diff --git a/go.sum b/go.sum
index 5b7d45908cd..21b4238a585 100644
--- a/go.sum
+++ b/go.sum
@@ -103,8 +103,6 @@ github.com/bmatcuk/doublestar/v2 v2.0.3/go.mod h1:QMmcs3H2AUQICWhfzLXz+IYln8lRQm
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/bmizerany/pat v0.0.0-20170815010413-6226ea591a40 h1:y4B3+GPxKlrigF1ha5FFErxK+sr6sWxQovRMzwMhejo=
 github.com/bmizerany/pat v0.0.0-20170815010413-6226ea591a40/go.mod h1:8rLXio+WjiTceGBHIoTvn60HIbs7Hm7bcHjyrSqYB9c=
-github.com/butonic/go-cs3apis v0.0.0-20210608111428-0b2c079174c9 h1:q2UFrmiIZwdFOislnGjUWlyqIpttjBRIB6K3QOUmZkY=
-github.com/butonic/go-cs3apis v0.0.0-20210608111428-0b2c079174c9/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
 github.com/c-bata/go-prompt v0.2.5 h1:3zg6PecEywxNn0xiqcXHD96fkbxghD+gdB2tbsYfl+Y=
 github.com/c-bata/go-prompt v0.2.5/go.mod h1:vFnjEGDIIA/Lib7giyE4E9c50Lvl8j0S+7FVlAwDAVw=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
@@ -152,6 +150,8 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cs3org/cato v0.0.0-20200828125504-e418fc54dd5e h1:tqSPWQeueWTKnJVMJffz4pz0o1WuQxJ28+5x5JgaHD8=
 github.com/cs3org/cato v0.0.0-20200828125504-e418fc54dd5e/go.mod h1:XJEZ3/EQuI3BXTp/6DUzFr850vlxq11I6satRtz0YQ4=
+github.com/cs3org/go-cs3apis v0.0.0-20210614143420-5ee2eb1e7887 h1:X5Se3M/kbh9w6LZQvyLS7djAGKcWGzmaY6IOa7Talpk=
+github.com/cs3org/go-cs3apis v0.0.0-20210614143420-5ee2eb1e7887/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
 github.com/cucumber/godog v0.8.1/go.mod h1:vSh3r/lM+psC1BPXvdkSEuNjmXfpVqrMGYAElF6hxnA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
diff --git a/internal/grpc/services/gateway/ocmshareprovider.go b/internal/grpc/services/gateway/ocmshareprovider.go
index a64f2dc326e..d1d686a846d 100644
--- a/internal/grpc/services/gateway/ocmshareprovider.go
+++ b/internal/grpc/services/gateway/ocmshareprovider.go
@@ -54,8 +54,7 @@ func (s *svc) CreateOCMShare(ctx context.Context, req *ocm.CreateOCMShareRequest
 
 	// TODO(labkode): if both commits are enabled they could be done concurrently.
 	if s.c.CommitShareToStorageGrant {
-		rid := &provider.Reference{ResourceId: req.ResourceId}
-		addGrantStatus, err := s.addGrant(ctx, rid, req.Grant.Grantee, req.Grant.Permissions.Permissions)
+		addGrantStatus, err := s.addGrant(ctx, req.ResourceId, req.Grant.Grantee, req.Grant.Permissions.Permissions)
 		if err != nil {
 			return nil, errors.Wrap(err, "gateway: error adding OCM grant to storage")
 		}
@@ -110,8 +109,7 @@ func (s *svc) RemoveOCMShare(ctx context.Context, req *ocm.RemoveOCMShareRequest
 
 	// TODO(labkode): if both commits are enabled they could be done concurrently.
 	if s.c.CommitShareToStorageGrant {
-		rid := &provider.Reference{ResourceId: share.ResourceId}
-		removeGrantStatus, err := s.removeGrant(ctx, rid, share.Grantee, share.Permissions.Permissions)
+		removeGrantStatus, err := s.removeGrant(ctx, share.ResourceId, share.Grantee, share.Permissions.Permissions)
 		if err != nil {
 			return nil, errors.Wrap(err, "gateway: error removing OCM grant from storage")
 		}
diff --git a/internal/grpc/services/gateway/storageprovider.go b/internal/grpc/services/gateway/storageprovider.go
index c2d688dd77f..466bb7f3036 100644
--- a/internal/grpc/services/gateway/storageprovider.go
+++ b/internal/grpc/services/gateway/storageprovider.go
@@ -122,9 +122,16 @@ func (s *svc) ListStorageSpaces(ctx context.Context, req *provider.ListStorageSp
 			id = f.GetId()
 		}
 	}
-	c, err := s.find(ctx, &provider.Reference{
-		StorageId: id.OpaqueId, // FIXME REFERENCE the StorageSpaceId is a storageid + a nodeid
-	})
+	parts := strings.SplitN(id.OpaqueId, "!", 2)
+	if len(parts) != 2 {
+		return &provider.ListStorageSpacesResponse{
+			Status: status.NewInvalidArg(ctx, "space id must be separated by !"),
+		}, nil
+	}
+	c, err := s.find(ctx, &provider.Reference{ResourceId: &provider.ResourceId{
+		StorageId: parts[0], // FIXME REFERENCE the StorageSpaceId is a storageid + a opaqueid
+		OpaqueId:  parts[1],
+	}})
 	if err != nil {
 		return &provider.ListStorageSpacesResponse{
 			Status: status.NewStatusFromErrType(ctx, "error finding path", err),
@@ -144,7 +151,7 @@ func (s *svc) ListStorageSpaces(ctx context.Context, req *provider.ListStorageSp
 func (s *svc) UpdateStorageSpace(ctx context.Context, req *provider.UpdateStorageSpaceRequest) (*provider.UpdateStorageSpaceResponse, error) {
 	log := appctx.GetLogger(ctx)
 	// TODO: needs to be fixed
-	c, err := s.find(ctx, req.StorageSpace.Root)
+	c, err := s.find(ctx, &provider.Reference{ResourceId: req.StorageSpace.Root})
 	if err != nil {
 		return &provider.UpdateStorageSpaceResponse{
 			Status: status.NewStatusFromErrType(ctx, "error finding ID", err),
@@ -164,9 +171,16 @@ func (s *svc) UpdateStorageSpace(ctx context.Context, req *provider.UpdateStorag
 func (s *svc) DeleteStorageSpace(ctx context.Context, req *provider.DeleteStorageSpaceRequest) (*provider.DeleteStorageSpaceResponse, error) {
 	log := appctx.GetLogger(ctx)
 	// TODO: needs to be fixed
-	c, err := s.find(ctx, &provider.Reference{
-		StorageId: req.Id.OpaqueId, // FIXME REFERENCE the StorageSpaceId is a storageid + a nodeid
-	})
+	parts := strings.SplitN(req.Id.OpaqueId, "!", 2)
+	if len(parts) != 2 {
+		return &provider.DeleteStorageSpaceResponse{
+			Status: status.NewInvalidArg(ctx, "space id must be separated by !"),
+		}, nil
+	}
+	c, err := s.find(ctx, &provider.Reference{ResourceId: &provider.ResourceId{
+		StorageId: parts[0], // FIXME REFERENCE the StorageSpaceId is a storageid + a opaqueid
+		OpaqueId:  parts[1],
+	}})
 	if err != nil {
 		return &provider.DeleteStorageSpaceResponse{
 			Status: status.NewStatusFromErrType(ctx, "error finding path", err),
@@ -185,7 +199,7 @@ func (s *svc) DeleteStorageSpace(ctx context.Context, req *provider.DeleteStorag
 
 func (s *svc) GetHome(ctx context.Context, _ *provider.GetHomeRequest) (*provider.GetHomeResponse, error) {
 	home := s.getHome(ctx)
-	homeRes := &provider.GetHomeResponse{Ref: &provider.Reference{Path: home}, Status: status.NewOK(ctx)}
+	homeRes := &provider.GetHomeResponse{Path: home, Status: status.NewOK(ctx)}
 	return homeRes, nil
 }
 
@@ -283,7 +297,7 @@ func (s *svc) InitiateFileDownload(ctx context.Context, req *provider.InitiateFi
 		if ri.Type == provider.ResourceType_RESOURCE_TYPE_FILE {
 			log.Debug().Str("path", p).Interface("ri", ri).Msg("path points to share name file")
 			req.Ref.Path = ri.Path
-			log.Debug().Str("storage", ri.Id.StorageId).Str("node", ri.Id.NodeId).Str("path", req.Ref.Path).Msg("download")
+			log.Debug().Str("path", ri.Path).Msg("download")
 			return s.initiateFileDownload(ctx, req)
 		}
 
@@ -345,7 +359,7 @@ func (s *svc) InitiateFileDownload(ctx context.Context, req *provider.InitiateFi
 
 		// append child to target
 		req.Ref.Path = path.Join(ri.Path, shareChild)
-		log.Debug().Str("storage", ri.Id.StorageId).Str("node", ri.Id.NodeId).Str("path", req.Ref.Path).Msg("download")
+		log.Debug().Str("path", req.Ref.Path).Msg("download")
 		return s.initiateFileDownload(ctx, req)
 	}
 
@@ -482,7 +496,7 @@ func (s *svc) InitiateFileUpload(ctx context.Context, req *provider.InitiateFile
 		if ri.Type == provider.ResourceType_RESOURCE_TYPE_FILE {
 			log.Debug().Str("path", p).Interface("ri", ri).Msg("path points to share name file")
 			req.Ref.Path = ri.Path
-			log.Debug().Str("storage", req.Ref.StorageId).Str("node", req.Ref.NodeId).Str("path", req.Ref.Path).Msg("upload")
+			log.Debug().Str("path", ri.Path).Msg("upload")
 			return s.initiateFileUpload(ctx, req)
 		}
 
@@ -607,7 +621,7 @@ func (s *svc) initiateFileUpload(ctx context.Context, req *provider.InitiateFile
 }
 
 func (s *svc) GetPath(ctx context.Context, req *provider.GetPathRequest) (*provider.GetPathResponse, error) {
-	statReq := &provider.StatRequest{Ref: req.ResourceId}
+	statReq := &provider.StatRequest{Ref: &provider.Reference{ResourceId: req.ResourceId}}
 	statRes, err := s.stat(ctx, statReq)
 	if err != nil {
 		err = errors.Wrap(err, "gateway: error stating ref:"+statReq.Ref.String())
@@ -1108,9 +1122,9 @@ func (s *svc) stat(ctx context.Context, req *provider.StatRequest) (*provider.St
 	return &provider.StatResponse{
 		Status: status.NewOK(ctx),
 		Info: &provider.ResourceInfo{
-			Id: &provider.Reference{
+			Id: &provider.ResourceId{
 				StorageId: "/",
-				NodeId:    uuid.New().String(),
+				OpaqueId:  uuid.New().String(),
 			},
 			Type: provider.ResourceType_RESOURCE_TYPE_CONTAINER,
 			Path: resPath,
@@ -1307,8 +1321,10 @@ func (s *svc) handleCS3Ref(ctx context.Context, opaque string) (*provider.Resour
 
 	req := &provider.StatRequest{
 		Ref: &provider.Reference{
-			StorageId: parts[0],
-			NodeId:    parts[1],
+			ResourceId: &provider.ResourceId{
+				StorageId: parts[0],
+				OpaqueId:  parts[1],
+			},
 		},
 	}
 	res, err := s.stat(ctx, req)
@@ -1460,9 +1476,9 @@ func (s *svc) listContainer(ctx context.Context, req *provider.ListContainerRequ
 
 	for k, v := range indirects {
 		inf := &provider.ResourceInfo{
-			Id: &provider.Reference{
+			Id: &provider.ResourceId{
 				StorageId: "/",
-				NodeId:    uuid.New().String(),
+				OpaqueId:  uuid.New().String(),
 			},
 			Type: provider.ResourceType_RESOURCE_TYPE_CONTAINER,
 			Etag: etag.GenerateEtagFromResources(nil, v),
@@ -1679,7 +1695,7 @@ func (s *svc) ListContainer(ctx context.Context, req *provider.ListContainerRequ
 func (s *svc) getPath(ctx context.Context, ref *provider.Reference, keys ...string) (string, *rpc.Status) {
 
 	// check if it is an id based or combined reference first
-	if ref.StorageId != "" && ref.NodeId != "" {
+	if ref.ResourceId != nil {
 		req := &provider.StatRequest{Ref: ref, ArbitraryMetadataKeys: keys}
 		res, err := s.stat(ctx, req)
 		if (res != nil && res.Status.Code != rpc.Code_CODE_OK) || err != nil {
@@ -1689,7 +1705,7 @@ func (s *svc) getPath(ctx context.Context, ref *provider.Reference, keys ...stri
 		return res.Info.Path, res.Status
 	}
 
-	if ref.StorageId == "" && ref.NodeId == "" && ref.Path != "" {
+	if ref.Path != "" {
 		return ref.Path, &rpc.Status{Code: rpc.Code_CODE_OK}
 	}
 	return "", &rpc.Status{Code: rpc.Code_CODE_INTERNAL}
diff --git a/internal/grpc/services/ocmcore/ocmcore.go b/internal/grpc/services/ocmcore/ocmcore.go
index fd41802957a..81ae633154d 100644
--- a/internal/grpc/services/ocmcore/ocmcore.go
+++ b/internal/grpc/services/ocmcore/ocmcore.go
@@ -116,11 +116,9 @@ func (s *service) CreateOCMCoreShare(ctx context.Context, req *ocmcore.CreateOCM
 		}, nil
 	}
 
-	resource := &provider.Reference{
-		ResourceId: &provider.ResourceId{
-			StorageId: parts[0],
-			OpaqueId:  parts[1],
-		},
+	resource := &provider.ResourceId{
+		StorageId: parts[0],
+		OpaqueId:  parts[1],
 	}
 
 	var resourcePermissions *provider.ResourcePermissions
diff --git a/internal/grpc/services/publicstorageprovider/publicstorageprovider.go b/internal/grpc/services/publicstorageprovider/publicstorageprovider.go
index 50273357afd..b53f5adf070 100644
--- a/internal/grpc/services/publicstorageprovider/publicstorageprovider.go
+++ b/internal/grpc/services/publicstorageprovider/publicstorageprovider.go
@@ -573,7 +573,7 @@ func filterPermissions(l *provider.ResourcePermissions, r *provider.ResourcePerm
 }
 
 func (s *service) unwrap(ctx context.Context, ref *provider.Reference) (token string, relativePath string, err error) {
-	if ref.ResourceId.StorageId != "" || ref.ResourceId.OpaqueId != "" {
+	if ref.ResourceId != nil {
 		return "", "", errtypes.BadRequest("need absolute path ref: got " + ref.String())
 	}
 
diff --git a/internal/grpc/services/storageprovider/storageprovider.go b/internal/grpc/services/storageprovider/storageprovider.go
index 9753d695edf..d3eee4d1637 100644
--- a/internal/grpc/services/storageprovider/storageprovider.go
+++ b/internal/grpc/services/storageprovider/storageprovider.go
@@ -400,7 +400,7 @@ func (s *service) GetHome(ctx context.Context, req *provider.GetHomeRequest) (*p
 
 	res := &provider.GetHomeResponse{
 		Status: status.NewOK(ctx),
-		Ref:    &provider.Reference{Path: home},
+		Path:   home,
 	}
 
 	return res, nil
@@ -839,8 +839,8 @@ func (s *service) RestoreRecycleItem(ctx context.Context, req *provider.RestoreR
 
 func (s *service) PurgeRecycle(ctx context.Context, req *provider.PurgeRecycleRequest) (*provider.PurgeRecycleResponse, error) {
 	// if a key was sent as opacque id purge only that item
-	if req.GetRef() != nil && req.GetRef().NodeId != "" {
-		if err := s.storage.PurgeRecycleItem(ctx, req.GetRef().NodeId); err != nil {
+	if req.GetRef() != nil && req.GetRef().GetResourceId().OpaqueId != "" {
+		if err := s.storage.PurgeRecycleItem(ctx, req.GetRef().GetResourceId().OpaqueId); err != nil {
 			var st *rpc.Status
 			switch err.(type) {
 			case errtypes.IsNotFound:
@@ -1095,7 +1095,7 @@ func getFS(c *config) (storage.FS, error) {
 }
 
 func (s *service) unwrap(ctx context.Context, ref *provider.Reference) (*provider.Reference, error) {
-	if ref.StorageId != "" {
+	if ref.GetResourceId() != nil {
 		return ref, nil
 	}
 
diff --git a/internal/http/services/owncloud/ocdav/ocdav.go b/internal/http/services/owncloud/ocdav/ocdav.go
index a5a708e8bb9..c2b7561cf2b 100644
--- a/internal/http/services/owncloud/ocdav/ocdav.go
+++ b/internal/http/services/owncloud/ocdav/ocdav.go
@@ -206,8 +206,8 @@ func applyLayout(ctx context.Context, ns string, useLoggedInUserNS bool, request
 	return templates.WithUser(u, ns)
 }
 
-func wrapResourceID(r *provider.Reference) string {
-	return wrap(r.ResourceId.StorageId, r.ResourceId.OpaqueId)
+func wrapResourceID(r *provider.ResourceId) string {
+	return wrap(r.StorageId, r.OpaqueId)
 }
 
 // The fileID must be encoded
@@ -218,7 +218,7 @@ func wrap(sid string, oid string) string {
 	return base64.URLEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", sid, oid)))
 }
 
-func unwrap(rid string) *provider.Reference {
+func unwrap(rid string) *provider.ResourceId {
 	decodedID, err := base64.URLEncoding.DecodeString(rid)
 	if err != nil {
 		return nil
@@ -233,11 +233,9 @@ func unwrap(rid string) *provider.Reference {
 		return nil
 	}
 
-	return &provider.Reference{
-		ResourceId: &provider.ResourceId{
-			StorageId: parts[0],
-			OpaqueId:  parts[1],
-		},
+	return &provider.ResourceId{
+		StorageId: parts[0],
+		OpaqueId:  parts[1],
 	}
 }
 
diff --git a/internal/http/services/owncloud/ocdav/put.go b/internal/http/services/owncloud/ocdav/put.go
index 2381a28d803..7a9ad49963b 100644
--- a/internal/http/services/owncloud/ocdav/put.go
+++ b/internal/http/services/owncloud/ocdav/put.go
@@ -333,7 +333,7 @@ func (s *svc) handlePutHelper(w http.ResponseWriter, r *http.Request, content io
 
 	w.Header().Add("Content-Type", newInfo.MimeType)
 	w.Header().Set("ETag", newInfo.Etag)
-	w.Header().Set("OC-FileId", wrapResourceID(&provider.Reference{ResourceId: newInfo.Id}))
+	w.Header().Set("OC-FileId", wrapResourceID(newInfo.Id))
 	w.Header().Set("OC-ETag", newInfo.Etag)
 	t := utils.TSToTime(newInfo.Mtime).UTC()
 	lastModifiedString := t.Format(time.RFC1123Z)
diff --git a/internal/http/services/owncloud/ocdav/versions.go b/internal/http/services/owncloud/ocdav/versions.go
index fad6182b3ee..af3644cbdfb 100644
--- a/internal/http/services/owncloud/ocdav/versions.go
+++ b/internal/http/services/owncloud/ocdav/versions.go
@@ -42,7 +42,7 @@ func (h *VersionsHandler) init(c *Config) error {
 // Handler handles requests
 // versions can be listed with a PROPFIND to /remote.php/dav/meta/<fileid>/v
 // a version is identified by a timestamp, eg. /remote.php/dav/meta/<fileid>/v/1561410426
-func (h *VersionsHandler) Handler(s *svc, rid *provider.Reference) http.Handler {
+func (h *VersionsHandler) Handler(s *svc, rid *provider.ResourceId) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
@@ -78,7 +78,7 @@ func (h *VersionsHandler) Handler(s *svc, rid *provider.Reference) http.Handler
 	})
 }
 
-func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request, s *svc, rid *provider.Reference) {
+func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request, s *svc, rid *provider.ResourceId) {
 	ctx := r.Context()
 	ctx, span := trace.StartSpan(ctx, "listVersions")
 	defer span.End()
@@ -99,8 +99,8 @@ func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request,
 		return
 	}
 
-	req := &provider.StatRequest{Ref: rid}
-	res, err := client.Stat(ctx, req)
+	ref := &provider.Reference{ResourceId: rid}
+	res, err := client.Stat(ctx, &provider.StatRequest{Ref: ref})
 	if err != nil {
 		sublog.Error().Err(err).Msg("error sending a grpc stat request")
 		w.WriteHeader(http.StatusInternalServerError)
@@ -113,10 +113,7 @@ func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request,
 
 	info := res.Info
 
-	lvReq := &provider.ListFileVersionsRequest{
-		Ref: rid,
-	}
-	lvRes, err := client.ListFileVersions(ctx, lvReq)
+	lvRes, err := client.ListFileVersions(ctx, &provider.ListFileVersionsRequest{Ref: ref})
 	if err != nil {
 		sublog.Error().Err(err).Msg("error sending list container grpc request")
 		w.WriteHeader(http.StatusInternalServerError)
@@ -175,7 +172,7 @@ func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request,
 
 }
 
-func (h *VersionsHandler) doRestore(w http.ResponseWriter, r *http.Request, s *svc, rid *provider.Reference, key string) {
+func (h *VersionsHandler) doRestore(w http.ResponseWriter, r *http.Request, s *svc, rid *provider.ResourceId, key string) {
 	ctx := r.Context()
 	ctx, span := trace.StartSpan(ctx, "restore")
 	defer span.End()
@@ -190,7 +187,7 @@ func (h *VersionsHandler) doRestore(w http.ResponseWriter, r *http.Request, s *s
 	}
 
 	req := &provider.RestoreFileVersionRequest{
-		Ref: rid,
+		Ref: &provider.Reference{ResourceId: rid},
 		Key: key,
 	}
 
diff --git a/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go b/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
index 831ed994152..5e5115e23e5 100644
--- a/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
+++ b/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
@@ -160,7 +160,7 @@ func (h *Handler) listPublicShares(r *http.Request, filters []*link.ListPublicSh
 		}
 
 		for _, share := range res.GetShare() {
-			info, status, err := h.getResourceInfoByID(ctx, client, &provider.Reference{ResourceId: share.ResourceId})
+			info, status, err := h.getResourceInfoByID(ctx, client, share.ResourceId)
 			if err != nil || status.Code != rpc.Code_CODE_OK {
 				log.Debug().Interface("share", share).Interface("status", status).Err(err).Msg("could not stat share, skipping")
 				continue
diff --git a/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go b/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
index d56dc774eb2..0c4306455c3 100644
--- a/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
+++ b/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
@@ -112,7 +112,7 @@ func (h *Handler) startCacheWarmup(c cache.Warmup) {
 		return
 	}
 	for _, r := range infos {
-		key := wrapResourceID(&provider.Reference{ResourceId: r.Id})
+		key := wrapResourceID(r.Id)
 		_ = h.resourceInfoCache.SetWithExpire(key, r, time.Second*h.resourceInfoCacheTTL)
 	}
 }
@@ -331,7 +331,7 @@ type PublicShareContextName string
 
 func (h *Handler) getShare(w http.ResponseWriter, r *http.Request, shareID string) {
 	var share *conversions.ShareData
-	var reference *provider.Reference
+	var resourceID *provider.ResourceId
 	ctx := r.Context()
 	logger := appctx.GetLogger(r.Context())
 	logger.Debug().Str("shareID", shareID).Msg("get share by id")
@@ -371,9 +371,7 @@ func (h *Handler) getShare(w http.ResponseWriter, r *http.Request, shareID strin
 
 	if err == nil && psRes.GetShare() != nil {
 		share = conversions.PublicShare2ShareData(psRes.Share, r, h.publicURL)
-		reference = &provider.Reference{
-			ResourceId: psRes.Share.ResourceId,
-		}
+		resourceID = psRes.Share.ResourceId
 	}
 
 	if share == nil {
@@ -406,9 +404,7 @@ func (h *Handler) getShare(w http.ResponseWriter, r *http.Request, shareID strin
 		*/
 
 		if err == nil && uRes.GetShare() != nil {
-			reference = &provider.Reference{
-				ResourceId: uRes.Share.ResourceId,
-			}
+			resourceID = uRes.Share.ResourceId
 			share, err = conversions.CS3Share2ShareData(ctx, uRes.Share)
 			if err != nil {
 				response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "error mapping share data", err)
@@ -423,7 +419,7 @@ func (h *Handler) getShare(w http.ResponseWriter, r *http.Request, shareID strin
 		return
 	}
 
-	info, status, err := h.getResourceInfoByID(ctx, client, reference)
+	info, status, err := h.getResourceInfoByID(ctx, client, resourceID)
 	if err != nil {
 		log.Error().Err(err).Msg("error mapping share data")
 		response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "error mapping share data", err)
@@ -630,7 +626,7 @@ func (h *Handler) listSharesWithMe(w http.ResponseWriter, r *http.Request) {
 			info = pinfo
 		} else {
 			var status *rpc.Status
-			info, status, err = h.getResourceInfoByID(ctx, client, &provider.Reference{ResourceId: rs.Share.ResourceId})
+			info, status, err = h.getResourceInfoByID(ctx, client, rs.Share.ResourceId)
 			if err != nil || status.Code != rpc.Code_CODE_OK {
 				h.logProblems(status, err, "could not stat, skipping")
 				continue
@@ -768,8 +764,8 @@ func (h *Handler) addFilters(w http.ResponseWriter, r *http.Request, prefix stri
 	return collaborationFilters, linkFilters, nil
 }
 
-func wrapResourceID(r *provider.Reference) string {
-	return wrap(r.ResourceId.StorageId, r.ResourceId.OpaqueId)
+func wrapResourceID(r *provider.ResourceId) string {
+	return wrap(r.StorageId, r.OpaqueId)
 }
 
 // The fileID must be encoded
@@ -793,7 +789,7 @@ func (h *Handler) addFileInfo(ctx context.Context, s *conversions.ShareData, inf
 		// TODO STime:     &types.Timestamp{Seconds: info.Mtime.Seconds, Nanos: info.Mtime.Nanos},
 		s.StorageID = info.Id.StorageId + "!" + info.Id.OpaqueId
 		// TODO Storage: int
-		s.ItemSource = wrapResourceID(&provider.Reference{ResourceId: info.Id})
+		s.ItemSource = wrapResourceID(info.Id)
 		s.FileSource = s.ItemSource
 		s.FileTarget = path.Join("/", path.Base(info.Path))
 		s.Path = path.Join("/", path.Base(info.Path)) // TODO hm this might have to be relative to the users home ... depends on the webdav_namespace config
@@ -943,8 +939,8 @@ func (h *Handler) getResourceInfoByPath(ctx context.Context, client gateway.Gate
 	})
 }
 
-func (h *Handler) getResourceInfoByID(ctx context.Context, client gateway.GatewayAPIClient, id *provider.Reference) (*provider.ResourceInfo, *rpc.Status, error) {
-	return h.getResourceInfo(ctx, client, wrapResourceID(id), id)
+func (h *Handler) getResourceInfoByID(ctx context.Context, client gateway.GatewayAPIClient, id *provider.ResourceId) (*provider.ResourceInfo, *rpc.Status, error) {
+	return h.getResourceInfo(ctx, client, wrapResourceID(id), &provider.Reference{ResourceId: id})
 }
 
 // getResourceInfo retrieves the resource info to a target.
diff --git a/pkg/auth/scope/publicshare.go b/pkg/auth/scope/publicshare.go
index 872ff56d100..7a2e9ed8b76 100644
--- a/pkg/auth/scope/publicshare.go
+++ b/pkg/auth/scope/publicshare.go
@@ -72,7 +72,7 @@ func publicshareScope(scope *authpb.Scope, resource interface{}) (bool, error) {
 
 func checkStorageRef(s *link.PublicShare, r *provider.Reference) bool {
 	// r: <id:<storage_id:$storageID node_id:$nodeID path:$path > >
-	if (r.ResourceId.StorageId != "" || r.ResourceId.OpaqueId != "") && r.Path == "" { // path must be empty
+	if r.ResourceId != nil && r.Path == "" { // path must be empty
 		return s.ResourceId.StorageId == r.ResourceId.StorageId && s.ResourceId.OpaqueId == r.ResourceId.OpaqueId
 	}
 
diff --git a/pkg/auth/scope/resourceinfo.go b/pkg/auth/scope/resourceinfo.go
index fe359294109..3d90770df1e 100644
--- a/pkg/auth/scope/resourceinfo.go
+++ b/pkg/auth/scope/resourceinfo.go
@@ -69,7 +69,8 @@ func resourceinfoScope(scope *authpb.Scope, resource interface{}) (bool, error)
 
 func checkResourceInfo(inf *provider.ResourceInfo, ref *provider.Reference) bool {
 	// ref: <id:<storage_id:$storageID node_id:$nodeID path:$path> >
-	if ref.ResourceId.StorageId != "" || ref.ResourceId.OpaqueId != "" { // path can be empty or a relative path
+	if ref.ResourceId != nil { // path can be empty or a relative path
+		// TODO what about the path?
 		return inf.Id.StorageId == ref.ResourceId.StorageId && inf.Id.OpaqueId == ref.ResourceId.OpaqueId
 	}
 	// ref: <path:$path >
diff --git a/pkg/ocm/share/manager/json/json.go b/pkg/ocm/share/manager/json/json.go
index f952ad12d88..3168f4951ac 100644
--- a/pkg/ocm/share/manager/json/json.go
+++ b/pkg/ocm/share/manager/json/json.go
@@ -195,7 +195,7 @@ func getOCMEndpoint(originProvider *ocmprovider.ProviderInfo) (string, error) {
 	return "", errors.New("json: ocm endpoint not specified for mesh provider")
 }
 
-func (m *mgr) Share(ctx context.Context, md *provider.Reference, g *ocm.ShareGrant, name string,
+func (m *mgr) Share(ctx context.Context, md *provider.ResourceId, g *ocm.ShareGrant, name string,
 	pi *ocmprovider.ProviderInfo, pm string, owner *userpb.UserId, token string, st ocm.Share_ShareType) (*ocm.Share, error) {
 
 	id := genID()
@@ -243,7 +243,7 @@ func (m *mgr) Share(ctx context.Context, md *provider.Reference, g *ocm.ShareGra
 	// check if share already exists.
 	key := &ocm.ShareKey{
 		Owner:      userID,
-		ResourceId: md.ResourceId,
+		ResourceId: md,
 		Grantee:    g.Grantee,
 	}
 	_, err := m.getByKey(ctx, key)
@@ -258,7 +258,7 @@ func (m *mgr) Share(ctx context.Context, md *provider.Reference, g *ocm.ShareGra
 			OpaqueId: id,
 		},
 		Name:        name,
-		ResourceId:  md.ResourceId,
+		ResourceId:  md,
 		Permissions: g.Permissions,
 		Grantee:     g.Grantee,
 		Owner:       userID,
@@ -308,7 +308,7 @@ func (m *mgr) Share(ctx context.Context, md *provider.Reference, g *ocm.ShareGra
 		requestBody := url.Values{
 			"shareWith":    {g.Grantee.GetUserId().OpaqueId},
 			"name":         {name},
-			"providerId":   {fmt.Sprintf("%s:%s", md.ResourceId.StorageId, md.ResourceId.OpaqueId)},
+			"providerId":   {fmt.Sprintf("%s:%s", md.StorageId, md.OpaqueId)},
 			"owner":        {userID.OpaqueId},
 			"protocol":     {string(protocol)},
 			"meshProvider": {userID.Idp},
diff --git a/pkg/ocm/share/share.go b/pkg/ocm/share/share.go
index 45237d4be81..9eb439a6e04 100644
--- a/pkg/ocm/share/share.go
+++ b/pkg/ocm/share/share.go
@@ -30,7 +30,7 @@ import (
 // Manager is the interface that manipulates the OCM shares.
 type Manager interface {
 	// Create a new share in fn with the given acl.
-	Share(ctx context.Context, md *provider.Reference, g *ocm.ShareGrant, name string,
+	Share(ctx context.Context, md *provider.ResourceId, g *ocm.ShareGrant, name string,
 		pi *ocmprovider.ProviderInfo, pm string, owner *userpb.UserId, token string, st ocm.Share_ShareType) (*ocm.Share, error)
 
 	// GetShare gets the information for a share by the given ref.
diff --git a/pkg/share/manager/json/json.go b/pkg/share/manager/json/json.go
index 586978933b6..354ce478803 100644
--- a/pkg/share/manager/json/json.go
+++ b/pkg/share/manager/json/json.go
@@ -245,7 +245,7 @@ func (m *mgr) getByKey(ctx context.Context, key *collaboration.ShareKey) (*colla
 	defer m.Unlock()
 	for _, s := range m.model.Shares {
 		if (utils.UserEqual(key.Owner, s.Owner) || utils.UserEqual(key.Owner, s.Creator)) &&
-			utils.ResourceEqual(key.ResourceId, s.ResourceId) && utils.GranteeEqual(key.Grantee, s.Grantee) {
+			utils.ResourceIDEqual(key.ResourceId, s.ResourceId) && utils.GranteeEqual(key.Grantee, s.Grantee) {
 			return s, nil
 		}
 	}
@@ -323,7 +323,7 @@ func sharesEqual(ref *collaboration.ShareReference, s *collaboration.Share) bool
 		}
 	} else if ref.GetKey() != nil {
 		if (utils.UserEqual(ref.GetKey().Owner, s.Owner) || utils.UserEqual(ref.GetKey().Owner, s.Creator)) &&
-			utils.ResourceEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
+			utils.ResourceIDEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
 			return true
 		}
 	}
@@ -369,7 +369,7 @@ func (m *mgr) ListShares(ctx context.Context, filters []*collaboration.ListShare
 				// TODO(labkode): add the rest of filters.
 				for _, f := range filters {
 					if f.Type == collaboration.ListSharesRequest_Filter_TYPE_RESOURCE_ID {
-						if utils.ResourceEqual(s.ResourceId, f.GetResourceId()) {
+						if utils.ResourceIDEqual(s.ResourceId, f.GetResourceId()) {
 							ss = append(ss, s)
 						}
 					}
diff --git a/pkg/share/manager/memory/memory.go b/pkg/share/manager/memory/memory.go
index e3d6cda8bb0..6b6c3e5b4c9 100644
--- a/pkg/share/manager/memory/memory.go
+++ b/pkg/share/manager/memory/memory.go
@@ -125,7 +125,7 @@ func (m *manager) getByKey(ctx context.Context, key *collaboration.ShareKey) (*c
 	defer m.lock.Unlock()
 	for _, s := range m.shares {
 		if (utils.UserEqual(key.Owner, s.Owner) || utils.UserEqual(key.Owner, s.Creator)) &&
-			utils.ResourceEqual(key.ResourceId, s.ResourceId) && utils.GranteeEqual(key.Grantee, s.Grantee) {
+			utils.ResourceIDEqual(key.ResourceId, s.ResourceId) && utils.GranteeEqual(key.Grantee, s.Grantee) {
 			return s, nil
 		}
 	}
@@ -188,7 +188,7 @@ func sharesEqual(ref *collaboration.ShareReference, s *collaboration.Share) bool
 		}
 	} else if ref.GetKey() != nil {
 		if (utils.UserEqual(ref.GetKey().Owner, s.Owner) || utils.UserEqual(ref.GetKey().Owner, s.Creator)) &&
-			utils.ResourceEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
+			utils.ResourceIDEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
 			return true
 		}
 	}
@@ -230,7 +230,7 @@ func (m *manager) ListShares(ctx context.Context, filters []*collaboration.ListS
 				// TODO(labkode): add the rest of filters.
 				for _, f := range filters {
 					if f.Type == collaboration.ListSharesRequest_Filter_TYPE_RESOURCE_ID {
-						if utils.ResourceEqual(s.ResourceId, f.GetResourceId()) {
+						if utils.ResourceIDEqual(s.ResourceId, f.GetResourceId()) {
 							ss = append(ss, s)
 						}
 					}
diff --git a/pkg/storage/fs/owncloud/owncloud.go b/pkg/storage/fs/owncloud/owncloud.go
index dec328b203c..bad1b6d53c9 100644
--- a/pkg/storage/fs/owncloud/owncloud.go
+++ b/pkg/storage/fs/owncloud/owncloud.go
@@ -738,19 +738,19 @@ func readOrCreateID(ctx context.Context, ip string, conn redis.Conn) string {
 	return uid.String()
 }
 
-func (fs *ocfs) getPath(ctx context.Context, id *provider.Reference) (string, error) {
+func (fs *ocfs) getPath(ctx context.Context, id *provider.ResourceId) (string, error) {
 	log := appctx.GetLogger(ctx)
 	c := fs.pool.Get()
 	defer c.Close()
 	fs.scanFiles(ctx, c)
-	ip, err := redis.String(c.Do("GET", id.ResourceId.OpaqueId))
+	ip, err := redis.String(c.Do("GET", id.OpaqueId))
 	if err != nil {
-		return "", errtypes.NotFound(id.ResourceId.OpaqueId)
+		return "", errtypes.NotFound(id.OpaqueId)
 	}
 
 	idFromXattr, err := xattr.Get(ip, idAttribute)
 	if err != nil {
-		return "", errtypes.NotFound(id.ResourceId.OpaqueId)
+		return "", errtypes.NotFound(id.OpaqueId)
 	}
 
 	uid, err := uuid.FromBytes(idFromXattr)
@@ -758,18 +758,18 @@ func (fs *ocfs) getPath(ctx context.Context, id *provider.Reference) (string, er
 		log.Error().Err(err).Msg("error parsing uuid")
 	}
 
-	if uid.String() != id.ResourceId.OpaqueId {
-		if _, err := c.Do("DEL", id.ResourceId.OpaqueId); err != nil {
+	if uid.String() != id.OpaqueId {
+		if _, err := c.Do("DEL", id.OpaqueId); err != nil {
 			return "", err
 		}
-		return "", errtypes.NotFound(id.ResourceId.OpaqueId)
+		return "", errtypes.NotFound(id.OpaqueId)
 	}
 
 	return ip, nil
 }
 
 // GetPathByID returns the storage relative path for the file id, without the internal namespace
-func (fs *ocfs) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
+func (fs *ocfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
 	ip, err := fs.getPath(ctx, id)
 	if err != nil {
 		return "", err
@@ -794,8 +794,8 @@ func (fs *ocfs) GetPathByID(ctx context.Context, id *provider.Reference) (string
 func (fs *ocfs) resolve(ctx context.Context, ref *provider.Reference) (string, error) {
 
 	// if storage id is set look up that
-	if ref.ResourceId.StorageId != "" || ref.ResourceId.OpaqueId != "" {
-		ip, err := fs.getPath(ctx, ref)
+	if ref.ResourceId != nil {
+		ip, err := fs.getPath(ctx, ref.ResourceId)
 		if err != nil {
 			return "", err
 		}
diff --git a/pkg/storage/fs/s3/s3.go b/pkg/storage/fs/s3/s3.go
index 99c18e02648..bdce6ccc923 100644
--- a/pkg/storage/fs/s3/s3.go
+++ b/pkg/storage/fs/s3/s3.go
@@ -244,8 +244,8 @@ func (fs *s3FS) normalizeCommonPrefix(ctx context.Context, p *s3.CommonPrefix) *
 // GetPathByID returns the path pointed by the file id
 // In this implementation the file id is that path of the file without the first slash
 // thus the file id always points to the filename
-func (fs *s3FS) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
-	return path.Join("/", strings.TrimPrefix(id.ResourceId.OpaqueId, "fileid-")), nil
+func (fs *s3FS) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
+	return path.Join("/", strings.TrimPrefix(id.OpaqueId, "fileid-")), nil
 }
 
 func (fs *s3FS) AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error {
diff --git a/pkg/storage/registry/static/static.go b/pkg/storage/registry/static/static.go
index 7ab3bed4eda..3074dd467e7 100644
--- a/pkg/storage/registry/static/static.go
+++ b/pkg/storage/registry/static/static.go
@@ -143,8 +143,8 @@ func (b *reg) FindProviders(ctx context.Context, ref *provider.Reference) ([]*re
 	var match *registrypb.ProviderInfo
 	var shardedMatches []*registrypb.ProviderInfo
 
-	// If the reference has a storage id set, use it to route
-	if ref.ResourceId.StorageId != "" {
+	// If the reference has a resource id set, use it to route
+	if ref.ResourceId != nil {
 		for prefix, rule := range b.c.Rules {
 			addr := getProviderAddr(ctx, rule)
 			r, err := regexp.Compile("^" + prefix + "$")
@@ -161,12 +161,6 @@ func (b *reg) FindProviders(ctx context.Context, ref *provider.Reference) ([]*re
 		}
 	}
 
-	// TODO if the storage id is not set but node id is set we could poll all storage providers to check if the node is known there
-	// for now, say the reference is invalid
-	if ref.ResourceId.OpaqueId != "" {
-		return nil, errtypes.BadRequest("invalid reference " + ref.String())
-	}
-
 	// Try to find by path  as most storage operations will be done using the path.
 	// TODO this needs to be reevaluated once all clients query the storage registry for a list of storage providers
 	fn := path.Clean(ref.GetPath())
diff --git a/pkg/storage/storage.go b/pkg/storage/storage.go
index 76b10266743..8481c45a989 100644
--- a/pkg/storage/storage.go
+++ b/pkg/storage/storage.go
@@ -46,7 +46,7 @@ type FS interface {
 	RestoreRecycleItem(ctx context.Context, key string, restoreRef *provider.Reference) error
 	PurgeRecycleItem(ctx context.Context, key string) error
 	EmptyRecycle(ctx context.Context) error
-	GetPathByID(ctx context.Context, id *provider.Reference) (string, error)
+	GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error)
 	AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error
 	RemoveGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error
 	UpdateGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error
diff --git a/pkg/storage/utils/decomposedfs/decomposedfs.go b/pkg/storage/utils/decomposedfs/decomposedfs.go
index d809bb879ec..3d55a99a194 100644
--- a/pkg/storage/utils/decomposedfs/decomposedfs.go
+++ b/pkg/storage/utils/decomposedfs/decomposedfs.go
@@ -225,7 +225,7 @@ func (fs *Decomposedfs) GetHome(ctx context.Context) (string, error) {
 }
 
 // GetPathByID returns the fn pointed by the file id, without the internal namespace
-func (fs *Decomposedfs) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
+func (fs *Decomposedfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
 	node, err := fs.lu.NodeFromID(ctx, id)
 	if err != nil {
 		return "", err
diff --git a/pkg/storage/utils/decomposedfs/lookup.go b/pkg/storage/utils/decomposedfs/lookup.go
index 3bbf703cd95..fe1fc315bca 100644
--- a/pkg/storage/utils/decomposedfs/lookup.go
+++ b/pkg/storage/utils/decomposedfs/lookup.go
@@ -40,16 +40,16 @@ type Lookup struct {
 
 // NodeFromResource takes in a request path or request id and converts it to a Node
 func (lu *Lookup) NodeFromResource(ctx context.Context, ref *provider.Reference) (*node.Node, error) {
-	if ref.Path != "" {
-		return lu.NodeFromPath(ctx, ref.GetPath())
+	if ref.ResourceId != nil {
+		return lu.NodeFromID(ctx, ref.ResourceId)
 	}
 
-	if ref.StorageId != "" || ref.NodeId != "" {
-		return lu.NodeFromID(ctx, ref)
+	if ref.Path != "" {
+		return lu.NodeFromPath(ctx, ref.GetPath())
 	}
 
 	// reference is invalid
-	return nil, fmt.Errorf("invalid reference %+v", ref)
+	return nil, fmt.Errorf("invalid reference %+v. at least resource_id or path must be set", ref)
 }
 
 // NodeFromPath converts a filename into a Node
@@ -77,11 +77,11 @@ func (lu *Lookup) NodeFromPath(ctx context.Context, fn string) (*node.Node, erro
 }
 
 // NodeFromID returns the internal path for the id
-func (lu *Lookup) NodeFromID(ctx context.Context, id *provider.Reference) (n *node.Node, err error) {
-	if id == nil || id.NodeId == "" {
+func (lu *Lookup) NodeFromID(ctx context.Context, id *provider.ResourceId) (n *node.Node, err error) {
+	if id == nil || id.OpaqueId == "" {
 		return nil, fmt.Errorf("invalid resource id %+v", id)
 	}
-	return node.ReadNode(ctx, lu, id.NodeId)
+	return node.ReadNode(ctx, lu, id.OpaqueId)
 }
 
 // Path returns the path for node
diff --git a/pkg/storage/utils/decomposedfs/node/node.go b/pkg/storage/utils/decomposedfs/node/node.go
index 102bbd669ca..55af74eb5c4 100644
--- a/pkg/storage/utils/decomposedfs/node/node.go
+++ b/pkg/storage/utils/decomposedfs/node/node.go
@@ -444,7 +444,7 @@ func (n *Node) AsResourceInfo(ctx context.Context, rp *provider.ResourcePermissi
 		// nodeType = provider.ResourceType_RESOURCE_TYPE_REFERENCE
 	}
 
-	id := &provider.Reference{NodeId: n.ID}
+	id := &provider.ResourceId{OpaqueId: n.ID}
 
 	fn, err = n.lu.Path(ctx, n)
 	if err != nil {
diff --git a/pkg/storage/utils/decomposedfs/tree/tree.go b/pkg/storage/utils/decomposedfs/tree/tree.go
index 90d360abdb7..a6f07008713 100644
--- a/pkg/storage/utils/decomposedfs/tree/tree.go
+++ b/pkg/storage/utils/decomposedfs/tree/tree.go
@@ -52,7 +52,7 @@ type Blobstore interface {
 // PathLookup defines the interface for the lookup component
 type PathLookup interface {
 	NodeFromPath(ctx context.Context, fn string) (*node.Node, error)
-	NodeFromID(ctx context.Context, id *provider.Reference) (n *node.Node, err error)
+	NodeFromID(ctx context.Context, id *provider.ResourceId) (n *node.Node, err error)
 	RootNode(ctx context.Context) (node *node.Node, err error)
 	HomeOrRootNode(ctx context.Context) (node *node.Node, err error)
 
diff --git a/pkg/storage/utils/eosfs/eosfs.go b/pkg/storage/utils/eosfs/eosfs.go
index 278b95ef3c0..a51fd8d0a3b 100644
--- a/pkg/storage/utils/eosfs/eosfs.go
+++ b/pkg/storage/utils/eosfs/eosfs.go
@@ -290,9 +290,8 @@ func (fs *eosfs) unwrapInternal(ctx context.Context, ns, np, layout string) (str
 
 // resolve takes in a request path or request id and returns the unwrappedNominal path.
 func (fs *eosfs) resolve(ctx context.Context, u *userpb.User, ref *provider.Reference) (string, error) {
-
-	if ref.StorageId != "" || ref.NodeId != "" {
-		p, err := fs.getPath(ctx, u, ref)
+	if ref.ResourceId != nil {
+		p, err := fs.getPath(ctx, u, ref.ResourceId)
 		if err != nil {
 			return "", err
 		}
@@ -304,13 +303,13 @@ func (fs *eosfs) resolve(ctx context.Context, u *userpb.User, ref *provider.Refe
 	}
 
 	// reference is invalid
-	return "", fmt.Errorf("invalid reference %+v. id and path are missing", ref)
+	return "", fmt.Errorf("invalid reference %+v. at least resource_id or path must be set", ref)
 }
 
-func (fs *eosfs) getPath(ctx context.Context, u *userpb.User, id *provider.Reference) (string, error) {
-	fid, err := strconv.ParseUint(id.NodeId, 10, 64)
+func (fs *eosfs) getPath(ctx context.Context, u *userpb.User, id *provider.ResourceId) (string, error) {
+	fid, err := strconv.ParseUint(id.OpaqueId, 10, 64)
 	if err != nil {
-		return "", fmt.Errorf("error converting string to int for eos fileid: %s", id.NodeId)
+		return "", fmt.Errorf("error converting string to int for eos fileid: %s", id.OpaqueId)
 	}
 
 	uid, gid, err := fs.getUserUIDAndGID(ctx, u)
@@ -340,7 +339,7 @@ func (fs *eosfs) isShareFolderChild(ctx context.Context, p string) bool {
 	return len(vals) > 1 && vals[1] != ""
 }
 
-func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
+func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
 	u, err := getUser(ctx)
 	if err != nil {
 		return "", errors.Wrap(err, "eos: no user in ctx")
@@ -348,7 +347,7 @@ func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.Reference) (strin
 
 	// parts[0] = 868317, parts[1] = photos, ...
 	// FIXME REFERENCE ... umm ... 868317/photos? @ishank011 might be a leftover
-	parts := strings.Split(id.NodeId, "/")
+	parts := strings.Split(id.OpaqueId, "/")
 	fileID, err := strconv.ParseUint(parts[0], 10, 64)
 	if err != nil {
 		return "", errors.Wrap(err, "eos: error parsing fileid string")
@@ -1465,7 +1464,7 @@ func (fs *eosfs) convert(ctx context.Context, eosFileInfo *eosclient.FileInfo, v
 	}
 
 	info := &provider.ResourceInfo{
-		Id:            &provider.Reference{NodeId: fmt.Sprintf("%d", eosFileInfo.Inode)},
+		Id:            &provider.ResourceId{OpaqueId: fmt.Sprintf("%d", eosFileInfo.Inode)},
 		Path:          path,
 		Owner:         owner,
 		Etag:          fmt.Sprintf("\"%s\"", strings.Trim(eosFileInfo.ETag, "\"")),
diff --git a/pkg/storage/utils/localfs/localfs.go b/pkg/storage/utils/localfs/localfs.go
index 2bcf3fba27e..c8d5cc2fbc2 100644
--- a/pkg/storage/utils/localfs/localfs.go
+++ b/pkg/storage/utils/localfs/localfs.go
@@ -136,14 +136,19 @@ func (fs *localfs) Shutdown(ctx context.Context) error {
 }
 
 func (fs *localfs) resolve(ctx context.Context, ref *provider.Reference) (p string, err error) {
-	if ref.StorageId != "" || ref.NodeId != "" {
-		if p, err = fs.GetPathByID(ctx, ref); err != nil {
+	if ref.ResourceId != nil {
+		if p, err = fs.GetPathByID(ctx, ref.ResourceId); err != nil {
 			return "", err
 		}
 		return path.Join(p, ref.Path), nil
 	}
 
-	return ref.Path, nil
+	if ref.Path != "" {
+		return ref.Path, nil
+	}
+
+	// reference is invalid
+	return "", fmt.Errorf("invalid reference %+v. at least resource_id or path must be set", ref)
 }
 
 func getUser(ctx context.Context) (*userpb.User, error) {
@@ -341,7 +346,7 @@ func (fs *localfs) normalize(ctx context.Context, fi os.FileInfo, fn string, mdK
 
 	// A fileid is constructed like `fileid-url_encoded_path`. See GetPathByID for the inverse conversion
 	md := &provider.ResourceInfo{
-		Id:            &provider.Reference{NodeId: "fileid-" + url.QueryEscape(path.Join(layout, fp))},
+		Id:            &provider.ResourceId{OpaqueId: "fileid-" + url.QueryEscape(path.Join(layout, fp))},
 		Path:          fp,
 		Type:          getResourceType(fi.IsDir()),
 		Etag:          calcEtag(ctx, fi),
@@ -413,7 +418,7 @@ func (fs *localfs) retrieveArbitraryMetadata(ctx context.Context, fn string, mdK
 
 // GetPathByID returns the path pointed by the file id
 // In this implementation the file id is in the form `fileid-url_encoded_path`
-func (fs *localfs) GetPathByID(ctx context.Context, ref *provider.Reference) (string, error) {
+func (fs *localfs) GetPathByID(ctx context.Context, ref *provider.ResourceId) (string, error) {
 	var layout string
 	if !fs.conf.DisableHome {
 		var err error
@@ -422,7 +427,7 @@ func (fs *localfs) GetPathByID(ctx context.Context, ref *provider.Reference) (st
 			return "", err
 		}
 	}
-	return url.QueryUnescape(strings.TrimPrefix(ref.NodeId, "fileid-"+layout))
+	return url.QueryUnescape(strings.TrimPrefix(ref.OpaqueId, "fileid-"+layout))
 }
 
 func (fs *localfs) AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error {
diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go
index d5e77a4347d..ac8b2f2a41d 100644
--- a/pkg/utils/utils.go
+++ b/pkg/utils/utils.go
@@ -152,9 +152,14 @@ func GroupEqual(u, v *grouppb.GroupId) bool {
 	return u != nil && v != nil && u.Idp == v.Idp && u.OpaqueId == v.OpaqueId
 }
 
+// ResourceIDEqual returns whether two resources have the same field values.
+func ResourceIDEqual(u, v *provider.ResourceId) bool {
+	return u != nil && v != nil && u.StorageId == v.StorageId && u.OpaqueId == v.OpaqueId
+}
+
 // ResourceEqual returns whether two resources have the same field values.
 func ResourceEqual(u, v *provider.Reference) bool {
-	return u != nil && v != nil && u.StorageId == v.StorageId && u.NodeId == v.NodeId && u.Path == v.Path
+	return u != nil && v != nil && u.Path == v.Path && ((u.ResourceId == nil && v.ResourceId == nil) || (ResourceIDEqual(u.ResourceId, v.ResourceId)))
 }
 
 // GranteeEqual returns whether two grantees have the same field values.