diff --git a/components/public-api/gitpod/experimental/v1/user.proto b/components/public-api/gitpod/experimental/v1/user.proto
index f69c5907b93ed8..6f3be20a08a12f 100644
--- a/components/public-api/gitpod/experimental/v1/user.proto
+++ b/components/public-api/gitpod/experimental/v1/user.proto
@@ -38,7 +38,6 @@ service UserService {
     // GetAuthenticatedUser gets the user info.
     rpc GetAuthenticatedUser(GetAuthenticatedUserRequest) returns (GetAuthenticatedUserResponse) {};
 
-
     // ListSSHKeys lists the public SSH keys.
     rpc ListSSHKeys(ListSSHKeysRequest) returns (ListSSHKeysResponse) {};
 
@@ -50,6 +49,8 @@ service UserService {
 
     // DeleteSSHKey removes a public SSH key.
     rpc DeleteSSHKey(DeleteSSHKeyRequest) returns (DeleteSSHKeyResponse) {}
+
+    rpc GetGitToken(GetGitTokenRequest) returns (GetGitTokenResponse) {}
 }
 
 message GetAuthenticatedUserRequest {
@@ -96,3 +97,34 @@ message DeleteSSHKeyRequest {
 
 message DeleteSSHKeyResponse {
 }
+
+message GetGitTokenRequest {
+    string host = 1;
+}
+
+message GetGitTokenResponse {
+    GitToken token = 1;
+}
+
+message GitToken {
+    // expiry_date is the date when the token will expire
+    string expiry_date = 1;
+
+    // id_token is the unique identifier for the token
+    string id_token = 2;
+
+    // refresh_token is the token used to refresh the git token
+    string refresh_token = 3;
+
+    // scopes is a list of permissions associated with the token
+    repeated string scopes = 4;
+
+    // update_date is the date when the token was last updated
+    string update_date = 5;
+
+    // username is the username associated with the token
+    string username = 6;
+
+    // value is the actual token value for the token
+    string value = 7;
+}
diff --git a/components/public-api/gitpod/experimental/v1/workspaces.proto b/components/public-api/gitpod/experimental/v1/workspaces.proto
index 385838f75ac381..52d81f6ba19d2b 100644
--- a/components/public-api/gitpod/experimental/v1/workspaces.proto
+++ b/components/public-api/gitpod/experimental/v1/workspaces.proto
@@ -27,6 +27,8 @@ service WorkspacesService {
     //   NOT_FOUND:           the workspace_id is unkown
     //   FAILED_PRECONDITION: if there's no running instance
     rpc StopWorkspace(StopWorkspaceRequest) returns (stream StopWorkspaceResponse) {}
+
+    rpc UpdatePort(UpdatePortRequest) returns (UpdatePortResponse) {}
 }
 
 message ListWorkspacesRequest {
@@ -249,12 +251,37 @@ message WorkspaceInstanceStatus {
     // Admission describes who can access a workspace instance and its ports.
     AdmissionLevel admission = 6;
 
+    // ports is the list of exposed ports in the workspace.
+    repeated Port ports = 7;
+
     // repo details the Git working copy status of the workspace.
     // Note: this is a best-effort field and more often than not will not be present. Its absence does not
     // indicate the absence of a working copy.
     // contentservice.GitStatus repo = 7;
 }
 
+// PortPolicy defines the accssbility policy of a workspace port is guarded by an authentication in the proxy
+enum PortPolicy {
+    PORT_POLICY_UNSPECIFIED = 0;
+
+    // Private means the port is accessible by the workspace owner only using the workspace port URL
+    PORT_POLICY_PRIVATE = 1;
+
+    // Public means the port is accessible by everybody using the workspace port URL
+    PORT_POLICY_PUBLIC = 2;
+}
+
+message Port {
+    // port number
+    uint64 port = 1;
+
+    // policy of this port
+    PortPolicy policy = 2;
+
+    // url that can be used to access the port
+    string url = 3;
+}
+
 // Admission level describes who can access a workspace instance and its ports.
 enum AdmissionLevel {
     ADMISSION_LEVEL_UNSPECIFIED = 0;
@@ -270,3 +297,18 @@ enum AdmissionLevel {
 message StartWorkspaceSpec {
     // future per-workspace-start fields, e.g. region
 }
+
+message PortSpec {
+    // port number
+    uint64 port = 1;
+
+    // policy of this port
+    PortPolicy policy = 2;
+}
+
+message UpdatePortRequest {
+    string workspace_id = 1;
+    PortSpec port = 2;
+}
+
+message UpdatePortResponse {}
diff --git a/components/public-api/go/experimental/v1/user.pb.go b/components/public-api/go/experimental/v1/user.pb.go
index 2ef01a1a4f56cd..40722d3c71dcd5 100644
--- a/components/public-api/go/experimental/v1/user.pb.go
+++ b/components/public-api/go/experimental/v1/user.pb.go
@@ -630,6 +630,202 @@ func (*DeleteSSHKeyResponse) Descriptor() ([]byte, []int) {
 	return file_gitpod_experimental_v1_user_proto_rawDescGZIP(), []int{11}
 }
 
+type GetGitTokenRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+}
+
+func (x *GetGitTokenRequest) Reset() {
+	*x = GetGitTokenRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_gitpod_experimental_v1_user_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetGitTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetGitTokenRequest) ProtoMessage() {}
+
+func (x *GetGitTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_gitpod_experimental_v1_user_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetGitTokenRequest.ProtoReflect.Descriptor instead.
+func (*GetGitTokenRequest) Descriptor() ([]byte, []int) {
+	return file_gitpod_experimental_v1_user_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *GetGitTokenRequest) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+type GetGitTokenResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Token *GitToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+}
+
+func (x *GetGitTokenResponse) Reset() {
+	*x = GetGitTokenResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_gitpod_experimental_v1_user_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetGitTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetGitTokenResponse) ProtoMessage() {}
+
+func (x *GetGitTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_gitpod_experimental_v1_user_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetGitTokenResponse.ProtoReflect.Descriptor instead.
+func (*GetGitTokenResponse) Descriptor() ([]byte, []int) {
+	return file_gitpod_experimental_v1_user_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *GetGitTokenResponse) GetToken() *GitToken {
+	if x != nil {
+		return x.Token
+	}
+	return nil
+}
+
+type GitToken struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// expiry_date is the date when the token will expire
+	ExpiryDate string `protobuf:"bytes,1,opt,name=expiry_date,json=expiryDate,proto3" json:"expiry_date,omitempty"`
+	// id_token is the unique identifier for the token
+	IdToken string `protobuf:"bytes,2,opt,name=id_token,json=idToken,proto3" json:"id_token,omitempty"`
+	// refresh_token is the token used to refresh the git token
+	RefreshToken string `protobuf:"bytes,3,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
+	// scopes is a list of permissions associated with the token
+	Scopes []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"`
+	// update_date is the date when the token was last updated
+	UpdateDate string `protobuf:"bytes,5,opt,name=update_date,json=updateDate,proto3" json:"update_date,omitempty"`
+	// username is the username associated with the token
+	Username string `protobuf:"bytes,6,opt,name=username,proto3" json:"username,omitempty"`
+	// value is the actual token value for the token
+	Value string `protobuf:"bytes,7,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *GitToken) Reset() {
+	*x = GitToken{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_gitpod_experimental_v1_user_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GitToken) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GitToken) ProtoMessage() {}
+
+func (x *GitToken) ProtoReflect() protoreflect.Message {
+	mi := &file_gitpod_experimental_v1_user_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GitToken.ProtoReflect.Descriptor instead.
+func (*GitToken) Descriptor() ([]byte, []int) {
+	return file_gitpod_experimental_v1_user_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *GitToken) GetExpiryDate() string {
+	if x != nil {
+		return x.ExpiryDate
+	}
+	return ""
+}
+
+func (x *GitToken) GetIdToken() string {
+	if x != nil {
+		return x.IdToken
+	}
+	return ""
+}
+
+func (x *GitToken) GetRefreshToken() string {
+	if x != nil {
+		return x.RefreshToken
+	}
+	return ""
+}
+
+func (x *GitToken) GetScopes() []string {
+	if x != nil {
+		return x.Scopes
+	}
+	return nil
+}
+
+func (x *GitToken) GetUpdateDate() string {
+	if x != nil {
+		return x.UpdateDate
+	}
+	return ""
+}
+
+func (x *GitToken) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *GitToken) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
 var File_gitpod_experimental_v1_user_proto protoreflect.FileDescriptor
 
 var file_gitpod_experimental_v1_user_proto_rawDesc = []byte{
@@ -687,48 +883,76 @@ var file_gitpod_experimental_v1_user_proto_rawDesc = []byte{
 	0x65, 0x74, 0x65, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
 	0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x16, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32,
-	0xbb, 0x04, 0x0a, 0x0b, 0x55, 0x73, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
-	0x83, 0x01, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x12, 0x33, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f,
-	0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x34, 0x2e,
-	0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
-	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
-	0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x68, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x53, 0x48,
-	0x4b, 0x65, 0x79, 0x73, 0x12, 0x2a, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78,
-	0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69,
-	0x73, 0x74, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x2b, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69,
-	0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x53,
-	0x48, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x6b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x12,
-	0x2b, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d,
-	0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53,
-	0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x67,
-	0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
-	0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x53, 0x48, 0x4b,
-	0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x62, 0x0a, 0x09,
-	0x47, 0x65, 0x74, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x12, 0x28, 0x2e, 0x67, 0x69, 0x74, 0x70,
-	0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70,
-	0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
-	0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x6b, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79,
-	0x12, 0x2b, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69,
-	0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e,
-	0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
-	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x53, 0x48,
-	0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x46, 0x5a,
-	0x44, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74, 0x70,
-	0x6f, 0x64, 0x2d, 0x69, 0x6f, 0x2f, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2f, 0x63, 0x6f, 0x6d,
-	0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2d, 0x61,
-	0x70, 0x69, 0x2f, 0x67, 0x6f, 0x2f, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
-	0x61, 0x6c, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x28, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x47, 0x69, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x22, 0x4d, 0x0a, 0x13, 0x47, 0x65, 0x74,
+	0x47, 0x69, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x36, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x20, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d,
+	0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x69, 0x74, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xd6, 0x01, 0x0a, 0x08, 0x47, 0x69, 0x74,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x5f,
+	0x64, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x78, 0x70, 0x69,
+	0x72, 0x79, 0x44, 0x61, 0x74, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x69, 0x64, 0x5f, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x69, 0x64, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73,
+	0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73,
+	0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x12, 0x1f,
+	0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x64, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x65, 0x12,
+	0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x32, 0xa5, 0x05, 0x0a, 0x0b, 0x55, 0x73, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x12, 0x83, 0x01, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x12, 0x33, 0x2e, 0x67, 0x69, 0x74,
+	0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c,
+	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x34, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d,
+	0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68,
+	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x68, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x53,
+	0x53, 0x48, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x2a, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e,
+	0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e,
+	0x4c, 0x69, 0x73, 0x74, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65,
+	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x6b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x53, 0x48, 0x4b, 0x65,
+	0x79, 0x12, 0x2b, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72,
+	0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c,
+	0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65,
+	0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x53,
+	0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x62,
+	0x0a, 0x09, 0x47, 0x65, 0x74, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x12, 0x28, 0x2e, 0x67, 0x69,
+	0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61,
+	0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65,
+	0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47,
+	0x65, 0x74, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x6b, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x53, 0x48, 0x4b,
+	0x65, 0x79, 0x12, 0x2b, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65,
+	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x53, 0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x2c, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d,
+	0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53,
+	0x53, 0x48, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x68, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x47, 0x69, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2a,
+	0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65,
+	0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x47, 0x69, 0x74, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x67, 0x69, 0x74,
+	0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c,
+	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x47, 0x69, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x46, 0x5a, 0x44, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2d, 0x69,
+	0x6f, 0x2f, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2f, 0x63, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65,
+	0x6e, 0x74, 0x73, 0x2f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2d, 0x61, 0x70, 0x69, 0x2f, 0x67,
+	0x6f, 0x2f, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2f, 0x76,
+	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -743,7 +967,7 @@ func file_gitpod_experimental_v1_user_proto_rawDescGZIP() []byte {
 	return file_gitpod_experimental_v1_user_proto_rawDescData
 }
 
-var file_gitpod_experimental_v1_user_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_gitpod_experimental_v1_user_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
 var file_gitpod_experimental_v1_user_proto_goTypes = []interface{}{
 	(*User)(nil),                         // 0: gitpod.experimental.v1.User
 	(*SSHKey)(nil),                       // 1: gitpod.experimental.v1.SSHKey
@@ -757,30 +981,36 @@ var file_gitpod_experimental_v1_user_proto_goTypes = []interface{}{
 	(*GetSSHKeyResponse)(nil),            // 9: gitpod.experimental.v1.GetSSHKeyResponse
 	(*DeleteSSHKeyRequest)(nil),          // 10: gitpod.experimental.v1.DeleteSSHKeyRequest
 	(*DeleteSSHKeyResponse)(nil),         // 11: gitpod.experimental.v1.DeleteSSHKeyResponse
-	(*timestamppb.Timestamp)(nil),        // 12: google.protobuf.Timestamp
+	(*GetGitTokenRequest)(nil),           // 12: gitpod.experimental.v1.GetGitTokenRequest
+	(*GetGitTokenResponse)(nil),          // 13: gitpod.experimental.v1.GetGitTokenResponse
+	(*GitToken)(nil),                     // 14: gitpod.experimental.v1.GitToken
+	(*timestamppb.Timestamp)(nil),        // 15: google.protobuf.Timestamp
 }
 var file_gitpod_experimental_v1_user_proto_depIdxs = []int32{
-	12, // 0: gitpod.experimental.v1.User.created_at:type_name -> google.protobuf.Timestamp
-	12, // 1: gitpod.experimental.v1.SSHKey.created_at:type_name -> google.protobuf.Timestamp
+	15, // 0: gitpod.experimental.v1.User.created_at:type_name -> google.protobuf.Timestamp
+	15, // 1: gitpod.experimental.v1.SSHKey.created_at:type_name -> google.protobuf.Timestamp
 	0,  // 2: gitpod.experimental.v1.GetAuthenticatedUserResponse.user:type_name -> gitpod.experimental.v1.User
 	1,  // 3: gitpod.experimental.v1.ListSSHKeysResponse.keys:type_name -> gitpod.experimental.v1.SSHKey
 	1,  // 4: gitpod.experimental.v1.CreateSSHKeyResponse.key:type_name -> gitpod.experimental.v1.SSHKey
 	1,  // 5: gitpod.experimental.v1.GetSSHKeyResponse.key:type_name -> gitpod.experimental.v1.SSHKey
-	2,  // 6: gitpod.experimental.v1.UserService.GetAuthenticatedUser:input_type -> gitpod.experimental.v1.GetAuthenticatedUserRequest
-	4,  // 7: gitpod.experimental.v1.UserService.ListSSHKeys:input_type -> gitpod.experimental.v1.ListSSHKeysRequest
-	6,  // 8: gitpod.experimental.v1.UserService.CreateSSHKey:input_type -> gitpod.experimental.v1.CreateSSHKeyRequest
-	8,  // 9: gitpod.experimental.v1.UserService.GetSSHKey:input_type -> gitpod.experimental.v1.GetSSHKeyRequest
-	10, // 10: gitpod.experimental.v1.UserService.DeleteSSHKey:input_type -> gitpod.experimental.v1.DeleteSSHKeyRequest
-	3,  // 11: gitpod.experimental.v1.UserService.GetAuthenticatedUser:output_type -> gitpod.experimental.v1.GetAuthenticatedUserResponse
-	5,  // 12: gitpod.experimental.v1.UserService.ListSSHKeys:output_type -> gitpod.experimental.v1.ListSSHKeysResponse
-	7,  // 13: gitpod.experimental.v1.UserService.CreateSSHKey:output_type -> gitpod.experimental.v1.CreateSSHKeyResponse
-	9,  // 14: gitpod.experimental.v1.UserService.GetSSHKey:output_type -> gitpod.experimental.v1.GetSSHKeyResponse
-	11, // 15: gitpod.experimental.v1.UserService.DeleteSSHKey:output_type -> gitpod.experimental.v1.DeleteSSHKeyResponse
-	11, // [11:16] is the sub-list for method output_type
-	6,  // [6:11] is the sub-list for method input_type
-	6,  // [6:6] is the sub-list for extension type_name
-	6,  // [6:6] is the sub-list for extension extendee
-	0,  // [0:6] is the sub-list for field type_name
+	14, // 6: gitpod.experimental.v1.GetGitTokenResponse.token:type_name -> gitpod.experimental.v1.GitToken
+	2,  // 7: gitpod.experimental.v1.UserService.GetAuthenticatedUser:input_type -> gitpod.experimental.v1.GetAuthenticatedUserRequest
+	4,  // 8: gitpod.experimental.v1.UserService.ListSSHKeys:input_type -> gitpod.experimental.v1.ListSSHKeysRequest
+	6,  // 9: gitpod.experimental.v1.UserService.CreateSSHKey:input_type -> gitpod.experimental.v1.CreateSSHKeyRequest
+	8,  // 10: gitpod.experimental.v1.UserService.GetSSHKey:input_type -> gitpod.experimental.v1.GetSSHKeyRequest
+	10, // 11: gitpod.experimental.v1.UserService.DeleteSSHKey:input_type -> gitpod.experimental.v1.DeleteSSHKeyRequest
+	12, // 12: gitpod.experimental.v1.UserService.GetGitToken:input_type -> gitpod.experimental.v1.GetGitTokenRequest
+	3,  // 13: gitpod.experimental.v1.UserService.GetAuthenticatedUser:output_type -> gitpod.experimental.v1.GetAuthenticatedUserResponse
+	5,  // 14: gitpod.experimental.v1.UserService.ListSSHKeys:output_type -> gitpod.experimental.v1.ListSSHKeysResponse
+	7,  // 15: gitpod.experimental.v1.UserService.CreateSSHKey:output_type -> gitpod.experimental.v1.CreateSSHKeyResponse
+	9,  // 16: gitpod.experimental.v1.UserService.GetSSHKey:output_type -> gitpod.experimental.v1.GetSSHKeyResponse
+	11, // 17: gitpod.experimental.v1.UserService.DeleteSSHKey:output_type -> gitpod.experimental.v1.DeleteSSHKeyResponse
+	13, // 18: gitpod.experimental.v1.UserService.GetGitToken:output_type -> gitpod.experimental.v1.GetGitTokenResponse
+	13, // [13:19] is the sub-list for method output_type
+	7,  // [7:13] is the sub-list for method input_type
+	7,  // [7:7] is the sub-list for extension type_name
+	7,  // [7:7] is the sub-list for extension extendee
+	0,  // [0:7] is the sub-list for field type_name
 }
 
 func init() { file_gitpod_experimental_v1_user_proto_init() }
@@ -933,6 +1163,42 @@ func file_gitpod_experimental_v1_user_proto_init() {
 				return nil
 			}
 		}
+		file_gitpod_experimental_v1_user_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetGitTokenRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_gitpod_experimental_v1_user_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetGitTokenResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_gitpod_experimental_v1_user_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GitToken); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -940,7 +1206,7 @@ func file_gitpod_experimental_v1_user_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_gitpod_experimental_v1_user_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   12,
+			NumMessages:   15,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/components/public-api/go/experimental/v1/user_grpc.pb.go b/components/public-api/go/experimental/v1/user_grpc.pb.go
index 99adc452ba39be..a6d87efc2bf7e0 100644
--- a/components/public-api/go/experimental/v1/user_grpc.pb.go
+++ b/components/public-api/go/experimental/v1/user_grpc.pb.go
@@ -36,6 +36,7 @@ type UserServiceClient interface {
 	GetSSHKey(ctx context.Context, in *GetSSHKeyRequest, opts ...grpc.CallOption) (*GetSSHKeyResponse, error)
 	// DeleteSSHKey removes a public SSH key.
 	DeleteSSHKey(ctx context.Context, in *DeleteSSHKeyRequest, opts ...grpc.CallOption) (*DeleteSSHKeyResponse, error)
+	GetGitToken(ctx context.Context, in *GetGitTokenRequest, opts ...grpc.CallOption) (*GetGitTokenResponse, error)
 }
 
 type userServiceClient struct {
@@ -91,6 +92,15 @@ func (c *userServiceClient) DeleteSSHKey(ctx context.Context, in *DeleteSSHKeyRe
 	return out, nil
 }
 
+func (c *userServiceClient) GetGitToken(ctx context.Context, in *GetGitTokenRequest, opts ...grpc.CallOption) (*GetGitTokenResponse, error) {
+	out := new(GetGitTokenResponse)
+	err := c.cc.Invoke(ctx, "/gitpod.experimental.v1.UserService/GetGitToken", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // UserServiceServer is the server API for UserService service.
 // All implementations must embed UnimplementedUserServiceServer
 // for forward compatibility
@@ -105,6 +115,7 @@ type UserServiceServer interface {
 	GetSSHKey(context.Context, *GetSSHKeyRequest) (*GetSSHKeyResponse, error)
 	// DeleteSSHKey removes a public SSH key.
 	DeleteSSHKey(context.Context, *DeleteSSHKeyRequest) (*DeleteSSHKeyResponse, error)
+	GetGitToken(context.Context, *GetGitTokenRequest) (*GetGitTokenResponse, error)
 	mustEmbedUnimplementedUserServiceServer()
 }
 
@@ -127,6 +138,9 @@ func (UnimplementedUserServiceServer) GetSSHKey(context.Context, *GetSSHKeyReque
 func (UnimplementedUserServiceServer) DeleteSSHKey(context.Context, *DeleteSSHKeyRequest) (*DeleteSSHKeyResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteSSHKey not implemented")
 }
+func (UnimplementedUserServiceServer) GetGitToken(context.Context, *GetGitTokenRequest) (*GetGitTokenResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetGitToken not implemented")
+}
 func (UnimplementedUserServiceServer) mustEmbedUnimplementedUserServiceServer() {}
 
 // UnsafeUserServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -230,6 +244,24 @@ func _UserService_DeleteSSHKey_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
+func _UserService_GetGitToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetGitTokenRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UserServiceServer).GetGitToken(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/gitpod.experimental.v1.UserService/GetGitToken",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UserServiceServer).GetGitToken(ctx, req.(*GetGitTokenRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // UserService_ServiceDesc is the grpc.ServiceDesc for UserService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -257,6 +289,10 @@ var UserService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteSSHKey",
 			Handler:    _UserService_DeleteSSHKey_Handler,
 		},
+		{
+			MethodName: "GetGitToken",
+			Handler:    _UserService_GetGitToken_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "gitpod/experimental/v1/user.proto",
diff --git a/components/public-api/go/experimental/v1/v1connect/user.connect.go b/components/public-api/go/experimental/v1/v1connect/user.connect.go
index 4dcc7030d6e623..acb06cfda65a62 100644
--- a/components/public-api/go/experimental/v1/v1connect/user.connect.go
+++ b/components/public-api/go/experimental/v1/v1connect/user.connect.go
@@ -41,6 +41,7 @@ type UserServiceClient interface {
 	GetSSHKey(context.Context, *connect_go.Request[v1.GetSSHKeyRequest]) (*connect_go.Response[v1.GetSSHKeyResponse], error)
 	// DeleteSSHKey removes a public SSH key.
 	DeleteSSHKey(context.Context, *connect_go.Request[v1.DeleteSSHKeyRequest]) (*connect_go.Response[v1.DeleteSSHKeyResponse], error)
+	GetGitToken(context.Context, *connect_go.Request[v1.GetGitTokenRequest]) (*connect_go.Response[v1.GetGitTokenResponse], error)
 }
 
 // NewUserServiceClient constructs a client for the gitpod.experimental.v1.UserService service. By
@@ -78,6 +79,11 @@ func NewUserServiceClient(httpClient connect_go.HTTPClient, baseURL string, opts
 			baseURL+"/gitpod.experimental.v1.UserService/DeleteSSHKey",
 			opts...,
 		),
+		getGitToken: connect_go.NewClient[v1.GetGitTokenRequest, v1.GetGitTokenResponse](
+			httpClient,
+			baseURL+"/gitpod.experimental.v1.UserService/GetGitToken",
+			opts...,
+		),
 	}
 }
 
@@ -88,6 +94,7 @@ type userServiceClient struct {
 	createSSHKey         *connect_go.Client[v1.CreateSSHKeyRequest, v1.CreateSSHKeyResponse]
 	getSSHKey            *connect_go.Client[v1.GetSSHKeyRequest, v1.GetSSHKeyResponse]
 	deleteSSHKey         *connect_go.Client[v1.DeleteSSHKeyRequest, v1.DeleteSSHKeyResponse]
+	getGitToken          *connect_go.Client[v1.GetGitTokenRequest, v1.GetGitTokenResponse]
 }
 
 // GetAuthenticatedUser calls gitpod.experimental.v1.UserService.GetAuthenticatedUser.
@@ -115,6 +122,11 @@ func (c *userServiceClient) DeleteSSHKey(ctx context.Context, req *connect_go.Re
 	return c.deleteSSHKey.CallUnary(ctx, req)
 }
 
+// GetGitToken calls gitpod.experimental.v1.UserService.GetGitToken.
+func (c *userServiceClient) GetGitToken(ctx context.Context, req *connect_go.Request[v1.GetGitTokenRequest]) (*connect_go.Response[v1.GetGitTokenResponse], error) {
+	return c.getGitToken.CallUnary(ctx, req)
+}
+
 // UserServiceHandler is an implementation of the gitpod.experimental.v1.UserService service.
 type UserServiceHandler interface {
 	// GetAuthenticatedUser gets the user info.
@@ -127,6 +139,7 @@ type UserServiceHandler interface {
 	GetSSHKey(context.Context, *connect_go.Request[v1.GetSSHKeyRequest]) (*connect_go.Response[v1.GetSSHKeyResponse], error)
 	// DeleteSSHKey removes a public SSH key.
 	DeleteSSHKey(context.Context, *connect_go.Request[v1.DeleteSSHKeyRequest]) (*connect_go.Response[v1.DeleteSSHKeyResponse], error)
+	GetGitToken(context.Context, *connect_go.Request[v1.GetGitTokenRequest]) (*connect_go.Response[v1.GetGitTokenResponse], error)
 }
 
 // NewUserServiceHandler builds an HTTP handler from the service implementation. It returns the path
@@ -161,6 +174,11 @@ func NewUserServiceHandler(svc UserServiceHandler, opts ...connect_go.HandlerOpt
 		svc.DeleteSSHKey,
 		opts...,
 	))
+	mux.Handle("/gitpod.experimental.v1.UserService/GetGitToken", connect_go.NewUnaryHandler(
+		"/gitpod.experimental.v1.UserService/GetGitToken",
+		svc.GetGitToken,
+		opts...,
+	))
 	return "/gitpod.experimental.v1.UserService/", mux
 }
 
@@ -186,3 +204,7 @@ func (UnimplementedUserServiceHandler) GetSSHKey(context.Context, *connect_go.Re
 func (UnimplementedUserServiceHandler) DeleteSSHKey(context.Context, *connect_go.Request[v1.DeleteSSHKeyRequest]) (*connect_go.Response[v1.DeleteSSHKeyResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("gitpod.experimental.v1.UserService.DeleteSSHKey is not implemented"))
 }
+
+func (UnimplementedUserServiceHandler) GetGitToken(context.Context, *connect_go.Request[v1.GetGitTokenRequest]) (*connect_go.Response[v1.GetGitTokenResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("gitpod.experimental.v1.UserService.GetGitToken is not implemented"))
+}
diff --git a/components/public-api/go/experimental/v1/v1connect/workspaces.connect.go b/components/public-api/go/experimental/v1/v1connect/workspaces.connect.go
index 5155527950185c..35ceecab97f271 100644
--- a/components/public-api/go/experimental/v1/v1connect/workspaces.connect.go
+++ b/components/public-api/go/experimental/v1/v1connect/workspaces.connect.go
@@ -45,6 +45,7 @@ type WorkspacesServiceClient interface {
 	//	NOT_FOUND:           the workspace_id is unkown
 	//	FAILED_PRECONDITION: if there's no running instance
 	StopWorkspace(context.Context, *connect_go.Request[v1.StopWorkspaceRequest]) (*connect_go.ServerStreamForClient[v1.StopWorkspaceResponse], error)
+	UpdatePort(context.Context, *connect_go.Request[v1.UpdatePortRequest]) (*connect_go.Response[v1.UpdatePortResponse], error)
 }
 
 // NewWorkspacesServiceClient constructs a client for the gitpod.experimental.v1.WorkspacesService
@@ -82,6 +83,11 @@ func NewWorkspacesServiceClient(httpClient connect_go.HTTPClient, baseURL string
 			baseURL+"/gitpod.experimental.v1.WorkspacesService/StopWorkspace",
 			opts...,
 		),
+		updatePort: connect_go.NewClient[v1.UpdatePortRequest, v1.UpdatePortResponse](
+			httpClient,
+			baseURL+"/gitpod.experimental.v1.WorkspacesService/UpdatePort",
+			opts...,
+		),
 	}
 }
 
@@ -92,6 +98,7 @@ type workspacesServiceClient struct {
 	getOwnerToken           *connect_go.Client[v1.GetOwnerTokenRequest, v1.GetOwnerTokenResponse]
 	createAndStartWorkspace *connect_go.Client[v1.CreateAndStartWorkspaceRequest, v1.CreateAndStartWorkspaceResponse]
 	stopWorkspace           *connect_go.Client[v1.StopWorkspaceRequest, v1.StopWorkspaceResponse]
+	updatePort              *connect_go.Client[v1.UpdatePortRequest, v1.UpdatePortResponse]
 }
 
 // ListWorkspaces calls gitpod.experimental.v1.WorkspacesService.ListWorkspaces.
@@ -119,6 +126,11 @@ func (c *workspacesServiceClient) StopWorkspace(ctx context.Context, req *connec
 	return c.stopWorkspace.CallServerStream(ctx, req)
 }
 
+// UpdatePort calls gitpod.experimental.v1.WorkspacesService.UpdatePort.
+func (c *workspacesServiceClient) UpdatePort(ctx context.Context, req *connect_go.Request[v1.UpdatePortRequest]) (*connect_go.Response[v1.UpdatePortResponse], error) {
+	return c.updatePort.CallUnary(ctx, req)
+}
+
 // WorkspacesServiceHandler is an implementation of the gitpod.experimental.v1.WorkspacesService
 // service.
 type WorkspacesServiceHandler interface {
@@ -136,6 +148,7 @@ type WorkspacesServiceHandler interface {
 	//	NOT_FOUND:           the workspace_id is unkown
 	//	FAILED_PRECONDITION: if there's no running instance
 	StopWorkspace(context.Context, *connect_go.Request[v1.StopWorkspaceRequest], *connect_go.ServerStream[v1.StopWorkspaceResponse]) error
+	UpdatePort(context.Context, *connect_go.Request[v1.UpdatePortRequest]) (*connect_go.Response[v1.UpdatePortResponse], error)
 }
 
 // NewWorkspacesServiceHandler builds an HTTP handler from the service implementation. It returns
@@ -170,6 +183,11 @@ func NewWorkspacesServiceHandler(svc WorkspacesServiceHandler, opts ...connect_g
 		svc.StopWorkspace,
 		opts...,
 	))
+	mux.Handle("/gitpod.experimental.v1.WorkspacesService/UpdatePort", connect_go.NewUnaryHandler(
+		"/gitpod.experimental.v1.WorkspacesService/UpdatePort",
+		svc.UpdatePort,
+		opts...,
+	))
 	return "/gitpod.experimental.v1.WorkspacesService/", mux
 }
 
@@ -195,3 +213,7 @@ func (UnimplementedWorkspacesServiceHandler) CreateAndStartWorkspace(context.Con
 func (UnimplementedWorkspacesServiceHandler) StopWorkspace(context.Context, *connect_go.Request[v1.StopWorkspaceRequest], *connect_go.ServerStream[v1.StopWorkspaceResponse]) error {
 	return connect_go.NewError(connect_go.CodeUnimplemented, errors.New("gitpod.experimental.v1.WorkspacesService.StopWorkspace is not implemented"))
 }
+
+func (UnimplementedWorkspacesServiceHandler) UpdatePort(context.Context, *connect_go.Request[v1.UpdatePortRequest]) (*connect_go.Response[v1.UpdatePortResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("gitpod.experimental.v1.WorkspacesService.UpdatePort is not implemented"))
+}
diff --git a/components/public-api/go/experimental/v1/workspaces.pb.go b/components/public-api/go/experimental/v1/workspaces.pb.go
index 3eb801a33f0ace..b89387b1a2d440 100644
--- a/components/public-api/go/experimental/v1/workspaces.pb.go
+++ b/components/public-api/go/experimental/v1/workspaces.pb.go
@@ -26,6 +26,58 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+// PortPolicy defines the accssbility policy of a workspace port is guarded by an authentication in the proxy
+type PortPolicy int32
+
+const (
+	PortPolicy_PORT_POLICY_UNSPECIFIED PortPolicy = 0
+	// Private means the port is accessible by the workspace owner only using the workspace port URL
+	PortPolicy_PORT_POLICY_PRIVATE PortPolicy = 1
+	// Public means the port is accessible by everybody using the workspace port URL
+	PortPolicy_PORT_POLICY_PUBLIC PortPolicy = 2
+)
+
+// Enum value maps for PortPolicy.
+var (
+	PortPolicy_name = map[int32]string{
+		0: "PORT_POLICY_UNSPECIFIED",
+		1: "PORT_POLICY_PRIVATE",
+		2: "PORT_POLICY_PUBLIC",
+	}
+	PortPolicy_value = map[string]int32{
+		"PORT_POLICY_UNSPECIFIED": 0,
+		"PORT_POLICY_PRIVATE":     1,
+		"PORT_POLICY_PUBLIC":      2,
+	}
+)
+
+func (x PortPolicy) Enum() *PortPolicy {
+	p := new(PortPolicy)
+	*p = x
+	return p
+}
+
+func (x PortPolicy) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PortPolicy) Descriptor() protoreflect.EnumDescriptor {
+	return file_gitpod_experimental_v1_workspaces_proto_enumTypes[0].Descriptor()
+}
+
+func (PortPolicy) Type() protoreflect.EnumType {
+	return &file_gitpod_experimental_v1_workspaces_proto_enumTypes[0]
+}
+
+func (x PortPolicy) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PortPolicy.Descriptor instead.
+func (PortPolicy) EnumDescriptor() ([]byte, []int) {
+	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{0}
+}
+
 // Admission level describes who can access a workspace instance and its ports.
 type AdmissionLevel int32
 
@@ -62,11 +114,11 @@ func (x AdmissionLevel) String() string {
 }
 
 func (AdmissionLevel) Descriptor() protoreflect.EnumDescriptor {
-	return file_gitpod_experimental_v1_workspaces_proto_enumTypes[0].Descriptor()
+	return file_gitpod_experimental_v1_workspaces_proto_enumTypes[1].Descriptor()
 }
 
 func (AdmissionLevel) Type() protoreflect.EnumType {
-	return &file_gitpod_experimental_v1_workspaces_proto_enumTypes[0]
+	return &file_gitpod_experimental_v1_workspaces_proto_enumTypes[1]
 }
 
 func (x AdmissionLevel) Number() protoreflect.EnumNumber {
@@ -75,7 +127,7 @@ func (x AdmissionLevel) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use AdmissionLevel.Descriptor instead.
 func (AdmissionLevel) EnumDescriptor() ([]byte, []int) {
-	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{0}
+	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{1}
 }
 
 // Phase is a simple, high-level summary of where the workspace instance is in its lifecycle.
@@ -155,11 +207,11 @@ func (x WorkspaceInstanceStatus_Phase) String() string {
 }
 
 func (WorkspaceInstanceStatus_Phase) Descriptor() protoreflect.EnumDescriptor {
-	return file_gitpod_experimental_v1_workspaces_proto_enumTypes[1].Descriptor()
+	return file_gitpod_experimental_v1_workspaces_proto_enumTypes[2].Descriptor()
 }
 
 func (WorkspaceInstanceStatus_Phase) Type() protoreflect.EnumType {
-	return &file_gitpod_experimental_v1_workspaces_proto_enumTypes[1]
+	return &file_gitpod_experimental_v1_workspaces_proto_enumTypes[2]
 }
 
 func (x WorkspaceInstanceStatus_Phase) Number() protoreflect.EnumNumber {
@@ -1169,6 +1221,8 @@ type WorkspaceInstanceStatus struct {
 	Url string `protobuf:"bytes,5,opt,name=url,proto3" json:"url,omitempty"`
 	// Admission describes who can access a workspace instance and its ports.
 	Admission AdmissionLevel `protobuf:"varint,6,opt,name=admission,proto3,enum=gitpod.experimental.v1.AdmissionLevel" json:"admission,omitempty"`
+	// ports is the list of exposed ports in the workspace.
+	Ports []*Port `protobuf:"bytes,7,rep,name=ports,proto3" json:"ports,omitempty"`
 }
 
 func (x *WorkspaceInstanceStatus) Reset() {
@@ -1245,6 +1299,79 @@ func (x *WorkspaceInstanceStatus) GetAdmission() AdmissionLevel {
 	return AdmissionLevel_ADMISSION_LEVEL_UNSPECIFIED
 }
 
+func (x *WorkspaceInstanceStatus) GetPorts() []*Port {
+	if x != nil {
+		return x.Ports
+	}
+	return nil
+}
+
+type Port struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// port number
+	Port uint64 `protobuf:"varint,1,opt,name=port,proto3" json:"port,omitempty"`
+	// policy of this port
+	Policy PortPolicy `protobuf:"varint,2,opt,name=policy,proto3,enum=gitpod.experimental.v1.PortPolicy" json:"policy,omitempty"`
+	// url that can be used to access the port
+	Url string `protobuf:"bytes,3,opt,name=url,proto3" json:"url,omitempty"`
+}
+
+func (x *Port) Reset() {
+	*x = Port{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Port) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Port) ProtoMessage() {}
+
+func (x *Port) ProtoReflect() protoreflect.Message {
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Port.ProtoReflect.Descriptor instead.
+func (*Port) Descriptor() ([]byte, []int) {
+	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *Port) GetPort() uint64 {
+	if x != nil {
+		return x.Port
+	}
+	return 0
+}
+
+func (x *Port) GetPolicy() PortPolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return PortPolicy_PORT_POLICY_UNSPECIFIED
+}
+
+func (x *Port) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
 // StartWorkspaceSpec influences the workspace start
 type StartWorkspaceSpec struct {
 	state         protoimpl.MessageState
@@ -1255,7 +1382,7 @@ type StartWorkspaceSpec struct {
 func (x *StartWorkspaceSpec) Reset() {
 	*x = StartWorkspaceSpec{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[17]
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1268,7 +1395,7 @@ func (x *StartWorkspaceSpec) String() string {
 func (*StartWorkspaceSpec) ProtoMessage() {}
 
 func (x *StartWorkspaceSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[17]
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1281,7 +1408,157 @@ func (x *StartWorkspaceSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartWorkspaceSpec.ProtoReflect.Descriptor instead.
 func (*StartWorkspaceSpec) Descriptor() ([]byte, []int) {
-	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{17}
+	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{18}
+}
+
+type PortSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// port number
+	Port uint64 `protobuf:"varint,1,opt,name=port,proto3" json:"port,omitempty"`
+	// policy of this port
+	Policy PortPolicy `protobuf:"varint,2,opt,name=policy,proto3,enum=gitpod.experimental.v1.PortPolicy" json:"policy,omitempty"`
+}
+
+func (x *PortSpec) Reset() {
+	*x = PortSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PortSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortSpec) ProtoMessage() {}
+
+func (x *PortSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortSpec.ProtoReflect.Descriptor instead.
+func (*PortSpec) Descriptor() ([]byte, []int) {
+	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *PortSpec) GetPort() uint64 {
+	if x != nil {
+		return x.Port
+	}
+	return 0
+}
+
+func (x *PortSpec) GetPolicy() PortPolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return PortPolicy_PORT_POLICY_UNSPECIFIED
+}
+
+type UpdatePortRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	WorkspaceId string    `protobuf:"bytes,1,opt,name=workspace_id,json=workspaceId,proto3" json:"workspace_id,omitempty"`
+	Port        *PortSpec `protobuf:"bytes,2,opt,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *UpdatePortRequest) Reset() {
+	*x = UpdatePortRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdatePortRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePortRequest) ProtoMessage() {}
+
+func (x *UpdatePortRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePortRequest.ProtoReflect.Descriptor instead.
+func (*UpdatePortRequest) Descriptor() ([]byte, []int) {
+	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *UpdatePortRequest) GetWorkspaceId() string {
+	if x != nil {
+		return x.WorkspaceId
+	}
+	return ""
+}
+
+func (x *UpdatePortRequest) GetPort() *PortSpec {
+	if x != nil {
+		return x.Port
+	}
+	return nil
+}
+
+type UpdatePortResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *UpdatePortResponse) Reset() {
+	*x = UpdatePortResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdatePortResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePortResponse) ProtoMessage() {}
+
+func (x *UpdatePortResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePortResponse.ProtoReflect.Descriptor instead.
+func (*UpdatePortResponse) Descriptor() ([]byte, []int) {
+	return file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP(), []int{21}
 }
 
 // Explicit Git context
@@ -1297,7 +1574,7 @@ type WorkspaceContext_Git struct {
 func (x *WorkspaceContext_Git) Reset() {
 	*x = WorkspaceContext_Git{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[18]
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1310,7 +1587,7 @@ func (x *WorkspaceContext_Git) String() string {
 func (*WorkspaceContext_Git) ProtoMessage() {}
 
 func (x *WorkspaceContext_Git) ProtoReflect() protoreflect.Message {
-	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[18]
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1356,7 +1633,7 @@ type WorkspaceContext_Prebuild struct {
 func (x *WorkspaceContext_Prebuild) Reset() {
 	*x = WorkspaceContext_Prebuild{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[19]
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1369,7 +1646,7 @@ func (x *WorkspaceContext_Prebuild) String() string {
 func (*WorkspaceContext_Prebuild) ProtoMessage() {}
 
 func (x *WorkspaceContext_Prebuild) ProtoReflect() protoreflect.Message {
-	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[19]
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1411,7 +1688,7 @@ type WorkspaceContext_Snapshot struct {
 func (x *WorkspaceContext_Snapshot) Reset() {
 	*x = WorkspaceContext_Snapshot{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[20]
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1424,7 +1701,7 @@ func (x *WorkspaceContext_Snapshot) String() string {
 func (*WorkspaceContext_Snapshot) ProtoMessage() {}
 
 func (x *WorkspaceContext_Snapshot) ProtoReflect() protoreflect.Message {
-	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[20]
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1468,7 +1745,7 @@ type WorkspaceInstanceStatus_Conditions struct {
 func (x *WorkspaceInstanceStatus_Conditions) Reset() {
 	*x = WorkspaceInstanceStatus_Conditions{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[21]
+		mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1481,7 +1758,7 @@ func (x *WorkspaceInstanceStatus_Conditions) String() string {
 func (*WorkspaceInstanceStatus_Conditions) ProtoMessage() {}
 
 func (x *WorkspaceInstanceStatus_Conditions) ProtoReflect() protoreflect.Message {
-	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[21]
+	mi := &file_gitpod_experimental_v1_workspaces_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1686,7 +1963,7 @@ var file_gitpod_experimental_v1_workspaces_proto_rawDesc = []byte{
 	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65,
 	0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x57,
 	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65,
-	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x8e,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xc2,
 	0x06, 0x0a, 0x17, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x6e, 0x73, 0x74,
 	0x61, 0x6e, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x73, 0x74,
 	0x61, 0x74, 0x75, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01,
@@ -1708,86 +1985,122 @@ var file_gitpod_experimental_v1_workspaces_proto_rawDesc = []byte{
 	0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x26, 0x2e, 0x67, 0x69, 0x74, 0x70,
 	0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e,
 	0x76, 0x31, 0x2e, 0x41, 0x64, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4c, 0x65, 0x76, 0x65,
-	0x6c, 0x52, 0x09, 0x61, 0x64, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x1a, 0xd4, 0x01, 0x0a,
-	0x0a, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x66,
-	0x61, 0x69, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x66, 0x61, 0x69,
-	0x6c, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12, 0x4a, 0x0a,
-	0x13, 0x66, 0x69, 0x72, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x61, 0x63, 0x74, 0x69,
-	0x76, 0x69, 0x74, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x11, 0x66, 0x69, 0x72, 0x73, 0x74, 0x55, 0x73, 0x65,
-	0x72, 0x41, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x12, 0x31, 0x0a, 0x12, 0x73, 0x74, 0x6f,
-	0x70, 0x70, 0x65, 0x64, 0x5f, 0x62, 0x79, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18,
-	0x0b, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x10, 0x73, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64,
-	0x42, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x88, 0x01, 0x01, 0x42, 0x15, 0x0a, 0x13,
-	0x5f, 0x73, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x62, 0x79, 0x5f, 0x72, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x22, 0xd9, 0x01, 0x0a, 0x05, 0x50, 0x68, 0x61, 0x73, 0x65, 0x12, 0x15, 0x0a,
-	0x11, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
-	0x45, 0x44, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x50, 0x52,
-	0x45, 0x50, 0x41, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x50, 0x48, 0x41,
-	0x53, 0x45, 0x5f, 0x49, 0x4d, 0x41, 0x47, 0x45, 0x42, 0x55, 0x49, 0x4c, 0x44, 0x10, 0x02, 0x12,
-	0x11, 0x0a, 0x0d, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47,
-	0x10, 0x03, 0x12, 0x12, 0x0a, 0x0e, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41,
-	0x54, 0x49, 0x4e, 0x47, 0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f,
-	0x49, 0x4e, 0x49, 0x54, 0x49, 0x41, 0x4c, 0x49, 0x5a, 0x49, 0x4e, 0x47, 0x10, 0x05, 0x12, 0x11,
-	0x0a, 0x0d, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x52, 0x55, 0x4e, 0x4e, 0x49, 0x4e, 0x47, 0x10,
-	0x06, 0x12, 0x15, 0x0a, 0x11, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x45, 0x52,
-	0x52, 0x55, 0x50, 0x54, 0x45, 0x44, 0x10, 0x07, 0x12, 0x12, 0x0a, 0x0e, 0x50, 0x48, 0x41, 0x53,
-	0x45, 0x5f, 0x53, 0x54, 0x4f, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x10, 0x08, 0x12, 0x11, 0x0a, 0x0d,
-	0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x54, 0x4f, 0x50, 0x50, 0x45, 0x44, 0x10, 0x09, 0x22,
-	0x14, 0x0a, 0x12, 0x53, 0x74, 0x61, 0x72, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x53, 0x70, 0x65, 0x63, 0x2a, 0x6f, 0x0a, 0x0e, 0x41, 0x64, 0x6d, 0x69, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1f, 0x0a, 0x1b, 0x41, 0x44, 0x4d, 0x49, 0x53,
-	0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
-	0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1e, 0x0a, 0x1a, 0x41, 0x44, 0x4d, 0x49,
-	0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x4f, 0x57, 0x4e, 0x45,
-	0x52, 0x5f, 0x4f, 0x4e, 0x4c, 0x59, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x41, 0x44, 0x4d, 0x49,
-	0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x45, 0x56, 0x45, 0x52,
-	0x59, 0x4f, 0x4e, 0x45, 0x10, 0x02, 0x32, 0xe4, 0x04, 0x0a, 0x11, 0x57, 0x6f, 0x72, 0x6b, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x73, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x71, 0x0a, 0x0e,
-	0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x12, 0x2d,
-	0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65,
-	0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e,
-	0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
-	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x6b, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12,
-	0x2b, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d,
-	0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x67,
-	0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
-	0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6e, 0x0a, 0x0d,
-	0x47, 0x65, 0x74, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2c, 0x2e,
-	0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
-	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x67, 0x69,
+	0x6c, 0x52, 0x09, 0x61, 0x64, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x32, 0x0a, 0x05,
+	0x70, 0x6f, 0x72, 0x74, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x69,
 	0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61,
-	0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x8c, 0x01, 0x0a,
-	0x17, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x57,
-	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x36, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f,
+	0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x05, 0x70, 0x6f, 0x72, 0x74, 0x73,
+	0x1a, 0xd4, 0x01, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12,
+	0x16, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f,
+	0x75, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75,
+	0x74, 0x12, 0x4a, 0x0a, 0x13, 0x66, 0x69, 0x72, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x11, 0x66, 0x69, 0x72, 0x73,
+	0x74, 0x55, 0x73, 0x65, 0x72, 0x41, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x12, 0x31, 0x0a,
+	0x12, 0x73, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x62, 0x79, 0x5f, 0x72, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x10, 0x73, 0x74, 0x6f,
+	0x70, 0x70, 0x65, 0x64, 0x42, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x88, 0x01, 0x01,
+	0x42, 0x15, 0x0a, 0x13, 0x5f, 0x73, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x62, 0x79, 0x5f,
+	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xd9, 0x01, 0x0a, 0x05, 0x50, 0x68, 0x61, 0x73,
+	0x65, 0x12, 0x15, 0x0a, 0x11, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
+	0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x50, 0x48, 0x41, 0x53,
+	0x45, 0x5f, 0x50, 0x52, 0x45, 0x50, 0x41, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x14, 0x0a,
+	0x10, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x49, 0x4d, 0x41, 0x47, 0x45, 0x42, 0x55, 0x49, 0x4c,
+	0x44, 0x10, 0x02, 0x12, 0x11, 0x0a, 0x0d, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x50, 0x45, 0x4e,
+	0x44, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x12, 0x0a, 0x0e, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f,
+	0x43, 0x52, 0x45, 0x41, 0x54, 0x49, 0x4e, 0x47, 0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x48,
+	0x41, 0x53, 0x45, 0x5f, 0x49, 0x4e, 0x49, 0x54, 0x49, 0x41, 0x4c, 0x49, 0x5a, 0x49, 0x4e, 0x47,
+	0x10, 0x05, 0x12, 0x11, 0x0a, 0x0d, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x52, 0x55, 0x4e, 0x4e,
+	0x49, 0x4e, 0x47, 0x10, 0x06, 0x12, 0x15, 0x0a, 0x11, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x49,
+	0x4e, 0x54, 0x45, 0x52, 0x52, 0x55, 0x50, 0x54, 0x45, 0x44, 0x10, 0x07, 0x12, 0x12, 0x0a, 0x0e,
+	0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x54, 0x4f, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x10, 0x08,
+	0x12, 0x11, 0x0a, 0x0d, 0x50, 0x48, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x54, 0x4f, 0x50, 0x50, 0x45,
+	0x44, 0x10, 0x09, 0x22, 0x68, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12,
+	0x3a, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x22, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d,
+	0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x52, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x75,
+	0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x14, 0x0a,
+	0x12, 0x53, 0x74, 0x61, 0x72, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53,
+	0x70, 0x65, 0x63, 0x22, 0x5a, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x53, 0x70, 0x65, 0x63, 0x12,
+	0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x70,
+	0x6f, 0x72, 0x74, 0x12, 0x3a, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70,
+	0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x72,
+	0x74, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22,
+	0x6c, 0x0a, 0x11, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x34, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65,
+	0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x50,
+	0x6f, 0x72, 0x74, 0x53, 0x70, 0x65, 0x63, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x14, 0x0a,
+	0x12, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x2a, 0x5a, 0x0a, 0x0a, 0x50, 0x6f, 0x72, 0x74, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x12, 0x1b, 0x0a, 0x17, 0x50, 0x4f, 0x52, 0x54, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59,
+	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x17,
+	0x0a, 0x13, 0x50, 0x4f, 0x52, 0x54, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f, 0x50, 0x52,
+	0x49, 0x56, 0x41, 0x54, 0x45, 0x10, 0x01, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x4f, 0x52, 0x54, 0x5f,
+	0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x10, 0x02, 0x2a,
+	0x6f, 0x0a, 0x0e, 0x41, 0x64, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4c, 0x65, 0x76, 0x65,
+	0x6c, 0x12, 0x1f, 0x0a, 0x1b, 0x41, 0x44, 0x4d, 0x49, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x4c,
+	0x45, 0x56, 0x45, 0x4c, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
+	0x10, 0x00, 0x12, 0x1e, 0x0a, 0x1a, 0x41, 0x44, 0x4d, 0x49, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f,
+	0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x4f, 0x57, 0x4e, 0x45, 0x52, 0x5f, 0x4f, 0x4e, 0x4c, 0x59,
+	0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x41, 0x44, 0x4d, 0x49, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f,
+	0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x45, 0x56, 0x45, 0x52, 0x59, 0x4f, 0x4e, 0x45, 0x10, 0x02,
+	0x32, 0xcb, 0x05, 0x0a, 0x11, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x71, 0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f,
+	0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x12, 0x2d, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f,
 	0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76,
-	0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74,
-	0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x37, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69,
-	0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x41, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x70, 0x0a, 0x0d, 0x53,
-	0x74, 0x6f, 0x70, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x67,
-	0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
-	0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x67, 0x69, 0x74,
+	0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64,
+	0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6b, 0x0a, 0x0c, 0x47, 0x65, 0x74,
+	0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x2b, 0x2e, 0x67, 0x69, 0x74, 0x70,
+	0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e,
+	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e,
+	0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e,
+	0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6e, 0x0a, 0x0d, 0x47, 0x65, 0x74, 0x4f, 0x77, 0x6e,
+	0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2c, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64,
+	0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31,
+	0x2e, 0x47, 0x65, 0x74, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65,
+	0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47,
+	0x65, 0x74, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x8c, 0x01, 0x0a, 0x17, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x41, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x12, 0x36, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65,
+	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x41, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x37, 0x2e, 0x67, 0x69, 0x74,
 	0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x30, 0x01, 0x42, 0x46, 0x5a,
-	0x44, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74, 0x70,
-	0x6f, 0x64, 0x2d, 0x69, 0x6f, 0x2f, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2f, 0x63, 0x6f, 0x6d,
-	0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2d, 0x61,
-	0x70, 0x69, 0x2f, 0x67, 0x6f, 0x2f, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
-	0x61, 0x6c, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x6e, 0x64, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x70, 0x0a, 0x0d, 0x53, 0x74, 0x6f, 0x70, 0x57, 0x6f, 0x72,
+	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e,
+	0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x74, 0x6f, 0x70, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78,
+	0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74,
+	0x6f, 0x70, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x65, 0x0a, 0x0a, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x29, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65,
+	0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x2a, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69,
+	0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x50, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x46,
+	0x5a, 0x44, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74,
+	0x70, 0x6f, 0x64, 0x2d, 0x69, 0x6f, 0x2f, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2f, 0x63, 0x6f,
+	0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2d,
+	0x61, 0x70, 0x69, 0x2f, 0x67, 0x6f, 0x2f, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
+	0x74, 0x61, 0x6c, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1802,72 +2115,83 @@ func file_gitpod_experimental_v1_workspaces_proto_rawDescGZIP() []byte {
 	return file_gitpod_experimental_v1_workspaces_proto_rawDescData
 }
 
-var file_gitpod_experimental_v1_workspaces_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_gitpod_experimental_v1_workspaces_proto_msgTypes = make([]protoimpl.MessageInfo, 22)
+var file_gitpod_experimental_v1_workspaces_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_gitpod_experimental_v1_workspaces_proto_msgTypes = make([]protoimpl.MessageInfo, 26)
 var file_gitpod_experimental_v1_workspaces_proto_goTypes = []interface{}{
-	(AdmissionLevel)(0),                        // 0: gitpod.experimental.v1.AdmissionLevel
-	(WorkspaceInstanceStatus_Phase)(0),         // 1: gitpod.experimental.v1.WorkspaceInstanceStatus.Phase
-	(*ListWorkspacesRequest)(nil),              // 2: gitpod.experimental.v1.ListWorkspacesRequest
-	(*ListWorkspacesResponse)(nil),             // 3: gitpod.experimental.v1.ListWorkspacesResponse
-	(*GetWorkspaceRequest)(nil),                // 4: gitpod.experimental.v1.GetWorkspaceRequest
-	(*GetWorkspaceResponse)(nil),               // 5: gitpod.experimental.v1.GetWorkspaceResponse
-	(*GetOwnerTokenRequest)(nil),               // 6: gitpod.experimental.v1.GetOwnerTokenRequest
-	(*GetOwnerTokenResponse)(nil),              // 7: gitpod.experimental.v1.GetOwnerTokenResponse
-	(*CreateAndStartWorkspaceRequest)(nil),     // 8: gitpod.experimental.v1.CreateAndStartWorkspaceRequest
-	(*CreateAndStartWorkspaceResponse)(nil),    // 9: gitpod.experimental.v1.CreateAndStartWorkspaceResponse
-	(*StartWorkspaceRequest)(nil),              // 10: gitpod.experimental.v1.StartWorkspaceRequest
-	(*StartWorkspaceResponse)(nil),             // 11: gitpod.experimental.v1.StartWorkspaceResponse
-	(*StopWorkspaceRequest)(nil),               // 12: gitpod.experimental.v1.StopWorkspaceRequest
-	(*StopWorkspaceResponse)(nil),              // 13: gitpod.experimental.v1.StopWorkspaceResponse
-	(*Workspace)(nil),                          // 14: gitpod.experimental.v1.Workspace
-	(*WorkspaceStatus)(nil),                    // 15: gitpod.experimental.v1.WorkspaceStatus
-	(*WorkspaceContext)(nil),                   // 16: gitpod.experimental.v1.WorkspaceContext
-	(*WorkspaceInstance)(nil),                  // 17: gitpod.experimental.v1.WorkspaceInstance
-	(*WorkspaceInstanceStatus)(nil),            // 18: gitpod.experimental.v1.WorkspaceInstanceStatus
-	(*StartWorkspaceSpec)(nil),                 // 19: gitpod.experimental.v1.StartWorkspaceSpec
-	(*WorkspaceContext_Git)(nil),               // 20: gitpod.experimental.v1.WorkspaceContext.Git
-	(*WorkspaceContext_Prebuild)(nil),          // 21: gitpod.experimental.v1.WorkspaceContext.Prebuild
-	(*WorkspaceContext_Snapshot)(nil),          // 22: gitpod.experimental.v1.WorkspaceContext.Snapshot
-	(*WorkspaceInstanceStatus_Conditions)(nil), // 23: gitpod.experimental.v1.WorkspaceInstanceStatus.Conditions
-	(*Pagination)(nil),                         // 24: gitpod.experimental.v1.Pagination
-	(*fieldmaskpb.FieldMask)(nil),              // 25: google.protobuf.FieldMask
-	(*timestamppb.Timestamp)(nil),              // 26: google.protobuf.Timestamp
+	(PortPolicy)(0),                            // 0: gitpod.experimental.v1.PortPolicy
+	(AdmissionLevel)(0),                        // 1: gitpod.experimental.v1.AdmissionLevel
+	(WorkspaceInstanceStatus_Phase)(0),         // 2: gitpod.experimental.v1.WorkspaceInstanceStatus.Phase
+	(*ListWorkspacesRequest)(nil),              // 3: gitpod.experimental.v1.ListWorkspacesRequest
+	(*ListWorkspacesResponse)(nil),             // 4: gitpod.experimental.v1.ListWorkspacesResponse
+	(*GetWorkspaceRequest)(nil),                // 5: gitpod.experimental.v1.GetWorkspaceRequest
+	(*GetWorkspaceResponse)(nil),               // 6: gitpod.experimental.v1.GetWorkspaceResponse
+	(*GetOwnerTokenRequest)(nil),               // 7: gitpod.experimental.v1.GetOwnerTokenRequest
+	(*GetOwnerTokenResponse)(nil),              // 8: gitpod.experimental.v1.GetOwnerTokenResponse
+	(*CreateAndStartWorkspaceRequest)(nil),     // 9: gitpod.experimental.v1.CreateAndStartWorkspaceRequest
+	(*CreateAndStartWorkspaceResponse)(nil),    // 10: gitpod.experimental.v1.CreateAndStartWorkspaceResponse
+	(*StartWorkspaceRequest)(nil),              // 11: gitpod.experimental.v1.StartWorkspaceRequest
+	(*StartWorkspaceResponse)(nil),             // 12: gitpod.experimental.v1.StartWorkspaceResponse
+	(*StopWorkspaceRequest)(nil),               // 13: gitpod.experimental.v1.StopWorkspaceRequest
+	(*StopWorkspaceResponse)(nil),              // 14: gitpod.experimental.v1.StopWorkspaceResponse
+	(*Workspace)(nil),                          // 15: gitpod.experimental.v1.Workspace
+	(*WorkspaceStatus)(nil),                    // 16: gitpod.experimental.v1.WorkspaceStatus
+	(*WorkspaceContext)(nil),                   // 17: gitpod.experimental.v1.WorkspaceContext
+	(*WorkspaceInstance)(nil),                  // 18: gitpod.experimental.v1.WorkspaceInstance
+	(*WorkspaceInstanceStatus)(nil),            // 19: gitpod.experimental.v1.WorkspaceInstanceStatus
+	(*Port)(nil),                               // 20: gitpod.experimental.v1.Port
+	(*StartWorkspaceSpec)(nil),                 // 21: gitpod.experimental.v1.StartWorkspaceSpec
+	(*PortSpec)(nil),                           // 22: gitpod.experimental.v1.PortSpec
+	(*UpdatePortRequest)(nil),                  // 23: gitpod.experimental.v1.UpdatePortRequest
+	(*UpdatePortResponse)(nil),                 // 24: gitpod.experimental.v1.UpdatePortResponse
+	(*WorkspaceContext_Git)(nil),               // 25: gitpod.experimental.v1.WorkspaceContext.Git
+	(*WorkspaceContext_Prebuild)(nil),          // 26: gitpod.experimental.v1.WorkspaceContext.Prebuild
+	(*WorkspaceContext_Snapshot)(nil),          // 27: gitpod.experimental.v1.WorkspaceContext.Snapshot
+	(*WorkspaceInstanceStatus_Conditions)(nil), // 28: gitpod.experimental.v1.WorkspaceInstanceStatus.Conditions
+	(*Pagination)(nil),                         // 29: gitpod.experimental.v1.Pagination
+	(*fieldmaskpb.FieldMask)(nil),              // 30: google.protobuf.FieldMask
+	(*timestamppb.Timestamp)(nil),              // 31: google.protobuf.Timestamp
 }
 var file_gitpod_experimental_v1_workspaces_proto_depIdxs = []int32{
-	24, // 0: gitpod.experimental.v1.ListWorkspacesRequest.pagination:type_name -> gitpod.experimental.v1.Pagination
-	25, // 1: gitpod.experimental.v1.ListWorkspacesRequest.field_mask:type_name -> google.protobuf.FieldMask
-	14, // 2: gitpod.experimental.v1.ListWorkspacesResponse.result:type_name -> gitpod.experimental.v1.Workspace
-	14, // 3: gitpod.experimental.v1.GetWorkspaceResponse.result:type_name -> gitpod.experimental.v1.Workspace
-	19, // 4: gitpod.experimental.v1.CreateAndStartWorkspaceRequest.start_spec:type_name -> gitpod.experimental.v1.StartWorkspaceSpec
-	19, // 5: gitpod.experimental.v1.StartWorkspaceRequest.spec:type_name -> gitpod.experimental.v1.StartWorkspaceSpec
-	16, // 6: gitpod.experimental.v1.Workspace.context:type_name -> gitpod.experimental.v1.WorkspaceContext
-	15, // 7: gitpod.experimental.v1.Workspace.status:type_name -> gitpod.experimental.v1.WorkspaceStatus
-	17, // 8: gitpod.experimental.v1.WorkspaceStatus.instance:type_name -> gitpod.experimental.v1.WorkspaceInstance
-	20, // 9: gitpod.experimental.v1.WorkspaceContext.git:type_name -> gitpod.experimental.v1.WorkspaceContext.Git
-	21, // 10: gitpod.experimental.v1.WorkspaceContext.prebuild:type_name -> gitpod.experimental.v1.WorkspaceContext.Prebuild
-	22, // 11: gitpod.experimental.v1.WorkspaceContext.snapshot:type_name -> gitpod.experimental.v1.WorkspaceContext.Snapshot
-	26, // 12: gitpod.experimental.v1.WorkspaceInstance.created_at:type_name -> google.protobuf.Timestamp
-	18, // 13: gitpod.experimental.v1.WorkspaceInstance.status:type_name -> gitpod.experimental.v1.WorkspaceInstanceStatus
-	1,  // 14: gitpod.experimental.v1.WorkspaceInstanceStatus.phase:type_name -> gitpod.experimental.v1.WorkspaceInstanceStatus.Phase
-	23, // 15: gitpod.experimental.v1.WorkspaceInstanceStatus.conditions:type_name -> gitpod.experimental.v1.WorkspaceInstanceStatus.Conditions
-	0,  // 16: gitpod.experimental.v1.WorkspaceInstanceStatus.admission:type_name -> gitpod.experimental.v1.AdmissionLevel
-	20, // 17: gitpod.experimental.v1.WorkspaceContext.Prebuild.original_context:type_name -> gitpod.experimental.v1.WorkspaceContext.Git
-	26, // 18: gitpod.experimental.v1.WorkspaceInstanceStatus.Conditions.first_user_activity:type_name -> google.protobuf.Timestamp
-	2,  // 19: gitpod.experimental.v1.WorkspacesService.ListWorkspaces:input_type -> gitpod.experimental.v1.ListWorkspacesRequest
-	4,  // 20: gitpod.experimental.v1.WorkspacesService.GetWorkspace:input_type -> gitpod.experimental.v1.GetWorkspaceRequest
-	6,  // 21: gitpod.experimental.v1.WorkspacesService.GetOwnerToken:input_type -> gitpod.experimental.v1.GetOwnerTokenRequest
-	8,  // 22: gitpod.experimental.v1.WorkspacesService.CreateAndStartWorkspace:input_type -> gitpod.experimental.v1.CreateAndStartWorkspaceRequest
-	12, // 23: gitpod.experimental.v1.WorkspacesService.StopWorkspace:input_type -> gitpod.experimental.v1.StopWorkspaceRequest
-	3,  // 24: gitpod.experimental.v1.WorkspacesService.ListWorkspaces:output_type -> gitpod.experimental.v1.ListWorkspacesResponse
-	5,  // 25: gitpod.experimental.v1.WorkspacesService.GetWorkspace:output_type -> gitpod.experimental.v1.GetWorkspaceResponse
-	7,  // 26: gitpod.experimental.v1.WorkspacesService.GetOwnerToken:output_type -> gitpod.experimental.v1.GetOwnerTokenResponse
-	9,  // 27: gitpod.experimental.v1.WorkspacesService.CreateAndStartWorkspace:output_type -> gitpod.experimental.v1.CreateAndStartWorkspaceResponse
-	13, // 28: gitpod.experimental.v1.WorkspacesService.StopWorkspace:output_type -> gitpod.experimental.v1.StopWorkspaceResponse
-	24, // [24:29] is the sub-list for method output_type
-	19, // [19:24] is the sub-list for method input_type
-	19, // [19:19] is the sub-list for extension type_name
-	19, // [19:19] is the sub-list for extension extendee
-	0,  // [0:19] is the sub-list for field type_name
+	29, // 0: gitpod.experimental.v1.ListWorkspacesRequest.pagination:type_name -> gitpod.experimental.v1.Pagination
+	30, // 1: gitpod.experimental.v1.ListWorkspacesRequest.field_mask:type_name -> google.protobuf.FieldMask
+	15, // 2: gitpod.experimental.v1.ListWorkspacesResponse.result:type_name -> gitpod.experimental.v1.Workspace
+	15, // 3: gitpod.experimental.v1.GetWorkspaceResponse.result:type_name -> gitpod.experimental.v1.Workspace
+	21, // 4: gitpod.experimental.v1.CreateAndStartWorkspaceRequest.start_spec:type_name -> gitpod.experimental.v1.StartWorkspaceSpec
+	21, // 5: gitpod.experimental.v1.StartWorkspaceRequest.spec:type_name -> gitpod.experimental.v1.StartWorkspaceSpec
+	17, // 6: gitpod.experimental.v1.Workspace.context:type_name -> gitpod.experimental.v1.WorkspaceContext
+	16, // 7: gitpod.experimental.v1.Workspace.status:type_name -> gitpod.experimental.v1.WorkspaceStatus
+	18, // 8: gitpod.experimental.v1.WorkspaceStatus.instance:type_name -> gitpod.experimental.v1.WorkspaceInstance
+	25, // 9: gitpod.experimental.v1.WorkspaceContext.git:type_name -> gitpod.experimental.v1.WorkspaceContext.Git
+	26, // 10: gitpod.experimental.v1.WorkspaceContext.prebuild:type_name -> gitpod.experimental.v1.WorkspaceContext.Prebuild
+	27, // 11: gitpod.experimental.v1.WorkspaceContext.snapshot:type_name -> gitpod.experimental.v1.WorkspaceContext.Snapshot
+	31, // 12: gitpod.experimental.v1.WorkspaceInstance.created_at:type_name -> google.protobuf.Timestamp
+	19, // 13: gitpod.experimental.v1.WorkspaceInstance.status:type_name -> gitpod.experimental.v1.WorkspaceInstanceStatus
+	2,  // 14: gitpod.experimental.v1.WorkspaceInstanceStatus.phase:type_name -> gitpod.experimental.v1.WorkspaceInstanceStatus.Phase
+	28, // 15: gitpod.experimental.v1.WorkspaceInstanceStatus.conditions:type_name -> gitpod.experimental.v1.WorkspaceInstanceStatus.Conditions
+	1,  // 16: gitpod.experimental.v1.WorkspaceInstanceStatus.admission:type_name -> gitpod.experimental.v1.AdmissionLevel
+	20, // 17: gitpod.experimental.v1.WorkspaceInstanceStatus.ports:type_name -> gitpod.experimental.v1.Port
+	0,  // 18: gitpod.experimental.v1.Port.policy:type_name -> gitpod.experimental.v1.PortPolicy
+	0,  // 19: gitpod.experimental.v1.PortSpec.policy:type_name -> gitpod.experimental.v1.PortPolicy
+	22, // 20: gitpod.experimental.v1.UpdatePortRequest.port:type_name -> gitpod.experimental.v1.PortSpec
+	25, // 21: gitpod.experimental.v1.WorkspaceContext.Prebuild.original_context:type_name -> gitpod.experimental.v1.WorkspaceContext.Git
+	31, // 22: gitpod.experimental.v1.WorkspaceInstanceStatus.Conditions.first_user_activity:type_name -> google.protobuf.Timestamp
+	3,  // 23: gitpod.experimental.v1.WorkspacesService.ListWorkspaces:input_type -> gitpod.experimental.v1.ListWorkspacesRequest
+	5,  // 24: gitpod.experimental.v1.WorkspacesService.GetWorkspace:input_type -> gitpod.experimental.v1.GetWorkspaceRequest
+	7,  // 25: gitpod.experimental.v1.WorkspacesService.GetOwnerToken:input_type -> gitpod.experimental.v1.GetOwnerTokenRequest
+	9,  // 26: gitpod.experimental.v1.WorkspacesService.CreateAndStartWorkspace:input_type -> gitpod.experimental.v1.CreateAndStartWorkspaceRequest
+	13, // 27: gitpod.experimental.v1.WorkspacesService.StopWorkspace:input_type -> gitpod.experimental.v1.StopWorkspaceRequest
+	23, // 28: gitpod.experimental.v1.WorkspacesService.UpdatePort:input_type -> gitpod.experimental.v1.UpdatePortRequest
+	4,  // 29: gitpod.experimental.v1.WorkspacesService.ListWorkspaces:output_type -> gitpod.experimental.v1.ListWorkspacesResponse
+	6,  // 30: gitpod.experimental.v1.WorkspacesService.GetWorkspace:output_type -> gitpod.experimental.v1.GetWorkspaceResponse
+	8,  // 31: gitpod.experimental.v1.WorkspacesService.GetOwnerToken:output_type -> gitpod.experimental.v1.GetOwnerTokenResponse
+	10, // 32: gitpod.experimental.v1.WorkspacesService.CreateAndStartWorkspace:output_type -> gitpod.experimental.v1.CreateAndStartWorkspaceResponse
+	14, // 33: gitpod.experimental.v1.WorkspacesService.StopWorkspace:output_type -> gitpod.experimental.v1.StopWorkspaceResponse
+	24, // 34: gitpod.experimental.v1.WorkspacesService.UpdatePort:output_type -> gitpod.experimental.v1.UpdatePortResponse
+	29, // [29:35] is the sub-list for method output_type
+	23, // [23:29] is the sub-list for method input_type
+	23, // [23:23] is the sub-list for extension type_name
+	23, // [23:23] is the sub-list for extension extendee
+	0,  // [0:23] is the sub-list for field type_name
 }
 
 func init() { file_gitpod_experimental_v1_workspaces_proto_init() }
@@ -2082,7 +2406,7 @@ func file_gitpod_experimental_v1_workspaces_proto_init() {
 			}
 		}
 		file_gitpod_experimental_v1_workspaces_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StartWorkspaceSpec); i {
+			switch v := v.(*Port); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2094,7 +2418,7 @@ func file_gitpod_experimental_v1_workspaces_proto_init() {
 			}
 		}
 		file_gitpod_experimental_v1_workspaces_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WorkspaceContext_Git); i {
+			switch v := v.(*StartWorkspaceSpec); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2106,7 +2430,7 @@ func file_gitpod_experimental_v1_workspaces_proto_init() {
 			}
 		}
 		file_gitpod_experimental_v1_workspaces_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WorkspaceContext_Prebuild); i {
+			switch v := v.(*PortSpec); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2118,7 +2442,7 @@ func file_gitpod_experimental_v1_workspaces_proto_init() {
 			}
 		}
 		file_gitpod_experimental_v1_workspaces_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WorkspaceContext_Snapshot); i {
+			switch v := v.(*UpdatePortRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2130,6 +2454,54 @@ func file_gitpod_experimental_v1_workspaces_proto_init() {
 			}
 		}
 		file_gitpod_experimental_v1_workspaces_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdatePortResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_gitpod_experimental_v1_workspaces_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WorkspaceContext_Git); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_gitpod_experimental_v1_workspaces_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WorkspaceContext_Prebuild); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_gitpod_experimental_v1_workspaces_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WorkspaceContext_Snapshot); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_gitpod_experimental_v1_workspaces_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*WorkspaceInstanceStatus_Conditions); i {
 			case 0:
 				return &v.state
@@ -2151,14 +2523,14 @@ func file_gitpod_experimental_v1_workspaces_proto_init() {
 		(*WorkspaceContext_Prebuild_)(nil),
 		(*WorkspaceContext_Snapshot_)(nil),
 	}
-	file_gitpod_experimental_v1_workspaces_proto_msgTypes[21].OneofWrappers = []interface{}{}
+	file_gitpod_experimental_v1_workspaces_proto_msgTypes[25].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_gitpod_experimental_v1_workspaces_proto_rawDesc,
-			NumEnums:      2,
-			NumMessages:   22,
+			NumEnums:      3,
+			NumMessages:   26,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/components/public-api/go/experimental/v1/workspaces_grpc.pb.go b/components/public-api/go/experimental/v1/workspaces_grpc.pb.go
index 403942de40b2d9..b7d869cb004aec 100644
--- a/components/public-api/go/experimental/v1/workspaces_grpc.pb.go
+++ b/components/public-api/go/experimental/v1/workspaces_grpc.pb.go
@@ -40,6 +40,7 @@ type WorkspacesServiceClient interface {
 	//	NOT_FOUND:           the workspace_id is unkown
 	//	FAILED_PRECONDITION: if there's no running instance
 	StopWorkspace(ctx context.Context, in *StopWorkspaceRequest, opts ...grpc.CallOption) (WorkspacesService_StopWorkspaceClient, error)
+	UpdatePort(ctx context.Context, in *UpdatePortRequest, opts ...grpc.CallOption) (*UpdatePortResponse, error)
 }
 
 type workspacesServiceClient struct {
@@ -118,6 +119,15 @@ func (x *workspacesServiceStopWorkspaceClient) Recv() (*StopWorkspaceResponse, e
 	return m, nil
 }
 
+func (c *workspacesServiceClient) UpdatePort(ctx context.Context, in *UpdatePortRequest, opts ...grpc.CallOption) (*UpdatePortResponse, error) {
+	out := new(UpdatePortResponse)
+	err := c.cc.Invoke(ctx, "/gitpod.experimental.v1.WorkspacesService/UpdatePort", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // WorkspacesServiceServer is the server API for WorkspacesService service.
 // All implementations must embed UnimplementedWorkspacesServiceServer
 // for forward compatibility
@@ -136,6 +146,7 @@ type WorkspacesServiceServer interface {
 	//	NOT_FOUND:           the workspace_id is unkown
 	//	FAILED_PRECONDITION: if there's no running instance
 	StopWorkspace(*StopWorkspaceRequest, WorkspacesService_StopWorkspaceServer) error
+	UpdatePort(context.Context, *UpdatePortRequest) (*UpdatePortResponse, error)
 	mustEmbedUnimplementedWorkspacesServiceServer()
 }
 
@@ -158,6 +169,9 @@ func (UnimplementedWorkspacesServiceServer) CreateAndStartWorkspace(context.Cont
 func (UnimplementedWorkspacesServiceServer) StopWorkspace(*StopWorkspaceRequest, WorkspacesService_StopWorkspaceServer) error {
 	return status.Errorf(codes.Unimplemented, "method StopWorkspace not implemented")
 }
+func (UnimplementedWorkspacesServiceServer) UpdatePort(context.Context, *UpdatePortRequest) (*UpdatePortResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdatePort not implemented")
+}
 func (UnimplementedWorkspacesServiceServer) mustEmbedUnimplementedWorkspacesServiceServer() {}
 
 // UnsafeWorkspacesServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -264,6 +278,24 @@ func (x *workspacesServiceStopWorkspaceServer) Send(m *StopWorkspaceResponse) er
 	return x.ServerStream.SendMsg(m)
 }
 
+func _WorkspacesService_UpdatePort_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdatePortRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(WorkspacesServiceServer).UpdatePort(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/gitpod.experimental.v1.WorkspacesService/UpdatePort",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(WorkspacesServiceServer).UpdatePort(ctx, req.(*UpdatePortRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // WorkspacesService_ServiceDesc is the grpc.ServiceDesc for WorkspacesService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -287,6 +319,10 @@ var WorkspacesService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "CreateAndStartWorkspace",
 			Handler:    _WorkspacesService_CreateAndStartWorkspace_Handler,
 		},
+		{
+			MethodName: "UpdatePort",
+			Handler:    _WorkspacesService_UpdatePort_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{
diff --git a/components/public-api/typescript/src/gitpod/experimental/v1/user_connectweb.ts b/components/public-api/typescript/src/gitpod/experimental/v1/user_connectweb.ts
index 452ec59d8df59d..fe87a19bf6213e 100644
--- a/components/public-api/typescript/src/gitpod/experimental/v1/user_connectweb.ts
+++ b/components/public-api/typescript/src/gitpod/experimental/v1/user_connectweb.ts
@@ -9,7 +9,7 @@
 /* eslint-disable */
 /* @ts-nocheck */
 
-import {CreateSSHKeyRequest, CreateSSHKeyResponse, DeleteSSHKeyRequest, DeleteSSHKeyResponse, GetAuthenticatedUserRequest, GetAuthenticatedUserResponse, GetSSHKeyRequest, GetSSHKeyResponse, ListSSHKeysRequest, ListSSHKeysResponse} from "./user_pb.js";
+import {CreateSSHKeyRequest, CreateSSHKeyResponse, DeleteSSHKeyRequest, DeleteSSHKeyResponse, GetAuthenticatedUserRequest, GetAuthenticatedUserResponse, GetGitTokenRequest, GetGitTokenResponse, GetSSHKeyRequest, GetSSHKeyResponse, ListSSHKeysRequest, ListSSHKeysResponse} from "./user_pb.js";
 import {MethodKind} from "@bufbuild/protobuf";
 
 /**
@@ -73,5 +73,14 @@ export const UserService = {
       O: DeleteSSHKeyResponse,
       kind: MethodKind.Unary,
     },
+    /**
+     * @generated from rpc gitpod.experimental.v1.UserService.GetGitToken
+     */
+    getGitToken: {
+      name: "GetGitToken",
+      I: GetGitTokenRequest,
+      O: GetGitTokenResponse,
+      kind: MethodKind.Unary,
+    },
   }
 } as const;
diff --git a/components/public-api/typescript/src/gitpod/experimental/v1/user_pb.ts b/components/public-api/typescript/src/gitpod/experimental/v1/user_pb.ts
index aac20d7cdc088b..c9699ae5ec92be 100644
--- a/components/public-api/typescript/src/gitpod/experimental/v1/user_pb.ts
+++ b/components/public-api/typescript/src/gitpod/experimental/v1/user_pb.ts
@@ -505,3 +505,164 @@ export class DeleteSSHKeyResponse extends Message<DeleteSSHKeyResponse> {
     return proto3.util.equals(DeleteSSHKeyResponse, a, b);
   }
 }
+
+/**
+ * @generated from message gitpod.experimental.v1.GetGitTokenRequest
+ */
+export class GetGitTokenRequest extends Message<GetGitTokenRequest> {
+  /**
+   * @generated from field: string host = 1;
+   */
+  host = "";
+
+  constructor(data?: PartialMessage<GetGitTokenRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.GetGitTokenRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "host", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetGitTokenRequest {
+    return new GetGitTokenRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetGitTokenRequest {
+    return new GetGitTokenRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetGitTokenRequest {
+    return new GetGitTokenRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetGitTokenRequest | PlainMessage<GetGitTokenRequest> | undefined, b: GetGitTokenRequest | PlainMessage<GetGitTokenRequest> | undefined): boolean {
+    return proto3.util.equals(GetGitTokenRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.GetGitTokenResponse
+ */
+export class GetGitTokenResponse extends Message<GetGitTokenResponse> {
+  /**
+   * @generated from field: gitpod.experimental.v1.GitToken token = 1;
+   */
+  token?: GitToken;
+
+  constructor(data?: PartialMessage<GetGitTokenResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.GetGitTokenResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "token", kind: "message", T: GitToken },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetGitTokenResponse {
+    return new GetGitTokenResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetGitTokenResponse {
+    return new GetGitTokenResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetGitTokenResponse {
+    return new GetGitTokenResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetGitTokenResponse | PlainMessage<GetGitTokenResponse> | undefined, b: GetGitTokenResponse | PlainMessage<GetGitTokenResponse> | undefined): boolean {
+    return proto3.util.equals(GetGitTokenResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.GitToken
+ */
+export class GitToken extends Message<GitToken> {
+  /**
+   * expiry_date is the date when the token will expire
+   *
+   * @generated from field: string expiry_date = 1;
+   */
+  expiryDate = "";
+
+  /**
+   * id_token is the unique identifier for the token
+   *
+   * @generated from field: string id_token = 2;
+   */
+  idToken = "";
+
+  /**
+   * refresh_token is the token used to refresh the git token
+   *
+   * @generated from field: string refresh_token = 3;
+   */
+  refreshToken = "";
+
+  /**
+   * scopes is a list of permissions associated with the token
+   *
+   * @generated from field: repeated string scopes = 4;
+   */
+  scopes: string[] = [];
+
+  /**
+   * update_date is the date when the token was last updated
+   *
+   * @generated from field: string update_date = 5;
+   */
+  updateDate = "";
+
+  /**
+   * username is the username associated with the token
+   *
+   * @generated from field: string username = 6;
+   */
+  username = "";
+
+  /**
+   * value is the actual token value for the token
+   *
+   * @generated from field: string value = 7;
+   */
+  value = "";
+
+  constructor(data?: PartialMessage<GitToken>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.GitToken";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "expiry_date", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "id_token", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "refresh_token", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "scopes", kind: "scalar", T: 9 /* ScalarType.STRING */, repeated: true },
+    { no: 5, name: "update_date", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 6, name: "username", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 7, name: "value", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GitToken {
+    return new GitToken().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GitToken {
+    return new GitToken().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GitToken {
+    return new GitToken().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GitToken | PlainMessage<GitToken> | undefined, b: GitToken | PlainMessage<GitToken> | undefined): boolean {
+    return proto3.util.equals(GitToken, a, b);
+  }
+}
diff --git a/components/public-api/typescript/src/gitpod/experimental/v1/workspace_connectweb.ts b/components/public-api/typescript/src/gitpod/experimental/v1/workspace_connectweb.ts
new file mode 100644
index 00000000000000..923456834d9a3d
--- /dev/null
+++ b/components/public-api/typescript/src/gitpod/experimental/v1/workspace_connectweb.ts
@@ -0,0 +1,49 @@
+/**
+ * Copyright (c) 2022 Gitpod GmbH. All rights reserved.
+ * Licensed under the GNU Affero General Public License (AGPL).
+ * See License-AGPL.txt in the project root for license information.
+ */
+
+// @generated by protoc-gen-connect-web v0.2.1 with parameter "target=ts"
+// @generated from file gitpod/experimental/v1/workspace.proto (package gitpod.experimental.v1, syntax proto3)
+/* eslint-disable */
+/* @ts-nocheck */
+
+import {GetOpenPortsRequest, GetOpenPortsResponse, InstanceUpdatesRequest, InstanceUpdatesResponse, OpenPortRequest, OpenPortResponse} from "./workspace_pb.js";
+import {MethodKind} from "@bufbuild/protobuf";
+
+/**
+ * @generated from service gitpod.experimental.v1.WorkspaceService
+ */
+export const WorkspaceService = {
+  typeName: "gitpod.experimental.v1.WorkspaceService",
+  methods: {
+    /**
+     * @generated from rpc gitpod.experimental.v1.WorkspaceService.OpenPort
+     */
+    openPort: {
+      name: "OpenPort",
+      I: OpenPortRequest,
+      O: OpenPortResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc gitpod.experimental.v1.WorkspaceService.GetOpenPorts
+     */
+    getOpenPorts: {
+      name: "GetOpenPorts",
+      I: GetOpenPortsRequest,
+      O: GetOpenPortsResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc gitpod.experimental.v1.WorkspaceService.InstanceUpdates
+     */
+    instanceUpdates: {
+      name: "InstanceUpdates",
+      I: InstanceUpdatesRequest,
+      O: InstanceUpdatesResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
diff --git a/components/public-api/typescript/src/gitpod/experimental/v1/workspace_pb.ts b/components/public-api/typescript/src/gitpod/experimental/v1/workspace_pb.ts
new file mode 100644
index 00000000000000..21bf5b9001f2ae
--- /dev/null
+++ b/components/public-api/typescript/src/gitpod/experimental/v1/workspace_pb.ts
@@ -0,0 +1,311 @@
+/**
+ * Copyright (c) 2022 Gitpod GmbH. All rights reserved.
+ * Licensed under the GNU Affero General Public License (AGPL).
+ * See License-AGPL.txt in the project root for license information.
+ */
+
+// @generated by protoc-gen-es v0.1.1 with parameter "target=ts"
+// @generated from file gitpod/experimental/v1/workspace.proto (package gitpod.experimental.v1, syntax proto3)
+/* eslint-disable */
+/* @ts-nocheck */
+
+import type {BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage} from "@bufbuild/protobuf";
+import {Message, proto3} from "@bufbuild/protobuf";
+import {WorkspaceInstance} from "./workspaces_pb.js";
+
+/**
+ * @generated from enum gitpod.experimental.v1.PortVisibility
+ */
+export enum PortVisibility {
+  /**
+   * @generated from enum value: PORT_VISIBILITY_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: PORT_VISIBILITY_PUBLIC = 1;
+   */
+  PUBLIC = 1,
+
+  /**
+   * @generated from enum value: PORT_VISIBILITY_PRIVATE = 2;
+   */
+  PRIVATE = 2,
+}
+// Retrieve enum metadata with: proto3.getEnumType(PortVisibility)
+proto3.util.setEnumType(PortVisibility, "gitpod.experimental.v1.PortVisibility", [
+  { no: 0, name: "PORT_VISIBILITY_UNSPECIFIED" },
+  { no: 1, name: "PORT_VISIBILITY_PUBLIC" },
+  { no: 2, name: "PORT_VISIBILITY_PRIVATE" },
+]);
+
+/**
+ * @generated from message gitpod.experimental.v1.OpenPortRequest
+ */
+export class OpenPortRequest extends Message<OpenPortRequest> {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId = "";
+
+  constructor(data?: PartialMessage<OpenPortRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.OpenPortRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "workspace_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OpenPortRequest {
+    return new OpenPortRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OpenPortRequest {
+    return new OpenPortRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OpenPortRequest {
+    return new OpenPortRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: OpenPortRequest | PlainMessage<OpenPortRequest> | undefined, b: OpenPortRequest | PlainMessage<OpenPortRequest> | undefined): boolean {
+    return proto3.util.equals(OpenPortRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.OpenPortResponse
+ */
+export class OpenPortResponse extends Message<OpenPortResponse> {
+  /**
+   * @generated from field: gitpod.experimental.v1.WorkspaceInstancePort port = 1;
+   */
+  port?: WorkspaceInstancePort;
+
+  constructor(data?: PartialMessage<OpenPortResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.OpenPortResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "port", kind: "message", T: WorkspaceInstancePort },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OpenPortResponse {
+    return new OpenPortResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OpenPortResponse {
+    return new OpenPortResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OpenPortResponse {
+    return new OpenPortResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: OpenPortResponse | PlainMessage<OpenPortResponse> | undefined, b: OpenPortResponse | PlainMessage<OpenPortResponse> | undefined): boolean {
+    return proto3.util.equals(OpenPortResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.WorkspaceInstancePort
+ */
+export class WorkspaceInstancePort extends Message<WorkspaceInstancePort> {
+  /**
+   * @generated from field: int32 port = 1;
+   */
+  port = 0;
+
+  /**
+   * @generated from field: string url = 2;
+   */
+  url = "";
+
+  /**
+   * @generated from field: gitpod.experimental.v1.PortVisibility visibility = 3;
+   */
+  visibility = PortVisibility.UNSPECIFIED;
+
+  constructor(data?: PartialMessage<WorkspaceInstancePort>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.WorkspaceInstancePort";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "port", kind: "scalar", T: 5 /* ScalarType.INT32 */ },
+    { no: 2, name: "url", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "visibility", kind: "enum", T: proto3.getEnumType(PortVisibility) },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): WorkspaceInstancePort {
+    return new WorkspaceInstancePort().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): WorkspaceInstancePort {
+    return new WorkspaceInstancePort().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): WorkspaceInstancePort {
+    return new WorkspaceInstancePort().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: WorkspaceInstancePort | PlainMessage<WorkspaceInstancePort> | undefined, b: WorkspaceInstancePort | PlainMessage<WorkspaceInstancePort> | undefined): boolean {
+    return proto3.util.equals(WorkspaceInstancePort, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.GetOpenPortsRequest
+ */
+export class GetOpenPortsRequest extends Message<GetOpenPortsRequest> {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId = "";
+
+  constructor(data?: PartialMessage<GetOpenPortsRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.GetOpenPortsRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "workspace_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetOpenPortsRequest {
+    return new GetOpenPortsRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetOpenPortsRequest {
+    return new GetOpenPortsRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetOpenPortsRequest {
+    return new GetOpenPortsRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetOpenPortsRequest | PlainMessage<GetOpenPortsRequest> | undefined, b: GetOpenPortsRequest | PlainMessage<GetOpenPortsRequest> | undefined): boolean {
+    return proto3.util.equals(GetOpenPortsRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.GetOpenPortsResponse
+ */
+export class GetOpenPortsResponse extends Message<GetOpenPortsResponse> {
+  /**
+   * @generated from field: repeated gitpod.experimental.v1.WorkspaceInstancePort ports = 1;
+   */
+  ports: WorkspaceInstancePort[] = [];
+
+  constructor(data?: PartialMessage<GetOpenPortsResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.GetOpenPortsResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "ports", kind: "message", T: WorkspaceInstancePort, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetOpenPortsResponse {
+    return new GetOpenPortsResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetOpenPortsResponse {
+    return new GetOpenPortsResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetOpenPortsResponse {
+    return new GetOpenPortsResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetOpenPortsResponse | PlainMessage<GetOpenPortsResponse> | undefined, b: GetOpenPortsResponse | PlainMessage<GetOpenPortsResponse> | undefined): boolean {
+    return proto3.util.equals(GetOpenPortsResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.InstanceUpdatesRequest
+ */
+export class InstanceUpdatesRequest extends Message<InstanceUpdatesRequest> {
+  /**
+   * @generated from field: string instance_id = 1;
+   */
+  instanceId = "";
+
+  constructor(data?: PartialMessage<InstanceUpdatesRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.InstanceUpdatesRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "instance_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): InstanceUpdatesRequest {
+    return new InstanceUpdatesRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): InstanceUpdatesRequest {
+    return new InstanceUpdatesRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): InstanceUpdatesRequest {
+    return new InstanceUpdatesRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: InstanceUpdatesRequest | PlainMessage<InstanceUpdatesRequest> | undefined, b: InstanceUpdatesRequest | PlainMessage<InstanceUpdatesRequest> | undefined): boolean {
+    return proto3.util.equals(InstanceUpdatesRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.InstanceUpdatesResponse
+ */
+export class InstanceUpdatesResponse extends Message<InstanceUpdatesResponse> {
+  /**
+   * @generated from field: gitpod.experimental.v1.WorkspaceInstance instance = 1;
+   */
+  instance?: WorkspaceInstance;
+
+  constructor(data?: PartialMessage<InstanceUpdatesResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.InstanceUpdatesResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "instance", kind: "message", T: WorkspaceInstance },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): InstanceUpdatesResponse {
+    return new InstanceUpdatesResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): InstanceUpdatesResponse {
+    return new InstanceUpdatesResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): InstanceUpdatesResponse {
+    return new InstanceUpdatesResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: InstanceUpdatesResponse | PlainMessage<InstanceUpdatesResponse> | undefined, b: InstanceUpdatesResponse | PlainMessage<InstanceUpdatesResponse> | undefined): boolean {
+    return proto3.util.equals(InstanceUpdatesResponse, a, b);
+  }
+}
diff --git a/components/public-api/typescript/src/gitpod/experimental/v1/workspaces_connectweb.ts b/components/public-api/typescript/src/gitpod/experimental/v1/workspaces_connectweb.ts
index 0f4bd03f790a53..c1d3027876ac4b 100644
--- a/components/public-api/typescript/src/gitpod/experimental/v1/workspaces_connectweb.ts
+++ b/components/public-api/typescript/src/gitpod/experimental/v1/workspaces_connectweb.ts
@@ -9,7 +9,7 @@
 /* eslint-disable */
 /* @ts-nocheck */
 
-import {CreateAndStartWorkspaceRequest, CreateAndStartWorkspaceResponse, GetOwnerTokenRequest, GetOwnerTokenResponse, GetWorkspaceRequest, GetWorkspaceResponse, ListWorkspacesRequest, ListWorkspacesResponse, StopWorkspaceRequest, StopWorkspaceResponse} from "./workspaces_pb.js";
+import {CreateAndStartWorkspaceRequest, CreateAndStartWorkspaceResponse, GetOwnerTokenRequest, GetOwnerTokenResponse, GetWorkspaceRequest, GetWorkspaceResponse, ListWorkspacesRequest, ListWorkspacesResponse, StopWorkspaceRequest, StopWorkspaceResponse, UpdatePortRequest, UpdatePortResponse} from "./workspaces_pb.js";
 import {MethodKind} from "@bufbuild/protobuf";
 
 /**
@@ -76,5 +76,14 @@ export const WorkspacesService = {
       O: StopWorkspaceResponse,
       kind: MethodKind.ServerStreaming,
     },
+    /**
+     * @generated from rpc gitpod.experimental.v1.WorkspacesService.UpdatePort
+     */
+    updatePort: {
+      name: "UpdatePort",
+      I: UpdatePortRequest,
+      O: UpdatePortResponse,
+      kind: MethodKind.Unary,
+    },
   }
 } as const;
diff --git a/components/public-api/typescript/src/gitpod/experimental/v1/workspaces_pb.ts b/components/public-api/typescript/src/gitpod/experimental/v1/workspaces_pb.ts
index 4e4af4841c5ffd..6d40bdb44d3660 100644
--- a/components/public-api/typescript/src/gitpod/experimental/v1/workspaces_pb.ts
+++ b/components/public-api/typescript/src/gitpod/experimental/v1/workspaces_pb.ts
@@ -13,6 +13,38 @@ import type {BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMe
 import {FieldMask, Message, proto3, protoInt64, Timestamp} from "@bufbuild/protobuf";
 import {Pagination} from "./pagination_pb.js";
 
+/**
+ * PortPolicy defines the accssbility policy of a workspace port is guarded by an authentication in the proxy
+ *
+ * @generated from enum gitpod.experimental.v1.PortPolicy
+ */
+export enum PortPolicy {
+  /**
+   * @generated from enum value: PORT_POLICY_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Private means the port is accessible by the workspace owner only using the workspace port URL
+   *
+   * @generated from enum value: PORT_POLICY_PRIVATE = 1;
+   */
+  PRIVATE = 1,
+
+  /**
+   * Public means the port is accessible by everybody using the workspace port URL
+   *
+   * @generated from enum value: PORT_POLICY_PUBLIC = 2;
+   */
+  PUBLIC = 2,
+}
+// Retrieve enum metadata with: proto3.getEnumType(PortPolicy)
+proto3.util.setEnumType(PortPolicy, "gitpod.experimental.v1.PortPolicy", [
+  { no: 0, name: "PORT_POLICY_UNSPECIFIED" },
+  { no: 1, name: "PORT_POLICY_PRIVATE" },
+  { no: 2, name: "PORT_POLICY_PUBLIC" },
+]);
+
 /**
  * Admission level describes who can access a workspace instance and its ports.
  *
@@ -981,6 +1013,13 @@ export class WorkspaceInstanceStatus extends Message<WorkspaceInstanceStatus> {
    */
   admission = AdmissionLevel.UNSPECIFIED;
 
+  /**
+   * ports is the list of exposed ports in the workspace.
+   *
+   * @generated from field: repeated gitpod.experimental.v1.Port ports = 7;
+   */
+  ports: Port[] = [];
+
   constructor(data?: PartialMessage<WorkspaceInstanceStatus>) {
     super();
     proto3.util.initPartial(data, this);
@@ -995,6 +1034,7 @@ export class WorkspaceInstanceStatus extends Message<WorkspaceInstanceStatus> {
     { no: 4, name: "message", kind: "scalar", T: 9 /* ScalarType.STRING */ },
     { no: 5, name: "url", kind: "scalar", T: 9 /* ScalarType.STRING */ },
     { no: 6, name: "admission", kind: "enum", T: proto3.getEnumType(AdmissionLevel) },
+    { no: 7, name: "ports", kind: "message", T: Port, repeated: true },
   ]);
 
   static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): WorkspaceInstanceStatus {
@@ -1183,6 +1223,61 @@ export class WorkspaceInstanceStatus_Conditions extends Message<WorkspaceInstanc
   }
 }
 
+/**
+ * @generated from message gitpod.experimental.v1.Port
+ */
+export class Port extends Message<Port> {
+  /**
+   * port number
+   *
+   * @generated from field: uint64 port = 1;
+   */
+  port = protoInt64.zero;
+
+  /**
+   * policy of this port
+   *
+   * @generated from field: gitpod.experimental.v1.PortPolicy policy = 2;
+   */
+  policy = PortPolicy.UNSPECIFIED;
+
+  /**
+   * url that can be used to access the port
+   *
+   * @generated from field: string url = 3;
+   */
+  url = "";
+
+  constructor(data?: PartialMessage<Port>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.Port";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "port", kind: "scalar", T: 4 /* ScalarType.UINT64 */ },
+    { no: 2, name: "policy", kind: "enum", T: proto3.getEnumType(PortPolicy) },
+    { no: 3, name: "url", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Port {
+    return new Port().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Port {
+    return new Port().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Port {
+    return new Port().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Port | PlainMessage<Port> | undefined, b: Port | PlainMessage<Port> | undefined): boolean {
+    return proto3.util.equals(Port, a, b);
+  }
+}
+
 /**
  * StartWorkspaceSpec influences the workspace start
  *
@@ -1217,3 +1312,124 @@ export class StartWorkspaceSpec extends Message<StartWorkspaceSpec> {
     return proto3.util.equals(StartWorkspaceSpec, a, b);
   }
 }
+
+/**
+ * @generated from message gitpod.experimental.v1.PortSpec
+ */
+export class PortSpec extends Message<PortSpec> {
+  /**
+   * port number
+   *
+   * @generated from field: uint64 port = 1;
+   */
+  port = protoInt64.zero;
+
+  /**
+   * policy of this port
+   *
+   * @generated from field: gitpod.experimental.v1.PortPolicy policy = 2;
+   */
+  policy = PortPolicy.UNSPECIFIED;
+
+  constructor(data?: PartialMessage<PortSpec>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.PortSpec";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "port", kind: "scalar", T: 4 /* ScalarType.UINT64 */ },
+    { no: 2, name: "policy", kind: "enum", T: proto3.getEnumType(PortPolicy) },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PortSpec {
+    return new PortSpec().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PortSpec {
+    return new PortSpec().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PortSpec {
+    return new PortSpec().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: PortSpec | PlainMessage<PortSpec> | undefined, b: PortSpec | PlainMessage<PortSpec> | undefined): boolean {
+    return proto3.util.equals(PortSpec, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.UpdatePortRequest
+ */
+export class UpdatePortRequest extends Message<UpdatePortRequest> {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId = "";
+
+  /**
+   * @generated from field: gitpod.experimental.v1.PortSpec port = 2;
+   */
+  port?: PortSpec;
+
+  constructor(data?: PartialMessage<UpdatePortRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.UpdatePortRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "workspace_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "port", kind: "message", T: PortSpec },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdatePortRequest {
+    return new UpdatePortRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdatePortRequest {
+    return new UpdatePortRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdatePortRequest {
+    return new UpdatePortRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: UpdatePortRequest | PlainMessage<UpdatePortRequest> | undefined, b: UpdatePortRequest | PlainMessage<UpdatePortRequest> | undefined): boolean {
+    return proto3.util.equals(UpdatePortRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message gitpod.experimental.v1.UpdatePortResponse
+ */
+export class UpdatePortResponse extends Message<UpdatePortResponse> {
+  constructor(data?: PartialMessage<UpdatePortResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime = proto3;
+  static readonly typeName = "gitpod.experimental.v1.UpdatePortResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdatePortResponse {
+    return new UpdatePortResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdatePortResponse {
+    return new UpdatePortResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdatePortResponse {
+    return new UpdatePortResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: UpdatePortResponse | PlainMessage<UpdatePortResponse> | undefined, b: UpdatePortResponse | PlainMessage<UpdatePortResponse> | undefined): boolean {
+    return proto3.util.equals(UpdatePortResponse, a, b);
+  }
+}