diff --git a/proto/jumpstarter/client/v1/client.proto b/proto/jumpstarter/client/v1/client.proto
index 9c19531..34eb66e 100644
--- a/proto/jumpstarter/client/v1/client.proto
+++ b/proto/jumpstarter/client/v1/client.proto
@@ -28,6 +28,51 @@ service ClientService {
     option (google.api.http) = {get: "/v1/{parent=namespaces/*}/exporters"};
     option (google.api.method_signature) = "parent";
   }
+  rpc CreateExporter(CreateExporterRequest) returns (Exporter) {
+    option (google.api.http) = {
+      post: "/v1/{parent=namespaces/*}/exporters"
+      body: "exporter"
+    };
+    option (google.api.method_signature) = "parent,exporter,exporter_id";
+  }
+  rpc UpdateExporter(UpdateExporterRequest) returns (Exporter) {
+    option (google.api.http) = {
+      patch: "/v1/{exporter.name=namespaces/*/exporters/*}"
+      body: "exporter"
+    };
+    option (google.api.method_signature) = "exporter,update_mask";
+  }
+  rpc DeleteExporter(DeleteExporterRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/v1/{name=namespaces/*/exporters/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  rpc GetClient(GetClientRequest) returns (Client) {
+    option (google.api.http) = {get: "/v1/{name=namespaces/*/clients/*}"};
+    option (google.api.method_signature) = "name";
+  }
+  rpc ListClients(ListClientsRequest) returns (ListClientsResponse) {
+    option (google.api.http) = {get: "/v1/{parent=namespaces/*}/clients"};
+    option (google.api.method_signature) = "parent";
+  }
+  rpc CreateClient(CreateClientRequest) returns (Client) {
+    option (google.api.http) = {
+      post: "/v1/{parent=namespaces/*}/clients"
+      body: "client"
+    };
+    option (google.api.method_signature) = "parent,client,client_id";
+  }
+  rpc UpdateClient(UpdateClientRequest) returns (Client) {
+    option (google.api.http) = {
+      patch: "/v1/{client.name=namespaces/*/clients/*}"
+      body: "client"
+    };
+    option (google.api.method_signature) = "client,update_mask";
+  }
+  rpc DeleteClient(DeleteClientRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/v1/{name=namespaces/*/clients/*}"};
+    option (google.api.method_signature) = "name";
+  }
 
   rpc GetLease(GetLeaseRequest) returns (Lease) {
     option (google.api.http) = {get: "/v1/{name=namespaces/*/leases/*}"};
@@ -66,7 +111,22 @@ message Exporter {
   };
 
   string name = 1 [(google.api.field_behavior) = IDENTIFIER];
-  map<string, string> labels = 2;
+  map<string, string> labels = 2 [(google.api.field_behavior) = REQUIRED];
+  optional string username = 3;
+}
+
+message Client {
+  option (google.api.resource) = {
+    type: "jumpstarter.dev/Client"
+    pattern: "namespaces/{namespace}/clients/{client}"
+    singular: "client"
+    plural: "clients"
+  };
+
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+  map<string, string> labels = 2 [(google.api.field_behavior) = REQUIRED];
+  bool admin = 3 [(google.api.field_behavior) = OPTIONAL];
+  optional string username = 4;
 }
 
 message Lease {
@@ -122,6 +182,72 @@ message ListExportersResponse {
   string next_page_token = 2;
 }
 
+message CreateExporterRequest {
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {child_type: "jumpstarter.dev/Exporter"}
+  ];
+
+  string exporter_id = 2 [(google.api.field_behavior) = OPTIONAL];
+  Exporter exporter = 3 [(google.api.field_behavior) = REQUIRED];
+}
+
+message UpdateExporterRequest {
+  Exporter exporter = 1 [(google.api.field_behavior) = REQUIRED];
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message DeleteExporterRequest {
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "jumpstarter.dev/Exporter"}
+  ];
+}
+
+message GetClientRequest {
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "jumpstarter.dev/Client"}
+  ];
+}
+
+message ListClientsRequest {
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {child_type: "jumpstarter.dev/Client"}
+  ];
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+  string filter = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListClientsResponse {
+  repeated Client clients = 1;
+  string next_page_token = 2;
+}
+
+message CreateClientRequest {
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {child_type: "jumpstarter.dev/Client"}
+  ];
+
+  string client_id = 2 [(google.api.field_behavior) = OPTIONAL];
+  Client client = 3 [(google.api.field_behavior) = REQUIRED];
+}
+
+message UpdateClientRequest {
+  Client client = 1 [(google.api.field_behavior) = REQUIRED];
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message DeleteClientRequest {
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "jumpstarter.dev/Client"}
+  ];
+}
+
 message GetLeaseRequest {
   string name = 1 [
     (google.api.field_behavior) = REQUIRED,