diff --git a/nebius/ai/v1/endpoint.proto b/nebius/ai/v1/endpoint.proto
index 819f34a..43616c8 100644
--- a/nebius/ai/v1/endpoint.proto
+++ b/nebius/ai/v1/endpoint.proto
@@ -246,6 +246,7 @@ message EndpointSpec {
       // Authentication method.
       oneof auth {
         // Inline S3 credentials.
+        // Unmasked values are returned only by Get with view SECRET.
         S3Credentials credentials = 4;
 
         // Reference to a MysteryBox secret containing S3 credentials.
diff --git a/nebius/ai/v1/endpoint_service.proto b/nebius/ai/v1/endpoint_service.proto
index aa71f80..e1357c4 100644
--- a/nebius/ai/v1/endpoint_service.proto
+++ b/nebius/ai/v1/endpoint_service.proto
@@ -43,7 +43,7 @@ service EndpointService {
 }
 
 message GetEndpointRequest {
-  // Controls whether sensitive injected-file content is included.
+  // Controls whether injected-file content and unmasked inline S3 credential values are included.
   enum View {
     VIEW_UNSPECIFIED = 0;
 
@@ -57,7 +57,7 @@ message GetEndpointRequest {
     }
   ];
 
-  // SECRET includes injected file content and requires
+  // SECRET includes injected-file content and unmasked inline S3 credentials and requires
   // resource.aiendpoint.getSensitiveData.
   View view = 101 [(buf.validate.field) = {
     enum: {defined_only: true}
diff --git a/nebius/ai/v1/job.proto b/nebius/ai/v1/job.proto
index e95cda5..83c7c65 100644
--- a/nebius/ai/v1/job.proto
+++ b/nebius/ai/v1/job.proto
@@ -233,6 +233,7 @@ message JobSpec {
       // Authentication method.
       oneof auth {
         // Inline S3 credentials.
+        // Unmasked values are returned only by Get with view SECRET.
         S3Credentials credentials = 4;
 
         // Reference to a MysteryBox secret containing S3 credentials.
diff --git a/nebius/ai/v1/job_service.proto b/nebius/ai/v1/job_service.proto
index ff43f7a..0da0114 100644
--- a/nebius/ai/v1/job_service.proto
+++ b/nebius/ai/v1/job_service.proto
@@ -40,7 +40,7 @@ service JobService {
 }
 
 message GetJobRequest {
-  // Controls whether sensitive injected-file content is included.
+  // Controls whether injected-file content and unmasked inline S3 credential values are included.
   enum View {
     VIEW_UNSPECIFIED = 0;
 
@@ -54,7 +54,7 @@ message GetJobRequest {
     }
   ];
 
-  // SECRET includes injected file content and requires
+  // SECRET includes injected-file content and unmasked inline S3 credentials and requires
   // resource.aijob.getSensitiveData.
   View view = 101 [(buf.validate.field) = {
     enum: {defined_only: true}
diff --git a/nebius/compute/v1/disk.proto b/nebius/compute/v1/disk.proto
index b7eb3ba..780c315 100644
--- a/nebius/compute/v1/disk.proto
+++ b/nebius/compute/v1/disk.proto
@@ -12,7 +12,9 @@ option java_outer_classname = "DiskProto";
 option java_package = "ai.nebius.pub.compute.v1";
 
 message Disk {
-  common.v1.ResourceMetadata metadata = 1;
+  common.v1.ResourceMetadata metadata = 1 [(nid) = {
+    parent_resource: ["project"]
+  }];
 
   DiskSpec spec = 2;
 
@@ -65,11 +67,21 @@ message DiskSpec {
   // Boot disk must be created from an image https://docs.nebius.com/compute/storage/manage#boot
   // Additional disks can be created as an empty volume https://docs.nebius.com/compute/storage/manage#additional
   oneof source {
-    string source_image_id = 8 [(field_behavior) = IMMUTABLE];
+    string source_image_id = 8 [
+      (field_behavior) = IMMUTABLE,
+      (nid) = {
+        resource: ["computeimage"]
+      }
+    ];
 
     SourceImageFamily source_image_family = 10 [(field_behavior) = IMMUTABLE];
 
-    string source_snapshot_id = 13 [(field_behavior) = IMMUTABLE];
+    string source_snapshot_id = 13 [
+      (field_behavior) = IMMUTABLE,
+      (nid) = {
+        resource: ["computedisksnapshot"]
+      }
+    ];
   }
 
   // Defines how data on the disk is encrypted. By default, no encryption is applied.
@@ -82,7 +94,9 @@ message DiskSpec {
 message SourceImageFamily {
   string image_family = 1 [(buf.validate.field).required = true];
 
-  string parent_id = 2;
+  string parent_id = 2 [(nid) = {
+    resource: ["project"]
+  }];
 }
 
 message DiskStatus {
@@ -122,11 +136,17 @@ message DiskStatus {
   // Reassigned on disk detach, instance deletion, or ownership transfer.
   // Ownership transfer occurs when this disk is explicitly attached to another instance
   // or when a VM with this disk attached starts while the current owner is stopped.
-  string read_write_attachment = 3;
+  string read_write_attachment = 3 [(nid) = {
+    resource: ["computeinstance"]
+  }];
 
-  repeated string read_only_attachments = 4;
+  repeated string read_only_attachments = 4 [(nid) = {
+    resource: ["computeinstance"]
+  }];
 
-  string source_image_id = 5;
+  string source_image_id = 5 [(nid) = {
+    resource: ["computeimage"]
+  }];
 
   int64 size_bytes = 6;
 
@@ -140,11 +160,15 @@ message DiskStatus {
   message LockState {
     // Disk is locked for deletion and for read-write operations while image is being created.
     // Here is the list of these images.
-    repeated string images = 1;
+    repeated string images = 1 [(nid) = {
+      resource: ["computeimage"]
+    }];
 
     // Disk is locked only for deletion while snapshot is being created.
     // Here is the list of these snapshots.
-    repeated string snapshots = 2;
+    repeated string snapshots = 2 [(nid) = {
+      resource: ["computedisksnapshot"]
+    }];
   }
 
   // Indicates resources that prevent the disk from being attached as read-write.
@@ -154,7 +178,9 @@ message DiskStatus {
   // Set only for disks declared in the instance spec.
   // If set, the value is the instance ID that manages this disk's lifecycle (the disk is deleted when that instance is deleted).
   // To change this value, update the instance specification (see AttachedDiskSpec.type).
-  string managed_by = 12;
+  string managed_by = 12 [(nid) = {
+    resource: ["computeinstance"]
+  }];
 }
 
 message DiskEncryption {
diff --git a/nebius/compute/v1/disk_service.proto b/nebius/compute/v1/disk_service.proto
index 2949b0f..4f9a38b 100644
--- a/nebius/compute/v1/disk_service.proto
+++ b/nebius/compute/v1/disk_service.proto
@@ -38,15 +38,26 @@ service DiskService {
   rpc Delete(DeleteDiskRequest) returns (common.v1.Operation);
 
   // Lists all operations that were performed within a specific parent resource.
-  rpc ListOperationsByParent(ListOperationsByParentRequest) returns (common.v1.ListOperationsResponse);
+  rpc ListOperationsByParent(ListOperationsByParentRequest) returns (common.v1.ListOperationsResponse) {
+    option (request_fields) = {
+      field_path: "parent_id"
+      nid: {
+        resource: ["project"]
+      }
+    };
+  }
 }
 
 message GetDiskRequest {
-  string id = 1;
+  string id = 1 [(nid) = {
+    resource: ["computedisk"]
+  }];
 }
 
 message ListDisksRequest {
-  string parent_id = 1;
+  string parent_id = 1 [(nid) = {
+    resource: ["project"]
+  }];
 
   int64 page_size = 2;
 
@@ -62,19 +73,25 @@ message ListDisksRequest {
 }
 
 message CreateDiskRequest {
-  common.v1.ResourceMetadata metadata = 1;
+  common.v1.ResourceMetadata metadata = 1 [(nid) = {
+    parent_resource: ["project"]
+  }];
 
   DiskSpec spec = 2;
 }
 
 message UpdateDiskRequest {
-  common.v1.ResourceMetadata metadata = 1;
+  common.v1.ResourceMetadata metadata = 1 [(nid) = {
+    parent_resource: ["project"]
+  }];
 
   DiskSpec spec = 2;
 }
 
 message DeleteDiskRequest {
-  string id = 1;
+  string id = 1 [(nid) = {
+    resource: ["computedisk"]
+  }];
 }
 
 message ListDisksResponse {
diff --git a/nebius/vpc/v1/allocation.proto b/nebius/vpc/v1/allocation.proto
index b8a69af..d9efef7 100644
--- a/nebius/vpc/v1/allocation.proto
+++ b/nebius/vpc/v1/allocation.proto
@@ -58,29 +58,24 @@ message IPv4PrivateAllocationSpec {
     (field_behavior) = IMMUTABLE
   ];
 
+  // May be changed only from subnet_id to pool_id, and the new pool_id
+  // must be equal to status.details.pool_id.
   oneof pool {
     option (buf.validate.oneof).required = true;
-    option (oneof_behavior) = IMMUTABLE;
 
     // ID of the subnet that allocation will be associated with.
     // IP address of the allocation must be within a CIDR block associated
     // with this subnet.
     // In order to assign an allocation to a resource (i.e. network interface)
     // both must be associated with the same subnet.
-    string subnet_id = 2 [
-      (field_behavior) = IMMUTABLE,
-      (nid) = {
-        resource: ["vpcsubnet"]
-      }
-    ];
+    string subnet_id = 2 [(nid) = {
+      resource: ["vpcsubnet"]
+    }];
 
     // ID of the pool that allocation will receive its IP address from.
-    string pool_id = 3 [
-      (field_behavior) = IMMUTABLE,
-      (nid) = {
-        resource: ["vpcpool"]
-      }
-    ];
+    string pool_id = 3 [(nid) = {
+      resource: ["vpcpool"]
+    }];
   }
 }
 
@@ -104,29 +99,24 @@ message IPv4PublicAllocationSpec {
     (field_behavior) = IMMUTABLE
   ];
 
+  // May be changed only from subnet_id to pool_id, and the new pool_id
+  // must be equal to status.details.pool_id.
   oneof pool {
     option (buf.validate.oneof).required = true;
-    option (oneof_behavior) = IMMUTABLE;
 
     // ID of the subnet that allocation will be associated with.
     // IP address of the allocation must be within a CIDR block associated with
     // this subnet.
     // Assigning an allocation to a resource (i.e. network interface) requires
     // both to be associated with the same subnet.
-    string subnet_id = 2 [
-      (field_behavior) = IMMUTABLE,
-      (nid) = {
-        resource: ["vpcsubnet"]
-      }
-    ];
+    string subnet_id = 2 [(nid) = {
+      resource: ["vpcsubnet"]
+    }];
 
     // ID of the pool that allocation will receive its IP address from.
-    string pool_id = 3 [
-      (field_behavior) = IMMUTABLE,
-      (nid) = {
-        resource: ["vpcpool"]
-      }
-    ];
+    string pool_id = 3 [(nid) = {
+      resource: ["vpcpool"]
+    }];
   }
 }