diff --git a/internal/credential/service_list_credentials_ext_test.go b/internal/credential/service_list_credentials_ext_test.go
index 474769a84f..abe81a7250 100644
--- a/internal/credential/service_list_credentials_ext_test.go
+++ b/internal/credential/service_list_credentials_ext_test.go
@@ -145,7 +145,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), "some-id", fiveDaysAgo)
+			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), "some-id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListPage(ctx, nil, 1, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing grants hash")
@@ -155,7 +155,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), "some-id", fiveDaysAgo)
+			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), "some-id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListPage(ctx, []byte("some hash"), 0, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "page size must be at least 1")
@@ -165,14 +165,14 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), "some-id", fiveDaysAgo)
+			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), "some-id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListPage(ctx, []byte("some hash"), -1, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "page size must be at least 1")
 		})
 		t.Run("nil filter func", func(t *testing.T) {
 			t.Parallel()
-			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), "some-id", fiveDaysAgo)
+			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), "some-id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListPage(ctx, []byte("some hash"), 1, nil, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing filter item callback")
@@ -190,7 +190,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
+			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListPage(ctx, []byte("some hash"), 1, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "token did not have a pagination token component")
@@ -200,7 +200,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), "some-id", fiveDaysAgo)
+			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), "some-id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListPage(ctx, []byte("some hash"), 1, filterFunc, tok, nil, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing service")
@@ -210,7 +210,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), "some-id", fiveDaysAgo)
+			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), "some-id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListPage(ctx, []byte("some hash"), 1, filterFunc, tok, repo, "")
 			require.ErrorContains(t, err, "missing credential store ID")
@@ -223,7 +223,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
+			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefresh(ctx, nil, 1, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing grants hash")
@@ -233,7 +233,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
+			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefresh(ctx, []byte("some hash"), 0, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "page size must be at least 1")
@@ -243,14 +243,14 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
+			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefresh(ctx, []byte("some hash"), -1, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "page size must be at least 1")
 		})
 		t.Run("nil filter func", func(t *testing.T) {
 			t.Parallel()
-			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
+			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefresh(ctx, []byte("some hash"), 1, nil, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing filter item callback")
@@ -268,7 +268,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
+			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefresh(ctx, []byte("some hash"), 1, filterFunc, tok, nil, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing service")
@@ -278,7 +278,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
+			tok, err := listtoken.NewStartRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefresh(ctx, []byte("some hash"), 1, filterFunc, tok, repo, "")
 			require.ErrorContains(t, err, "missing credential store ID")
@@ -291,7 +291,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
+			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefreshPage(ctx, nil, 1, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing grants hash")
@@ -301,7 +301,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
+			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefreshPage(ctx, []byte("some hash"), 0, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "page size must be at least 1")
@@ -311,14 +311,14 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
+			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefreshPage(ctx, []byte("some hash"), -1, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "page size must be at least 1")
 		})
 		t.Run("nil filter func", func(t *testing.T) {
 			t.Parallel()
-			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
+			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefreshPage(ctx, []byte("some hash"), 1, nil, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing filter item callback")
@@ -336,7 +336,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), "some-id", fiveDaysAgo)
+			tok, err := listtoken.NewPagination(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), "some-id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefreshPage(ctx, []byte("some hash"), 1, filterFunc, tok, repo, credStore.GetPublicId())
 			require.ErrorContains(t, err, "token did not have a refresh token component")
@@ -346,7 +346,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
+			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefreshPage(ctx, []byte("some hash"), 1, filterFunc, tok, nil, credStore.GetPublicId())
 			require.ErrorContains(t, err, "missing service")
@@ -356,7 +356,7 @@ func TestService_List(t *testing.T) {
 			filterFunc := func(_ context.Context, c credential.Static) (bool, error) {
 				return true, nil
 			}
-			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Target, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
+			tok, err := listtoken.NewRefresh(ctx, fiveDaysAgo, resource.Credential, []byte("some hash"), fiveDaysAgo, fiveDaysAgo, fiveDaysAgo, "some other id", fiveDaysAgo)
 			require.NoError(t, err)
 			_, err = credential.ListRefreshPage(ctx, []byte("some hash"), 1, filterFunc, tok, repo, "")
 			require.ErrorContains(t, err, "missing credential store ID")