw": "{{URL}}/challenges",
@@ -8952,7 +10622,7 @@
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID2}}\",\n\t\"track\": \"test-track-1\",\n\t\"name\": \"test-create-copilot\",\n\t\"description\": \"test-description\",\n\t\"challengeSettings\": [\n\t\t{\n\t\t\t\"type\": \"{{TEST_SETTING_ID3}}\",\n\t\t\t\"value\": \"value3\"\n\t\t},\n\t\t{\n\t\t\t\"type\": \"{{TEST_SETTING_ID4}}\",\n\t\t\t\"value\": \"value4\"\n\t\t}\n\t],\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Code\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type\",\n\t\"tags\": [\"tag1\", \"tag2\"],\n\t\"projectId\": 123,\n\t\"forumId\": 456,\n\t\"status\": \"Draft\",\n\t\"groups\": [\"group1\", \"group2\"]\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID2}}\",\n\t\"track\": \"test-track-1\",\n\t\"name\": \"test-create-copilot\",\n\t\"description\": \"test-description\",\n\t\"challengeSettings\": [\n\t\t{\n\t\t\t\"type\": \"{{TEST_SETTING_ID3}}\",\n\t\t\t\"value\": \"value3\"\n\t\t},\n\t\t{\n\t\t\t\"type\": \"{{TEST_SETTING_ID4}}\",\n\t\t\t\"value\": \"value4\"\n\t\t}\n\t],\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Challenge prizes\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type\",\n\t\"tags\": [\"tag1\", \"tag2\"],\n\t\"projectId\": 123,\n\t\"forumId\": 456,\n\t\"status\": \"Draft\",\n\t\"groups\": [\"group1\", \"group2\"]\n}"
 								},
 								"url": {
 									"raw": "{{URL}}/challenges",
@@ -9628,24 +11298,76 @@
 								}
 							},
 							"response": []
-						}
-					],
-					"_postman_isSubFolder": true
-				},
-				{
-					"name": "upload attachment",
-					"item": [
+						},
 						{
-							"name": "upload attachment by admin",
+							"name": "create challenge using m2m",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
 										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
 										"exec": [
-											"pm.test(\"Status code is 200\", function () {",
-											"    pm.response.to.have.status(200);",
-											"    pm.environment.set(\"ATTACHMENT_ID1\", pm.response.json().id);",
+											"pm.test(\"Status code is 201\", function () {",
+											"    pm.response.to.have.status(201);",
+											"    pm.environment.set(\"TEST_CHALLENGE_M2M_ID\", pm.response.json().id);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_create}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create-m2m\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 2000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Challenge prizes\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 500\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 250\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type\",\n\t\"tags\": [\"tag1\", \"tag2\"],\n\t\"projectId\": 123,\n\t\"forumId\": 456,\n\t\"status\": \"Draft\"\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challenges",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges"
+									]
+								}
+							},
+							"response": []
+						}
+					],
+					"_postman_isSubFolder": true
+				},
+				{
+					"name": "upload attachment",
+					"item": [
+						{
+							"name": "upload attachment by admin",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"    pm.environment.set(\"ATTACHMENT_ID1\", pm.response.json().id);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -9667,7 +11389,7 @@
 										{
 											"key": "attachment",
 											"type": "file",
-											"src": ""
+											"src": []
 										}
 									]
 								},
@@ -9717,7 +11439,7 @@
 										{
 											"key": "attachment",
 											"type": "file",
-											"src": ""
+											"src": []
 										}
 									]
 								},
@@ -9766,7 +11488,7 @@
 										{
 											"key": "attachment",
 											"type": "file",
-											"src": ""
+											"src": []
 										}
 									]
 								},
@@ -9815,7 +11537,7 @@
 										{
 											"key": "attachment",
 											"type": "file",
-											"src": ""
+											"src": []
 										}
 									]
 								},
@@ -9864,7 +11586,7 @@
 										{
 											"key": "attachment",
 											"type": "file",
-											"src": ""
+											"src": []
 										}
 									]
 								},
@@ -9907,7 +11629,7 @@
 										{
 											"key": "attachment",
 											"type": "file",
-											"src": ""
+											"src": []
 										}
 									]
 								},
@@ -9956,7 +11678,7 @@
 										{
 											"key": "wrong",
 											"type": "file",
-											"src": ""
+											"src": []
 										}
 									]
 								},
@@ -9973,6 +11695,105 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "upload attachment using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"    pm.environment.set(\"TEST_ATTACHMENT_M2M_ID\", pm.response.json().id);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_attachments_create}}"
+									}
+								],
+								"body": {
+									"mode": "formdata",
+									"formdata": [
+										{
+											"key": "attachment",
+											"type": "file",
+											"src": []
+										}
+									]
+								},
+								"url": {
+									"raw": "{{URL}}/challenges/{{TEST_CHALLENGE_M2M_ID}}/attachments",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{TEST_CHALLENGE_M2M_ID}}",
+										"attachments"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure upload attachment using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "POST",
+								"header": [
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"body": {
+									"mode": "formdata",
+									"formdata": [
+										{
+											"key": "attachment",
+											"type": "file",
+											"src": []
+										}
+									]
+								},
+								"url": {
+									"raw": "{{URL}}/challenges/{{TEST_CHALLENGE_M2M_ID}}/attachments",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{TEST_CHALLENGE_M2M_ID}}",
+										"attachments"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -10005,10 +11826,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}/attachments/{{ATTACHMENT_ID1}}",
 									"host": [
@@ -10049,10 +11866,6 @@
 										"value": "Bearer {{copilot1_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}/attachments/{{ATTACHMENT_ID2}}",
 									"host": [
@@ -10093,10 +11906,6 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}/attachments/{{ATTACHMENT_ID2}}",
 									"host": [
@@ -10137,10 +11946,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{TYPEA_ID}}/attachments/{{ATTACHMENT_ID1}}",
 									"host": [
@@ -10181,10 +11986,6 @@
 										"value": "Bearer {{expire_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}/attachments/{{ATTACHMENT_ID1}}",
 									"host": [
@@ -10225,10 +12026,6 @@
 										"value": "Bearer invalid"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}/attachments/{{ATTACHMENT_ID1}}",
 									"host": [
@@ -10269,10 +12066,6 @@
 										"value": "Bearer {{copilot2_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}/attachments/{{ATTACHMENT_ID2}}",
 									"host": [
@@ -10307,10 +12100,6 @@
 							"request": {
 								"method": "GET",
 								"header": [],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}/attachments/{{ATTACHMENT_ID2}}",
 									"host": [
@@ -10325,6 +12114,86 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "download attachment using m2m",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_attachments_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challenges/{{TEST_CHALLENGE_M2M_ID}}/attachments/{{TEST_ATTACHMENT_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{TEST_CHALLENGE_M2M_ID}}",
+										"attachments",
+										"{{TEST_ATTACHMENT_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure download attachment using forbidden m2m 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challenges/{{TEST_CHALLENGE_M2M_ID}}/attachments/{{TEST_ATTACHMENT_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{TEST_CHALLENGE_M2M_ID}}",
+										"attachments",
+										"{{TEST_ATTACHMENT_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"event": [
@@ -10389,10 +12258,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges?perPage=10&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
 									"host": [
@@ -10459,10 +12324,6 @@
 										"value": "Bearer {{copilot1_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges?perPage=10&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
 									"host": [
@@ -10529,10 +12390,6 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges?perPage=10&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
 									"host": [
@@ -10594,10 +12451,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges?perPage=10&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
 									"host": [
@@ -10659,10 +12512,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges?perPage=10&createdDateStart=abc&createdDateEnd=2022-03-22T00:00:00Z",
 									"host": [
@@ -10724,10 +12573,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges?invalid=test-",
 									"host": [
@@ -10745,6 +12590,138 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "search challenge using m2m with read scope",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "0f5c58f0-3b8c-4a8a-a6c8-2df8bd6d2cf0",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challenges?perPage=10&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges"
+									],
+									"query": [
+										{
+											"key": "perPage",
+											"value": "10"
+										},
+										{
+											"key": "createdBy",
+											"value": "TonyJ",
+											"disabled": true
+										},
+										{
+											"key": "createdDateStart",
+											"value": "2019-02-22T00:00:00Z"
+										},
+										{
+											"key": "createdDateEnd",
+											"value": "2022-03-22T00:00:00Z"
+										}
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "search challenge using m2m without read scope(same as anonymous user)",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "0f5c58f0-3b8c-4a8a-a6c8-2df8bd6d2cf0",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_attachments_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challenges?perPage=10&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges"
+									],
+									"query": [
+										{
+											"key": "perPage",
+											"value": "10"
+										},
+										{
+											"key": "createdBy",
+											"value": "TonyJ",
+											"disabled": true
+										},
+										{
+											"key": "createdDateStart",
+											"value": "2019-02-22T00:00:00Z"
+										},
+										{
+											"key": "createdDateEnd",
+											"value": "2022-03-22T00:00:00Z"
+										}
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -10782,10 +12759,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}",
 									"host": [
@@ -10834,10 +12807,6 @@
 										"type": "text"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
 									"host": [
@@ -10886,10 +12855,6 @@
 										"value": "Bearer {{admin_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
 									"host": [
@@ -10938,10 +12903,6 @@
 										"value": "Bearer {{user_token}}"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
 									"host": [
@@ -10985,10 +12946,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/invalid-id",
 									"host": [
@@ -11032,10 +12989,6 @@
 										"value": "application/json"
 									}
 								],
-								"body": {
-									"mode": "raw",
-									"raw": ""
-								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{TYPEA_ID}}",
 									"host": [
@@ -11048,6 +13001,151 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "get challenge using m2m token with read scope",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "0a63d8e6-2604-4836-9d3a-1f4f5b099305",
+										"exec": [
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenges_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{CHALLENGE_ID2}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure get challenge 2 using m2m token without scope 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "0a63d8e6-2604-4836-9d3a-1f4f5b099305",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_attachments_read}}"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{CHALLENGE_ID2}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure get challenge 2 using invalid token 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "0a63d8e6-2604-4836-9d3a-1f4f5b099305",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "GET",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer invalid"
+									}
+								],
+								"url": {
+									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{CHALLENGE_ID2}}"
+									]
+								},
+								"description": "it will be consided as anonymous user"
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -11092,7 +13190,7 @@
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 10000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Code\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 600\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 300\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type 2\",\n\t\"tags\": [\"tag1\", \"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID1}}\"]\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 10000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Challenge prizes\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 600\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 300\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type 2\",\n\t\"tags\": [\"tag1\", \"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID1}}\"]\n}"
 								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}",
@@ -11144,7 +13242,7 @@
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Code\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 222\",\n\t\"tags\": [\"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"],\n\t\"groups\": [\"group1\", \"group2\", \"group3\"]\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Challenge prizes\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 222\",\n\t\"tags\": [\"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"],\n\t\"groups\": [\"group1\", \"group2\", \"group3\"]\n}"
 								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
@@ -11196,7 +13294,7 @@
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 10000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Code\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 600\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 300\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type 2\",\n\t\"tags\": [\"tag1\", \"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID1}}\"],\n\t\"groups\": \"group1 group2\"\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 10000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Challenge prizes\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 600\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 300\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type 2\",\n\t\"tags\": [\"tag1\", \"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID1}}\"],\n\t\"groups\": \"group1 group2\"\n}"
 								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}",
@@ -11248,31 +13346,135 @@
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 10000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Code\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 600\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 300\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type 2\",\n\t\"tags\": [\"tag1\", \"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{TYPEA_ID}}\"]\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-create\",\n\t\"description\": \"test-description\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 10000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Challenge prizes\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 600\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 300\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type 2\",\n\t\"tags\": [\"tag1\", \"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{TYPEA_ID}}\"]\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{CHALLENGE_ID1}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure update challenge invalid parameter 400",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
+										"exec": [
+											"pm.test(\"Status code is 400\", function () {",
+											"    pm.response.to.have.status(400);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{admin_token}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"invalid\": 123,\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Challenge prizes\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 2\",\n\t\"tags\": [\"tag1\", \"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID1}}\"]\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{CHALLENGE_ID1}}"
+									]
+								}
+							},
+							"response": []
+						},
+						{
+							"name": "failure update challenge by different copilot 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PUT",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{copilot2_token}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Challenge prizes\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 222\",\n\t\"tags\": [\"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"]\n}"
 								},
 								"url": {
-									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}",
+									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"challenges",
-										"{{CHALLENGE_ID1}}"
+										"{{CHALLENGE_ID2}}"
 									]
 								}
 							},
 							"response": []
 						},
 						{
-							"name": "failure update challenge invalid parameter 400",
+							"name": "failure update challenge by user 403",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
 										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
 										"exec": [
-											"pm.test(\"Status code is 400\", function () {",
-											"    pm.response.to.have.status(400);",
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -11295,36 +13497,36 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{user_token}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"invalid\": 123,\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Code\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 2\",\n\t\"tags\": [\"tag1\", \"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID1}}\"]\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Challenge prizes\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 222\",\n\t\"tags\": [\"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"]\n}"
 								},
 								"url": {
-									"raw": "{{URL}}/challenges/{{CHALLENGE_ID1}}",
+									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"challenges",
-										"{{CHALLENGE_ID1}}"
+										"{{CHALLENGE_ID2}}"
 									]
 								}
 							},
 							"response": []
 						},
 						{
-							"name": "failure update challenge by different copilot 403",
+							"name": "failure update challenge not found 404",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
 										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
 										"exec": [
-											"pm.test(\"Status code is 403\", function () {",
-											"    pm.response.to.have.status(403);",
+											"pm.test(\"Status code is 404\", function () {",
+											"    pm.response.to.have.status(404);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -11347,36 +13549,36 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{copilot2_token}}"
+										"value": "Bearer {{admin_token}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Code\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 222\",\n\t\"tags\": [\"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"]\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Challenge prizes\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 222\",\n\t\"tags\": [\"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"]\n}"
 								},
 								"url": {
-									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
+									"raw": "{{URL}}/challenges/{{TYPEA_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"challenges",
-										"{{CHALLENGE_ID2}}"
+										"{{TYPEA_ID}}"
 									]
 								}
 							},
 							"response": []
 						},
 						{
-							"name": "failure update challenge by user 403",
+							"name": "update challenge using m2m token",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
 										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
 										"exec": [
-											"pm.test(\"Status code is 403\", function () {",
-											"    pm.response.to.have.status(403);",
+											"pm.test(\"Status code is 200\", function () {",
+											"    pm.response.to.have.status(200);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -11399,36 +13601,36 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{user_token}}"
+										"value": "Bearer {{m2m_challenges_update}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Code\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 222\",\n\t\"tags\": [\"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"]\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-update-m2m\",\n\t\"description\": \"test-update-m2m\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 2000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Challenge prizes\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 500\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 250\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type\",\n\t\"tags\": [\"tag1\", \"tag2\"],\n\t\"projectId\": 123,\n\t\"forumId\": 456,\n\t\"status\": \"Draft\"\n}"
 								},
 								"url": {
-									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
+									"raw": "{{URL}}/challenges/{{TEST_CHALLENGE_M2M_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"challenges",
-										"{{CHALLENGE_ID2}}"
+										"{{TEST_CHALLENGE_M2M_ID}}"
 									]
 								}
 							},
 							"response": []
 						},
 						{
-							"name": "failure update challenge not found 404",
+							"name": "failure update challenge using forbidden m2m token 403",
 							"event": [
 								{
 									"listen": "test",
 									"script": {
 										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
 										"exec": [
-											"pm.test(\"Status code is 404\", function () {",
-											"    pm.response.to.have.status(404);",
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
 											"});"
 										],
 										"type": "text/javascript"
@@ -11451,21 +13653,21 @@
 									{
 										"key": "Authorization",
 										"type": "text",
-										"value": "Bearer {{admin_token}}"
+										"value": "Bearer {{m2m_challenge_attachments_read}}"
 									}
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID4}}\",\n\t\"track\": \"update-track-1\",\n\t\"name\": \"update-name-1\",\n\t\"description\": \"update-description-1\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n        {\n            \"id\": \"{{PHASEA_ID}}\",\n            \"name\": \"new-phase-1\",\n            \"isActive\": true,\n            \"duration\": 1000000\n        },\n        {\n            \"id\": \"{{PHASEB_ID}}\",\n            \"name\": \"new-PHASE-2\",\n            \"description\": \"add-description-in-put\",\n            \"predecessor\": \"{{PHASEA_ID}}\",\n            \"isActive\": true,\n            \"duration\": 2000000\n        }\n    ],\n    \"prizeSets\": [\n        {\n            \"type\": \"Code\",\n            \"description\": \"desc\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 500\n                },\n                {\n                    \"description\": \"desc-second\",\n                    \"type\": \"second place\",\n                    \"value\": 250\n                }\n            ]\n        }\n    ],\n\t\"reviewType\": \"review type 222\",\n\t\"tags\": [\"tag3\", \"tag4\"],\n\t\"projectId\": 123123,\n\t\"forumId\": 456456,\n\t\"status\": \"Active\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"]\n}"
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"test-update-m2m\",\n\t\"description\": \"test-update-m2m\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 2000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Challenge prizes\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 500\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 250\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type\",\n\t\"tags\": [\"tag1\", \"tag2\"],\n\t\"projectId\": 123,\n\t\"forumId\": 456,\n\t\"status\": \"Draft\"\n}"
 								},
 								"url": {
-									"raw": "{{URL}}/challenges/{{TYPEA_ID}}",
+									"raw": "{{URL}}/challenges/{{TEST_CHALLENGE_M2M_ID}}",
 									"host": [
 										"{{URL}}"
 									],
 									"path": [
 										"challenges",
-										"{{TYPEA_ID}}"
+										"{{TEST_CHALLENGE_M2M_ID}}"
 									]
 								}
 							},
@@ -11566,7 +13768,7 @@
 								],
 								"body": {
 									"mode": "raw",
-									"raw": "{\n\t\"name\": \"update-new-name-1\",\n\t\"challengeSettings\": [\n\t\t{\n\t\t\t\"type\": \"{{TEST_SETTING_ID5}}\",\n\t\t\t\"value\": \"value5\"\n\t\t}\n\t],\n\t\"prizeSets\": [\n        {\n            \"type\": \"First to Finish\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 100\n                }\n            ]\n        }\n    ],\n\t\"status\": \"Completed\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"],\n\t\"groups\": [\"group1\", \"group2\", \"group3\", \"group4\"]\n}"
+									"raw": "{\n\t\"name\": \"update-new-name-1\",\n\t\"challengeSettings\": [\n\t\t{\n\t\t\t\"type\": \"{{TEST_SETTING_ID5}}\",\n\t\t\t\"value\": \"value5\"\n\t\t}\n\t],\n\t\"prizeSets\": [\n        {\n            \"type\": \"Challenge prizes\",\n            \"prizes\": [\n                {\n                    \"description\": \"desc-first\",\n                    \"type\": \"first place\",\n                    \"value\": 100\n                }\n            ]\n        }\n    ],\n\t\"status\": \"Completed\",\n\t\"attachmentIds\": [\"{{ATTACHMENT_ID2}}\"],\n\t\"groups\": [\"group1\", \"group2\", \"group3\", \"group4\"]\n}"
 								},
 								"url": {
 									"raw": "{{URL}}/challenges/{{CHALLENGE_ID2}}",
@@ -11892,6 +14094,58 @@
 								}
 							},
 							"response": []
+						},
+						{
+							"name": "failure partial update challenge using forbidden m2m token 403",
+							"event": [
+								{
+									"listen": "test",
+									"script": {
+										"id": "03483bad-dfb2-45d1-bf42-35dd3bd46dad",
+										"exec": [
+											"pm.test(\"Status code is 403\", function () {",
+											"    pm.response.to.have.status(403);",
+											"});"
+										],
+										"type": "text/javascript"
+									}
+								}
+							],
+							"request": {
+								"method": "PATCH",
+								"header": [
+									{
+										"key": "Accept",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Content-Type",
+										"type": "text",
+										"value": "application/json"
+									},
+									{
+										"key": "Authorization",
+										"type": "text",
+										"value": "Bearer {{m2m_challenge_attachments_read}}"
+									}
+								],
+								"body": {
+									"mode": "raw",
+									"raw": "{\n\t\"typeId\": \"{{TEST_TYPE_ID1}}\",\n\t\"track\": \"test-track\",\n\t\"name\": \"new-update-m2m\",\n\t\"description\": \"patch-update-m2m\",\n\t\"timelineTemplateId\": \"{{TEMPLATEA_ID}}\",\n\t\"phases\": [\n\t\t{\n        \t\"id\": \"{{PHASEA_ID}}\",\n        \t\"name\": \"new-phase-1\",\n        \t\"isActive\": true,\n        \t\"duration\": 1000000\n        },\n        {\n        \t\"id\": \"{{PHASEB_ID}}\",\n        \t\"name\": \"new-PHASE-2\",\n        \t\"description\": \"add-description-in-put\",\n\t    \t\"predecessor\": \"{{PHASEA_ID}}\",\n    \t\t\"isActive\": true,\n\t    \t\"duration\": 2000000\n        }\n\t],\n\t\"prizeSets\": [\n\t\t{\n\t\t\t\"type\": \"Challenge prizes\",\n\t\t\t\"description\": \"desc\",\n\t\t\t\"prizes\": [\n\t\t        {\n\t\t          \"description\": \"desc-first\",\n\t\t          \"type\": \"first place\",\n\t\t          \"value\": 500\n\t\t        },\n\t\t        {\n\t\t          \"description\": \"desc-second\",\n\t\t          \"type\": \"second place\",\n\t\t          \"value\": 250\n\t\t        }\n\t\t    ]\n\t\t}\n\t],\n\t\"reviewType\": \"review type\",\n\t\"tags\": [\"tag1\", \"tag2\"],\n\t\"projectId\": 123,\n\t\"forumId\": 456,\n\t\"status\": \"Draft\"\n}"
+								},
+								"url": {
+									"raw": "{{URL}}/challenges/{{TEST_CHALLENGE_M2M_ID}}",
+									"host": [
+										"{{URL}}"
+									],
+									"path": [
+										"challenges",
+										"{{TEST_CHALLENGE_M2M_ID}}"
+									]
+								}
+							},
+							"response": []
 						}
 					],
 					"_postman_isSubFolder": true
@@ -11936,10 +14190,6 @@
 								"value": "Bearer {{admin_token}}"
 							}
 						],
-						"body": {
-							"mode": "raw",
-							"raw": ""
-						},
 						"url": {
 							"raw": "{{URL}}/challengeAuditLogs?challengeId={{CHALLENGE_ID1}}&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
 							"host": [
@@ -12021,10 +14271,6 @@
 								"value": "Bearer {{admin_token}}"
 							}
 						],
-						"body": {
-							"mode": "raw",
-							"raw": ""
-						},
 						"url": {
 							"raw": "{{URL}}/challengeAuditLogs?challengeId={{CHALLENGE_ID2}}&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z&createdBy=ghostar",
 							"host": [
@@ -12095,10 +14341,6 @@
 								"value": "Bearer {{user_token}}"
 							}
 						],
-						"body": {
-							"mode": "raw",
-							"raw": ""
-						},
 						"url": {
 							"raw": "{{URL}}/challengeAuditLogs?challengeId={{CHALLENGE_ID1}}&fieldName=n&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2019-03-22T00:00:00Z&createdBy=tonyj",
 							"host": [
@@ -12168,10 +14410,6 @@
 								"value": "Bearer {{expire_token}}"
 							}
 						],
-						"body": {
-							"mode": "raw",
-							"raw": ""
-						},
 						"url": {
 							"raw": "{{URL}}/challengeAuditLogs?challengeId={{CHALLENGE_ID1}}&fieldName=n&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2019-03-22T00:00:00Z&createdBy=tonyj",
 							"host": [
@@ -12241,10 +14479,6 @@
 								"value": "Bearer {{admin_token}}"
 							}
 						],
-						"body": {
-							"mode": "raw",
-							"raw": ""
-						},
 						"url": {
 							"raw": "{{URL}}/challengeAuditLogs?challengeId={{CHALLENGE_ID1}}&invalid=n&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2019-03-22T00:00:00Z&createdBy=tonyj",
 							"host": [
@@ -12278,6 +14512,168 @@
 						}
 					},
 					"response": []
+				},
+				{
+					"name": "search using m2m token",
+					"event": [
+						{
+							"listen": "test",
+							"script": {
+								"id": "9fd8c9f4-13e3-47d0-9c78-1e544521d97d",
+								"exec": [
+									"pm.test(\"Status code is 200\", function () {",
+									"    pm.response.to.have.status(200);",
+									"});"
+								],
+								"type": "text/javascript"
+							}
+						}
+					],
+					"request": {
+						"method": "GET",
+						"header": [
+							{
+								"key": "Accept",
+								"type": "text",
+								"value": "application/json"
+							},
+							{
+								"key": "Content-Type",
+								"type": "text",
+								"value": "application/json"
+							},
+							{
+								"key": "Authorization",
+								"type": "text",
+								"value": "Bearer {{m2m_challenge_audit_logs_read}}"
+							}
+						],
+						"url": {
+							"raw": "{{URL}}/challengeAuditLogs?challengeId={{CHALLENGE_ID1}}&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
+							"host": [
+								"{{URL}}"
+							],
+							"path": [
+								"challengeAuditLogs"
+							],
+							"query": [
+								{
+									"key": "challengeId",
+									"value": "{{CHALLENGE_ID1}}"
+								},
+								{
+									"key": "fieldName",
+									"value": "n",
+									"disabled": true
+								},
+								{
+									"key": "createdDateStart",
+									"value": "2019-02-22T00:00:00Z"
+								},
+								{
+									"key": "createdDateEnd",
+									"value": "2022-03-22T00:00:00Z"
+								},
+								{
+									"key": "createdBy",
+									"value": "tonyj",
+									"disabled": true
+								},
+								{
+									"key": "perPage",
+									"value": "2",
+									"disabled": true
+								},
+								{
+									"key": "page",
+									"value": "2",
+									"disabled": true
+								}
+							]
+						}
+					},
+					"response": []
+				},
+				{
+					"name": "failure search using forbidden m2m token 403",
+					"event": [
+						{
+							"listen": "test",
+							"script": {
+								"id": "9fd8c9f4-13e3-47d0-9c78-1e544521d97d",
+								"exec": [
+									"pm.test(\"Status code is 403\", function () {",
+									"    pm.response.to.have.status(403);",
+									"});"
+								],
+								"type": "text/javascript"
+							}
+						}
+					],
+					"request": {
+						"method": "GET",
+						"header": [
+							{
+								"key": "Accept",
+								"type": "text",
+								"value": "application/json"
+							},
+							{
+								"key": "Content-Type",
+								"type": "text",
+								"value": "application/json"
+							},
+							{
+								"key": "Authorization",
+								"type": "text",
+								"value": "Bearer {{m2m_challenges_read}}"
+							}
+						],
+						"url": {
+							"raw": "{{URL}}/challengeAuditLogs?challengeId={{CHALLENGE_ID1}}&createdDateStart=2019-02-22T00:00:00Z&createdDateEnd=2022-03-22T00:00:00Z",
+							"host": [
+								"{{URL}}"
+							],
+							"path": [
+								"challengeAuditLogs"
+							],
+							"query": [
+								{
+									"key": "challengeId",
+									"value": "{{CHALLENGE_ID1}}"
+								},
+								{
+									"key": "fieldName",
+									"value": "n",
+									"disabled": true
+								},
+								{
+									"key": "createdDateStart",
+									"value": "2019-02-22T00:00:00Z"
+								},
+								{
+									"key": "createdDateEnd",
+									"value": "2022-03-22T00:00:00Z"
+								},
+								{
+									"key": "createdBy",
+									"value": "tonyj",
+									"disabled": true
+								},
+								{
+									"key": "perPage",
+									"value": "2",
+									"disabled": true
+								},
+								{
+									"key": "page",
+									"value": "2",
+									"disabled": true
+								}
+							]
+						}
+					},
+					"response": []
 				}
 			]
 		},
@@ -12314,10 +14710,6 @@
 								"value": "application/json"
 							}
 						],
-						"body": {
-							"mode": "raw",
-							"raw": ""
-						},
 						"url": {
 							"raw": "{{URL}}/health",
 							"host": [
diff --git a/docs/topcoder-challenge-api.postman_environment.json b/docs/topcoder-challenge-api.postman_environment.json
index e1279fe1..25eb40bb 100644
--- a/docs/topcoder-challenge-api.postman_environment.json
+++ b/docs/topcoder-challenge-api.postman_environment.json
@@ -1,50 +1,30 @@
 {
-	"id": "563c0431-f1cd-42a3-b8b5-29a30f1c2c38",
+	"id": "1313001a-a495-4416-b89b-89a914759267",
 	"name": "topcoder-challenge-api",
 	"values": [
 		{
 			"key": "URL",
 			"value": "http://localhost:3000",
-			"description": {
-				"content": "",
-				"type": "text/plain"
-			},
 			"enabled": true
 		},
 		{
 			"key": "user_token",
 			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIl0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJkZW5pcyIsImV4cCI6MTU2MjgwMDE2OSwidXNlcklkIjoiMjUxMjgwIiwiaWF0IjoxNTQ5Nzk5NTY5LCJlbWFpbCI6ImVtYWlsQGRvbWFpbi5jb20ueiIsImp0aSI6IjljNDUxMWM1LWMxNjUtNGExYi04OTllLWI2NWFkMGUwMmI1NSJ9.a5-oBMwFtwGkSw2161y0lEu1XvKsKElCmRu6e8Q6PPk",
-			"description": {
-				"content": "",
-				"type": "text/plain"
-			},
 			"enabled": true
 		},
 		{
 			"key": "copilot1_token",
 			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJjb3BpbG90IiwiQ29ubmVjdCBTdXBwb3J0Il0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJHaG9zdGFyIiwiZXhwIjoxNTYyODAwMDc3LCJ1c2VySWQiOiIxNTE3NDMiLCJpYXQiOjE1NDk3OTk0NzcsImVtYWlsIjoiZW1haWxAZG9tYWluLmNvbS56IiwianRpIjoiMTJjMWMxMGItOTNlZi00NTMxLTgzMDUtYmE2NjVmYzRlMWI0In0.TgxNCChFrM6QhKYFyXkd6FWNg_XRC-0aWCW0nM3Z9mE",
-			"description": {
-				"content": "",
-				"type": "text/plain"
-			},
 			"enabled": true
 		},
 		{
 			"key": "copilot2_token",
 			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJjb3BpbG90Il0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJob2hvc2t5IiwiZXhwIjoxNTYxNzkyMzcwLCJ1c2VySWQiOiIxNjA5NjgyMyIsImlhdCI6MTU0OTc5MTc3MCwiZW1haWwiOiJlbWFpbEBkb21haW4uY29tLnoiLCJqdGkiOiJmMWU2MTNiZS1kNWI5LTQyMzEtYmFhZS1lZTlmMmQyMjcyMzQifQ._ehIlaqxU5AdEdt2IFsYrulT40msSSV5j8gNuQaWwgQ",
-			"description": {
-				"content": "",
-				"type": "text/plain"
-			},
 			"enabled": true
 		},
 		{
 			"key": "admin_token",
 			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIiwiQ29ubmVjdCBTdXBwb3J0IiwiYWRtaW5pc3RyYXRvciIsInRlc3RSb2xlIiwiYWFhIiwidG9ueV90ZXN0XzEiLCJDb25uZWN0IE1hbmFnZXIiLCJDb25uZWN0IEFkbWluIiwiY29waWxvdCIsIkNvbm5lY3QgQ29waWxvdCBNYW5hZ2VyIl0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJUb255SiIsImV4cCI6MTU2MTc5MjIxMSwidXNlcklkIjoiODU0Nzg5OSIsImlhdCI6MTU0OTc5MTYxMSwiZW1haWwiOiJ0amVmdHMrZml4QHRvcGNvZGVyLmNvbSIsImp0aSI6ImY5NGQxZTI2LTNkMGUtNDZjYS04MTE1LTg3NTQ1NDRhMDhmMSJ9.o8VQsaYepIZmgBNuVuU7K7HWnqcPWJSnd8p88SqDgQU",
-			"description": {
-				"content": "",
-				"type": "text/plain"
-			},
 			"enabled": true
 		},
 		{
@@ -75,19 +55,11 @@
 		{
 			"key": "m2m_token",
 			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUyMTE5NDQ4LCJleHAiOjE1NjIyMDU4NDgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJ1cGRhdGU6dXNlcl9wcm9maWxlcyBhbGw6d3JpdGU6dXNlcl9wcm9maWxlcyB3cml0ZTp1c2VyX3Byb2ZpbGVzIHJlYWQ6Y2hhbGxlbmdlcyByZWFkOmdyb3VwcyB1cGRhdGU6c3VibWlzc2lvbiByZWFkOnN1Ym1pc3Npb24gY3JlYXRlOnN1Ym1pc3Npb24gcmVhZDpyZXZpZXdfdHlwZSB1cGRhdGU6cmV2aWV3X3N1bW1hdGlvbiByZWFkOnJldmlld19zdW1tYXRpb24gZGVsZXRlOnJldmlld19zdW1tYXRpb24gY3JlYXRlOnJldmlld19zdW1tYXRpb24gYWxsOnJldmlld19zdW1tYXRpb24gdXBkYXRlOnJldmlldyByZWFkOnJldmlldyBkZWxldGU6cmV2aWV3IGNyZWF0ZTpyZXZpZXcgYWxsOnJldmlldyB3cml0ZTpidXNfYXBpIHJlYWQ6dXNlcl9wcm9maWxlcyByZWFkOnJvbGVzIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.FBnnL5MKwDQXyliCwKsVVAootakpcO6VHwMTOl44nF0",
-			"description": {
-				"content": "",
-				"type": "text/plain"
-			},
 			"enabled": true
 		},
 		{
 			"key": "expire_token",
 			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJjb3BpbG90IiwiQ29ubmVjdCBTdXBwb3J0Il0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJHaG9zdGFyIiwiZXhwIjoxNTQ5ODAwMDc3LCJ1c2VySWQiOiIxNTE3NDMiLCJpYXQiOjE1NDk3OTk0NzcsImVtYWlsIjoiZW1haWxAZG9tYWluLmNvbS56IiwianRpIjoiMTJjMWMxMGItOTNlZi00NTMxLTgzMDUtYmE2NjVmYzRlMWI0In0.2n8k9pb16sE7LOLF_7mjAvEVKgggzS-wS3_8n2-R4RU",
-			"description": {
-				"content": "",
-				"type": "text/plain"
-			},
 			"enabled": true
 		},
 		{
@@ -189,9 +161,134 @@
 			"key": "ATTACHMENT_ID2",
 			"value": "3aea806a-9f32-435d-b095-9f44df2a5098",
 			"enabled": true
+		},
+		{
+			"key": "m2m_challenges_read",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJyZWFkOmNoYWxsZW5nZXMgYWxsOmNoYWxsZW5nZXMiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.u03WwiZdEvVfDqG30EQhp5HnlQKmgE-T0x06sSe-ZzU",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenges_create",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJjcmVhdGU6Y2hhbGxlbmdlcyBhbGw6Y2hhbGxlbmdlcyIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyJ9.i3OsNVmEDvfU7K4XpNkj0p3i-iDUKHG-2I6-tXrKlMY",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenges_update",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJ1cGRhdGU6Y2hhbGxlbmdlcyBhbGw6Y2hhbGxlbmdlcyIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyJ9.MDIhaeUHz6LMV1oGa4hehlXznXjTFjfK89OE3AiVzjY",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_types_create",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJjcmVhdGU6Y2hhbGxlbmdlX3R5cGVzIGFsbDpjaGFsbGVuZ2VfdHlwZXMiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.4M706EYL5tMB8Dg6T05SEMV1oMaRfm7ChnJvJQzoc74",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_types_update",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJ1cGRhdGU6Y2hhbGxlbmdlX3R5cGVzIGFsbDpjaGFsbGVuZ2VfdHlwZXMiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.LJmlSbDITIx1x3ZdxglQzUW6WXjjKp2vQ4qQmYMdl6M",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_settings_read",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJyZWFkOmNoYWxsZW5nZV9zZXR0aW5ncyBhbGw6Y2hhbGxlbmdlX3NldHRpbmdzIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.36ZfBKgaDOUa-qGsVJb5Cw0q3oJ96ZSVDtkhfsYuqQc",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_settings_create",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJjcmVhdGU6Y2hhbGxlbmdlX3NldHRpbmdzIGFsbDpjaGFsbGVuZ2Vfc2V0dGluZ3MiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.M9KLgUBcimBOXf3tQgEQNIh6vC7gzsFL-Lu-5jaCCzI",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_settings_update",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJ1cGRhdGU6Y2hhbGxlbmdlX3NldHRpbmdzIGFsbDpjaGFsbGVuZ2Vfc2V0dGluZ3MiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.XKl4006dakroI_3h87kuxippwU-BMQdSvvvNewxhRQ0",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_audit_logs_read",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJyZWFkOmNoYWxsZW5nZV9hdWRpdF9sb2dzIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.SjJOg2r6pW4ziujLFJHMLl02tuBm5waa7c4OTkYTckg",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_phases_read",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJyZWFkOmNoYWxsZW5nZV9waGFzZXMgYWxsOmNoYWxsZW5nZV9waGFzZXMiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.4yoJzjUCb2O94-G0Mn7emfJWRaoYc6tkpPfSaLf8uaE",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_phases_create",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJjcmVhdGU6Y2hhbGxlbmdlX3BoYXNlcyBhbGw6Y2hhbGxlbmdlX3BoYXNlcyIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyJ9.ZuXRA1ia9meFxW5rhIR-VGwrXkrRBAz9pLEx7i4-cvs",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_phases_delete",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJkZWxldGU6Y2hhbGxlbmdlX3BoYXNlcyBhbGw6Y2hhbGxlbmdlX3BoYXNlcyIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyJ9.Ozt5SiL2A00dhiCLg8963dQDpTWfikStPDB0gpf60WM",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_phases_update",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJ1cGRhdGU6Y2hhbGxlbmdlX3BoYXNlcyBhbGw6Y2hhbGxlbmdlX3BoYXNlcyIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyJ9.NQKOMe4GEawWuScfvHwl-zfSg5sfL3KD8Hfe99mz1Ao",
+			"enabled": true
+		},
+		{
+			"key": "m2m_timeline_templates_read",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJyZWFkOnRpbWVsaW5lX3RlbXBsYXRlcyBhbGw6dGltZWxpbmVfdGVtcGxhdGVzIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.HlBPA0M9t5-_2nOjOJXDGjE-9z8p4w8-7A7PagTFuS4",
+			"enabled": true
+		},
+		{
+			"key": "m2m_timeline_templates_create",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJjcmVhdGU6dGltZWxpbmVfdGVtcGxhdGVzIGFsbDp0aW1lbGluZV90ZW1wbGF0ZXMiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.3G3mKh_4NUi11-Bl2BkEI0xt7TzWcUpeRyrKKDvsBdA",
+			"enabled": true
+		},
+		{
+			"key": "m2m_timeline_templates_delete",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJkZWxldGU6dGltZWxpbmVfdGVtcGxhdGVzIGFsbDp0aW1lbGluZV90ZW1wbGF0ZXMiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.K6NUc8ra5HfbE1Kq6Wz0X1uva88i9BDPVnxbIXJixLc",
+			"enabled": true
+		},
+		{
+			"key": "m2m_timeline_templates_update",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJ1cGRhdGU6dGltZWxpbmVfdGVtcGxhdGVzIGFsbDp0aW1lbGluZV90ZW1wbGF0ZXMiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.nm55UrOflneE1Nlch3xKvCUT_038TbTAh_vEBAU8bAU",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_attachments_read",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJyZWFkOmNoYWxsZW5nZV9hdHRhY2htZW50cyBhbGw6Y2hhbGxlbmdlX2F0dGFjaG1lbnRzIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.IfJKxmfiiSTdlrf_GUmWut50Y8X0tyaSJIjHHBjBqjM",
+			"enabled": true
+		},
+		{
+			"key": "m2m_challenge_attachments_create",
+			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE1ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJjcmVhdGU6Y2hhbGxlbmdlX2F0dGFjaG1lbnRzIGFsbDpjaGFsbGVuZ2VfYXR0YWNobWVudHMiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.bjBaMkWFPaWKDKq7SynvjUWH76eiMAWbkiU1Js5j5vc",
+			"enabled": true
+		},
+		{
+			"key": "TEST_SETTING_M2M_ID",
+			"value": "",
+			"enabled": true
+		},
+		{
+			"key": "TEST_TYPE_M2M_ID",
+			"value": "",
+			"enabled": true
+		},
+		{
+			"key": "TEST_PHASE_M2M_ID",
+			"value": "",
+			"enabled": true
+		},
+		{
+			"key": "TEST_TEMPLATE_M2M_ID",
+			"value": "",
+			"enabled": true
+		},
+		{
+			"key": "TEST_CHALLENGE_M2M_ID",
+			"value": "",
+			"enabled": true
+		},
+		{
+			"key": "TEST_ATTACHMENT_M2M_ID",
+			"value": "",
+			"enabled": true
 		}
 	],
 	"_postman_variable_scope": "environment",
-	"_postman_exported_at": "2019-05-03T18:45:52.371Z",
-	"_postman_exported_using": "Postman/6.4.4"
+	"_postman_exported_at": "2019-06-06T05:22:00.094Z",
+	"_postman_exported_using": "Postman/7.1.1"
 }
\ No newline at end of file
diff --git a/local/Dockerfile b/local/Dockerfile
deleted file mode 100644
index a4fc8f4c..00000000
--- a/local/Dockerfile
+++ /dev/null
@@ -1,24 +0,0 @@
-FROM openjdk:8-jre
-
-RUN apt-get update && \
-    apt-get install -y \
-        python3 \
-        python3-pip \
-        python3-setuptools \
-        groff \
-        less \
-    && pip3 install --upgrade pip \
-    && apt-get clean
-
-RUN pip3 --no-cache-dir install --upgrade awscli
-
-RUN /usr/bin/curl -L http://dynamodb-local.s3-website-us-west-2.amazonaws.com/dynamodb_local_latest.tar.gz | /bin/tar xz
-
-COPY ./init-dynamodb.sh .
-COPY ./config /root/.aws/
-COPY ./credentials /root/.aws/
-RUN chmod +x ./init-dynamodb.sh
-
-ENTRYPOINT ["/docker-java-home/bin/java", "-Djava.library.path=./DynamoDBLocal_lib", "-jar", "DynamoDBLocal.jar"]
-
-CMD ["-help"]
diff --git a/local/config b/local/config
deleted file mode 100644
index 6dd86342..00000000
--- a/local/config
+++ /dev/null
@@ -1,3 +0,0 @@
-[default]
-output=json
-region=ap-northeast-1
diff --git a/local/credentials b/local/credentials
deleted file mode 100644
index fb725d95..00000000
--- a/local/credentials
+++ /dev/null
@@ -1,3 +0,0 @@
-[default]
-aws_access_key_id=FAKE_ACCESS_KEY
-aws_secret_access_key=FAKE_SECRET_ACCESS_KEY
diff --git a/local/docker-compose.yml b/local/docker-compose.yml
index a44a02b6..501f1973 100644
--- a/local/docker-compose.yml
+++ b/local/docker-compose.yml
@@ -1,10 +1,7 @@
 version: '3'
 services:
   dynamodb:
-    build:
-      context: ./
-      dockerfile: ./Dockerfile
-    container_name: dynamodb
+    image: tray/dynamodb-local
     ports:
       - "7777:7777"
-    command: "-inMemory -sharedDb -port 7777"
+    command: "-inMemory -port 7777"
diff --git a/local/init-dynamodb.sh b/local/init-dynamodb.sh
deleted file mode 100644
index 11d800f0..00000000
--- a/local/init-dynamodb.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-# Create the Challenge table
-aws dynamodb create-table --table-name Challenge --attribute-definitions AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --region ap-northeast-1 --provisioned-throughput ReadCapacityUnits=4,WriteCapacityUnits=2 --endpoint-url http://localhost:7777
-# Create the ChallengeType table
-aws dynamodb create-table --table-name ChallengeType --attribute-definitions AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --region ap-northeast-1 --provisioned-throughput ReadCapacityUnits=4,WriteCapacityUnits=2 --endpoint-url http://localhost:7777
-# Create the ChallengeSetting table
-aws dynamodb create-table --table-name ChallengeSetting --attribute-definitions AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --region ap-northeast-1 --provisioned-throughput ReadCapacityUnits=4,WriteCapacityUnits=2 --endpoint-url http://localhost:7777
-# Create the AuditLog table
-aws dynamodb create-table --table-name AuditLog --attribute-definitions AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --region ap-northeast-1 --provisioned-throughput ReadCapacityUnits=4,WriteCapacityUnits=2 --endpoint-url http://localhost:7777
-# Create the Phase table
-aws dynamodb create-table --table-name Phase --attribute-definitions AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --region ap-northeast-1 --provisioned-throughput ReadCapacityUnits=4,WriteCapacityUnits=2 --endpoint-url http://localhost:7777
-# Create the TimelineTemplate table
-aws dynamodb create-table --table-name TimelineTemplate --attribute-definitions AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --region ap-northeast-1 --provisioned-throughput ReadCapacityUnits=4,WriteCapacityUnits=2 --endpoint-url http://localhost:7777
-# Create the Attachment table
-aws dynamodb create-table --table-name Attachment --attribute-definitions AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --region ap-northeast-1 --provisioned-throughput ReadCapacityUnits=4,WriteCapacityUnits=2 --endpoint-url http://localhost:7777
diff --git a/package-lock.json b/package-lock.json
index 8149f467..753541e9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3152,8 +3152,7 @@
       "requires": {
         "joi": "^13.4.0",
         "lodash": "^4.17.10",
-        "superagent": "^3.8.3",
-        "tc-core-library-js": "github:appirio-tech/tc-core-library-js#d16413db30b1eed21c0cf426e185bedb2329ddab"
+        "superagent": "^3.8.3"
       },
       "dependencies": {
         "axios": {
@@ -3203,7 +3202,7 @@
         },
         "tc-core-library-js": {
           "version": "github:appirio-tech/tc-core-library-js#d16413db30b1eed21c0cf426e185bedb2329ddab",
-          "from": "github:appirio-tech/tc-core-library-js#v2.6",
+          "from": "github:appirio-tech/tc-core-library-js#d16413db30b1eed21c0cf426e185bedb2329ddab",
           "requires": {
             "auth0-js": "^9.4.2",
             "axios": "^0.12.0",
diff --git a/package.json b/package.json
index b36891cd..82cd5f9c 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,8 @@
     "init-db": "node src/init-db.js",
     "drop-tables": "node src/scripts/drop-tables.js",
     "create-tables": "node src/scripts/create-tables.js",
-    "seed-tables": "node src/scripts/seed-tables.js"
+    "seed-tables": "node src/scripts/seed-tables.js",
+    "view-data": "node src/scripts/view-data.js"
   },
   "author": "TCSCODER",
   "license": "none",
diff --git a/src/common/helper.js b/src/common/helper.js
index 185763b9..8e79bea7 100644
--- a/src/common/helper.js
+++ b/src/common/helper.js
@@ -76,6 +76,9 @@ function getPageLink (req, page) {
  */
 function setResHeaders (req, res, result) {
   const totalPages = Math.ceil(result.total / result.perPage)
+  if (result.page > 1) {
+    res.set('X-Prev-Page', result.page - 1)
+  }
   if (result.page < totalPages) {
     res.set('X-Next-Page', result.page + 1)
   }
@@ -179,12 +182,12 @@ async function getById (modelName, id) {
   return new Promise((resolve, reject) => {
     models[modelName].query('id').eq(id).exec((err, result) => {
       if (err) {
-        reject(err)
+        return reject(err)
       }
       if (result.length > 0) {
         return resolve(result[0])
       } else {
-        reject(new errors.NotFoundError(`${modelName} with id: ${id} doesn't exist`))
+        return reject(new errors.NotFoundError(`${modelName} with id: ${id} doesn't exist`))
       }
     })
   })
@@ -232,7 +235,7 @@ async function create (modelName, data) {
     const dbItem = new models[modelName](data)
     dbItem.save((err) => {
       if (err) {
-        reject(err)
+        return reject(err)
       } else {
         return resolve(dbItem)
       }
@@ -253,7 +256,7 @@ async function update (dbItem, data) {
   return new Promise((resolve, reject) => {
     dbItem.save((err) => {
       if (err) {
-        reject(err)
+        return reject(err)
       } else {
         return resolve(dbItem)
       }
@@ -271,7 +274,7 @@ async function scan (modelName, scanParams) {
   return new Promise((resolve, reject) => {
     models[modelName].scan(scanParams).exec((err, result) => {
       if (err) {
-        reject(err)
+        return reject(err)
       } else {
         return resolve(result.count === 0 ? [] : result)
       }
diff --git a/src/routes.js b/src/routes.js
index 57f0d832..078dda2a 100644
--- a/src/routes.js
+++ b/src/routes.js
@@ -3,36 +3,50 @@
  */
 
 const constants = require('../app-constants')
+const { SCOPES: {
+  CHALLENGES,
+  CHALLENGE_TYPES,
+  CHALLENGE_SETTINGS,
+  CHALLENGE_AUDIT_LOGS,
+  CHALLENGE_PHASES,
+  TIMELINE_TEMPLATES,
+  CHALLENGE_ATTACHMENTS
+} } = require('config')
 
 module.exports = {
   '/challenges': {
     get: {
       controller: 'ChallengeController',
-      method: 'searchChallenges'
+      method: 'searchChallenges',
+      scopes: [CHALLENGES.READ, CHALLENGES.ALL]
     },
     post: {
       controller: 'ChallengeController',
       method: 'createChallenge',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGES.CREATE, CHALLENGES.ALL]
     }
   },
   '/challenges/:challengeId': {
     get: {
       controller: 'ChallengeController',
-      method: 'getChallenge'
+      method: 'getChallenge',
+      scopes: [CHALLENGES.READ, CHALLENGES.ALL]
     },
     put: {
       controller: 'ChallengeController',
       method: 'fullyUpdateChallenge',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGES.UPDATE, CHALLENGES.ALL]
     },
     patch: {
       controller: 'ChallengeController',
       method: 'partiallyUpdateChallenge',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGES.UPDATE, CHALLENGES.ALL]
     }
   },
   '/challengeTypes': {
@@ -44,7 +58,8 @@ module.exports = {
       controller: 'ChallengeTypeController',
       method: 'createChallengeType',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_TYPES.CREATE, CHALLENGE_TYPES.ALL]
     }
   },
   '/challengeTypes/:challengeTypeId': {
@@ -56,13 +71,15 @@ module.exports = {
       controller: 'ChallengeTypeController',
       method: 'fullyUpdateChallengeType',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_TYPES.UPDATE, CHALLENGE_TYPES.ALL]
     },
     patch: {
       controller: 'ChallengeTypeController',
       method: 'partiallyUpdateChallengeType',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_TYPES.UPDATE, CHALLENGE_TYPES.ALL]
     }
   },
   '/challengeSettings': {
@@ -70,13 +87,15 @@ module.exports = {
       controller: 'ChallengeSettingController',
       method: 'searchChallengeSettings',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_SETTINGS.READ, CHALLENGE_SETTINGS.ALL]
     },
     post: {
       controller: 'ChallengeSettingController',
       method: 'createChallengeSetting',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_SETTINGS.CREATE, CHALLENGE_SETTINGS.ALL]
     }
   },
   '/challengeSettings/:challengeSettingId': {
@@ -84,13 +103,15 @@ module.exports = {
       controller: 'ChallengeSettingController',
       method: 'getChallengeSetting',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_SETTINGS.READ, CHALLENGE_SETTINGS.ALL]
     },
     put: {
       controller: 'ChallengeSettingController',
       method: 'updateChallengeSetting',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_SETTINGS.UPDATE, CHALLENGE_SETTINGS.ALL]
     }
   },
   '/challengeAuditLogs': {
@@ -98,7 +119,8 @@ module.exports = {
       controller: 'AuditLogController',
       method: 'searchAuditLogs',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [CHALLENGE_AUDIT_LOGS.READ]
     }
   },
   '/challengePhases': {
@@ -106,13 +128,15 @@ module.exports = {
       controller: 'ChallengePhaseController',
       method: 'searchPhases',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_PHASES.READ, CHALLENGE_PHASES.ALL]
     },
     post: {
       controller: 'ChallengePhaseController',
       method: 'createPhase',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [CHALLENGE_PHASES.CREATE, CHALLENGE_PHASES.ALL]
     }
   },
   '/challengePhases/:challengePhaseId': {
@@ -120,25 +144,29 @@ module.exports = {
       controller: 'ChallengePhaseController',
       method: 'getPhase',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_PHASES.READ, CHALLENGE_PHASES.ALL]
     },
     put: {
       controller: 'ChallengePhaseController',
       method: 'fullyUpdatePhase',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [CHALLENGE_PHASES.UPDATE, CHALLENGE_PHASES.ALL]
     },
     patch: {
       controller: 'ChallengePhaseController',
       method: 'partiallyUpdatePhase',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [CHALLENGE_PHASES.UPDATE, CHALLENGE_PHASES.ALL]
     },
     delete: {
       controller: 'ChallengePhaseController',
       method: 'deletePhase',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [CHALLENGE_PHASES.DELETE, CHALLENGE_PHASES.ALL]
     }
   },
   '/timelineTemplates': {
@@ -146,13 +174,15 @@ module.exports = {
       controller: 'TimelineTemplateController',
       method: 'searchTimelineTemplates',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [TIMELINE_TEMPLATES.READ, TIMELINE_TEMPLATES.ALL]
     },
     post: {
       controller: 'TimelineTemplateController',
       method: 'createTimelineTemplate',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [TIMELINE_TEMPLATES.CREATE, TIMELINE_TEMPLATES.ALL]
     }
   },
   '/timelineTemplates/:timelineTemplateId': {
@@ -160,25 +190,29 @@ module.exports = {
       controller: 'TimelineTemplateController',
       method: 'getTimelineTemplate',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [TIMELINE_TEMPLATES.READ, TIMELINE_TEMPLATES.ALL]
     },
     put: {
       controller: 'TimelineTemplateController',
       method: 'fullyUpdateTimelineTemplate',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [TIMELINE_TEMPLATES.UPDATE, TIMELINE_TEMPLATES.ALL]
     },
     patch: {
       controller: 'TimelineTemplateController',
       method: 'partiallyUpdateTimelineTemplate',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [TIMELINE_TEMPLATES.UPDATE, TIMELINE_TEMPLATES.ALL]
     },
     delete: {
       controller: 'TimelineTemplateController',
       method: 'deleteTimelineTemplate',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin]
+      access: [constants.UserRoles.Admin],
+      scopes: [TIMELINE_TEMPLATES.DELETE, TIMELINE_TEMPLATES.ALL]
     }
   },
   '/challenges/:challengeId/attachments': {
@@ -186,15 +220,16 @@ module.exports = {
       controller: 'AttachmentController',
       method: 'uploadAttachment',
       auth: 'jwt',
-      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot]
+      access: [constants.UserRoles.Admin, constants.UserRoles.Copilot],
+      scopes: [CHALLENGE_ATTACHMENTS.CREATE, CHALLENGE_ATTACHMENTS.ALL]
     }
   },
   '/challenges/:challengeId/attachments/:attachmentId': {
     get: {
       controller: 'AttachmentController',
       method: 'downloadAttachment',
-      auth: 'jwt'
-      // any authenticated role is allowed
+      auth: 'jwt', // any authenticated role is allowed
+      scopes: [CHALLENGE_ATTACHMENTS.READ, CHALLENGE_ATTACHMENTS.ALL]
     }
   },
   '/health': {
diff --git a/src/scripts/view-data.js b/src/scripts/view-data.js
new file mode 100644
index 00000000..8208005f
--- /dev/null
+++ b/src/scripts/view-data.js
@@ -0,0 +1,34 @@
+/**
+ * View table data.
+ */
+
+require('../../app-bootstrap')
+const _ = require('lodash')
+const models = require('../models')
+const logger = require('../common/logger')
+const helper = require('../common/helper')
+
+const viewData = async (modelName) => {
+  const fieldNames = _.keys(models[modelName].$__.table.schema.attributes)
+  const records = await helper.scan(modelName)
+  console.log(_.map(records, e => _.pick(e, fieldNames)))
+}
+
+if (process.argv.length === 2) {
+  logger.info(`Please provide one of the following table name: [${_.keys(models)}]`)
+  process.exit(1)
+} else {
+  const modelName = process.argv[2]
+  if (_.keys(models).includes(modelName)) {
+    viewData(modelName).then(() => {
+      logger.info('Done!')
+      process.exit()
+    }).catch((e) => {
+      logger.logFullError(e)
+      process.exit(1)
+    })
+  } else {
+    logger.info(`Please provide one of the following table name: [${_.keys(models)}]`)
+    process.exit(1)
+  }
+}
diff --git a/src/services/AttachmentService.js b/src/services/AttachmentService.js
index 9f61fa3b..3d802e8d 100644
--- a/src/services/AttachmentService.js
+++ b/src/services/AttachmentService.js
@@ -39,9 +39,11 @@ async function uploadAttachment (authUser, challengeId, files) {
   // ensure challenge exists
   await helper.getById('Challenge', challengeId)
 
-  // check authorization
-  if (!(await canUploadChallengeAttachment(authUser, challengeId))) {
-    throw new errors.ForbiddenError('You are not allowed to upload attachment of the challenge.')
+  if (!authUser.isMachine) {
+    // check authorization
+    if (!(await canUploadChallengeAttachment(authUser, challengeId))) {
+      throw new errors.ForbiddenError('You are not allowed to upload attachment of the challenge.')
+    }
   }
 
   const file = files.attachment
@@ -98,9 +100,11 @@ async function canDownloadChallengeAttachment (authUser, challengeId) {
  * @returns {Promise<Object>} the downloaded attachment data
  */
 async function downloadAttachment (authUser, challengeId, attachmentId) {
-  // check authorization
-  if (!(await canDownloadChallengeAttachment(authUser, challengeId))) {
-    throw new errors.ForbiddenError('You are not allowed to download attachment of the challenge.')
+  if (!authUser.isMachine) {
+    // check authorization
+    if (!(await canDownloadChallengeAttachment(authUser, challengeId))) {
+      throw new errors.ForbiddenError('You are not allowed to download attachment of the challenge.')
+    }
   }
   const attachment = await helper.getById('Attachment', attachmentId)
   if (attachment.challengeId !== challengeId) {
diff --git a/src/services/ChallengeService.js b/src/services/ChallengeService.js
index 5bfaa11b..b236512c 100644
--- a/src/services/ChallengeService.js
+++ b/src/services/ChallengeService.js
@@ -21,7 +21,7 @@ async function filterChallengesByGroupsAccess (currentUser, challenges) {
   const res = []
   let userGroups
   for (const challenge of challenges) {
-    if (!challenge.groups || challenge.groups.length === 0 || (currentUser && helper.hasAdminRole(currentUser))) {
+    if (!challenge.groups || challenge.groups.length === 0 || (currentUser && (currentUser.isMachine || helper.hasAdminRole(currentUser)))) {
       res.push(challenge)
     } else if (currentUser) {
       // get user groups if not yet
@@ -346,8 +346,8 @@ async function update (currentUser, challengeId, data, isFull) {
     newAttachments = await helper.getByIds('Attachment', data.attachmentIds || [])
   }
 
-  if (challenge.createdBy.toLowerCase() !== currentUser.handle.toLowerCase() && !helper.hasAdminRole(currentUser)) {
-    throw new errors.ForbiddenError(`Only admin or challenge's copilot can perform modification.`)
+  if (challenge.createdBy.toLowerCase() !== currentUser.handle.toLowerCase() && !currentUser.isMachine && !helper.hasAdminRole(currentUser)) {
+    throw new errors.ForbiddenError(`Only M2M, admin or challenge's copilot can perform modification.`)
   }
 
   // find out attachment ids to delete