diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index afb3d8b..5af1dbf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,9 +10,9 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: '1.24.6'
-  GOLANGCI_VERSION: 'v2.1.2'
-  DOCKER_BUILDX_VERSION: 'v0.23.0'
+  GO_VERSION: "1.24.6"
+  GOLANGCI_VERSION: "v2.1.2"
+  DOCKER_BUILDX_VERSION: "v0.23.0"
 
 jobs:
   detect-noop:
@@ -28,7 +28,6 @@ jobs:
           paths_ignore: '["**.md", "**.png", "**.jpg"]'
           do_not_skip: '["workflow_dispatch", "schedule", "push"]'
 
-
   lint:
     runs-on: ubuntu-latest
     needs: detect-noop
@@ -111,7 +110,18 @@ jobs:
     runs-on: ubuntu-latest
     needs: detect-noop
     if: needs.detect-noop.outputs.noop != 'true'
-
+    strategy:
+      fail-fast: false
+      matrix:
+        crossplane-version:
+          - name: "crossplane-v2"
+            version: "2.1.1"
+            cli-version: "v2.1.1"
+          - name: "crossplane-v1"
+            version: "1.20.1"
+            cli-version: "v1.20.1"
+
+    name: e2e-tests-${{ matrix.crossplane-version.name }}
     steps:
       - name: Setup QEMU
         uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
@@ -145,4 +155,7 @@ jobs:
         env:
           # We're using docker buildx, which doesn't actually load the images it
           # builds by default. Specifying --load does so.
-          BUILD_ARGS: "--load"
\ No newline at end of file
+          BUILD_ARGS: "--load"
+          # Set Crossplane version for this matrix run
+          CROSSPLANE_VERSION: ${{ matrix.crossplane-version.version }}
+          CROSSPLANE_CLI_VERSION: ${{ matrix.crossplane-version.cli-version }}
diff --git a/.gitignore b/.gitignore
index 3bbf371..ddda77b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,4 +13,4 @@ kubeconfig
 
 # Test server binaries
 cluster/test/server
-cluster/test/testserver
\ No newline at end of file
+cluster/test/testserver
diff --git a/Makefile b/Makefile
index ca85439..85c859d 100644
--- a/Makefile
+++ b/Makefile
@@ -39,8 +39,8 @@ GOLANGCILINT_VERSION = 2.1.2
 # ====================================================================================
 # Setup Kubernetes tools
 USE_HELM3 = true
-CROSSPLANE_VERSION = 2.0.2
-CROSSPLANE_CLI_VERSION = v2.0.2
+CROSSPLANE_VERSION = 2.1.1
+CROSSPLANE_CLI_VERSION = v2.1.1
 
 -include build/makelib/k8s_tools.mk
 
@@ -90,11 +90,16 @@ CROSSPLANE_NAMESPACE = crossplane-system
 -include build/makelib/local.xpkg.mk
 -include build/makelib/controlplane.mk
 
-UPTEST_EXAMPLE_LIST := $(shell find ./examples/sample -path '*.yaml' | paste -s -d ',' - )
+# Conditionally include namespaced examples for Crossplane v2
+ifeq ($(shell echo "$(CROSSPLANE_VERSION)" | cut -d. -f1),2)
+    UPTEST_EXAMPLE_LIST := $(shell find ./examples/sample -path '*.yaml' | paste -s -d ',' - ),$(shell find ./examples/namespaced -path '*.yaml' | paste -s -d ',' - )
+else
+    UPTEST_EXAMPLE_LIST := $(shell find ./examples/sample -path '*.yaml' | paste -s -d ',' - )
+endif
 
-uptest: $(UPTEST) $(KUBECTL) $(KUTTL)
+uptest: $(UPTEST) $(KUBECTL) $(CHAINSAW) $(CROSSPLANE_CLI)
 	@$(INFO) running automated tests
-	@KUBECTL=$(KUBECTL) KUTTL=$(KUTTL) CROSSPLANE_NAMESPACE=$(CROSSPLANE_NAMESPACE) TEST_SERVER_IMAGE=$(TEST_SERVER_IMAGE) $(UPTEST) e2e "$(UPTEST_EXAMPLE_LIST)" --setup-script=cluster/test/setup.sh || $(FAIL)
+	@KUBECTL=$(KUBECTL) CHAINSAW=$(CHAINSAW) CROSSPLANE_CLI=$(CROSSPLANE_CLI) CROSSPLANE_NAMESPACE=$(CROSSPLANE_NAMESPACE) CROSSPLANE_VERSION=$(CROSSPLANE_VERSION) $(UPTEST) e2e "$(UPTEST_EXAMPLE_LIST)" --setup-script=cluster/test/setup.sh || $(FAIL)
 	@$(OK) running automated tests
 
 local-dev: controlplane.up
diff --git a/README.md b/README.md
index 5fda380..c2d6b47 100644
--- a/README.md
+++ b/README.md
@@ -20,22 +20,36 @@ To install `provider-http`, you have two options:
    metadata:
      name: provider-http
    spec:
-     package: "xpkg.upbound.io/crossplane-contrib/provider-http:v1.0.11"
+     package: 'xpkg.upbound.io/crossplane-contrib/provider-http:v1.0.11'
    ```
 
 ## Supported Resources
 
-`provider-http` supports the following resources:
+`provider-http` supports resources in two scopes:
+
+### Cluster-scoped Resources (`http.crossplane.io`)
 
 - **DisposableRequest:** Initiates a one-time HTTP request. See [DisposableRequest CRD documentation](resources-docs/disposablerequest_docs.md).
 - **Request:** Manages a resource through HTTP requests. See [Request CRD documentation](resources-docs/request_docs.md).
 
+### Namespaced Resources (`http.m.crossplane.io`)
+
+- **DisposableRequest:** Namespace-scoped version of the disposable HTTP request.
+- **Request:** Namespace-scoped version of the managed HTTP resource.
+- **ProviderConfig:** Namespace-scoped provider configuration.
+- **ClusterProviderConfig:** Cluster-scoped provider configuration for cross-namespace access.
+
+**When to use each:**
+
+- Use **cluster-scoped** resources for shared infrastructure and when you have cluster-admin privileges
+- Use **namespaced** resources for tenant isolation, application-specific resources, and when working with namespace-level permissions
+
 ## TLS Certificate Authentication
 
 The provider supports TLS certificate-based authentication for secure API communication:
 
 - **CA Certificates:** Trust custom certificate authorities
-- **Client Certificates:** Mutual TLS (mTLS) authentication  
+- **Client Certificates:** Mutual TLS (mTLS) authentication
 - **Flexible Configuration:** Set TLS at provider or resource level
 - **Secret References:** Load certificates from Kubernetes secrets
 
@@ -130,6 +144,24 @@ spec:
 
 For more detailed examples and configuration options, refer to the [examples directory](examples/sample/).
 
+### Namespaced Resources
+
+For namespace-scoped resources, use the `http.m.crossplane.io` API group:
+
+```yaml
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: Request
+metadata:
+  name: example-namespaced-request
+  namespace: my-namespace
+spec:
+  # Add your Request specification here
+  providerConfigRef:
+    name: my-namespaced-config
+```
+
+For namespaced examples and configuration options, refer to the [namespaced examples directory](examples/namespaced/).
+
 ## Developing locally
 
 Run controller against the cluster:
diff --git a/apis/disposablerequest/disposablerequest.go b/apis/cluster/disposablerequest/disposablerequest.go
similarity index 100%
rename from apis/disposablerequest/disposablerequest.go
rename to apis/cluster/disposablerequest/disposablerequest.go
diff --git a/apis/disposablerequest/v1alpha1/disposablerequest_types.go b/apis/cluster/disposablerequest/v1alpha1/disposablerequest_types.go
similarity index 98%
rename from apis/disposablerequest/v1alpha1/disposablerequest_types.go
rename to apis/cluster/disposablerequest/v1alpha1/disposablerequest_types.go
index 814275e..9f0edeb 100644
--- a/apis/disposablerequest/v1alpha1/disposablerequest_types.go
+++ b/apis/cluster/disposablerequest/v1alpha1/disposablerequest_types.go
@@ -22,7 +22,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 )
 
 // DisposableRequestParameters are the configurable fields of a DisposableRequest.
diff --git a/apis/disposablerequest/v1alpha1/doc.go b/apis/cluster/disposablerequest/v1alpha1/doc.go
similarity index 100%
rename from apis/disposablerequest/v1alpha1/doc.go
rename to apis/cluster/disposablerequest/v1alpha1/doc.go
diff --git a/apis/disposablerequest/v1alpha1/groupversion_info.go b/apis/cluster/disposablerequest/v1alpha1/groupversion_info.go
similarity index 100%
rename from apis/disposablerequest/v1alpha1/groupversion_info.go
rename to apis/cluster/disposablerequest/v1alpha1/groupversion_info.go
diff --git a/apis/disposablerequest/v1alpha1/spec_accessors.go b/apis/cluster/disposablerequest/v1alpha1/spec_accessors.go
similarity index 100%
rename from apis/disposablerequest/v1alpha1/spec_accessors.go
rename to apis/cluster/disposablerequest/v1alpha1/spec_accessors.go
diff --git a/apis/disposablerequest/v1alpha1/status_setters.go b/apis/cluster/disposablerequest/v1alpha1/status_setters.go
similarity index 100%
rename from apis/disposablerequest/v1alpha1/status_setters.go
rename to apis/cluster/disposablerequest/v1alpha1/status_setters.go
diff --git a/apis/disposablerequest/v1alpha1/zz_generated.deepcopy.go b/apis/cluster/disposablerequest/v1alpha1/zz_generated.deepcopy.go
similarity index 100%
rename from apis/disposablerequest/v1alpha1/zz_generated.deepcopy.go
rename to apis/cluster/disposablerequest/v1alpha1/zz_generated.deepcopy.go
diff --git a/apis/disposablerequest/v1alpha1/zz_generated.managed.go b/apis/cluster/disposablerequest/v1alpha1/zz_generated.managed.go
similarity index 83%
rename from apis/disposablerequest/v1alpha1/zz_generated.managed.go
rename to apis/cluster/disposablerequest/v1alpha1/zz_generated.managed.go
index 1a249e8..f4f7245 100644
--- a/apis/disposablerequest/v1alpha1/zz_generated.managed.go
+++ b/apis/cluster/disposablerequest/v1alpha1/zz_generated.managed.go
@@ -17,7 +17,7 @@ limitations under the License.
 
 package v1alpha1
 
-import xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+import xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 
 // GetCondition of this DisposableRequest.
 func (mg *DisposableRequest) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
@@ -39,11 +39,6 @@ func (mg *DisposableRequest) GetProviderConfigReference() *xpv1.Reference {
 	return mg.Spec.ProviderConfigReference
 }
 
-// GetPublishConnectionDetailsTo of this DisposableRequest.
-func (mg *DisposableRequest) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
-	return mg.Spec.PublishConnectionDetailsTo
-}
-
 // GetWriteConnectionSecretToReference of this DisposableRequest.
 func (mg *DisposableRequest) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
 	return mg.Spec.WriteConnectionSecretToReference
@@ -69,11 +64,6 @@ func (mg *DisposableRequest) SetProviderConfigReference(r *xpv1.Reference) {
 	mg.Spec.ProviderConfigReference = r
 }
 
-// SetPublishConnectionDetailsTo of this DisposableRequest.
-func (mg *DisposableRequest) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
-	mg.Spec.PublishConnectionDetailsTo = r
-}
-
 // SetWriteConnectionSecretToReference of this DisposableRequest.
 func (mg *DisposableRequest) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
 	mg.Spec.WriteConnectionSecretToReference = r
diff --git a/apis/disposablerequest/v1alpha1/zz_generated.managedlist.go b/apis/cluster/disposablerequest/v1alpha1/zz_generated.managedlist.go
similarity index 91%
rename from apis/disposablerequest/v1alpha1/zz_generated.managedlist.go
rename to apis/cluster/disposablerequest/v1alpha1/zz_generated.managedlist.go
index f2bea17..4fc6c1e 100644
--- a/apis/disposablerequest/v1alpha1/zz_generated.managedlist.go
+++ b/apis/cluster/disposablerequest/v1alpha1/zz_generated.managedlist.go
@@ -17,7 +17,7 @@ limitations under the License.
 
 package v1alpha1
 
-import resource "github.com/crossplane/crossplane-runtime/pkg/resource"
+import resource "github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 
 // GetItems of this DisposableRequestList.
 func (l *DisposableRequestList) GetItems() []resource.Managed {
diff --git a/apis/disposablerequest/v1alpha2/disposablerequest_types.go b/apis/cluster/disposablerequest/v1alpha2/disposablerequest_types.go
similarity index 98%
rename from apis/disposablerequest/v1alpha2/disposablerequest_types.go
rename to apis/cluster/disposablerequest/v1alpha2/disposablerequest_types.go
index 09728dd..b465043 100644
--- a/apis/disposablerequest/v1alpha2/disposablerequest_types.go
+++ b/apis/cluster/disposablerequest/v1alpha2/disposablerequest_types.go
@@ -23,7 +23,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 )
 
 // DisposableRequestParameters are the configurable fields of a DisposableRequest.
diff --git a/apis/disposablerequest/v1alpha2/doc.go b/apis/cluster/disposablerequest/v1alpha2/doc.go
similarity index 100%
rename from apis/disposablerequest/v1alpha2/doc.go
rename to apis/cluster/disposablerequest/v1alpha2/doc.go
diff --git a/apis/disposablerequest/v1alpha2/groupversion_info.go b/apis/cluster/disposablerequest/v1alpha2/groupversion_info.go
similarity index 100%
rename from apis/disposablerequest/v1alpha2/groupversion_info.go
rename to apis/cluster/disposablerequest/v1alpha2/groupversion_info.go
diff --git a/apis/disposablerequest/v1alpha2/spec_accessors.go b/apis/cluster/disposablerequest/v1alpha2/spec_accessors.go
similarity index 100%
rename from apis/disposablerequest/v1alpha2/spec_accessors.go
rename to apis/cluster/disposablerequest/v1alpha2/spec_accessors.go
diff --git a/apis/disposablerequest/v1alpha2/spec_accessors_test.go b/apis/cluster/disposablerequest/v1alpha2/spec_accessors_test.go
similarity index 100%
rename from apis/disposablerequest/v1alpha2/spec_accessors_test.go
rename to apis/cluster/disposablerequest/v1alpha2/spec_accessors_test.go
diff --git a/apis/disposablerequest/v1alpha2/status_setters.go b/apis/cluster/disposablerequest/v1alpha2/status_setters.go
similarity index 100%
rename from apis/disposablerequest/v1alpha2/status_setters.go
rename to apis/cluster/disposablerequest/v1alpha2/status_setters.go
diff --git a/apis/disposablerequest/v1alpha2/zz_generated.deepcopy.go b/apis/cluster/disposablerequest/v1alpha2/zz_generated.deepcopy.go
similarity index 100%
rename from apis/disposablerequest/v1alpha2/zz_generated.deepcopy.go
rename to apis/cluster/disposablerequest/v1alpha2/zz_generated.deepcopy.go
diff --git a/apis/disposablerequest/v1alpha2/zz_generated.managed.go b/apis/cluster/disposablerequest/v1alpha2/zz_generated.managed.go
similarity index 83%
rename from apis/disposablerequest/v1alpha2/zz_generated.managed.go
rename to apis/cluster/disposablerequest/v1alpha2/zz_generated.managed.go
index e77daa5..952f331 100644
--- a/apis/disposablerequest/v1alpha2/zz_generated.managed.go
+++ b/apis/cluster/disposablerequest/v1alpha2/zz_generated.managed.go
@@ -17,7 +17,7 @@ limitations under the License.
 
 package v1alpha2
 
-import xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+import xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 
 // GetCondition of this DisposableRequest.
 func (mg *DisposableRequest) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
@@ -39,11 +39,6 @@ func (mg *DisposableRequest) GetProviderConfigReference() *xpv1.Reference {
 	return mg.Spec.ProviderConfigReference
 }
 
-// GetPublishConnectionDetailsTo of this DisposableRequest.
-func (mg *DisposableRequest) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
-	return mg.Spec.PublishConnectionDetailsTo
-}
-
 // GetWriteConnectionSecretToReference of this DisposableRequest.
 func (mg *DisposableRequest) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
 	return mg.Spec.WriteConnectionSecretToReference
@@ -69,11 +64,6 @@ func (mg *DisposableRequest) SetProviderConfigReference(r *xpv1.Reference) {
 	mg.Spec.ProviderConfigReference = r
 }
 
-// SetPublishConnectionDetailsTo of this DisposableRequest.
-func (mg *DisposableRequest) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
-	mg.Spec.PublishConnectionDetailsTo = r
-}
-
 // SetWriteConnectionSecretToReference of this DisposableRequest.
 func (mg *DisposableRequest) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
 	mg.Spec.WriteConnectionSecretToReference = r
diff --git a/apis/disposablerequest/v1alpha2/zz_generated.managedlist.go b/apis/cluster/disposablerequest/v1alpha2/zz_generated.managedlist.go
similarity index 91%
rename from apis/disposablerequest/v1alpha2/zz_generated.managedlist.go
rename to apis/cluster/disposablerequest/v1alpha2/zz_generated.managedlist.go
index c55775f..9f555c0 100644
--- a/apis/disposablerequest/v1alpha2/zz_generated.managedlist.go
+++ b/apis/cluster/disposablerequest/v1alpha2/zz_generated.managedlist.go
@@ -17,7 +17,7 @@ limitations under the License.
 
 package v1alpha2
 
-import resource "github.com/crossplane/crossplane-runtime/pkg/resource"
+import resource "github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 
 // GetItems of this DisposableRequestList.
 func (l *DisposableRequestList) GetItems() []resource.Managed {
diff --git a/apis/request/request.go b/apis/cluster/request/request.go
similarity index 100%
rename from apis/request/request.go
rename to apis/cluster/request/request.go
diff --git a/apis/request/v1alpha1/doc.go b/apis/cluster/request/v1alpha1/doc.go
similarity index 100%
rename from apis/request/v1alpha1/doc.go
rename to apis/cluster/request/v1alpha1/doc.go
diff --git a/apis/request/v1alpha1/groupversion_info.go b/apis/cluster/request/v1alpha1/groupversion_info.go
similarity index 100%
rename from apis/request/v1alpha1/groupversion_info.go
rename to apis/cluster/request/v1alpha1/groupversion_info.go
diff --git a/apis/request/v1alpha1/request_types.go b/apis/cluster/request/v1alpha1/request_types.go
similarity index 98%
rename from apis/request/v1alpha1/request_types.go
rename to apis/cluster/request/v1alpha1/request_types.go
index dad3fcf..fa73569 100644
--- a/apis/request/v1alpha1/request_types.go
+++ b/apis/cluster/request/v1alpha1/request_types.go
@@ -22,7 +22,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 )
 
 // RequestParameters are the configurable fields of a Request.
diff --git a/apis/request/v1alpha1/spec_accessors.go b/apis/cluster/request/v1alpha1/spec_accessors.go
similarity index 100%
rename from apis/request/v1alpha1/spec_accessors.go
rename to apis/cluster/request/v1alpha1/spec_accessors.go
diff --git a/apis/request/v1alpha1/status_setters.go b/apis/cluster/request/v1alpha1/status_setters.go
similarity index 100%
rename from apis/request/v1alpha1/status_setters.go
rename to apis/cluster/request/v1alpha1/status_setters.go
diff --git a/apis/request/v1alpha1/zz_generated.deepcopy.go b/apis/cluster/request/v1alpha1/zz_generated.deepcopy.go
similarity index 100%
rename from apis/request/v1alpha1/zz_generated.deepcopy.go
rename to apis/cluster/request/v1alpha1/zz_generated.deepcopy.go
diff --git a/apis/request/v1alpha1/zz_generated.managed.go b/apis/cluster/request/v1alpha1/zz_generated.managed.go
similarity index 83%
rename from apis/request/v1alpha1/zz_generated.managed.go
rename to apis/cluster/request/v1alpha1/zz_generated.managed.go
index 4096310..45b09e1 100644
--- a/apis/request/v1alpha1/zz_generated.managed.go
+++ b/apis/cluster/request/v1alpha1/zz_generated.managed.go
@@ -17,7 +17,7 @@ limitations under the License.
 
 package v1alpha1
 
-import xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+import xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 
 // GetCondition of this Request.
 func (mg *Request) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
@@ -39,11 +39,6 @@ func (mg *Request) GetProviderConfigReference() *xpv1.Reference {
 	return mg.Spec.ProviderConfigReference
 }
 
-// GetPublishConnectionDetailsTo of this Request.
-func (mg *Request) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
-	return mg.Spec.PublishConnectionDetailsTo
-}
-
 // GetWriteConnectionSecretToReference of this Request.
 func (mg *Request) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
 	return mg.Spec.WriteConnectionSecretToReference
@@ -69,11 +64,6 @@ func (mg *Request) SetProviderConfigReference(r *xpv1.Reference) {
 	mg.Spec.ProviderConfigReference = r
 }
 
-// SetPublishConnectionDetailsTo of this Request.
-func (mg *Request) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
-	mg.Spec.PublishConnectionDetailsTo = r
-}
-
 // SetWriteConnectionSecretToReference of this Request.
 func (mg *Request) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
 	mg.Spec.WriteConnectionSecretToReference = r
diff --git a/apis/request/v1alpha1/zz_generated.managedlist.go b/apis/cluster/request/v1alpha1/zz_generated.managedlist.go
similarity index 91%
rename from apis/request/v1alpha1/zz_generated.managedlist.go
rename to apis/cluster/request/v1alpha1/zz_generated.managedlist.go
index badb290..fc7fb54 100644
--- a/apis/request/v1alpha1/zz_generated.managedlist.go
+++ b/apis/cluster/request/v1alpha1/zz_generated.managedlist.go
@@ -17,7 +17,7 @@ limitations under the License.
 
 package v1alpha1
 
-import resource "github.com/crossplane/crossplane-runtime/pkg/resource"
+import resource "github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 
 // GetItems of this RequestList.
 func (l *RequestList) GetItems() []resource.Managed {
diff --git a/apis/request/v1alpha2/doc.go b/apis/cluster/request/v1alpha2/doc.go
similarity index 100%
rename from apis/request/v1alpha2/doc.go
rename to apis/cluster/request/v1alpha2/doc.go
diff --git a/apis/request/v1alpha2/groupversion_info.go b/apis/cluster/request/v1alpha2/groupversion_info.go
similarity index 100%
rename from apis/request/v1alpha2/groupversion_info.go
rename to apis/cluster/request/v1alpha2/groupversion_info.go
diff --git a/apis/request/v1alpha2/request_types.go b/apis/cluster/request/v1alpha2/request_types.go
similarity index 98%
rename from apis/request/v1alpha2/request_types.go
rename to apis/cluster/request/v1alpha2/request_types.go
index 2fb69d5..4aec815 100644
--- a/apis/request/v1alpha2/request_types.go
+++ b/apis/cluster/request/v1alpha2/request_types.go
@@ -23,7 +23,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 )
 
 // Re-export common constants for backward compatibility
diff --git a/apis/request/v1alpha2/spec_accessors.go b/apis/cluster/request/v1alpha2/spec_accessors.go
similarity index 100%
rename from apis/request/v1alpha2/spec_accessors.go
rename to apis/cluster/request/v1alpha2/spec_accessors.go
diff --git a/apis/request/v1alpha2/spec_accessors_test.go b/apis/cluster/request/v1alpha2/spec_accessors_test.go
similarity index 100%
rename from apis/request/v1alpha2/spec_accessors_test.go
rename to apis/cluster/request/v1alpha2/spec_accessors_test.go
diff --git a/apis/request/v1alpha2/status_setters.go b/apis/cluster/request/v1alpha2/status_setters.go
similarity index 100%
rename from apis/request/v1alpha2/status_setters.go
rename to apis/cluster/request/v1alpha2/status_setters.go
diff --git a/apis/request/v1alpha2/zz_generated.deepcopy.go b/apis/cluster/request/v1alpha2/zz_generated.deepcopy.go
similarity index 100%
rename from apis/request/v1alpha2/zz_generated.deepcopy.go
rename to apis/cluster/request/v1alpha2/zz_generated.deepcopy.go
diff --git a/apis/request/v1alpha2/zz_generated.managed.go b/apis/cluster/request/v1alpha2/zz_generated.managed.go
similarity index 83%
rename from apis/request/v1alpha2/zz_generated.managed.go
rename to apis/cluster/request/v1alpha2/zz_generated.managed.go
index 97a8d05..0459767 100644
--- a/apis/request/v1alpha2/zz_generated.managed.go
+++ b/apis/cluster/request/v1alpha2/zz_generated.managed.go
@@ -17,7 +17,7 @@ limitations under the License.
 
 package v1alpha2
 
-import xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+import xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 
 // GetCondition of this Request.
 func (mg *Request) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
@@ -39,11 +39,6 @@ func (mg *Request) GetProviderConfigReference() *xpv1.Reference {
 	return mg.Spec.ProviderConfigReference
 }
 
-// GetPublishConnectionDetailsTo of this Request.
-func (mg *Request) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
-	return mg.Spec.PublishConnectionDetailsTo
-}
-
 // GetWriteConnectionSecretToReference of this Request.
 func (mg *Request) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
 	return mg.Spec.WriteConnectionSecretToReference
@@ -69,11 +64,6 @@ func (mg *Request) SetProviderConfigReference(r *xpv1.Reference) {
 	mg.Spec.ProviderConfigReference = r
 }
 
-// SetPublishConnectionDetailsTo of this Request.
-func (mg *Request) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
-	mg.Spec.PublishConnectionDetailsTo = r
-}
-
 // SetWriteConnectionSecretToReference of this Request.
 func (mg *Request) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
 	mg.Spec.WriteConnectionSecretToReference = r
diff --git a/apis/request/v1alpha2/zz_generated.managedlist.go b/apis/cluster/request/v1alpha2/zz_generated.managedlist.go
similarity index 91%
rename from apis/request/v1alpha2/zz_generated.managedlist.go
rename to apis/cluster/request/v1alpha2/zz_generated.managedlist.go
index 565b460..58d7864 100644
--- a/apis/request/v1alpha2/zz_generated.managedlist.go
+++ b/apis/cluster/request/v1alpha2/zz_generated.managedlist.go
@@ -17,7 +17,7 @@ limitations under the License.
 
 package v1alpha2
 
-import resource "github.com/crossplane/crossplane-runtime/pkg/resource"
+import resource "github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 
 // GetItems of this RequestList.
 func (l *RequestList) GetItems() []resource.Managed {
diff --git a/apis/v1alpha1/doc.go b/apis/cluster/v1alpha1/doc.go
similarity index 100%
rename from apis/v1alpha1/doc.go
rename to apis/cluster/v1alpha1/doc.go
diff --git a/apis/v1alpha1/groupversion_info.go b/apis/cluster/v1alpha1/groupversion_info.go
similarity index 100%
rename from apis/v1alpha1/groupversion_info.go
rename to apis/cluster/v1alpha1/groupversion_info.go
diff --git a/apis/v1alpha1/providerconfig_types.go b/apis/cluster/v1alpha1/providerconfig_types.go
similarity index 76%
rename from apis/v1alpha1/providerconfig_types.go
rename to apis/cluster/v1alpha1/providerconfig_types.go
index 5dac759..0697108 100644
--- a/apis/v1alpha1/providerconfig_types.go
+++ b/apis/cluster/v1alpha1/providerconfig_types.go
@@ -23,9 +23,13 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 )
 
+// verify interface casting required by controller
+var _ resource.ProviderConfig = &ProviderConfig{}
+
 // A ProviderConfigSpec defines the desired state of a ProviderConfig.
 type ProviderConfigSpec struct {
 	// Credentials required to authenticate to this provider.
@@ -82,6 +86,27 @@ var (
 	ProviderConfigGroupVersionKind = SchemeGroupVersion.WithKind(ProviderConfigKind)
 )
 
+// GetCondition returns the condition for the given ConditionType if exists,
+// otherwise returns nil
+func (pc *ProviderConfig) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return pc.Status.GetCondition(ct)
+}
+
+// SetConditions sets the conditions on the resource status
+func (pc *ProviderConfig) SetConditions(c ...xpv1.Condition) {
+	pc.Status.SetConditions(c...)
+}
+
+// GetUsers returns the number of users of this ProviderConfig.
+func (pc *ProviderConfig) GetUsers() int64 {
+	return pc.Status.Users
+}
+
+// SetUsers sets the number of users of this ProviderConfig.
+func (pc *ProviderConfig) SetUsers(i int64) {
+	pc.Status.Users = i
+}
+
 func init() {
 	SchemeBuilder.Register(&ProviderConfig{}, &ProviderConfigList{})
 }
diff --git a/apis/v1alpha1/providerconfigusage_types.go b/apis/cluster/v1alpha1/providerconfigusage_types.go
similarity index 74%
rename from apis/v1alpha1/providerconfigusage_types.go
rename to apis/cluster/v1alpha1/providerconfigusage_types.go
index ea4dd4a..5357e94 100644
--- a/apis/v1alpha1/providerconfigusage_types.go
+++ b/apis/cluster/v1alpha1/providerconfigusage_types.go
@@ -22,9 +22,14 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 )
 
+// verify interface casting required by controller
+var _ resource.ProviderConfigUsage = &ProviderConfigUsage{}
+var _ resource.ProviderConfigUsageList = &ProviderConfigUsageList{}
+
 // +kubebuilder:object:root=true
 
 // A ProviderConfigUsage indicates that a resource is using a ProviderConfig.
@@ -62,6 +67,25 @@ var (
 	ProviderConfigUsageListGroupVersionKind = SchemeGroupVersion.WithKind(ProviderConfigUsageListKind)
 )
 
+// SetResourceReference sets the resource reference.
+func (pcu *ProviderConfigUsage) SetResourceReference(r xpv1.TypedReference) {
+	pcu.ResourceReference = r
+}
+
+// GetResourceReference gets the resource reference.
+func (pcu *ProviderConfigUsage) GetResourceReference() xpv1.TypedReference {
+	return pcu.ResourceReference
+}
+
+// GetItems returns the list of ProviderConfigUsage items.
+func (pcul *ProviderConfigUsageList) GetItems() []resource.ProviderConfigUsage {
+	items := make([]resource.ProviderConfigUsage, len(pcul.Items))
+	for i := range pcul.Items {
+		items[i] = &pcul.Items[i]
+	}
+	return items
+}
+
 func init() {
 	SchemeBuilder.Register(&ProviderConfigUsage{}, &ProviderConfigUsageList{})
 }
diff --git a/apis/v1alpha1/zz_generated.deepcopy.go b/apis/cluster/v1alpha1/zz_generated.deepcopy.go
similarity index 100%
rename from apis/v1alpha1/zz_generated.deepcopy.go
rename to apis/cluster/v1alpha1/zz_generated.deepcopy.go
diff --git a/apis/cluster/v1alpha1/zz_generated.pc.go b/apis/cluster/v1alpha1/zz_generated.pc.go
new file mode 100644
index 0000000..88195b6
--- /dev/null
+++ b/apis/cluster/v1alpha1/zz_generated.pc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1alpha1
diff --git a/apis/v1alpha1/zz_generated.pcu.go b/apis/cluster/v1alpha1/zz_generated.pcu.go
similarity index 71%
rename from apis/v1alpha1/zz_generated.pcu.go
rename to apis/cluster/v1alpha1/zz_generated.pcu.go
index 710c6c6..8651bf0 100644
--- a/apis/v1alpha1/zz_generated.pcu.go
+++ b/apis/cluster/v1alpha1/zz_generated.pcu.go
@@ -17,24 +17,14 @@ limitations under the License.
 
 package v1alpha1
 
-import xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+import xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 
 // GetProviderConfigReference of this ProviderConfigUsage.
 func (p *ProviderConfigUsage) GetProviderConfigReference() xpv1.Reference {
 	return p.ProviderConfigReference
 }
 
-// GetResourceReference of this ProviderConfigUsage.
-func (p *ProviderConfigUsage) GetResourceReference() xpv1.TypedReference {
-	return p.ResourceReference
-}
-
 // SetProviderConfigReference of this ProviderConfigUsage.
 func (p *ProviderConfigUsage) SetProviderConfigReference(r xpv1.Reference) {
 	p.ProviderConfigReference = r
 }
-
-// SetResourceReference of this ProviderConfigUsage.
-func (p *ProviderConfigUsage) SetResourceReference(r xpv1.TypedReference) {
-	p.ResourceReference = r
-}
diff --git a/apis/cluster/v1alpha1/zz_generated.pculist.go b/apis/cluster/v1alpha1/zz_generated.pculist.go
new file mode 100644
index 0000000..88195b6
--- /dev/null
+++ b/apis/cluster/v1alpha1/zz_generated.pculist.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1alpha1
diff --git a/apis/common/common.go b/apis/common/common.go
index baf19d0..a12ba11 100644
--- a/apis/common/common.go
+++ b/apis/common/common.go
@@ -16,7 +16,7 @@ limitations under the License.
 package common
 
 import (
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 )
 
 // TLSConfig contains TLS configuration for HTTPS requests.
diff --git a/apis/common/zz_generated.deepcopy.go b/apis/common/zz_generated.deepcopy.go
index 5b0b740..f773e59 100644
--- a/apis/common/zz_generated.deepcopy.go
+++ b/apis/common/zz_generated.deepcopy.go
@@ -21,7 +21,7 @@ limitations under the License.
 package common
 
 import (
-	"github.com/crossplane/crossplane-runtime/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
diff --git a/apis/generate.go b/apis/generate.go
index 8dc4f86..3ed8e3f 100644
--- a/apis/generate.go
+++ b/apis/generate.go
@@ -1,6 +1,3 @@
-//go:build generate
-// +build generate
-
 /*
 Copyright 2020 The Crossplane Authors.
 
@@ -30,9 +27,3 @@ limitations under the License.
 //go:generate go run -tags generate github.com/crossplane/crossplane-tools/cmd/angryjet generate-methodsets --header-file=../hack/boilerplate.go.txt ./...
 
 package apis
-
-import (
-	_ "sigs.k8s.io/controller-tools/cmd/controller-gen" //nolint:typecheck
-
-	_ "github.com/crossplane/crossplane-tools/cmd/angryjet" //nolint:typecheck
-)
diff --git a/apis/http.go b/apis/http.go
index 3e48468..656f846 100644
--- a/apis/http.go
+++ b/apis/http.go
@@ -20,17 +20,25 @@ package apis
 import (
 	"k8s.io/apimachinery/pkg/runtime"
 
-	disposablerequestv1alpha1 "github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha2"
-	requestv1alpha1 "github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
-	httpv1alpha1 "github.com/crossplane-contrib/provider-http/apis/v1alpha1"
+	clusterdisposablerequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
+	clusterrequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
+	clusterhttpv1alpha1 "github.com/crossplane-contrib/provider-http/apis/cluster/v1alpha1"
+	namespaceddisposablerequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/disposablerequest/v1alpha2"
+	namespacedrequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/request/v1alpha2"
+	namespacedhtpv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/v1alpha2"
 )
 
 func init() {
 	// Register the types with the Scheme so the components can map objects to GroupVersionKinds and back
 	AddToSchemes = append(AddToSchemes,
-		httpv1alpha1.SchemeBuilder.AddToScheme,
-		disposablerequestv1alpha1.SchemeBuilder.AddToScheme,
-		requestv1alpha1.SchemeBuilder.AddToScheme,
+		// Cluster-scoped APIs
+		clusterhttpv1alpha1.SchemeBuilder.AddToScheme,
+		clusterdisposablerequestv1alpha2.SchemeBuilder.AddToScheme,
+		clusterrequestv1alpha2.SchemeBuilder.AddToScheme,
+		// Namespaced APIs
+		namespacedhtpv1alpha2.SchemeBuilder.AddToScheme,
+		namespaceddisposablerequestv1alpha2.SchemeBuilder.AddToScheme,
+		namespacedrequestv1alpha2.SchemeBuilder.AddToScheme,
 	)
 }
 
diff --git a/apis/interfaces/interfaces_test.go b/apis/interfaces/interfaces_test.go
index b005e13..78f3a90 100644
--- a/apis/interfaces/interfaces_test.go
+++ b/apis/interfaces/interfaces_test.go
@@ -19,66 +19,108 @@ package interfaces_test
 import (
 	"testing"
 
-	disposablerequestv1alpha1 "github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha1"
-	disposablerequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha2"
+	// Cluster-scoped imports
+	clusterdisposablerequestv1alpha1 "github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha1"
+	clusterdisposablerequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
+	clusterrequestv1alpha1 "github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha1"
+	clusterrequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
+
+	// Namespaced imports
+	namespaceddisposablerequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/disposablerequest/v1alpha2"
+	namespacedrequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/request/v1alpha2"
+
 	"github.com/crossplane-contrib/provider-http/apis/interfaces"
-	requestv1alpha1 "github.com/crossplane-contrib/provider-http/apis/request/v1alpha1"
-	requestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
 )
 
-// TestInterfaceImplementations verifies that all types properly implement the expected interfaces.
-func TestInterfaceImplementations(t *testing.T) {
+// TestClusterScopedInterfaceImplementations verifies that cluster-scoped types properly implement the expected interfaces.
+func TestClusterScopedInterfaceImplementations(t *testing.T) {
 	// Test v1alpha2.RequestParameters implements MappedHTTPRequestSpec
-	var _ interfaces.MappedHTTPRequestSpec = (*requestv1alpha2.RequestParameters)(nil)
+	var _ interfaces.MappedHTTPRequestSpec = (*clusterrequestv1alpha2.RequestParameters)(nil)
 
 	// Test v1alpha1.RequestParameters implements MappedHTTPRequestSpec
-	var _ interfaces.MappedHTTPRequestSpec = (*requestv1alpha1.RequestParameters)(nil)
+	var _ interfaces.MappedHTTPRequestSpec = (*clusterrequestv1alpha1.RequestParameters)(nil)
 
 	// Test v1alpha2.DisposableRequestParameters implements SimpleHTTPRequestSpec
-	var _ interfaces.SimpleHTTPRequestSpec = (*disposablerequestv1alpha2.DisposableRequestParameters)(nil)
+	var _ interfaces.SimpleHTTPRequestSpec = (*clusterdisposablerequestv1alpha2.DisposableRequestParameters)(nil)
 
 	// Test v1alpha1.DisposableRequestParameters implements SimpleHTTPRequestSpec
-	var _ interfaces.SimpleHTTPRequestSpec = (*disposablerequestv1alpha1.DisposableRequestParameters)(nil)
+	var _ interfaces.SimpleHTTPRequestSpec = (*clusterdisposablerequestv1alpha1.DisposableRequestParameters)(nil)
 
 	// Test Response types implement HTTPResponse
-	var _ interfaces.HTTPResponse = (*requestv1alpha2.Response)(nil)
-	var _ interfaces.HTTPResponse = (*requestv1alpha1.Response)(nil)
-	var _ interfaces.HTTPResponse = (*disposablerequestv1alpha2.Response)(nil)
-	var _ interfaces.HTTPResponse = (*disposablerequestv1alpha1.Response)(nil)
+	var _ interfaces.HTTPResponse = (*clusterrequestv1alpha2.Response)(nil)
+	var _ interfaces.HTTPResponse = (*clusterrequestv1alpha1.Response)(nil)
+	var _ interfaces.HTTPResponse = (*clusterdisposablerequestv1alpha2.Response)(nil)
+	var _ interfaces.HTTPResponse = (*clusterdisposablerequestv1alpha1.Response)(nil)
 
 	// Test Mapping types implement HTTPMapping
-	var _ interfaces.HTTPMapping = (*requestv1alpha2.Mapping)(nil)
-	var _ interfaces.HTTPMapping = (*requestv1alpha1.Mapping)(nil)
+	var _ interfaces.HTTPMapping = (*clusterrequestv1alpha2.Mapping)(nil)
+	var _ interfaces.HTTPMapping = (*clusterrequestv1alpha1.Mapping)(nil)
 
 	// Test Payload types implement HTTPPayload
-	var _ interfaces.HTTPPayload = (*requestv1alpha2.Payload)(nil)
-	var _ interfaces.HTTPPayload = (*requestv1alpha1.Payload)(nil)
+	var _ interfaces.HTTPPayload = (*clusterrequestv1alpha2.Payload)(nil)
+	var _ interfaces.HTTPPayload = (*clusterrequestv1alpha1.Payload)(nil)
 }
 
-func TestV1Alpha2SpecificInterfaces(t *testing.T) {
+// TestNamespacedInterfaceImplementations verifies that namespaced types properly implement the expected interfaces.
+func TestNamespacedInterfaceImplementations(t *testing.T) {
+	// Test v1alpha2.RequestParameters implements MappedHTTPRequestSpec
+	var _ interfaces.MappedHTTPRequestSpec = (*namespacedrequestv1alpha2.RequestParameters)(nil)
+
+	// Test v1alpha2.DisposableRequestParameters implements SimpleHTTPRequestSpec
+	var _ interfaces.SimpleHTTPRequestSpec = (*namespaceddisposablerequestv1alpha2.DisposableRequestParameters)(nil)
+
+	// Test Response types implement HTTPResponse
+	var _ interfaces.HTTPResponse = (*namespacedrequestv1alpha2.Response)(nil)
+	var _ interfaces.HTTPResponse = (*namespaceddisposablerequestv1alpha2.Response)(nil)
+
+	// Test Mapping types implement HTTPMapping
+	var _ interfaces.HTTPMapping = (*namespacedrequestv1alpha2.Mapping)(nil)
+
+	// Test Payload types implement HTTPPayload
+	var _ interfaces.HTTPPayload = (*namespacedrequestv1alpha2.Payload)(nil)
+}
+
+func TestClusterScopedV1Alpha2SpecificInterfaces(t *testing.T) {
 	// Test v1alpha2.RequestParameters implements ResponseCheckAware
-	var _ interfaces.ResponseCheckAware = (*requestv1alpha2.RequestParameters)(nil)
+	var _ interfaces.ResponseCheckAware = (*clusterrequestv1alpha2.RequestParameters)(nil)
 
 	// Test v1alpha2.DisposableRequestParameters implements ReconciliationPolicyAware
-	var _ interfaces.ReconciliationPolicyAware = (*disposablerequestv1alpha2.DisposableRequestParameters)(nil)
+	var _ interfaces.ReconciliationPolicyAware = (*clusterdisposablerequestv1alpha2.DisposableRequestParameters)(nil)
 
 	// Test v1alpha2.DisposableRequestParameters implements RollbackAware
-	var _ interfaces.RollbackAware = (*disposablerequestv1alpha2.DisposableRequestParameters)(nil)
+	var _ interfaces.RollbackAware = (*clusterdisposablerequestv1alpha2.DisposableRequestParameters)(nil)
 
 	// Test v1alpha1.DisposableRequestParameters implements RollbackAware
-	var _ interfaces.RollbackAware = (*disposablerequestv1alpha1.DisposableRequestParameters)(nil)
+	var _ interfaces.RollbackAware = (*clusterdisposablerequestv1alpha1.DisposableRequestParameters)(nil)
 
 	// Test v1alpha2.Request implements RequestStatus
-	var _ interfaces.RequestStatus = (*requestv1alpha2.Request)(nil)
+	var _ interfaces.RequestStatus = (*clusterrequestv1alpha2.Request)(nil)
 
 	// Test v1alpha2.DisposableRequest implements DisposableRequestStatus
-	var _ interfaces.DisposableRequestStatus = (*disposablerequestv1alpha2.DisposableRequest)(nil)
+	var _ interfaces.DisposableRequestStatus = (*clusterdisposablerequestv1alpha2.DisposableRequest)(nil)
 }
 
-func TestMethodAccess(t *testing.T) {
-	// Test that we can call interface methods
-	params := &requestv1alpha2.RequestParameters{
-		Mappings: []requestv1alpha2.Mapping{
+func TestNamespacedV1Alpha2SpecificInterfaces(t *testing.T) {
+	// Test v1alpha2.RequestParameters implements ResponseCheckAware
+	var _ interfaces.ResponseCheckAware = (*namespacedrequestv1alpha2.RequestParameters)(nil)
+
+	// Test v1alpha2.DisposableRequestParameters implements ReconciliationPolicyAware
+	var _ interfaces.ReconciliationPolicyAware = (*namespaceddisposablerequestv1alpha2.DisposableRequestParameters)(nil)
+
+	// Test v1alpha2.DisposableRequestParameters implements RollbackAware
+	var _ interfaces.RollbackAware = (*namespaceddisposablerequestv1alpha2.DisposableRequestParameters)(nil)
+
+	// Test v1alpha2.Request implements RequestStatus
+	var _ interfaces.RequestStatus = (*namespacedrequestv1alpha2.Request)(nil)
+
+	// Test v1alpha2.DisposableRequest implements DisposableRequestStatus
+	var _ interfaces.DisposableRequestStatus = (*namespaceddisposablerequestv1alpha2.DisposableRequest)(nil)
+}
+
+func TestClusterScopedMethodAccess(t *testing.T) {
+	// Test that we can call interface methods on cluster-scoped resources
+	params := &clusterrequestv1alpha2.RequestParameters{
+		Mappings: []clusterrequestv1alpha2.Mapping{
 			{URL: "https://example.com", Method: "GET"},
 		},
 	}
@@ -94,3 +136,23 @@ func TestMethodAccess(t *testing.T) {
 		t.Errorf("Expected URL 'https://example.com', got '%s'", mappings[0].GetURL())
 	}
 }
+
+func TestNamespacedMethodAccess(t *testing.T) {
+	// Test that we can call interface methods on namespaced resources
+	params := &namespacedrequestv1alpha2.RequestParameters{
+		Mappings: []namespacedrequestv1alpha2.Mapping{
+			{URL: "https://api.example.com", Method: "POST"},
+		},
+	}
+
+	var spec interfaces.MappedHTTPRequestSpec = params
+
+	mappings := spec.GetMappings()
+	if len(mappings) != 1 {
+		t.Errorf("Expected 1 mapping, got %d", len(mappings))
+	}
+
+	if mappings[0].GetURL() != "https://api.example.com" {
+		t.Errorf("Expected URL 'https://api.example.com', got '%s'", mappings[0].GetURL())
+	}
+}
diff --git a/apis/namespaced/disposablerequest/disposablerequest.go b/apis/namespaced/disposablerequest/disposablerequest.go
new file mode 100644
index 0000000..66d14ee
--- /dev/null
+++ b/apis/namespaced/disposablerequest/disposablerequest.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package disposablerequest contains group request API versions
+package disposablerequest
diff --git a/apis/namespaced/disposablerequest/v1alpha2/disposablerequest_types.go b/apis/namespaced/disposablerequest/v1alpha2/disposablerequest_types.go
new file mode 100644
index 0000000..9b45604
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/disposablerequest_types.go
@@ -0,0 +1,142 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	xpv2 "github.com/crossplane/crossplane-runtime/v2/apis/common/v2"
+)
+
+// DisposableRequestParameters are the configurable fields of a DisposableRequest.
+// +kubebuilder:validation:XValidation:rule="!(self.insecureSkipTLSVerify == true && has(self.tlsConfig))",message="insecureSkipTLSVerify and tlsConfig are mutually exclusive"
+type DisposableRequestParameters struct {
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Field 'forProvider.url' is immutable"
+	URL string `json:"url"`
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Field 'forProvider.method' is immutable"
+	Method string `json:"method"`
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Field 'forProvider.headers' is immutable"
+	Headers map[string][]string `json:"headers,omitempty"`
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Field 'forProvider.body' is immutable"
+	Body string `json:"body,omitempty"`
+
+	// WaitTimeout specifies the maximum time duration for waiting.
+	WaitTimeout *metav1.Duration `json:"waitTimeout,omitempty"`
+
+	// RollbackRetriesLimit is max number of attempts to retry HTTP request by sending again the request.
+	RollbackRetriesLimit *int32 `json:"rollbackRetriesLimit,omitempty"`
+
+	// InsecureSkipTLSVerify, when set to true, skips TLS certificate checks for the HTTP request.
+	// This field is mutually exclusive with TLSConfig.
+	// +optional
+	InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`
+
+	// TLSConfig allows overriding the TLS configuration from ProviderConfig for this specific request.
+	// This field is mutually exclusive with InsecureSkipTLSVerify.
+	// +optional
+	TLSConfig *common.TLSConfig `json:"tlsConfig,omitempty"`
+
+	// ExpectedResponse is a jq filter expression used to evaluate the HTTP response and determine if it matches the expected criteria.
+	// The expression should return a boolean; if true, the response is considered expected.
+	// Example: '.body.job_status == "success"'
+	ExpectedResponse string `json:"expectedResponse,omitempty"`
+
+	// NextReconcile specifies the duration after which the next reconcile should occur.
+	NextReconcile *metav1.Duration `json:"nextReconcile,omitempty"`
+
+	// ShouldLoopInfinitely specifies whether the reconciliation should loop indefinitely.
+	ShouldLoopInfinitely bool `json:"shouldLoopInfinitely,omitempty"`
+
+	// SecretInjectionConfig specifies the secrets receiving patches from response data.
+	SecretInjectionConfigs []common.SecretInjectionConfig `json:"secretInjectionConfigs,omitempty"`
+}
+
+// A DisposableRequestSpec defines the desired state of a DisposableRequest.
+type DisposableRequestSpec struct {
+	xpv2.ManagedResourceSpec `json:",inline"`
+	ForProvider              DisposableRequestParameters `json:"forProvider"`
+}
+
+type Response struct {
+	StatusCode int                 `json:"statusCode,omitempty"`
+	Body       string              `json:"body,omitempty"`
+	Headers    map[string][]string `json:"headers,omitempty"`
+}
+
+type Mapping struct {
+	Method  string              `json:"method"`
+	Body    string              `json:"body,omitempty"`
+	URL     string              `json:"url"`
+	Headers map[string][]string `json:"headers,omitempty"`
+}
+
+// A DisposableRequestStatus represents the observed state of a DisposableRequest.
+type DisposableRequestStatus struct {
+	xpv1.ResourceStatus `json:",inline"`
+	Response            Response `json:"response,omitempty"`
+	Failed              int32    `json:"failed,omitempty"`
+	Error               string   `json:"error,omitempty"`
+	Synced              bool     `json:"synced,omitempty"`
+	RequestDetails      Mapping  `json:"requestDetails,omitempty"`
+
+	// LastReconcileTime records the last time the resource was reconciled.
+	LastReconcileTime metav1.Time `json:"lastReconcileTime,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// A DisposableRequest is a namespaced HTTP disposable request resource.
+// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
+// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
+// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Namespaced,categories={crossplane,managed,http}
+// +kubebuilder:storageversion
+type DisposableRequest struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   DisposableRequestSpec   `json:"spec"`
+	Status DisposableRequestStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// DisposableRequestList contains a list of DisposableRequest
+type DisposableRequestList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []DisposableRequest `json:"items"`
+}
+
+// DisposableRequest type metadata.
+var (
+	DisposableRequestKind             = reflect.TypeOf(DisposableRequest{}).Name()
+	DisposableRequestGroupKind        = schema.GroupKind{Group: Group, Kind: DisposableRequestKind}.String()
+	DisposableRequestKindAPIVersion   = DisposableRequestKind + "." + SchemeGroupVersion.String()
+	DisposableRequestGroupVersionKind = SchemeGroupVersion.WithKind(DisposableRequestKind)
+)
+
+func init() {
+	SchemeBuilder.Register(&DisposableRequest{}, &DisposableRequestList{})
+}
diff --git a/apis/namespaced/disposablerequest/v1alpha2/doc.go b/apis/namespaced/disposablerequest/v1alpha2/doc.go
new file mode 100644
index 0000000..af368a1
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
diff --git a/apis/namespaced/disposablerequest/v1alpha2/groupversion_info.go b/apis/namespaced/disposablerequest/v1alpha2/groupversion_info.go
new file mode 100644
index 0000000..e4506ca
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/groupversion_info.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1alpha2 contains the v1alpha2 group Sample resources of the http provider.
+// +kubebuilder:object:generate=true
+// +groupName=http.m.crossplane.io
+// +versionName=v1alpha2
+package v1alpha2
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+// Package type metadata.
+const (
+	Group   = "http.m.crossplane.io"
+	Version = "v1alpha2"
+)
+
+var (
+	// SchemeGroupVersion is group version used to register these objects
+	SchemeGroupVersion = schema.GroupVersion{Group: Group, Version: Version}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
+)
diff --git a/apis/namespaced/disposablerequest/v1alpha2/spec_accessors.go b/apis/namespaced/disposablerequest/v1alpha2/spec_accessors.go
new file mode 100644
index 0000000..ce6c194
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/spec_accessors.go
@@ -0,0 +1,148 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	"github.com/crossplane-contrib/provider-http/apis/interfaces"
+)
+
+// Ensure DisposableRequestParameters implements SimpleHTTPRequestSpec
+var _ interfaces.SimpleHTTPRequestSpec = (*DisposableRequestParameters)(nil)
+
+// Ensure DisposableRequestParameters implements ReconciliationPolicyAware
+var _ interfaces.ReconciliationPolicyAware = (*DisposableRequestParameters)(nil)
+
+// Ensure DisposableRequestParameters implements RollbackAware
+var _ interfaces.RollbackAware = (*DisposableRequestParameters)(nil)
+
+// GetWaitTimeout returns the maximum time duration for waiting.
+func (d *DisposableRequestParameters) GetWaitTimeout() *metav1.Duration {
+	return d.WaitTimeout
+}
+
+// GetInsecureSkipTLSVerify returns whether to skip TLS certificate verification.
+func (d *DisposableRequestParameters) GetInsecureSkipTLSVerify() bool {
+	return d.InsecureSkipTLSVerify
+}
+
+// GetSecretInjectionConfigs returns the secret injection configurations.
+func (d *DisposableRequestParameters) GetSecretInjectionConfigs() []common.SecretInjectionConfig {
+	return d.SecretInjectionConfigs
+}
+
+// GetHeaders returns the default headers for the request.
+func (d *DisposableRequestParameters) GetHeaders() map[string][]string {
+	return d.Headers
+}
+
+// GetURL returns the URL for the request.
+func (d *DisposableRequestParameters) GetURL() string {
+	return d.URL
+}
+
+// GetMethod returns the HTTP method for the request.
+func (d *DisposableRequestParameters) GetMethod() string {
+	return d.Method
+}
+
+// GetBody returns the body of the request.
+func (d *DisposableRequestParameters) GetBody() string {
+	return d.Body
+}
+
+// GetExpectedResponse returns the jq filter expression for validating the response.
+func (d *DisposableRequestParameters) GetExpectedResponse() string {
+	return d.ExpectedResponse
+}
+
+// GetNextReconcile returns the duration after which the next reconcile should occur.
+func (d *DisposableRequestParameters) GetNextReconcile() *metav1.Duration {
+	return d.NextReconcile
+}
+
+// GetShouldLoopInfinitely returns whether reconciliation should loop indefinitely.
+func (d *DisposableRequestParameters) GetShouldLoopInfinitely() bool {
+	return d.ShouldLoopInfinitely
+}
+
+// GetRollbackRetriesLimit returns the maximum number of rollback retry attempts.
+func (d *DisposableRequestParameters) GetRollbackRetriesLimit() *int32 {
+	return d.RollbackRetriesLimit
+}
+
+// Ensure Response implements HTTPResponse
+var _ interfaces.HTTPResponse = (*Response)(nil)
+
+// GetStatusCode returns the HTTP status code.
+func (r *Response) GetStatusCode() int {
+	return r.StatusCode
+}
+
+// GetBody returns the response body.
+func (r *Response) GetBody() string {
+	return r.Body
+}
+
+// GetHeaders returns the response headers.
+func (r *Response) GetHeaders() map[string][]string {
+	return r.Headers
+}
+
+// Ensure DisposableRequest implements CachedResponse
+var _ interfaces.CachedResponse = (*DisposableRequest)(nil)
+
+// GetCachedResponse returns the cached response from the status.
+func (d *DisposableRequest) GetCachedResponse() interfaces.HTTPResponse {
+	if d.Status.Response.StatusCode == 0 {
+		return nil
+	}
+	return &d.Status.Response
+}
+
+// GetSynced returns whether the resource is synced.
+func (d *DisposableRequest) GetSynced() bool {
+	return d.Status.Synced
+}
+
+// GetFailed returns the failure count.
+func (d *DisposableRequest) GetFailed() int32 {
+	return d.Status.Failed
+}
+
+// GetResponse returns the HTTP response from status.
+func (d *DisposableRequest) GetResponse() interfaces.HTTPResponse {
+	return &d.Status.Response
+}
+
+// SetFailed sets the failure count.
+func (d *DisposableRequest) SetFailed(failed int32) {
+	d.Status.Failed = failed
+}
+
+// Ensure DisposableRequest implements DisposableRequestStatus
+var _ interfaces.DisposableRequestStatus = (*DisposableRequest)(nil)
+
+// Ensure DisposableRequest implements DisposableRequestResource
+var _ interfaces.DisposableRequestResource = (*DisposableRequest)(nil)
+
+// GetSpec returns the request specification (ForProvider parameters).
+func (d *DisposableRequest) GetSpec() interfaces.SimpleHTTPRequestSpec {
+	return &d.Spec.ForProvider
+}
diff --git a/apis/namespaced/disposablerequest/v1alpha2/spec_accessors_test.go b/apis/namespaced/disposablerequest/v1alpha2/spec_accessors_test.go
new file mode 100644
index 0000000..2e74788
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/spec_accessors_test.go
@@ -0,0 +1,172 @@
+package v1alpha2
+
+import (
+	"testing"
+	"time"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	"github.com/google/go-cmp/cmp"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestDisposableRequestParameters_Accessors(t *testing.T) {
+	timeout := &metav1.Duration{Duration: 5 * time.Minute}
+	nextReconcile := &metav1.Duration{Duration: 10 * time.Minute}
+	rollbackLimit := int32(3)
+
+	params := &DisposableRequestParameters{
+		URL:                   "https://api.example.com/resource",
+		Method:                "POST",
+		Body:                  `{"key":"value"}`,
+		Headers:               map[string][]string{"Content-Type": {"application/json"}},
+		WaitTimeout:           timeout,
+		InsecureSkipTLSVerify: true,
+		ExpectedResponse:      ".status == 'success'",
+		NextReconcile:         nextReconcile,
+		ShouldLoopInfinitely:  true,
+		RollbackRetriesLimit:  &rollbackLimit,
+		SecretInjectionConfigs: []common.SecretInjectionConfig{
+			{
+				SecretRef: common.SecretRef{
+					Name:      "test-secret",
+					Namespace: "default",
+				},
+			},
+		},
+	}
+
+	if got := params.GetURL(); got != "https://api.example.com/resource" {
+		t.Errorf("GetURL() = %v, want https://api.example.com/resource", got)
+	}
+
+	if got := params.GetMethod(); got != "POST" {
+		t.Errorf("GetMethod() = %v, want POST", got)
+	}
+
+	if got := params.GetBody(); got != `{"key":"value"}` {
+		t.Errorf("GetBody() = %v, want {\"key\":\"value\"}", got)
+	}
+
+	if got := params.GetHeaders(); !cmp.Equal(got, params.Headers) {
+		t.Errorf("GetHeaders() mismatch: %v", cmp.Diff(params.Headers, got))
+	}
+
+	if got := params.GetWaitTimeout(); got != timeout {
+		t.Errorf("GetWaitTimeout() = %v, want %v", got, timeout)
+	}
+
+	if got := params.GetInsecureSkipTLSVerify(); got != true {
+		t.Errorf("GetInsecureSkipTLSVerify() = %v, want true", got)
+	}
+
+	if got := params.GetExpectedResponse(); got != ".status == 'success'" {
+		t.Errorf("GetExpectedResponse() = %v, want .status == 'success'", got)
+	}
+
+	if got := params.GetNextReconcile(); got != nextReconcile {
+		t.Errorf("GetNextReconcile() = %v, want %v", got, nextReconcile)
+	}
+
+	if got := params.GetShouldLoopInfinitely(); got != true {
+		t.Errorf("GetShouldLoopInfinitely() = %v, want true", got)
+	}
+
+	if got := params.GetRollbackRetriesLimit(); *got != rollbackLimit {
+		t.Errorf("GetRollbackRetriesLimit() = %v, want %v", *got, rollbackLimit)
+	}
+
+	if got := params.GetSecretInjectionConfigs(); len(got) != 1 {
+		t.Errorf("GetSecretInjectionConfigs() length = %v, want 1", len(got))
+	}
+}
+
+func TestDisposableResponse_Accessors(t *testing.T) {
+	response := &Response{
+		StatusCode: 200,
+		Body:       `{"result":"success"}`,
+		Headers: map[string][]string{
+			"Content-Type": {"application/json"},
+		},
+	}
+
+	if got := response.GetStatusCode(); got != 200 {
+		t.Errorf("GetStatusCode() = %v, want 200", got)
+	}
+
+	if got := response.GetBody(); got != `{"result":"success"}` {
+		t.Errorf("GetBody() = %v, want {\"result\":\"success\"}", got)
+	}
+
+	if got := response.GetHeaders(); len(got) != 1 {
+		t.Errorf("GetHeaders() length = %v, want 1", len(got))
+	}
+}
+
+func TestDisposableRequest_CachedResponse(t *testing.T) {
+	// Test with cached response
+	req := &DisposableRequest{
+		Status: DisposableRequestStatus{
+			Response: Response{
+				StatusCode: 200,
+				Body:       "cached",
+			},
+		},
+	}
+
+	cached := req.GetCachedResponse()
+	if cached == nil {
+		t.Error("GetCachedResponse() returned nil for valid response")
+	}
+	if cached.GetStatusCode() != 200 {
+		t.Errorf("Cached response StatusCode = %v, want 200", cached.GetStatusCode())
+	}
+
+	// Test with no cached response
+	req2 := &DisposableRequest{
+		Status: DisposableRequestStatus{
+			Response: Response{
+				StatusCode: 0,
+			},
+		},
+	}
+
+	cached2 := req2.GetCachedResponse()
+	if cached2 != nil {
+		t.Error("GetCachedResponse() should return nil when StatusCode is 0")
+	}
+}
+
+func TestDisposableRequest_StatusAccessors(t *testing.T) {
+	req := &DisposableRequest{
+		Status: DisposableRequestStatus{
+			Synced: true,
+			Failed: 2,
+			Response: Response{
+				StatusCode: 201,
+				Body:       "test response",
+			},
+		},
+	}
+
+	if got := req.GetSynced(); got != true {
+		t.Errorf("GetSynced() = %v, want true", got)
+	}
+
+	if got := req.GetFailed(); got != 2 {
+		t.Errorf("GetFailed() = %v, want 2", got)
+	}
+
+	resp := req.GetResponse()
+	if resp == nil {
+		t.Error("GetResponse() returned nil")
+	}
+	if resp.GetStatusCode() != 201 {
+		t.Errorf("Response StatusCode = %v, want 201", resp.GetStatusCode())
+	}
+
+	// Test SetFailed
+	req.SetFailed(5)
+	if got := req.GetFailed(); got != 5 {
+		t.Errorf("After SetFailed(5), GetFailed() = %v, want 5", got)
+	}
+}
diff --git a/apis/namespaced/disposablerequest/v1alpha2/status_setters.go b/apis/namespaced/disposablerequest/v1alpha2/status_setters.go
new file mode 100644
index 0000000..3bb6f46
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/status_setters.go
@@ -0,0 +1,44 @@
+package v1alpha2
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (d *DisposableRequest) SetStatusCode(statusCode int) {
+	d.Status.Response.StatusCode = statusCode
+}
+
+func (d *DisposableRequest) SetHeaders(headers map[string][]string) {
+	d.Status.Response.Headers = headers
+}
+
+func (d *DisposableRequest) SetBody(body string) {
+	d.Status.Response.Body = body
+}
+
+func (d *DisposableRequest) SetSynced(synced bool) {
+	d.Status.Synced = synced
+	d.Status.Failed = 0
+	d.Status.Error = ""
+}
+
+func (d *DisposableRequest) SetLastReconcileTime() {
+	d.Status.LastReconcileTime = metav1.NewTime(time.Now())
+}
+
+func (d *DisposableRequest) SetError(err error) {
+	d.Status.Failed++
+	d.Status.Synced = false
+	if err != nil {
+		d.Status.Error = err.Error()
+	}
+}
+
+func (d *DisposableRequest) SetRequestDetails(url, method, body string, headers map[string][]string) {
+	d.Status.RequestDetails.Body = body
+	d.Status.RequestDetails.URL = url
+	d.Status.RequestDetails.Headers = headers
+	d.Status.RequestDetails.Method = method
+}
diff --git a/apis/namespaced/disposablerequest/v1alpha2/zz_generated.deepcopy.go b/apis/namespaced/disposablerequest/v1alpha2/zz_generated.deepcopy.go
new file mode 100644
index 0000000..afab4a0
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/zz_generated.deepcopy.go
@@ -0,0 +1,242 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DisposableRequest) DeepCopyInto(out *DisposableRequest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DisposableRequest.
+func (in *DisposableRequest) DeepCopy() *DisposableRequest {
+	if in == nil {
+		return nil
+	}
+	out := new(DisposableRequest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DisposableRequest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DisposableRequestList) DeepCopyInto(out *DisposableRequestList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]DisposableRequest, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DisposableRequestList.
+func (in *DisposableRequestList) DeepCopy() *DisposableRequestList {
+	if in == nil {
+		return nil
+	}
+	out := new(DisposableRequestList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DisposableRequestList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DisposableRequestParameters) DeepCopyInto(out *DisposableRequestParameters) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string][]string, len(*in))
+		for key, val := range *in {
+			var outVal []string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.WaitTimeout != nil {
+		in, out := &in.WaitTimeout, &out.WaitTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.RollbackRetriesLimit != nil {
+		in, out := &in.RollbackRetriesLimit, &out.RollbackRetriesLimit
+		*out = new(int32)
+		**out = **in
+	}
+	if in.TLSConfig != nil {
+		in, out := &in.TLSConfig, &out.TLSConfig
+		*out = new(common.TLSConfig)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.NextReconcile != nil {
+		in, out := &in.NextReconcile, &out.NextReconcile
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.SecretInjectionConfigs != nil {
+		in, out := &in.SecretInjectionConfigs, &out.SecretInjectionConfigs
+		*out = make([]common.SecretInjectionConfig, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DisposableRequestParameters.
+func (in *DisposableRequestParameters) DeepCopy() *DisposableRequestParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(DisposableRequestParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DisposableRequestSpec) DeepCopyInto(out *DisposableRequestSpec) {
+	*out = *in
+	in.ManagedResourceSpec.DeepCopyInto(&out.ManagedResourceSpec)
+	in.ForProvider.DeepCopyInto(&out.ForProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DisposableRequestSpec.
+func (in *DisposableRequestSpec) DeepCopy() *DisposableRequestSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(DisposableRequestSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DisposableRequestStatus) DeepCopyInto(out *DisposableRequestStatus) {
+	*out = *in
+	in.ResourceStatus.DeepCopyInto(&out.ResourceStatus)
+	in.Response.DeepCopyInto(&out.Response)
+	in.RequestDetails.DeepCopyInto(&out.RequestDetails)
+	in.LastReconcileTime.DeepCopyInto(&out.LastReconcileTime)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DisposableRequestStatus.
+func (in *DisposableRequestStatus) DeepCopy() *DisposableRequestStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(DisposableRequestStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Mapping) DeepCopyInto(out *Mapping) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string][]string, len(*in))
+		for key, val := range *in {
+			var outVal []string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Mapping.
+func (in *Mapping) DeepCopy() *Mapping {
+	if in == nil {
+		return nil
+	}
+	out := new(Mapping)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Response) DeepCopyInto(out *Response) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string][]string, len(*in))
+		for key, val := range *in {
+			var outVal []string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Response.
+func (in *Response) DeepCopy() *Response {
+	if in == nil {
+		return nil
+	}
+	out := new(Response)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/apis/namespaced/disposablerequest/v1alpha2/zz_generated.managed.go b/apis/namespaced/disposablerequest/v1alpha2/zz_generated.managed.go
new file mode 100644
index 0000000..cbbf70f
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/zz_generated.managed.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1alpha2
+
+import xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+
+// GetCondition of this DisposableRequest.
+func (mg *DisposableRequest) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return mg.Status.GetCondition(ct)
+}
+
+// GetManagementPolicies of this DisposableRequest.
+func (mg *DisposableRequest) GetManagementPolicies() xpv1.ManagementPolicies {
+	return mg.Spec.ManagementPolicies
+}
+
+// GetProviderConfigReference of this DisposableRequest.
+func (mg *DisposableRequest) GetProviderConfigReference() *xpv1.ProviderConfigReference {
+	return mg.Spec.ProviderConfigReference
+}
+
+// GetWriteConnectionSecretToReference of this DisposableRequest.
+func (mg *DisposableRequest) GetWriteConnectionSecretToReference() *xpv1.LocalSecretReference {
+	return mg.Spec.WriteConnectionSecretToReference
+}
+
+// SetConditions of this DisposableRequest.
+func (mg *DisposableRequest) SetConditions(c ...xpv1.Condition) {
+	mg.Status.SetConditions(c...)
+}
+
+// SetManagementPolicies of this DisposableRequest.
+func (mg *DisposableRequest) SetManagementPolicies(r xpv1.ManagementPolicies) {
+	mg.Spec.ManagementPolicies = r
+}
+
+// SetProviderConfigReference of this DisposableRequest.
+func (mg *DisposableRequest) SetProviderConfigReference(r *xpv1.ProviderConfigReference) {
+	mg.Spec.ProviderConfigReference = r
+}
+
+// SetWriteConnectionSecretToReference of this DisposableRequest.
+func (mg *DisposableRequest) SetWriteConnectionSecretToReference(r *xpv1.LocalSecretReference) {
+	mg.Spec.WriteConnectionSecretToReference = r
+}
diff --git a/apis/namespaced/disposablerequest/v1alpha2/zz_generated.managedlist.go b/apis/namespaced/disposablerequest/v1alpha2/zz_generated.managedlist.go
new file mode 100644
index 0000000..9f555c0
--- /dev/null
+++ b/apis/namespaced/disposablerequest/v1alpha2/zz_generated.managedlist.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1alpha2
+
+import resource "github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+
+// GetItems of this DisposableRequestList.
+func (l *DisposableRequestList) GetItems() []resource.Managed {
+	items := make([]resource.Managed, len(l.Items))
+	for i := range l.Items {
+		items[i] = &l.Items[i]
+	}
+	return items
+}
diff --git a/apis/namespaced/request/request.go b/apis/namespaced/request/request.go
new file mode 100644
index 0000000..b05a3f1
--- /dev/null
+++ b/apis/namespaced/request/request.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package request contains group request API versions
+package request
diff --git a/apis/namespaced/request/v1alpha2/doc.go b/apis/namespaced/request/v1alpha2/doc.go
new file mode 100644
index 0000000..af368a1
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
diff --git a/apis/namespaced/request/v1alpha2/groupversion_info.go b/apis/namespaced/request/v1alpha2/groupversion_info.go
new file mode 100644
index 0000000..e4506ca
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/groupversion_info.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1alpha2 contains the v1alpha2 group Sample resources of the http provider.
+// +kubebuilder:object:generate=true
+// +groupName=http.m.crossplane.io
+// +versionName=v1alpha2
+package v1alpha2
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+// Package type metadata.
+const (
+	Group   = "http.m.crossplane.io"
+	Version = "v1alpha2"
+)
+
+var (
+	// SchemeGroupVersion is group version used to register these objects
+	SchemeGroupVersion = schema.GroupVersion{Group: Group, Version: Version}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
+)
diff --git a/apis/namespaced/request/v1alpha2/request_types.go b/apis/namespaced/request/v1alpha2/request_types.go
new file mode 100644
index 0000000..d9a3d09
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/request_types.go
@@ -0,0 +1,180 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	xpv2 "github.com/crossplane/crossplane-runtime/v2/apis/common/v2"
+)
+
+const (
+	ExpectedResponseCheckTypeDefault = "DEFAULT"
+	ExpectedResponseCheckTypeCustom  = "CUSTOM"
+)
+
+const (
+	ActionCreate  = "CREATE"
+	ActionObserve = "OBSERVE"
+	ActionUpdate  = "UPDATE"
+	ActionRemove  = "REMOVE"
+)
+
+// RequestParameters are the configurable fields of a Request.
+// +kubebuilder:validation:XValidation:rule="!(self.insecureSkipTLSVerify == true && has(self.tlsConfig))",message="insecureSkipTLSVerify and tlsConfig are mutually exclusive"
+type RequestParameters struct {
+	// Mappings defines the HTTP mappings for different methods.
+	// Either Method or Action must be specified. If both are omitted, the mapping will not be used.
+	// +kubebuilder:validation:MinItems=1
+	Mappings []Mapping `json:"mappings"`
+
+	// Payload defines the payload for the request.
+	Payload Payload `json:"payload"`
+
+	// Headers defines default headers for each request.
+	Headers map[string][]string `json:"headers,omitempty"`
+
+	// WaitTimeout specifies the maximum time duration for waiting.
+	WaitTimeout *metav1.Duration `json:"waitTimeout,omitempty"`
+
+	// InsecureSkipTLSVerify, when set to true, skips TLS certificate checks for the HTTP request.
+	// This field is mutually exclusive with TLSConfig.
+	// +optional
+	InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`
+
+	// TLSConfig allows overriding the TLS configuration from ProviderConfig for this specific request.
+	// This field is mutually exclusive with InsecureSkipTLSVerify.
+	// +optional
+	TLSConfig *common.TLSConfig `json:"tlsConfig,omitempty"`
+
+	// SecretInjectionConfig specifies the secrets receiving patches for response data.
+	SecretInjectionConfigs []common.SecretInjectionConfig `json:"secretInjectionConfigs,omitempty"`
+
+	// ExpectedResponseCheck specifies the mechanism to validate the OBSERVE response against expected value.
+	ExpectedResponseCheck ExpectedResponseCheck `json:"expectedResponseCheck,omitempty"`
+
+	// IsRemovedCheck specifies the mechanism to validate the OBSERVE response after removal against expected value.
+	IsRemovedCheck ExpectedResponseCheck `json:"isRemovedCheck,omitempty"`
+}
+
+type Mapping struct {
+	// +kubebuilder:validation:Enum=POST;GET;PUT;DELETE;PATCH;HEAD;OPTIONS
+	// Method specifies the HTTP method for the request.
+	Method string `json:"method,omitempty"`
+
+	// +kubebuilder:validation:Enum=CREATE;OBSERVE;UPDATE;REMOVE
+	// Action specifies the intended action for the request.
+	Action string `json:"action,omitempty"`
+
+	// Body specifies the body of the request.
+	Body string `json:"body,omitempty"`
+
+	// URL specifies the URL for the request.
+	URL string `json:"url"`
+
+	// Headers specifies the headers for the request.
+	Headers map[string][]string `json:"headers,omitempty"`
+}
+
+type ExpectedResponseCheck struct {
+	// Type specifies the type of the expected response check.
+	// +kubebuilder:validation:Enum=DEFAULT;CUSTOM
+	Type string `json:"type,omitempty"`
+
+	// Logic specifies the custom logic for the expected response check.
+	Logic string `json:"logic,omitempty"`
+}
+
+type Payload struct {
+	// BaseUrl specifies the base URL for the request.
+	BaseUrl string `json:"baseUrl,omitempty"`
+
+	// Body specifies data to be used in the request body.
+	Body string `json:"body,omitempty"`
+}
+
+// A RequestSpec defines the desired state of a Request.
+type RequestSpec struct {
+	xpv2.ManagedResourceSpec `json:",inline"`
+	ForProvider              RequestParameters `json:"forProvider"`
+}
+
+// RequestObservation are the observable fields of a Request.
+type Response struct {
+	StatusCode int                 `json:"statusCode,omitempty"`
+	Body       string              `json:"body,omitempty"`
+	Headers    map[string][]string `json:"headers,omitempty"`
+}
+
+// A RequestStatus represents the observed state of a Request.
+type RequestStatus struct {
+	xpv1.ResourceStatus `json:",inline"`
+	Response            Response `json:"response,omitempty"`
+	Cache               Cache    `json:"cache,omitempty"`
+	Failed              int32    `json:"failed,omitempty"`
+	Error               string   `json:"error,omitempty"`
+	RequestDetails      Mapping  `json:"requestDetails,omitempty"`
+}
+
+type Cache struct {
+	LastUpdated string   `json:"lastUpdated,omitempty"`
+	Response    Response `json:"response,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// A Request is a namespaced HTTP request resource.
+// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
+// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
+// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Namespaced,categories={crossplane,managed,http}
+// +kubebuilder:storageversion
+type Request struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   RequestSpec   `json:"spec"`
+	Status RequestStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// RequestList contains a list of Request
+type RequestList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Request `json:"items"`
+}
+
+// Request type metadata.
+var (
+	RequestKind             = reflect.TypeOf(Request{}).Name()
+	RequestGroupKind        = schema.GroupKind{Group: Group, Kind: RequestKind}.String()
+	RequestKindAPIVersion   = RequestKind + "." + SchemeGroupVersion.String()
+	RequestGroupVersionKind = SchemeGroupVersion.WithKind(RequestKind)
+)
+
+func init() {
+	SchemeBuilder.Register(&Request{}, &RequestList{})
+}
diff --git a/apis/namespaced/request/v1alpha2/spec_accessors.go b/apis/namespaced/request/v1alpha2/spec_accessors.go
new file mode 100644
index 0000000..152459d
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/spec_accessors.go
@@ -0,0 +1,191 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	"github.com/crossplane-contrib/provider-http/apis/interfaces"
+)
+
+// Ensure RequestParameters implements MappedHTTPRequestSpec
+var _ interfaces.MappedHTTPRequestSpec = (*RequestParameters)(nil)
+
+// Ensure RequestParameters implements ResponseCheckAware
+var _ interfaces.ResponseCheckAware = (*RequestParameters)(nil)
+
+// GetWaitTimeout returns the maximum time duration for waiting.
+func (r *RequestParameters) GetWaitTimeout() *metav1.Duration {
+	return r.WaitTimeout
+}
+
+// GetInsecureSkipTLSVerify returns whether to skip TLS certificate verification.
+func (r *RequestParameters) GetInsecureSkipTLSVerify() bool {
+	return r.InsecureSkipTLSVerify
+}
+
+// GetSecretInjectionConfigs returns the secret injection configurations.
+func (r *RequestParameters) GetSecretInjectionConfigs() []common.SecretInjectionConfig {
+	return r.SecretInjectionConfigs
+}
+
+// GetHeaders returns the default headers for the request.
+func (r *RequestParameters) GetHeaders() map[string][]string {
+	return r.Headers
+}
+
+// GetMappings returns the HTTP mappings for different methods/actions.
+func (r *RequestParameters) GetMappings() []interfaces.HTTPMapping {
+	result := make([]interfaces.HTTPMapping, len(r.Mappings))
+	for i := range r.Mappings {
+		result[i] = &r.Mappings[i]
+	}
+	return result
+}
+
+// GetPayload returns the payload configuration.
+func (r *RequestParameters) GetPayload() interfaces.HTTPPayload {
+	return &r.Payload
+}
+
+// GetExpectedResponseCheck returns the expected response check configuration.
+func (r *RequestParameters) GetExpectedResponseCheck() interfaces.ResponseCheck {
+	return &r.ExpectedResponseCheck
+}
+
+// GetIsRemovedCheck returns the is-removed check configuration.
+func (r *RequestParameters) GetIsRemovedCheck() interfaces.ResponseCheck {
+	return &r.IsRemovedCheck
+}
+
+// Ensure Mapping implements HTTPMapping
+var _ interfaces.HTTPMapping = (*Mapping)(nil)
+
+// GetMethod returns the HTTP method.
+func (m *Mapping) GetMethod() string {
+	return m.Method
+}
+
+// SetMethod sets the HTTP method.
+func (m *Mapping) SetMethod(method string) {
+	m.Method = method
+}
+
+// GetAction returns the action type.
+func (m *Mapping) GetAction() string {
+	return m.Action
+}
+
+// GetBody returns the body template for this mapping.
+func (m *Mapping) GetBody() string {
+	return m.Body
+}
+
+// GetURL returns the URL template for this mapping.
+func (m *Mapping) GetURL() string {
+	return m.URL
+}
+
+// GetHeaders returns the headers for this mapping.
+func (m *Mapping) GetHeaders() map[string][]string {
+	return m.Headers
+}
+
+// Ensure Payload implements HTTPPayload
+var _ interfaces.HTTPPayload = (*Payload)(nil)
+
+// GetBaseURL returns the base URL.
+func (p *Payload) GetBaseURL() string {
+	return p.BaseUrl
+}
+
+// GetBody returns the payload body.
+func (p *Payload) GetBody() string {
+	return p.Body
+}
+
+// Ensure ExpectedResponseCheck implements ResponseCheck
+var _ interfaces.ResponseCheck = (*ExpectedResponseCheck)(nil)
+
+// GetType returns the check type.
+func (e *ExpectedResponseCheck) GetType() string {
+	return e.Type
+}
+
+// GetLogic returns the custom logic for the check.
+func (e *ExpectedResponseCheck) GetLogic() string {
+	return e.Logic
+}
+
+// Ensure Response implements HTTPResponse
+var _ interfaces.HTTPResponse = (*Response)(nil)
+
+// GetStatusCode returns the HTTP status code.
+func (r *Response) GetStatusCode() int {
+	return r.StatusCode
+}
+
+// GetBody returns the response body.
+func (r *Response) GetBody() string {
+	return r.Body
+}
+
+// GetHeaders returns the response headers.
+func (r *Response) GetHeaders() map[string][]string {
+	return r.Headers
+}
+
+// Ensure Request implements CachedResponse
+var _ interfaces.CachedResponse = (*Request)(nil)
+
+// GetCachedResponse returns the cached response from the status.
+func (r *Request) GetCachedResponse() interfaces.HTTPResponse {
+	if r.Status.Response.StatusCode == 0 {
+		return nil
+	}
+	return &r.Status.Response
+}
+
+// Ensure Request implements RequestStatusReader
+var _ interfaces.RequestStatusReader = (*Request)(nil)
+
+// GetResponse returns the HTTP response from status.
+func (r *Request) GetResponse() interfaces.HTTPResponse {
+	return &r.Status.Response
+}
+
+// GetFailed returns the failure count.
+func (r *Request) GetFailed() int32 {
+	return r.Status.Failed
+}
+
+// GetRequestDetails returns the request details mapping.
+func (r *Request) GetRequestDetails() interfaces.HTTPMapping {
+	return &r.Status.RequestDetails
+}
+
+// Ensure Request implements RequestResource
+var _ interfaces.RequestResource = (*Request)(nil)
+
+// GetSpec returns the request specification.
+func (r *Request) GetSpec() interfaces.MappedHTTPRequestSpec {
+	return &r.Spec.ForProvider
+}
+
+// Ensure Request implements RequestStatus (read + write + cached)
+var _ interfaces.RequestStatus = (*Request)(nil)
diff --git a/apis/namespaced/request/v1alpha2/spec_accessors_test.go b/apis/namespaced/request/v1alpha2/spec_accessors_test.go
new file mode 100644
index 0000000..2b28507
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/spec_accessors_test.go
@@ -0,0 +1,268 @@
+package v1alpha2
+
+import (
+	"testing"
+	"time"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	"github.com/google/go-cmp/cmp"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestRequestParameters_Accessors(t *testing.T) {
+	timeout := &metav1.Duration{Duration: 5 * time.Minute}
+	headers := map[string][]string{
+		"Content-Type": {"application/json"},
+	}
+	secretConfigs := []common.SecretInjectionConfig{
+		{
+			SecretRef: common.SecretRef{
+				Name:      "test-secret",
+				Namespace: "default",
+			},
+		},
+	}
+
+	params := &RequestParameters{
+		WaitTimeout:            timeout,
+		InsecureSkipTLSVerify:  true,
+		Headers:                headers,
+		SecretInjectionConfigs: secretConfigs,
+		Payload: Payload{
+			BaseUrl: "https://api.example.com",
+			Body:    `{"key":"value"}`,
+		},
+		Mappings: []Mapping{
+			{
+				Method: "POST",
+				URL:    ".payload.baseUrl",
+				Body:   ".payload.body",
+			},
+		},
+		ExpectedResponseCheck: ExpectedResponseCheck{
+			Type:  "jq",
+			Logic: ".status == 'success'",
+		},
+		IsRemovedCheck: ExpectedResponseCheck{
+			Type:  "statusCode",
+			Logic: "404",
+		},
+	}
+
+	if got := params.GetWaitTimeout(); got != timeout {
+		t.Errorf("GetWaitTimeout() = %v, want %v", got, timeout)
+	}
+
+	if got := params.GetInsecureSkipTLSVerify(); got != true {
+		t.Errorf("GetInsecureSkipTLSVerify() = %v, want true", got)
+	}
+
+	if got := params.GetHeaders(); !cmp.Equal(got, headers) {
+		t.Errorf("GetHeaders() mismatch: %v", cmp.Diff(headers, got))
+	}
+
+	if got := params.GetSecretInjectionConfigs(); len(got) != 1 {
+		t.Errorf("GetSecretInjectionConfigs() length = %v, want 1", len(got))
+	}
+
+	if got := params.GetPayload(); got == nil {
+		t.Error("GetPayload() returned nil")
+	}
+
+	if got := params.GetMappings(); len(got) != 1 {
+		t.Errorf("GetMappings() length = %v, want 1", len(got))
+	}
+
+	if got := params.GetExpectedResponseCheck(); got == nil {
+		t.Error("GetExpectedResponseCheck() returned nil")
+	}
+
+	if got := params.GetIsRemovedCheck(); got == nil {
+		t.Error("GetIsRemovedCheck() returned nil")
+	}
+}
+
+func TestMapping_Accessors(t *testing.T) {
+	mapping := &Mapping{
+		Method: "POST",
+		Action: "create",
+		Body:   `{"key":"value"}`,
+		URL:    "https://api.example.com/resource",
+		Headers: map[string][]string{
+			"Authorization": {"Bearer token"},
+		},
+	}
+
+	if got := mapping.GetMethod(); got != "POST" {
+		t.Errorf("GetMethod() = %v, want POST", got)
+	}
+
+	if got := mapping.GetAction(); got != "create" {
+		t.Errorf("GetAction() = %v, want create", got)
+	}
+
+	if got := mapping.GetBody(); got != `{"key":"value"}` {
+		t.Errorf("GetBody() = %v, want {\"key\":\"value\"}", got)
+	}
+
+	if got := mapping.GetURL(); got != "https://api.example.com/resource" {
+		t.Errorf("GetURL() = %v, want https://api.example.com/resource", got)
+	}
+
+	if got := mapping.GetHeaders(); len(got) != 1 {
+		t.Errorf("GetHeaders() length = %v, want 1", len(got))
+	}
+
+	// Test SetMethod
+	mapping.SetMethod("GET")
+	if got := mapping.GetMethod(); got != "GET" {
+		t.Errorf("After SetMethod(GET), GetMethod() = %v, want GET", got)
+	}
+}
+
+func TestPayload_Accessors(t *testing.T) {
+	payload := &Payload{
+		BaseUrl: "https://api.example.com",
+		Body:    `{"data":"test"}`,
+	}
+
+	if got := payload.GetBaseURL(); got != "https://api.example.com" {
+		t.Errorf("GetBaseURL() = %v, want https://api.example.com", got)
+	}
+
+	if got := payload.GetBody(); got != `{"data":"test"}` {
+		t.Errorf("GetBody() = %v, want {\"data\":\"test\"}", got)
+	}
+}
+
+func TestExpectedResponseCheck_Accessors(t *testing.T) {
+	check := &ExpectedResponseCheck{
+		Type:  "jq",
+		Logic: ".status == 'ok'",
+	}
+
+	if got := check.GetType(); got != "jq" {
+		t.Errorf("GetType() = %v, want jq", got)
+	}
+
+	if got := check.GetLogic(); got != ".status == 'ok'" {
+		t.Errorf("GetLogic() = %v, want .status == 'ok'", got)
+	}
+}
+
+func TestResponse_Accessors(t *testing.T) {
+	response := &Response{
+		StatusCode: 200,
+		Body:       `{"result":"success"}`,
+		Headers: map[string][]string{
+			"Content-Type": {"application/json"},
+		},
+	}
+
+	if got := response.GetStatusCode(); got != 200 {
+		t.Errorf("GetStatusCode() = %v, want 200", got)
+	}
+
+	if got := response.GetBody(); got != `{"result":"success"}` {
+		t.Errorf("GetBody() = %v, want {\"result\":\"success\"}", got)
+	}
+
+	if got := response.GetHeaders(); len(got) != 1 {
+		t.Errorf("GetHeaders() length = %v, want 1", len(got))
+	}
+}
+
+func TestRequest_CachedResponse(t *testing.T) {
+	// Test with cached response
+	req := &Request{
+		Status: RequestStatus{
+			Response: Response{
+				StatusCode: 200,
+				Body:       "cached",
+			},
+		},
+	}
+
+	cached := req.GetCachedResponse()
+	if cached == nil {
+		t.Error("GetCachedResponse() returned nil for valid response")
+	}
+	if cached.GetStatusCode() != 200 {
+		t.Errorf("Cached response StatusCode = %v, want 200", cached.GetStatusCode())
+	}
+
+	// Test with no cached response
+	req2 := &Request{
+		Status: RequestStatus{
+			Response: Response{
+				StatusCode: 0,
+			},
+		},
+	}
+
+	cached2 := req2.GetCachedResponse()
+	if cached2 != nil {
+		t.Error("GetCachedResponse() should return nil when StatusCode is 0")
+	}
+}
+
+func TestRequest_StatusReader(t *testing.T) {
+	req := &Request{
+		Status: RequestStatus{
+			Response: Response{
+				StatusCode: 200,
+				Body:       "test",
+			},
+			Failed: 3,
+			RequestDetails: Mapping{
+				Method: "POST",
+				URL:    "https://example.com",
+			},
+		},
+	}
+
+	resp := req.GetResponse()
+	if resp == nil {
+		t.Error("GetResponse() returned nil")
+	}
+	if resp.GetStatusCode() != 200 {
+		t.Errorf("Response StatusCode = %v, want 200", resp.GetStatusCode())
+	}
+
+	if got := req.GetFailed(); got != 3 {
+		t.Errorf("GetFailed() = %v, want 3", got)
+	}
+
+	details := req.GetRequestDetails()
+	if details == nil {
+		t.Error("GetRequestDetails() returned nil")
+	}
+	if details.GetMethod() != "POST" {
+		t.Errorf("RequestDetails Method = %v, want POST", details.GetMethod())
+	}
+}
+
+func TestRequest_RequestResource(t *testing.T) {
+	req := &Request{
+		Spec: RequestSpec{
+			ForProvider: RequestParameters{
+				Payload: Payload{
+					BaseUrl: "https://api.example.com",
+				},
+			},
+		},
+	}
+
+	spec := req.GetSpec()
+	if spec == nil {
+		t.Error("GetSpec() returned nil")
+	}
+
+	payload := spec.GetPayload()
+	if payload == nil {
+		t.Error("Spec.GetPayload() returned nil")
+	}
+	if payload.GetBaseURL() != "https://api.example.com" {
+		t.Errorf("Payload BaseURL = %v, want https://api.example.com", payload.GetBaseURL())
+	}
+}
diff --git a/apis/namespaced/request/v1alpha2/status_setters.go b/apis/namespaced/request/v1alpha2/status_setters.go
new file mode 100644
index 0000000..bb4ae7f
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/status_setters.go
@@ -0,0 +1,41 @@
+package v1alpha2
+
+import "time"
+
+func (d *Request) SetStatusCode(statusCode int) {
+	d.Status.Response.StatusCode = statusCode
+}
+
+func (d *Request) SetHeaders(headers map[string][]string) {
+	d.Status.Response.Headers = headers
+}
+
+func (d *Request) SetBody(body string) {
+	d.Status.Response.Body = body
+}
+
+func (d *Request) SetError(err error) {
+	d.Status.Failed++
+	if err != nil {
+		d.Status.Error = err.Error()
+	}
+}
+
+func (d *Request) ResetFailures() {
+	d.Status.Failed = 0
+	d.Status.Error = ""
+}
+
+func (d *Request) SetRequestDetails(url, method, body string, headers map[string][]string) {
+	d.Status.RequestDetails.Body = body
+	d.Status.RequestDetails.URL = url
+	d.Status.RequestDetails.Headers = headers
+	d.Status.RequestDetails.Method = method
+}
+
+func (d *Request) SetCache(statusCode int, headers map[string][]string, body string) {
+	d.Status.Cache.Response.StatusCode = statusCode
+	d.Status.Cache.Response.Headers = headers
+	d.Status.Cache.Response.Body = body
+	d.Status.Cache.LastUpdated = time.Now().UTC().Format(time.RFC3339)
+}
diff --git a/apis/namespaced/request/v1alpha2/zz_generated.deepcopy.go b/apis/namespaced/request/v1alpha2/zz_generated.deepcopy.go
new file mode 100644
index 0000000..1ecd13d
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/zz_generated.deepcopy.go
@@ -0,0 +1,288 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Cache) DeepCopyInto(out *Cache) {
+	*out = *in
+	in.Response.DeepCopyInto(&out.Response)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Cache.
+func (in *Cache) DeepCopy() *Cache {
+	if in == nil {
+		return nil
+	}
+	out := new(Cache)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExpectedResponseCheck) DeepCopyInto(out *ExpectedResponseCheck) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExpectedResponseCheck.
+func (in *ExpectedResponseCheck) DeepCopy() *ExpectedResponseCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(ExpectedResponseCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Mapping) DeepCopyInto(out *Mapping) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string][]string, len(*in))
+		for key, val := range *in {
+			var outVal []string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Mapping.
+func (in *Mapping) DeepCopy() *Mapping {
+	if in == nil {
+		return nil
+	}
+	out := new(Mapping)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Payload) DeepCopyInto(out *Payload) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Payload.
+func (in *Payload) DeepCopy() *Payload {
+	if in == nil {
+		return nil
+	}
+	out := new(Payload)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Request) DeepCopyInto(out *Request) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Request.
+func (in *Request) DeepCopy() *Request {
+	if in == nil {
+		return nil
+	}
+	out := new(Request)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Request) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestList) DeepCopyInto(out *RequestList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Request, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestList.
+func (in *RequestList) DeepCopy() *RequestList {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RequestList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestParameters) DeepCopyInto(out *RequestParameters) {
+	*out = *in
+	if in.Mappings != nil {
+		in, out := &in.Mappings, &out.Mappings
+		*out = make([]Mapping, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	out.Payload = in.Payload
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string][]string, len(*in))
+		for key, val := range *in {
+			var outVal []string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.WaitTimeout != nil {
+		in, out := &in.WaitTimeout, &out.WaitTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.TLSConfig != nil {
+		in, out := &in.TLSConfig, &out.TLSConfig
+		*out = new(common.TLSConfig)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.SecretInjectionConfigs != nil {
+		in, out := &in.SecretInjectionConfigs, &out.SecretInjectionConfigs
+		*out = make([]common.SecretInjectionConfig, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	out.ExpectedResponseCheck = in.ExpectedResponseCheck
+	out.IsRemovedCheck = in.IsRemovedCheck
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestParameters.
+func (in *RequestParameters) DeepCopy() *RequestParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestSpec) DeepCopyInto(out *RequestSpec) {
+	*out = *in
+	in.ManagedResourceSpec.DeepCopyInto(&out.ManagedResourceSpec)
+	in.ForProvider.DeepCopyInto(&out.ForProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestSpec.
+func (in *RequestSpec) DeepCopy() *RequestSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestStatus) DeepCopyInto(out *RequestStatus) {
+	*out = *in
+	in.ResourceStatus.DeepCopyInto(&out.ResourceStatus)
+	in.Response.DeepCopyInto(&out.Response)
+	in.Cache.DeepCopyInto(&out.Cache)
+	in.RequestDetails.DeepCopyInto(&out.RequestDetails)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestStatus.
+func (in *RequestStatus) DeepCopy() *RequestStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Response) DeepCopyInto(out *Response) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string][]string, len(*in))
+		for key, val := range *in {
+			var outVal []string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Response.
+func (in *Response) DeepCopy() *Response {
+	if in == nil {
+		return nil
+	}
+	out := new(Response)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/apis/namespaced/request/v1alpha2/zz_generated.managed.go b/apis/namespaced/request/v1alpha2/zz_generated.managed.go
new file mode 100644
index 0000000..6d066f6
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/zz_generated.managed.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1alpha2
+
+import xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+
+// GetCondition of this Request.
+func (mg *Request) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return mg.Status.GetCondition(ct)
+}
+
+// GetManagementPolicies of this Request.
+func (mg *Request) GetManagementPolicies() xpv1.ManagementPolicies {
+	return mg.Spec.ManagementPolicies
+}
+
+// GetProviderConfigReference of this Request.
+func (mg *Request) GetProviderConfigReference() *xpv1.ProviderConfigReference {
+	return mg.Spec.ProviderConfigReference
+}
+
+// GetWriteConnectionSecretToReference of this Request.
+func (mg *Request) GetWriteConnectionSecretToReference() *xpv1.LocalSecretReference {
+	return mg.Spec.WriteConnectionSecretToReference
+}
+
+// SetConditions of this Request.
+func (mg *Request) SetConditions(c ...xpv1.Condition) {
+	mg.Status.SetConditions(c...)
+}
+
+// SetManagementPolicies of this Request.
+func (mg *Request) SetManagementPolicies(r xpv1.ManagementPolicies) {
+	mg.Spec.ManagementPolicies = r
+}
+
+// SetProviderConfigReference of this Request.
+func (mg *Request) SetProviderConfigReference(r *xpv1.ProviderConfigReference) {
+	mg.Spec.ProviderConfigReference = r
+}
+
+// SetWriteConnectionSecretToReference of this Request.
+func (mg *Request) SetWriteConnectionSecretToReference(r *xpv1.LocalSecretReference) {
+	mg.Spec.WriteConnectionSecretToReference = r
+}
diff --git a/apis/namespaced/request/v1alpha2/zz_generated.managedlist.go b/apis/namespaced/request/v1alpha2/zz_generated.managedlist.go
new file mode 100644
index 0000000..58d7864
--- /dev/null
+++ b/apis/namespaced/request/v1alpha2/zz_generated.managedlist.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1alpha2
+
+import resource "github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+
+// GetItems of this RequestList.
+func (l *RequestList) GetItems() []resource.Managed {
+	items := make([]resource.Managed, len(l.Items))
+	for i := range l.Items {
+		items[i] = &l.Items[i]
+	}
+	return items
+}
diff --git a/apis/namespaced/v1alpha2/clusterproviderconfig_types.go b/apis/namespaced/v1alpha2/clusterproviderconfig_types.go
new file mode 100644
index 0000000..e5de7f0
--- /dev/null
+++ b/apis/namespaced/v1alpha2/clusterproviderconfig_types.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+)
+
+var _ resource.ProviderConfig = &ClusterProviderConfig{}
+
+// +kubebuilder:object:root=true
+
+// A ClusterProviderConfig configures a Http provider at the cluster level for cross-namespace access.
+// +kubebuilder:subresource:status
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:printcolumn:name="SECRET-NAME",type="string",JSONPath=".spec.credentials.secretRef.name",priority=1
+// +kubebuilder:resource:scope=Cluster
+type ClusterProviderConfig struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ProviderConfigSpec   `json:"spec"`
+	Status ProviderConfigStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// ClusterProviderConfigList contains a list of ClusterProviderConfig.
+type ClusterProviderConfigList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ClusterProviderConfig `json:"items"`
+}
+
+// ClusterProviderConfig type metadata.
+var (
+	ClusterProviderConfigKind             = reflect.TypeOf(ClusterProviderConfig{}).Name()
+	ClusterProviderConfigGroupKind        = schema.GroupKind{Group: Group, Kind: ClusterProviderConfigKind}.String()
+	ClusterProviderConfigKindAPIVersion   = ClusterProviderConfigKind + "." + SchemeGroupVersion.String()
+	ClusterProviderConfigGroupVersionKind = SchemeGroupVersion.WithKind(ClusterProviderConfigKind)
+)
+
+// GetCondition returns the condition for the given ConditionType if exists,
+// otherwise returns nil
+func (pc *ClusterProviderConfig) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return pc.Status.GetCondition(ct)
+}
+
+// SetConditions sets the conditions on the resource status
+func (pc *ClusterProviderConfig) SetConditions(c ...xpv1.Condition) {
+	pc.Status.SetConditions(c...)
+}
+
+// GetUsers returns the number of users of this ClusterProviderConfig.
+func (pc *ClusterProviderConfig) GetUsers() int64 {
+	return pc.Status.Users
+}
+
+// SetUsers sets the number of users of this ClusterProviderConfig.
+func (pc *ClusterProviderConfig) SetUsers(i int64) {
+	pc.Status.Users = i
+}
+
+func init() {
+	SchemeBuilder.Register(&ClusterProviderConfig{}, &ClusterProviderConfigList{})
+}
diff --git a/apis/namespaced/v1alpha2/doc.go b/apis/namespaced/v1alpha2/doc.go
new file mode 100644
index 0000000..af368a1
--- /dev/null
+++ b/apis/namespaced/v1alpha2/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2022 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
diff --git a/apis/namespaced/v1alpha2/groupversion_info.go b/apis/namespaced/v1alpha2/groupversion_info.go
new file mode 100644
index 0000000..b5fbd0b
--- /dev/null
+++ b/apis/namespaced/v1alpha2/groupversion_info.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1alpha2 contains the core resources of the http provider.
+// +kubebuilder:object:generate=true
+// +groupName=http.m.crossplane.io
+// +versionName=v1alpha2
+package v1alpha2
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+// Package type metadata.
+const (
+	Group   = "http.m.crossplane.io"
+	Version = "v1alpha2"
+)
+
+var (
+	// SchemeGroupVersion is group version used to register these objects
+	SchemeGroupVersion = schema.GroupVersion{Group: Group, Version: Version}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
+)
diff --git a/apis/namespaced/v1alpha2/providerconfig_types.go b/apis/namespaced/v1alpha2/providerconfig_types.go
new file mode 100644
index 0000000..c808225
--- /dev/null
+++ b/apis/namespaced/v1alpha2/providerconfig_types.go
@@ -0,0 +1,112 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+)
+
+// verify interface casting required by controller
+var _ resource.ProviderConfig = &ProviderConfig{}
+
+// A ProviderConfigSpec defines the desired state of a ProviderConfig.
+type ProviderConfigSpec struct {
+	// Credentials required to authenticate to this provider.
+	Credentials ProviderCredentials `json:"credentials"`
+
+	// TLS configuration for HTTPS requests.
+	// +optional
+	TLS *common.TLSConfig `json:"tls,omitempty"`
+}
+
+// ProviderCredentials required to authenticate.
+type ProviderCredentials struct {
+	// Source of the provider credentials.
+	// +kubebuilder:validation:Enum=None;Secret;InjectedIdentity;Environment;Filesystem
+	Source xpv1.CredentialsSource `json:"source"`
+
+	xpv1.CommonCredentialSelectors `json:",inline"`
+}
+
+// A ProviderConfigStatus reflects the observed state of a ProviderConfig.
+type ProviderConfigStatus struct {
+	xpv1.ProviderConfigStatus `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+
+// A ProviderConfig configures a Http provider.
+// +kubebuilder:subresource:status
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:printcolumn:name="SECRET-NAME",type="string",JSONPath=".spec.credentials.secretRef.name",priority=1
+// +kubebuilder:resource:scope=Namespaced
+type ProviderConfig struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ProviderConfigSpec   `json:"spec"`
+	Status ProviderConfigStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// ProviderConfigList contains a list of ProviderConfig.
+type ProviderConfigList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ProviderConfig `json:"items"`
+}
+
+// ProviderConfig type metadata.
+var (
+	ProviderConfigKind             = reflect.TypeOf(ProviderConfig{}).Name()
+	ProviderConfigGroupKind        = schema.GroupKind{Group: Group, Kind: ProviderConfigKind}.String()
+	ProviderConfigKindAPIVersion   = ProviderConfigKind + "." + SchemeGroupVersion.String()
+	ProviderConfigGroupVersionKind = SchemeGroupVersion.WithKind(ProviderConfigKind)
+)
+
+// GetCondition returns the condition for the given ConditionType if exists,
+// otherwise returns nil
+func (pc *ProviderConfig) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return pc.Status.GetCondition(ct)
+}
+
+// SetConditions sets the conditions on the resource status
+func (pc *ProviderConfig) SetConditions(c ...xpv1.Condition) {
+	pc.Status.SetConditions(c...)
+}
+
+// GetUsers returns the number of users of this ProviderConfig.
+func (pc *ProviderConfig) GetUsers() int64 {
+	return pc.Status.Users
+}
+
+// SetUsers sets the number of users of this ProviderConfig.
+func (pc *ProviderConfig) SetUsers(i int64) {
+	pc.Status.Users = i
+}
+
+func init() {
+	SchemeBuilder.Register(&ProviderConfig{}, &ProviderConfigList{})
+}
diff --git a/apis/namespaced/v1alpha2/providerconfigusage_types.go b/apis/namespaced/v1alpha2/providerconfigusage_types.go
new file mode 100644
index 0000000..36b3e35
--- /dev/null
+++ b/apis/namespaced/v1alpha2/providerconfigusage_types.go
@@ -0,0 +1,126 @@
+/*
+Copyright 2021 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	xpv2 "github.com/crossplane/crossplane-runtime/v2/apis/common/v2"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+)
+
+// verify interface casting required by controller
+var _ resource.ProviderConfigUsage = &ProviderConfigUsage{}
+var _ resource.ProviderConfigUsageList = &ProviderConfigUsageList{}
+
+// +kubebuilder:object:root=true
+
+// A ProviderConfigUsage indicates that a resource is using a ProviderConfig.
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:printcolumn:name="CONFIG-NAME",type="string",JSONPath=".providerConfigRef.name"
+// +kubebuilder:printcolumn:name="RESOURCE-KIND",type="string",JSONPath=".resourceRef.kind"
+// +kubebuilder:printcolumn:name="RESOURCE-NAME",type="string",JSONPath=".resourceRef.name"
+// +kubebuilder:resource:scope=Namespaced,categories={crossplane,provider,http}
+type ProviderConfigUsage struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	xpv2.TypedProviderConfigUsage `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+
+// ProviderConfigUsageList contains a list of ProviderConfigUsage
+type ProviderConfigUsageList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ProviderConfigUsage `json:"items"`
+}
+
+// ProviderConfigUsage type metadata.
+var (
+	ProviderConfigUsageKind             = reflect.TypeOf(ProviderConfigUsage{}).Name()
+	ProviderConfigUsageGroupKind        = schema.GroupKind{Group: Group, Kind: ProviderConfigUsageKind}.String()
+	ProviderConfigUsageKindAPIVersion   = ProviderConfigUsageKind + "." + SchemeGroupVersion.String()
+	ProviderConfigUsageGroupVersionKind = SchemeGroupVersion.WithKind(ProviderConfigUsageKind)
+
+	ProviderConfigUsageListKind             = reflect.TypeOf(ProviderConfigUsageList{}).Name()
+	ProviderConfigUsageListGroupKind        = schema.GroupKind{Group: Group, Kind: ProviderConfigUsageListKind}.String()
+	ProviderConfigUsageListKindAPIVersion   = ProviderConfigUsageListKind + "." + SchemeGroupVersion.String()
+	ProviderConfigUsageListGroupVersionKind = SchemeGroupVersion.WithKind(ProviderConfigUsageListKind)
+)
+
+// SetResourceReference sets the resource reference.
+func (pcu *ProviderConfigUsage) SetResourceReference(r xpv1.TypedReference) {
+	pcu.ResourceReference = r
+}
+
+// GetResourceReference gets the resource reference.
+func (pcu *ProviderConfigUsage) GetResourceReference() xpv1.TypedReference {
+	return pcu.ResourceReference
+}
+
+// GetItems returns the list of ProviderConfigUsage items.
+func (pcul *ProviderConfigUsageList) GetItems() []resource.ProviderConfigUsage {
+	items := make([]resource.ProviderConfigUsage, len(pcul.Items))
+	for i := range pcul.Items {
+		items[i] = &pcul.Items[i]
+	}
+	return items
+}
+
+// +kubebuilder:object:root=true
+
+// A ClusterProviderConfigUsage indicates that a resource is using a ClusterProviderConfig.
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:printcolumn:name="CONFIG-NAME",type="string",JSONPath=".providerConfigRef.name"
+// +kubebuilder:printcolumn:name="RESOURCE-KIND",type="string",JSONPath=".resourceRef.kind"
+// +kubebuilder:printcolumn:name="RESOURCE-NAME",type="string",JSONPath=".resourceRef.name"
+// +kubebuilder:resource:scope=Cluster,categories={crossplane,provider,http}
+type ClusterProviderConfigUsage struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	xpv2.TypedProviderConfigUsage `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+
+// ClusterProviderConfigUsageList contains a list of ClusterProviderConfigUsage
+type ClusterProviderConfigUsageList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ClusterProviderConfigUsage `json:"items"`
+}
+
+// ClusterProviderConfigUsage type metadata.
+var (
+	ClusterProviderConfigUsageKind                 = reflect.TypeOf(ClusterProviderConfigUsage{}).Name()
+	ClusterProviderConfigUsageGroupKind            = schema.GroupKind{Group: Group, Kind: ClusterProviderConfigUsageKind}.String()
+	ClusterProviderConfigUsageKindAPIVersion       = ClusterProviderConfigUsageKind + "." + SchemeGroupVersion.String()
+	ClusterProviderConfigUsageGroupVersionKind     = SchemeGroupVersion.WithKind(ClusterProviderConfigUsageKind)
+	ClusterProviderConfigUsageListKind             = reflect.TypeOf(ClusterProviderConfigUsageList{}).Name()
+	ClusterProviderConfigUsageListGroupVersionKind = SchemeGroupVersion.WithKind(ClusterProviderConfigUsageListKind)
+)
+
+func init() {
+	SchemeBuilder.Register(&ProviderConfigUsage{}, &ProviderConfigUsageList{}, &ClusterProviderConfigUsage{}, &ClusterProviderConfigUsageList{})
+}
diff --git a/apis/namespaced/v1alpha2/zz_generated.deepcopy.go b/apis/namespaced/v1alpha2/zz_generated.deepcopy.go
new file mode 100644
index 0000000..6781014
--- /dev/null
+++ b/apis/namespaced/v1alpha2/zz_generated.deepcopy.go
@@ -0,0 +1,313 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProviderConfig) DeepCopyInto(out *ClusterProviderConfig) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProviderConfig.
+func (in *ClusterProviderConfig) DeepCopy() *ClusterProviderConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProviderConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterProviderConfig) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProviderConfigList) DeepCopyInto(out *ClusterProviderConfigList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterProviderConfig, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProviderConfigList.
+func (in *ClusterProviderConfigList) DeepCopy() *ClusterProviderConfigList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProviderConfigList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterProviderConfigList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProviderConfigUsage) DeepCopyInto(out *ClusterProviderConfigUsage) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.TypedProviderConfigUsage.DeepCopyInto(&out.TypedProviderConfigUsage)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProviderConfigUsage.
+func (in *ClusterProviderConfigUsage) DeepCopy() *ClusterProviderConfigUsage {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProviderConfigUsage)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterProviderConfigUsage) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProviderConfigUsageList) DeepCopyInto(out *ClusterProviderConfigUsageList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterProviderConfigUsage, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProviderConfigUsageList.
+func (in *ClusterProviderConfigUsageList) DeepCopy() *ClusterProviderConfigUsageList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProviderConfigUsageList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterProviderConfigUsageList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProviderConfig) DeepCopyInto(out *ProviderConfig) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfig.
+func (in *ProviderConfig) DeepCopy() *ProviderConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ProviderConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ProviderConfig) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProviderConfigList) DeepCopyInto(out *ProviderConfigList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ProviderConfig, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfigList.
+func (in *ProviderConfigList) DeepCopy() *ProviderConfigList {
+	if in == nil {
+		return nil
+	}
+	out := new(ProviderConfigList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ProviderConfigList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProviderConfigSpec) DeepCopyInto(out *ProviderConfigSpec) {
+	*out = *in
+	in.Credentials.DeepCopyInto(&out.Credentials)
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(common.TLSConfig)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfigSpec.
+func (in *ProviderConfigSpec) DeepCopy() *ProviderConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ProviderConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProviderConfigStatus) DeepCopyInto(out *ProviderConfigStatus) {
+	*out = *in
+	in.ProviderConfigStatus.DeepCopyInto(&out.ProviderConfigStatus)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfigStatus.
+func (in *ProviderConfigStatus) DeepCopy() *ProviderConfigStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ProviderConfigStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProviderConfigUsage) DeepCopyInto(out *ProviderConfigUsage) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.TypedProviderConfigUsage.DeepCopyInto(&out.TypedProviderConfigUsage)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfigUsage.
+func (in *ProviderConfigUsage) DeepCopy() *ProviderConfigUsage {
+	if in == nil {
+		return nil
+	}
+	out := new(ProviderConfigUsage)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ProviderConfigUsage) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProviderConfigUsageList) DeepCopyInto(out *ProviderConfigUsageList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ProviderConfigUsage, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfigUsageList.
+func (in *ProviderConfigUsageList) DeepCopy() *ProviderConfigUsageList {
+	if in == nil {
+		return nil
+	}
+	out := new(ProviderConfigUsageList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ProviderConfigUsageList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProviderCredentials) DeepCopyInto(out *ProviderCredentials) {
+	*out = *in
+	in.CommonCredentialSelectors.DeepCopyInto(&out.CommonCredentialSelectors)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderCredentials.
+func (in *ProviderCredentials) DeepCopy() *ProviderCredentials {
+	if in == nil {
+		return nil
+	}
+	out := new(ProviderCredentials)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/apis/namespaced/v1alpha2/zz_generated.pcu.go b/apis/namespaced/v1alpha2/zz_generated.pcu.go
new file mode 100644
index 0000000..6882cf6
--- /dev/null
+++ b/apis/namespaced/v1alpha2/zz_generated.pcu.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1alpha2
+
+import xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+
+// GetProviderConfigReference of this ClusterProviderConfigUsage.
+func (p *ClusterProviderConfigUsage) GetProviderConfigReference() xpv1.ProviderConfigReference {
+	return p.ProviderConfigReference
+}
+
+// GetResourceReference of this ClusterProviderConfigUsage.
+func (p *ClusterProviderConfigUsage) GetResourceReference() xpv1.TypedReference {
+	return p.ResourceReference
+}
+
+// SetProviderConfigReference of this ClusterProviderConfigUsage.
+func (p *ClusterProviderConfigUsage) SetProviderConfigReference(r xpv1.ProviderConfigReference) {
+	p.ProviderConfigReference = r
+}
+
+// SetResourceReference of this ClusterProviderConfigUsage.
+func (p *ClusterProviderConfigUsage) SetResourceReference(r xpv1.TypedReference) {
+	p.ResourceReference = r
+}
+
+// GetProviderConfigReference of this ProviderConfigUsage.
+func (p *ProviderConfigUsage) GetProviderConfigReference() xpv1.ProviderConfigReference {
+	return p.ProviderConfigReference
+}
+
+// SetProviderConfigReference of this ProviderConfigUsage.
+func (p *ProviderConfigUsage) SetProviderConfigReference(r xpv1.ProviderConfigReference) {
+	p.ProviderConfigReference = r
+}
diff --git a/apis/v1alpha1/zz_generated.pculist.go b/apis/namespaced/v1alpha2/zz_generated.pculist.go
similarity index 76%
rename from apis/v1alpha1/zz_generated.pculist.go
rename to apis/namespaced/v1alpha2/zz_generated.pculist.go
index 468bad0..2ef1269 100644
--- a/apis/v1alpha1/zz_generated.pculist.go
+++ b/apis/namespaced/v1alpha2/zz_generated.pculist.go
@@ -15,12 +15,12 @@ limitations under the License.
 */
 // Code generated by angryjet. DO NOT EDIT.
 
-package v1alpha1
+package v1alpha2
 
-import resource "github.com/crossplane/crossplane-runtime/pkg/resource"
+import resource "github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 
-// GetItems of this ProviderConfigUsageList.
-func (p *ProviderConfigUsageList) GetItems() []resource.ProviderConfigUsage {
+// GetItems of this ClusterProviderConfigUsageList.
+func (p *ClusterProviderConfigUsageList) GetItems() []resource.ProviderConfigUsage {
 	items := make([]resource.ProviderConfigUsage, len(p.Items))
 	for i := range p.Items {
 		items[i] = &p.Items[i]
diff --git a/apis/v1alpha1/zz_generated.pc.go b/apis/v1alpha1/zz_generated.pc.go
deleted file mode 100644
index 28fad33..0000000
--- a/apis/v1alpha1/zz_generated.pc.go
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
-Copyright 2020 The Crossplane Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-// Code generated by angryjet. DO NOT EDIT.
-
-package v1alpha1
-
-import xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
-
-// GetCondition of this ProviderConfig.
-func (p *ProviderConfig) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
-	return p.Status.GetCondition(ct)
-}
-
-// GetUsers of this ProviderConfig.
-func (p *ProviderConfig) GetUsers() int64 {
-	return p.Status.Users
-}
-
-// SetConditions of this ProviderConfig.
-func (p *ProviderConfig) SetConditions(c ...xpv1.Condition) {
-	p.Status.SetConditions(c...)
-}
-
-// SetUsers of this ProviderConfig.
-func (p *ProviderConfig) SetUsers(i int64) {
-	p.Status.Users = i
-}
diff --git a/build b/build
index 0a8b884..99c79f0 160000
--- a/build
+++ b/build
@@ -1 +1 @@
-Subproject commit 0a8b8840306079292b7a3746ce1d5382b6868af8
+Subproject commit 99c79f0c310d02157495f457f99b95370200c389
diff --git a/cluster/test/setup.sh b/cluster/test/setup.sh
index 39d3094..f923e65 100755
--- a/cluster/test/setup.sh
+++ b/cluster/test/setup.sh
@@ -21,6 +21,121 @@ spec:
     source: None
 EOF
 
+# Check if we're running Crossplane v2 and create namespaced provider configurations
+if [ -z "${CROSSPLANE_VERSION:-}" ]; then
+    echo "ERROR: CROSSPLANE_VERSION environment variable must be set"
+    exit 1
+fi
+MAJOR_VERSION=$(echo "$CROSSPLANE_VERSION" | cut -d. -f1)
+
+if [ "$MAJOR_VERSION" = "2" ]; then
+    echo "Detected Crossplane v2, creating namespaced provider configurations..."
+    
+    # Create namespaced ProviderConfig
+    cat <<EOF | ${KUBECTL} apply -f -
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: ProviderConfig
+metadata:
+  name: http-conf-namespaced
+  namespace: default
+spec:
+  credentials:
+    source: None
+EOF
+
+    # Create ClusterProviderConfig for cross-namespace access
+    cat <<EOF | ${KUBECTL} apply -f -
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: ClusterProviderConfig
+metadata:
+  name: http-conf-cluster
+spec:
+  credentials:
+    source: None
+EOF
+    
+    # Create additional secrets needed for namespaced examples
+    cat <<EOF | ${KUBECTL} apply -f -
+kind: Secret
+apiVersion: v1
+metadata:
+  name: basic-auth
+  namespace: default
+type: Opaque
+data:
+  token: bXktc2VjcmV0LXZhbHVl
+EOF
+
+    # Create user-password secret in default namespace for namespaced examples
+    cat <<EOF | ${KUBECTL} apply -f -
+kind: Secret
+apiVersion: v1
+metadata:
+  name: user-password
+  namespace: default
+type: Opaque
+data:
+  password: bXktc2VjcmV0LXZhbHVl
+EOF
+
+    # Create auth secret in crossplane-system namespace for clusterproviderconfig examples
+    cat <<EOF | ${KUBECTL} apply -f -
+kind: Secret
+apiVersion: v1
+metadata:
+  name: auth
+  namespace: crossplane-system
+type: Opaque
+data:
+  token: bXktc2VjcmV0LXZhbHVl
+EOF
+
+    # Create admin-user secret in crossplane-system namespace for clusterproviderconfig examples
+    cat <<EOF | ${KUBECTL} apply -f -
+kind: Secret
+apiVersion: v1
+metadata:
+  name: admin-user
+  namespace: crossplane-system
+type: Opaque
+data:
+  username: YWRtaW4=
+EOF
+
+    # Create admin-token secret in crossplane-system namespace for clusterproviderconfig examples
+    # Using same token value as auth:default to ensure compatibility with flask-api
+    cat <<EOF | ${KUBECTL} apply -f -
+kind: Secret
+apiVersion: v1
+metadata:
+  name: admin-token
+  namespace: crossplane-system
+type: Opaque
+data:
+  token: bXktc2VjcmV0LXZhbHVl
+EOF
+
+    echo "Waiting for secrets to be available..."
+    # Wait for all secrets to be available before proceeding
+    for secret in "user-password:default" "auth:crossplane-system" "admin-user:crossplane-system" "admin-token:crossplane-system"; do
+        name=$(echo $secret | cut -d: -f1)
+        namespace=$(echo $secret | cut -d: -f2)
+        echo "Waiting for secret $name in namespace $namespace..."
+        while ! ${KUBECTL} get secret $name -n $namespace >/dev/null 2>&1; do
+            sleep 1
+        done
+        echo "Secret $name in namespace $namespace is available"
+    done
+    
+    # Additional wait to ensure provider has processed the secrets
+    echo "Waiting 10 seconds for provider to process secrets..."
+    sleep 10
+    
+    echo "Namespaced provider configurations created successfully"
+else
+    echo "Detected Crossplane v1, skipping namespaced configurations"
+fi
+
 cat <<EOF | ${KUBECTL} apply -f -
 apiVersion: apps/v1
 kind: Deployment
@@ -30,7 +145,7 @@ metadata:
   labels:
     app: test-server
 spec:
-  replicas: 3
+  replicas: 1
   selector:
     matchLabels:
       app: test-server
diff --git a/cmd/provider/main.go b/cmd/provider/main.go
index 05ce412..46ba291 100644
--- a/cmd/provider/main.go
+++ b/cmd/provider/main.go
@@ -21,20 +21,24 @@ import (
 	"path/filepath"
 	"time"
 
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
-	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
 	kingpin "gopkg.in/alecthomas/kingpin.v2"
 	"k8s.io/client-go/tools/leaderelection/resourcelock"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
-	"github.com/crossplane/crossplane-runtime/pkg/controller"
-	"github.com/crossplane/crossplane-runtime/pkg/feature"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/gate"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/customresourcesgate"
 
 	"github.com/crossplane-contrib/provider-http/apis"
-	template "github.com/crossplane-contrib/provider-http/internal/controller"
+	httpcontrollers "github.com/crossplane-contrib/provider-http/internal/controller"
 )
 
 func main() {
@@ -79,12 +83,16 @@ func main() {
 	kingpin.FatalIfError(err, "Cannot create controller manager")
 	kingpin.FatalIfError(apis.AddToScheme(mgr.GetScheme()), "Cannot add Http APIs to scheme")
 
+	// Add CRD types to scheme for SafeStart capability
+	kingpin.FatalIfError(apiextensionsv1.AddToScheme(mgr.GetScheme()), "Cannot add CRD APIs to scheme")
+
 	o := controller.Options{
 		Logger:                  log,
 		MaxConcurrentReconciles: *maxReconcileRate,
 		PollInterval:            *pollInterval,
 		GlobalRateLimiter:       ratelimiter.NewGlobal(*maxReconcileRate),
 		Features:                &feature.Flags{},
+		Gate:                    new(gate.Gate[schema.GroupVersionKind]),
 	}
 
 	// Enable management policies if flag is set
@@ -93,6 +101,8 @@ func main() {
 		log.Info("Beta feature enabled", "flag", feature.EnableBetaManagementPolicies)
 	}
 
-	kingpin.FatalIfError(template.Setup(mgr, o, *timeout), "Cannot setup Template controllers")
+	// Setup SafeStart CRD gate controller
+	kingpin.FatalIfError(customresourcesgate.Setup(mgr, o), "Cannot setup CRD gate controller")
+	kingpin.FatalIfError(httpcontrollers.SetupGated(mgr, o, *timeout), "Cannot setup provider controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/examples/in-composition/composition.yml b/examples/in-composition/composition.yml
index 12cb693..4260f21 100644
--- a/examples/in-composition/composition.yml
+++ b/examples/in-composition/composition.yml
@@ -17,7 +17,6 @@ spec:
       metadata:
         name: obtain-jwt-token
       spec:
-        deletionPolicy: Orphan
         forProvider:
           url: http://localhost:8000/v1/login/
           method: POST
diff --git a/examples/namespaced/README.md b/examples/namespaced/README.md
new file mode 100644
index 0000000..4b6e719
--- /dev/null
+++ b/examples/namespaced/README.md
@@ -0,0 +1,121 @@
+# Namespaced HTTP Provider Examples
+
+This directory contains examples for the namespaced version of the HTTP provider resources. These resources use the `http.m.crossplane.io` API group and provide namespace-scoped alternatives to the cluster-scoped resources in the `http.crossplane.io` API group.
+
+## Key Differences from Cluster-scoped Resources
+
+### API Group
+
+- **Cluster-scoped**: `http.crossplane.io`
+- **Namespaced**: `http.m.crossplane.io` (follows the `.m.` convention)
+
+### Scope
+
+- **Cluster-scoped**: Resources are available cluster-wide
+- **Namespaced**: Resources are confined to a specific namespace
+
+### Provider Configuration Options
+
+#### ProviderConfig (Namespace-scoped)
+
+```yaml
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: ProviderConfig
+metadata:
+  name: http-conf-namespaced
+  namespace: default # Confined to this namespace
+```
+
+#### ClusterProviderConfig (Cluster-scoped)
+
+```yaml
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: ClusterProviderConfig
+metadata:
+  name: http-conf-cluster # No namespace - cluster-wide
+```
+
+## When to Use Each Approach
+
+### Use Cluster-scoped Resources When:
+
+- You need shared configuration across multiple namespaces
+- You have cluster-admin privileges
+- You want centralized management of HTTP resources
+- Resources are shared infrastructure components
+
+### Use Namespaced Resources When:
+
+- You want namespace isolation for security
+- Multiple teams/tenants share the same cluster
+- You have namespace-level permissions only
+- Resources are application-specific
+
+## Examples Included
+
+These examples demonstrate namespaced HTTP resources. Provider configurations are automatically created during e2e testing.
+
+### Request Examples
+
+1. **request.yaml** - Namespaced HTTP request with full CRUD operations using namespaced ProviderConfig
+2. **request-with-clusterproviderconfig.yaml** - Namespaced HTTP request using ClusterProviderConfig for cross-namespace access
+
+### DisposableRequest Examples
+
+3. **disposablerequest.yaml** - Namespaced one-time HTTP request using namespaced ProviderConfig
+4. **disposablerequest-jwt.yaml** - Namespaced JWT token acquisition example
+5. **disposablerequest-with-clusterproviderconfig.yaml** - Namespaced one-time HTTP request using ClusterProviderConfig
+
+## Usage
+
+### For Testing/Development
+
+These examples are designed to work with the e2e test framework. The required provider configurations and secrets are automatically created by the test setup.
+
+### For Production Use
+
+1. Create the required provider configurations:
+
+   ```bash
+   # Namespace-scoped ProviderConfig
+   kubectl apply -f - <<EOF
+   apiVersion: http.m.crossplane.io/v1alpha2
+   kind: ProviderConfig
+   metadata:
+     name: http-conf-namespaced
+     namespace: default
+   spec:
+     credentials:
+       source: None
+   EOF
+
+   # ClusterProviderConfig for cross-namespace access
+   kubectl apply -f - <<EOF
+   apiVersion: http.m.crossplane.io/v1alpha2
+   kind: ClusterProviderConfig
+   metadata:
+     name: http-conf-cluster
+   spec:
+     credentials:
+       source: None
+   EOF
+   ```
+
+2. Apply the resource examples:
+   ```bash
+   kubectl apply -f request.yaml
+   kubectl apply -f disposablerequest.yaml
+   ```
+
+## Migration from Cluster-scoped Resources
+
+If you're migrating from cluster-scoped resources (`http.crossplane.io`), you'll need to:
+
+1. Update the `apiVersion` from `http.crossplane.io/v1alpha2` to `http.m.crossplane.io/v1alpha2`
+2. Add a `namespace` field to the metadata
+3. Update the `providerConfigRef` to reference a namespaced ProviderConfig
+4. Ensure secrets referenced in `secretInjectionConfigs` are in the same namespace
+
+## Cross-namespace Access
+
+If you need to access secrets or resources in different namespaces, use a `ClusterProviderConfig` instead of a namespace-scoped `ProviderConfig`. The ClusterProviderConfig allows cross-namespace operations while the resource itself remains namespaced.
diff --git a/examples/namespaced/disposablerequest-jwt.yaml b/examples/namespaced/disposablerequest-jwt.yaml
new file mode 100644
index 0000000..22c7245
--- /dev/null
+++ b/examples/namespaced/disposablerequest-jwt.yaml
@@ -0,0 +1,36 @@
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: DisposableRequest
+metadata:
+  name: obtain-jwt-token-namespaced
+  namespace: default
+spec:
+  forProvider:
+    insecureSkipTLSVerify: true
+
+    # Injecting data from secrets is possible, simply use the following syntax: {{ name:namespace:key }} (supported for body and headers only)
+    headers:
+      Authorization:
+        - "Basic {{ basic-auth:default:token }}"
+    url: http://test-server.default.svc.cluster.local/v1/login
+    method: POST
+    
+    # Indicates whether the reconciliation should loop indefinitely. If `rollbackRetriesLimit` is set and the request returns an error, it will stop reconciliation once the limit is reached.
+    shouldLoopInfinitely: true
+    # Specifies the duration after which the next reconcile should occur.
+    nextReconcile: 72h # 3 days
+
+    # waitTimeout: 5m
+
+    # Secrets receiving patches from response data
+    secretInjectionConfigs: 
+      - secretRef:
+          name: obtained-token-namespaced
+          namespace: default
+        secretKey: token
+        responsePath: .body.token
+        # setOwnerReference determines if the secret should be deleted when the associated resource is deleted.
+        # When injecting multiple keys into the same secret, ensure this field is set consistently for all keys.        
+        setOwnerReference: true
+  providerConfigRef:
+    name: http-conf-namespaced
+    kind: ProviderConfig
diff --git a/examples/namespaced/disposablerequest-with-clusterproviderconfig.yaml b/examples/namespaced/disposablerequest-with-clusterproviderconfig.yaml
new file mode 100644
index 0000000..aefd547
--- /dev/null
+++ b/examples/namespaced/disposablerequest-with-clusterproviderconfig.yaml
@@ -0,0 +1,62 @@
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: DisposableRequest
+metadata:
+  name: send-notification-with-cluster-config
+  namespace: default
+spec:
+  forProvider:
+    # This example demonstrates using ClusterProviderConfig with namespaced DisposableRequest
+    # ClusterProviderConfig allows cross-namespace access to secrets and configurations
+    url: http://test-server.default.svc.cluster.local/v1/notify
+    method: POST
+    body: |
+      {
+        "recipient": "admin@example.com",
+        "subject": "Cluster Config Alert",
+        "message": "Hello from Crossplane namespaced resource with cluster config!",
+        "user": "{{ admin-user:crossplane-system:username }}"
+      }
+    headers:
+      Content-Type:
+        - application/json
+      Authorization:
+        - "Bearer {{ admin-token:crossplane-system:token }}"
+    insecureSkipTLSVerify: true
+
+    # The 'expectedResponse' field is optional. If used, also set 'rollbackRetriesLimit', which determines the number of HTTP requests to be sent until the jq query returns true.
+    expectedResponse: '.body.status == "sent"'
+    rollbackRetriesLimit: 5
+    waitTimeout: 5m
+
+    # Indicates whether the reconciliation should loop indefinitely. If `rollbackRetriesLimit` is set and the request returns an error, it will stop reconciliation once the limit is reached.
+    # shouldLoopInfinitely: true
+
+    # Specifies the duration after which the next reconcile should occur.
+    # nextReconcile: 3m
+
+    # Using ClusterProviderConfig allows accessing secrets from crossplane-system namespace
+    secretInjectionConfigs:
+      - secretRef:
+          name: notification-response-cluster
+          namespace: crossplane-system  # Cross-namespace access via ClusterProviderConfig
+        metadata:
+          labels:
+            status: .body.status
+            managed-by: provider-http-cluster-config
+          annotations:
+            key: value
+        keyMappings:
+          - secretKey: notification-status
+            responseJQ: .body.status
+            missingFieldStrategy: setEmpty
+          - secretKey: notification-id
+            responseJQ: .body.id
+            missingFieldStrategy: preserve
+        # setOwnerReference must be false for cross-namespace secrets due to Kubernetes restrictions
+        # Cross-namespace owner references are disallowed by Kubernetes
+        setOwnerReference: false
+ 
+  # Using ClusterProviderConfig for cross-namespace access
+  providerConfigRef:
+    name: http-conf-cluster
+    kind: ClusterProviderConfig
\ No newline at end of file
diff --git a/examples/namespaced/disposablerequest.yaml b/examples/namespaced/disposablerequest.yaml
new file mode 100644
index 0000000..51d3362
--- /dev/null
+++ b/examples/namespaced/disposablerequest.yaml
@@ -0,0 +1,58 @@
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: DisposableRequest
+metadata:
+  name: send-notification-namespaced
+  namespace: default
+spec:
+  forProvider:
+    # Injecting data from secrets is possible, simply use the following syntax: {{ name:namespace:key }} (supported for body and headers only)
+    url:  http://test-server.default.svc.cluster.local/v1/notify
+    method: POST
+    body: |
+      {
+        "recipient": "namespaced-user@example.com",
+        "subject": "Namespaced Alert",
+        "message": "Your action is required immediately from namespaced resource."
+      }
+    headers:
+      Content-Type:
+        - application/json
+      Authorization:
+        - "Bearer {{ auth:default:token }}"
+    insecureSkipTLSVerify: true
+
+    # The 'expectedResponse' field is optional. If used, also set 'rollbackRetriesLimit', which determines the number of HTTP requests to be sent until the jq query returns true.
+    expectedResponse: '.body.status == "sent"'
+    rollbackRetriesLimit: 5
+    waitTimeout: 5m
+
+    # Indicates whether the reconciliation should loop indefinitely. If `rollbackRetriesLimit` is set and the request returns an error, it will stop reconciliation once the limit is reached.
+    # shouldLoopInfinitely: true
+
+    # Specifies the duration after which the next reconcile should occur.
+    # nextReconcile: 3m 
+
+    # Secrets receiving patches from response data
+    secretInjectionConfigs: 
+      - secretRef:
+          name: notification-response-namespaced
+          namespace: default
+        metadata:
+          labels:
+            status: .body.status
+            managed-by: provider-http-namespaced
+          annotations:
+            key: value
+        keyMappings:
+          - secretKey: notification-status
+            responseJQ: .body.status
+            missingFieldStrategy: setEmpty
+          - secretKey: notification-id
+            responseJQ: .body.id
+            missingFieldStrategy: preserve
+        # setOwnerReference determines if the secret should be deleted when the associated resource is deleted.
+        setOwnerReference: true
+ 
+  providerConfigRef:
+    name: http-conf-namespaced
+    kind: ProviderConfig
diff --git a/examples/namespaced/request-with-clusterproviderconfig.yaml b/examples/namespaced/request-with-clusterproviderconfig.yaml
new file mode 100644
index 0000000..ce0f8ad
--- /dev/null
+++ b/examples/namespaced/request-with-clusterproviderconfig.yaml
@@ -0,0 +1,119 @@
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: Request
+metadata:
+  name: manage-user-with-cluster-config
+  namespace: default
+spec:
+  forProvider:
+    # This example demonstrates using ClusterProviderConfig with namespaced resources
+    # ClusterProviderConfig allows cross-namespace access while the resource remains namespaced
+    insecureSkipTLSVerify: true
+    waitTimeout: 5m
+    headers:
+      Content-Type:
+        - application/json
+      Authorization:
+        - "Bearer {{ auth:crossplane-system:token }}"
+    payload:
+      baseUrl: http://test-server.default.svc.cluster.local/v1/users
+      body: |
+        {
+          "username": "cluster_config_user", 
+          "password": "secretdata {{ user-password:crossplane-system:password }}",
+          "email": "cluster_config_user@example.com", 
+          "age": 35
+        }
+    mappings:
+      # Scenario 1: Action specified, method not specified (defaults to POST for CREATE)
+      - action: CREATE
+        # method: "POST" 
+        body: |
+          {
+            username: .payload.body.username, 
+            email: .payload.body.email, 
+            age: .payload.body.age,
+            password: .payload.body.password
+          }
+        url: .payload.baseUrl
+        headers:
+          Content-Type:
+            - application/json
+          Authorization:
+            - "Bearer {{ auth:crossplane-system:token }}"
+          Extra-Header-For-Post:
+            - extra-value
+
+      # Scenario 2: Action specified, method not specified (defaults to GET for OBSERVE)
+      - action: OBSERVE
+        # method: "GET"
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
+
+      # Scenario 3: Method specified, action not specified (PUT implies UPDATE)
+      - method: "PUT"
+        # action: UPDATE
+        body: |
+          {
+            email: .payload.body.email, 
+            age: .payload.body.age
+          }
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
+
+      # Scenario 4: Action specified, method not specified (defaults to DELETE for REMOVE)
+      - action: REMOVE
+        # method: "DELETE"
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
+    
+    expectedResponseCheck:
+      type: CUSTOM
+      logic: |
+        if .response.body.password == .payload.body.password
+         and .response.body.age == 35
+         and .response.headers."Content-Type" == ["application/json"]
+         and .response.headers."X-Secret-Header"[0] == "{{ response-secret-cluster:crossplane-system:extracted-header-data }}"
+         then true 
+         else false 
+         end
+
+    isRemovedCheck:
+      type: CUSTOM
+      logic: |
+        if .response.statusCode == 404
+          and .response.body.error == "User not found"
+          then true 
+          else false 
+          end
+
+    # Using ClusterProviderConfig allows accessing secrets in crossplane-system namespace
+    secretInjectionConfigs: 
+      - secretRef:
+          name: response-secret-cluster
+          namespace: crossplane-system  # Cross-namespace access via ClusterProviderConfig
+        metadata:
+          labels:
+            managed-by: provider-http-cluster-config
+          annotations:
+            username: .body.username
+        keyMappings:
+          - secretKey: extracted-user-email
+            responseJQ: .body.email
+            missingFieldStrategy: preserve
+          - secretKey: extracted-header-data
+            responseJQ: .headers."X-Secret-Header"[0]
+            missingFieldStrategy: setEmpty
+        setOwnerReference: true
+      
+      - secretRef:
+          name: response-user-password-cluster
+          namespace: crossplane-system  # Cross-namespace access via ClusterProviderConfig
+        keyMappings:
+          - secretKey: extracted-user-password
+            responseJQ: .body.password
+            missingFieldStrategy: delete
+          - secretKey: extracted-user-age
+            responseJQ: .body.age
+
+  # Using ClusterProviderConfig instead of namespaced ProviderConfig
+  # This allows cross-namespace access for secrets and configurations
+  providerConfigRef:
+    name: http-conf-cluster
+    kind: ClusterProviderConfig
diff --git a/examples/namespaced/request.yaml b/examples/namespaced/request.yaml
new file mode 100644
index 0000000..5b25892
--- /dev/null
+++ b/examples/namespaced/request.yaml
@@ -0,0 +1,129 @@
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: Request
+metadata:
+  name: manage-user-namespaced
+  namespace: default
+spec:
+  forProvider:
+    # Injecting data from secrets is possible, simply use the following syntax: {{ name:namespace:key }} (supported for body and headers only)
+    insecureSkipTLSVerify: true
+    waitTimeout: 5m
+    headers:
+      Content-Type:
+        - application/json
+      Authorization:
+        - "Bearer {{ auth:default:token }}"
+    payload:
+      baseUrl: http://test-server.default.svc.cluster.local/v1/users
+      body: |
+        {
+          "username": "namespaced_user", 
+          "password": "secretdata {{ user-password:default:password }}",
+          "email": "namespaced_user@example.com", 
+          "age": 25
+        }
+    mappings:
+      # Scenario 1: Action specified, method not specified (defaults to POST for CREATE)
+      - action: CREATE
+        # method: "POST" 
+        body: |
+          {
+            username: .payload.body.username, 
+            email: .payload.body.email, 
+            age: .payload.body.age,
+            password: .payload.body.password
+          }
+        url: .payload.baseUrl
+        headers:
+          Content-Type:
+            - application/json
+          Authorization:
+            - "Bearer {{ auth:default:token }}"
+          Extra-Header-For-Post:
+            - extra-value
+
+      # Scenario 2: Action specified, method not specified (defaults to GET for OBSERVE)
+      - action: OBSERVE
+        # method: "GET"
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
+        # If the ID of the external resource is known in advance, ownership of the resource can be attempted:
+        # url: (.payload.baseUrl + "/1234567890")
+
+      # Scenario 3: Method specified, action not specified (PUT implies UPDATE)
+      - method: "PUT"
+        # action: UPDATE
+        body: |
+          {
+            email: .payload.body.email, 
+            age: .payload.body.age
+          }
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
+
+      # Scenario 4: Action specified, method not specified (defaults to DELETE for REMOVE)
+      - action: REMOVE
+        # method: "DELETE"
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
+    
+    # expectedResponseCheck is optional. If not specified or if the type is "DEFAULT", 
+    # the resource is considered up to date if the GET response containes the PUT body.
+    # If specified, the JQ logic determines if the resource is up to date:
+    # - If the JQ query is false, a PUT request is sent to update the resource.
+    # - If true, the resource is considered up to date.
+    expectedResponseCheck:
+      type: CUSTOM
+      logic: |
+        if .response.body.password == .payload.body.password
+         and .response.body.age == 25
+         and .response.headers."Content-Type" == ["application/json"]
+         and .response.headers."X-Secret-Header"[0] == "{{ response-secret:default:extracted-header-data }}"
+         then true 
+         else false 
+         end
+
+    # isRemovedCheck is optional. If not specified or if the type is "DEFAULT", 
+    # the resource is considered removed if the OBSERVE response after REMOVE has 404 status code.
+    # If specified, the JQ logic determines if the resource is removed:
+    # - If the JQ query is false, a REMOVE request is sent to remove the resource.
+    # - If true, the resource is considered up to date.
+    isRemovedCheck:
+      type: CUSTOM
+      logic: |
+        if .response.statusCode == 404
+          and .response.body.error == "User not found"
+          then true 
+          else false 
+          end
+
+    # Secrets receiving patches from response data
+    secretInjectionConfigs: 
+      - secretRef:
+          name: response-secret-namespaced
+          namespace: default
+        metadata:
+          labels:
+            managed-by: provider-http-namespaced
+          annotations:
+            username: .body.username
+        keyMappings:
+          - secretKey: extracted-user-email
+            responseJQ: .body.email
+            missingFieldStrategy: preserve
+          - secretKey: extracted-header-data
+            responseJQ: .headers."X-Secret-Header"[0]
+            missingFieldStrategy: setEmpty
+        # setOwnerReference determines if the secret should be deleted when the associated resource is deleted.
+        setOwnerReference: true
+      
+      - secretRef:
+          name: response-user-password-namespaced
+          namespace: default
+        keyMappings:
+          - secretKey: extracted-user-password
+            responseJQ: .body.password
+            missingFieldStrategy: delete
+          - secretKey: extracted-user-age
+            responseJQ: .body.age
+
+  providerConfigRef:
+    name: http-conf-namespaced
+    kind: ProviderConfig
\ No newline at end of file
diff --git a/examples/sample/disposablerequest-jwt.yaml b/examples/sample/disposablerequest-jwt.yaml
index eca467a..e1d298d 100644
--- a/examples/sample/disposablerequest-jwt.yaml
+++ b/examples/sample/disposablerequest-jwt.yaml
@@ -33,4 +33,3 @@ spec:
         setOwnerReference: true
   providerConfigRef:
     name: http-conf
-# TODO: check if it's possible to modify the deletionPolicy to be orphan by default.
diff --git a/examples/sample/disposablerequest.yaml b/examples/sample/disposablerequest.yaml
index 0f203c9..12ee476 100644
--- a/examples/sample/disposablerequest.yaml
+++ b/examples/sample/disposablerequest.yaml
@@ -30,10 +30,10 @@ spec:
     # shouldLoopInfinitely: true
 
     # Specifies the duration after which the next reconcile should occur.
-    # nextReconcile: 3m
+    # nextReconcile: 3m 
 
     # Secrets receiving patches from response data
-    secretInjectionConfigs:
+    secretInjectionConfigs: 
       - secretRef:
           name: notification-response
           namespace: default
@@ -51,7 +51,6 @@ spec:
             missingFieldStrategy: preserve
         # setOwnerReference determines if the secret should be deleted when the associated resource is deleted.
         setOwnerReference: true
-
+ 
   providerConfigRef:
     name: http-conf
-# TODO: check if it's possible to modify the deletionPolicy to be orphan by default.
diff --git a/examples/sample/request.yaml b/examples/sample/request.yaml
index a1326d3..1ecfddf 100644
--- a/examples/sample/request.yaml
+++ b/examples/sample/request.yaml
@@ -3,6 +3,7 @@ kind: Request
 metadata:
   name: manage-user
 spec:
+  deletionPolicy: Orphan
   forProvider:
     # Injecting data from secrets is possible, simply use the following syntax: {{ name:namespace:key }} (supported for body and headers only)
     insecureSkipTLSVerify: true
@@ -11,7 +12,7 @@ spec:
       Content-Type:
         - application/json
       Authorization:
-        - ("Bearer {{ auth:default:token }}")
+        - "Bearer {{ auth:default:token }}"
     payload:
       baseUrl: http://test-server.default.svc.cluster.local/v1/users
       body: |
@@ -37,14 +38,14 @@ spec:
           Content-Type:
             - application/json
           Authorization:
-            - ("Bearer {{ auth:default:token }}")
+            - "Bearer {{ auth:default:token }}"
           Extra-Header-For-Post:
             - extra-value
 
       # Scenario 2: Action specified, method not specified (defaults to GET for OBSERVE)
       - action: OBSERVE
         # method: "GET"
-        url: (.payload.baseUrl + "/" + (.response.body.id|tostring))
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
         # If the ID of the external resource is known in advance, ownership of the resource can be attempted:
         # url: (.payload.baseUrl + "/1234567890")
 
@@ -56,14 +57,14 @@ spec:
             email: .payload.body.email,
             age: .payload.body.age
           }
-        url: (.payload.baseUrl + "/" + (.response.body.id|tostring))
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
 
       # Scenario 4: Action specified, method not specified (defaults to DELETE for REMOVE)
       - action: REMOVE
         # method: "DELETE"
-        url: (.payload.baseUrl + "/" + (.response.body.id|tostring))
-
-    # expectedResponseCheck is optional. If not specified or if the type is "DEFAULT",
+        url: .payload.baseUrl + "/" + (.response.body.id | tostring)
+    
+    # expectedResponseCheck is optional. If not specified or if the type is "DEFAULT", 
     # the resource is considered up to date if the GET response containes the PUT body.
     # If specified, the JQ logic determines if the resource is up to date:
     # - If the JQ query is false, a PUT request is sent to update the resource.
diff --git a/examples/tls-sample/README.md b/examples/tls-sample/README.md
index e5c6bb7..3ad7d24 100644
--- a/examples/tls-sample/README.md
+++ b/examples/tls-sample/README.md
@@ -6,14 +6,26 @@ These examples demonstrate TLS and mutual TLS authentication features. They are
 
 ## Examples Included
 
+### Cluster-scoped Resources
 - `request-tls.yaml` - Request resource with ProviderConfig-level TLS
 - `request-with-tls.yaml` - Request resource with resource-level TLS override
 - `disposablerequest-tls.yaml` - DisposableRequest with ProviderConfig-level TLS
 - `disposablerequest-with-tls.yaml` - DisposableRequest with resource-level TLS override
 
+### Namespaced Resources
+- `namespaced-providerconfig-tls.yaml` - Namespaced ProviderConfig examples with various TLS configurations
+- `namespaced-request-tls.yaml` - Namespaced Request resources with TLS configurations
+- `namespaced-disposablerequest-tls.yaml` - Namespaced DisposableRequest resources with TLS configurations
+- `namespaced-tls-secrets.yaml` - Example Kubernetes secrets for storing TLS certificates
+- `namespaced-TLS-README.md` - Detailed documentation for namespaced TLS configuration
+
 ## Usage
 
 These examples require:
 1. A valid HTTPS endpoint (replace `https://api.example.com`)
-2. TLS certificates stored in Kubernetes secrets (see `examples/secrets/certificates-secret.yaml`)
-3. A ProviderConfig with TLS configuration (see `examples/provider/tls-config.yaml`)
+2. TLS certificates stored in Kubernetes secrets (see `namespaced-tls-secrets.yaml` for examples)
+3. A ProviderConfig with TLS configuration:
+   - For cluster-scoped resources: see `examples/provider/tls-config.yaml`
+   - For namespaced resources: see `namespaced-providerconfig-tls.yaml`
+
+For detailed information about configuring TLS for namespaced resources, refer to `namespaced-TLS-README.md`.
diff --git a/examples/tls-sample/namespaced-TLS-README.md b/examples/tls-sample/namespaced-TLS-README.md
new file mode 100644
index 0000000..c0b738e
--- /dev/null
+++ b/examples/tls-sample/namespaced-TLS-README.md
@@ -0,0 +1,106 @@
+# TLS Configuration Examples for Namespaced Resources
+
+This directory contains examples showing how to configure TLS authentication for namespaced HTTP provider resources.
+
+## Overview
+
+The HTTP provider supports TLS configuration at two levels:
+
+1. **ProviderConfig level**: TLS settings applied to all resources using that ProviderConfig
+2. **Resource level**: TLS settings that override ProviderConfig settings for specific resources
+
+## TLS Configuration Options
+
+### CA Certificate Verification
+- **caCertSecretRef**: Reference to a secret containing the CA certificate for server verification
+- **caBundle**: Inline CA certificate bundle (base64 encoded)
+
+### Mutual TLS (mTLS) Authentication
+- **clientCertSecretRef**: Reference to a secret containing the client certificate
+- **clientKeySecretRef**: Reference to a secret containing the client private key
+
+### Skip TLS Verification (Not Recommended for Production)
+- **insecureSkipVerify**: Skip TLS certificate verification entirely
+
+## Files
+
+### Provider Configuration
+- `providerconfig-tls.yaml`: Examples of namespaced ProviderConfigs with different TLS configurations
+
+### Resource Examples
+- `disposablerequest-tls.yaml`: DisposableRequest examples with TLS configurations
+- `request-tls.yaml`: Request examples with TLS configurations
+
+### Supporting Resources
+- `tls-secrets.yaml`: Example Kubernetes secrets for storing TLS certificates
+
+## Usage
+
+1. **Create TLS secrets** (replace placeholder certificates with real ones):
+   ```bash
+   kubectl apply -f tls-secrets.yaml
+   ```
+
+2. **Create ProviderConfig**:
+   ```bash
+   kubectl apply -f providerconfig-tls.yaml
+   ```
+
+3. **Create HTTP resources**:
+   ```bash
+   kubectl apply -f disposablerequest-tls.yaml
+   kubectl apply -f request-tls.yaml
+   ```
+
+## TLS Configuration Precedence
+
+When both ProviderConfig and resource-level TLS configurations are present:
+
+1. Resource-level TLS settings override ProviderConfig settings
+2. Fields can be mixed (e.g., CA from ProviderConfig, client cert from resource)
+3. `insecureSkipTLSVerify` and `tlsConfig` are mutually exclusive
+
+## Examples Explained
+
+### Basic CA Verification
+Uses a custom CA certificate to verify server certificates:
+```yaml
+tlsConfig:
+  caCertSecretRef:
+    name: my-ca-cert-secret
+    namespace: default
+    key: ca.crt
+```
+
+### Mutual TLS Authentication
+Provides both CA verification and client certificate authentication:
+```yaml
+tlsConfig:
+  caCertSecretRef:
+    name: my-ca-cert-secret
+    namespace: default
+    key: ca.crt
+  clientCertSecretRef:
+    name: my-client-cert-secret
+    namespace: default
+    key: tls.crt
+  clientKeySecretRef:
+    name: my-client-cert-secret
+    namespace: default
+    key: tls.key
+```
+
+### Skip TLS Verification (Testing Only)
+Disables TLS verification entirely:
+```yaml
+forProvider:
+  insecureSkipTLSVerify: true
+```
+
+## Security Notes
+
+- Never use `insecureSkipTLSVerify: true` in production environments
+- Store certificates securely in Kubernetes secrets
+- Use proper RBAC to restrict access to certificate secrets
+- Regularly rotate certificates and update secrets accordingly
+- Consider using cert-manager for automated certificate management
\ No newline at end of file
diff --git a/examples/tls-sample/namespaced-disposablerequest-tls.yaml b/examples/tls-sample/namespaced-disposablerequest-tls.yaml
new file mode 100644
index 0000000..68c98a0
--- /dev/null
+++ b/examples/tls-sample/namespaced-disposablerequest-tls.yaml
@@ -0,0 +1,91 @@
+---
+# Example namespaced DisposableRequest with TLS verification using ProviderConfig
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: DisposableRequest
+metadata:
+  name: example-disposable-https-tls
+  namespace: default
+spec:
+  deletionPolicy: Orphan
+  forProvider:
+    url: https://api.example.com/v1/resource
+    method: GET
+    headers:
+      Accept:
+        - application/json
+  providerConfigRef:
+    name: example-with-tls
+    kind: ProviderConfig
+---
+# Example namespaced DisposableRequest with mTLS authentication
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: DisposableRequest
+metadata:
+  name: example-disposable-mtls
+  namespace: default
+spec:
+  deletionPolicy: Orphan
+  forProvider:
+    url: https://api.example.com/v1/protected-resource
+    method: GET
+    headers:
+      Accept:
+        - application/json
+  # Use ProviderConfig with mTLS settings
+  providerConfigRef:
+    name: example-with-mtls
+    kind: ProviderConfig
+---
+# Example namespaced DisposableRequest with resource-level TLS override
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: DisposableRequest
+metadata:
+  name: example-disposable-custom-tls
+  namespace: default
+spec:
+  deletionPolicy: Orphan
+  forProvider:
+    url: https://api.example.com/webhook
+    method: POST
+    headers:
+      Content-Type:
+        - application/json
+    body: |
+      {
+        "event": "deployment",
+        "status": "success"
+      }
+    # Override TLS configuration for this specific request (optional)
+    tlsConfig:
+      caCertSecretRef:
+        name: webhook-ca
+        namespace: default
+        key: ca.crt
+      clientCertSecretRef:
+        name: webhook-client-cert
+        namespace: default
+        key: tls.crt
+      clientKeySecretRef:
+        name: webhook-client-cert
+        namespace: default
+        key: tls.key
+  providerConfigRef:
+    name: example-with-tls
+    kind: ProviderConfig
+---
+# Example namespaced DisposableRequest with insecureSkipTLSVerify
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: DisposableRequest
+metadata:
+  name: example-disposable-insecure
+  namespace: default
+spec:
+  deletionPolicy: Orphan
+  forProvider:
+    url: https://self-signed.example.com/api/test
+    method: GET
+    # Skip TLS verification for this request (not recommended for production)
+    insecureSkipTLSVerify: true
+  providerConfigRef:
+    name: example-with-tls
+    kind: ProviderConfig
\ No newline at end of file
diff --git a/examples/tls-sample/namespaced-providerconfig-tls.yaml b/examples/tls-sample/namespaced-providerconfig-tls.yaml
new file mode 100644
index 0000000..98550d7
--- /dev/null
+++ b/examples/tls-sample/namespaced-providerconfig-tls.yaml
@@ -0,0 +1,57 @@
+---
+# Example namespaced ProviderConfig with TLS CA certificate verification
+# This configuration uses a custom CA bundle to verify HTTPS server certificates
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: ProviderConfig
+metadata:
+  name: example-with-tls
+  namespace: default
+spec:
+  credentials:
+    source: None
+  tls:
+    # Custom CA certificate for verifying server certificates
+    caCertSecretRef:
+      name: my-ca-cert-secret
+      namespace: default
+      key: ca.crt
+---
+# Example namespaced ProviderConfig with mTLS (mutual TLS authentication)
+# This configuration provides both CA bundle and client certificates
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: ProviderConfig
+metadata:
+  name: example-with-mtls
+  namespace: default
+spec:
+  credentials:
+    source: None
+  tls:
+    # CA certificate for verifying server
+    caCertSecretRef:
+      name: my-ca-cert-secret
+      namespace: default
+      key: ca.crt
+    # Client certificate for mTLS authentication
+    clientCertSecretRef:
+      name: my-client-cert-secret
+      namespace: default
+      key: tls.crt
+    # Client private key for mTLS authentication
+    clientKeySecretRef:
+      name: my-client-cert-secret
+      namespace: default
+      key: tls.key
+---
+# Example namespaced ProviderConfig with insecureSkipVerify (not recommended for production)
+# Use only for testing with self-signed certificates
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: ProviderConfig
+metadata:
+  name: example-insecure
+  namespace: default
+spec:
+  credentials:
+    source: None
+  tls:
+    insecureSkipVerify: true
\ No newline at end of file
diff --git a/examples/tls-sample/namespaced-request-tls.yaml b/examples/tls-sample/namespaced-request-tls.yaml
new file mode 100644
index 0000000..502f59c
--- /dev/null
+++ b/examples/tls-sample/namespaced-request-tls.yaml
@@ -0,0 +1,113 @@
+---
+# Example namespaced Request with TLS verification using ProviderConfig
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: Request
+metadata:
+  name: example-https-with-tls
+  namespace: default
+spec:
+  forProvider:
+    payload:
+      baseUrl: https://api.example.com
+    mappings:
+      - method: POST
+        body: '{ "username": "testuser", "email": "test@example.com" }'
+        url: .payload.baseUrl + "/users"
+      - method: GET
+        url: .payload.baseUrl + "/users/" + (.response.body.id | tostring)
+      - method: DELETE
+        url: .payload.baseUrl + "/users/" + (.response.body.id | tostring)
+  providerConfigRef:
+    name: example-with-tls
+    kind: ProviderConfig
+---
+# Example namespaced Request with resource-level TLS override
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: Request
+metadata:
+  name: example-https-with-custom-tls
+  namespace: default
+spec:
+  forProvider:
+    payload:
+      baseUrl: https://api.example.com
+    mappings:
+      - method: POST
+        body: '{ "username": "testuser", "email": "test@example.com" }'
+        url: .payload.baseUrl + "/users"
+      - method: GET
+        url: .payload.baseUrl + "/users/" + (.response.body.id | tostring)
+      - method: DELETE
+        url: .payload.baseUrl + "/users/" + (.response.body.id | tostring)
+    # Override TLS configuration for this specific request (optional)
+    tlsConfig:
+      caCertSecretRef:
+        name: custom-ca-secret
+        namespace: default
+        key: ca.pem
+  providerConfigRef:
+    name: example-with-tls
+    kind: ProviderConfig
+---
+# Example namespaced Request with mTLS authentication
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: Request
+metadata:
+  name: example-request-mtls
+  namespace: default
+spec:
+  deletionPolicy: Delete
+  forProvider:
+    payload:
+      baseUrl: https://api.example.com
+    mappings:
+      - method: POST
+        body: '{ "name": "example", "value": "test" }'
+        url: .payload.baseUrl + "/resource"
+      - method: GET
+        url: .payload.baseUrl + "/resource/" + (.response.body.id | tostring)
+      - method: PUT
+        body: '{ "name": "example-updated", "value": "updated" }'
+        url: .payload.baseUrl + "/resource/" + (.response.body.id | tostring)
+      - method: DELETE
+        url: .payload.baseUrl + "/resource/" + (.response.body.id | tostring)
+    headers:
+      Content-Type:
+        - application/json
+    # Use specific TLS configuration for this API
+    tlsConfig:
+      caCertSecretRef:
+        name: api-specific-ca
+        namespace: default
+        key: ca.crt
+      clientCertSecretRef:
+        name: api-client-cert
+        namespace: default
+        key: tls.crt
+      clientKeySecretRef:
+        name: api-client-cert
+        namespace: default
+        key: tls.key
+  providerConfigRef:
+    name: example-with-tls
+    kind: ProviderConfig
+---
+# Example namespaced Request with insecureSkipTLSVerify
+apiVersion: http.m.crossplane.io/v1alpha2
+kind: Request
+metadata:
+  name: example-request-insecure
+  namespace: default
+spec:
+  deletionPolicy: Delete
+  forProvider:
+    payload:
+      baseUrl: https://self-signed.example.com
+    mappings:
+      - method: GET
+        url: .payload.baseUrl + "/test"
+    # Skip TLS verification for this request (not recommended for production)
+    insecureSkipTLSVerify: true
+  providerConfigRef:
+    name: example-with-tls
+    kind: ProviderConfig
\ No newline at end of file
diff --git a/examples/tls-sample/namespaced-tls-secrets.yaml b/examples/tls-sample/namespaced-tls-secrets.yaml
new file mode 100644
index 0000000..5861dff
--- /dev/null
+++ b/examples/tls-sample/namespaced-tls-secrets.yaml
@@ -0,0 +1,71 @@
+---
+# Example CA certificate secret for TLS verification
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-ca-cert-secret
+  namespace: default
+type: Opaque
+data:
+  # Base64 encoded CA certificate PEM data
+  # Replace this with your actual CA certificate
+  ca.crt: LS0tLS1CRUdJTi...  
+---
+# Example client certificate secret for mTLS authentication
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-client-cert-secret
+  namespace: default
+type: kubernetes.io/tls
+data:
+  # Base64 encoded client certificate PEM data
+  # Replace these with your actual client certificate and key
+  tls.crt: LS0tLS1CRUdJTi...
+  tls.key: LS0tLS1CRUdJTi...
+---
+# Example webhook-specific CA secret
+apiVersion: v1
+kind: Secret
+metadata:
+  name: webhook-ca
+  namespace: default
+type: Opaque
+data:
+  # Base64 encoded CA certificate for webhook endpoint
+  ca.crt: LS0tLS1CRUdJTi...
+---
+# Example webhook client certificate secret
+apiVersion: v1
+kind: Secret
+metadata:
+  name: webhook-client-cert
+  namespace: default
+type: kubernetes.io/tls
+data:
+  # Base64 encoded webhook client certificate and key
+  tls.crt: LS0tLS1CRUdJTi...
+  tls.key: LS0tLS1CRUdJTi...
+---
+# Example API-specific CA secret
+apiVersion: v1
+kind: Secret
+metadata:
+  name: custom-ca-secret
+  namespace: default
+type: Opaque
+data:
+  # Base64 encoded CA certificate for specific API
+  ca.pem: LS0tLS1CRUdJTi...
+---
+# Example API client certificate secret
+apiVersion: v1
+kind: Secret
+metadata:
+  name: api-client-cert
+  namespace: default
+type: kubernetes.io/tls
+data:
+  # Base64 encoded API client certificate and key
+  tls.crt: LS0tLS1CRUdJTi...
+  tls.key: LS0tLS1CRUdJTi...
\ No newline at end of file
diff --git a/go.mod b/go.mod
index c440025..c39d713 100644
--- a/go.mod
+++ b/go.mod
@@ -4,22 +4,26 @@ go 1.24.0
 
 toolchain go1.24.6
 
+tool sigs.k8s.io/controller-tools/cmd/controller-gen
+
+tool github.com/crossplane/crossplane-tools/cmd/angryjet
+
 require (
-	github.com/crossplane/crossplane-runtime v1.20.0
-	github.com/crossplane/crossplane-tools v0.0.0-20240522174801-1ad3d4c87f21
+	github.com/crossplane/crossplane-runtime/v2 v2.0.0
 	github.com/google/go-cmp v0.7.0
 	github.com/pkg/errors v0.9.1
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
 	k8s.io/apimachinery v0.34.1
 	k8s.io/client-go v0.34.1
 	sigs.k8s.io/controller-runtime v0.21.0
-	sigs.k8s.io/controller-tools v0.18.0
 )
 
 require (
 	dario.cat/mergo v1.0.1 // indirect
 	github.com/alecthomas/kingpin/v2 v2.4.0 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/crossplane/crossplane-tools v0.0.0-20251017183449-dd4517244339 // indirect
+	github.com/dave/jennifer v1.7.1 // indirect
 	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
@@ -38,16 +42,16 @@ require (
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	k8s.io/code-generator v0.33.0 // indirect
 	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
+	sigs.k8s.io/controller-tools v0.18.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 )
 
 require (
 	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
-	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
+	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/dave/jennifer v1.7.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
@@ -95,7 +99,7 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.34.1
-	k8s.io/apiextensions-apiserver v0.33.0 // indirect
+	k8s.io/apiextensions-apiserver v0.33.0
 	k8s.io/component-base v0.33.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
diff --git a/go.sum b/go.sum
index 4f84974..34ec2f3 100644
--- a/go.sum
+++ b/go.sum
@@ -4,8 +4,8 @@ github.com/alecthomas/kingpin/v2 v2.4.0 h1:f48lwail6p8zpO1bC4TxtqACaGqHYA22qkHjH
 github.com/alecthomas/kingpin/v2 v2.4.0/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
-github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
+github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b h1:mimo19zliBX/vSQ6PWWSL9lK8qwHozUj03+zLoEB8O0=
+github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b/go.mod h1:fvzegU4vN3H1qMT+8wDmzjAcDONcgo2/SZ/TyfdUOFs=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
@@ -14,12 +14,12 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/crossplane/crossplane-runtime v1.20.0 h1:I54uipRIecqZyms+vz1J/l62yjVQ7HV5w+Nh3RMrUtc=
-github.com/crossplane/crossplane-runtime v1.20.0/go.mod h1:lfV1VJenDc9PNVLxDC80YjPoTm+JdSZ13xlS2h37Dvg=
-github.com/crossplane/crossplane-tools v0.0.0-20240522174801-1ad3d4c87f21 h1:8wb7/zCbVPkeX68WbVESWJmSWQE5SZKzz0g9X4FlXRw=
-github.com/crossplane/crossplane-tools v0.0.0-20240522174801-1ad3d4c87f21/go.mod h1:cN0Y7PFGQMM8mcagXVCbeQoKtipmFWQTPZYyziCPBUI=
-github.com/dave/jennifer v1.7.0 h1:uRbSBH9UTS64yXbh4FrMHfgfY762RD+C7bUPKODpSJE=
-github.com/dave/jennifer v1.7.0/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
+github.com/crossplane/crossplane-runtime/v2 v2.0.0 h1:PK2pTKfshdDZ5IfoiMRiCi0PBnIjqbS0KGXEJgRdrb4=
+github.com/crossplane/crossplane-runtime/v2 v2.0.0/go.mod h1:pkd5UzmE8esaZAApevMutR832GjJ1Qgc5Ngr78ByxrI=
+github.com/crossplane/crossplane-tools v0.0.0-20251017183449-dd4517244339 h1:MPbMxSlY+82UsjrLUAGyXlh/iX1tL5WNj8W9SOaq/nk=
+github.com/crossplane/crossplane-tools v0.0.0-20251017183449-dd4517244339/go.mod h1:8etxwmP4cZwJDwen4+PQlnc1tggltAhEfyyigmdHulQ=
+github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
+github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -142,10 +142,11 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -234,7 +235,6 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/hack/helpers/apis/GROUP_LOWER/APIVERSION/KIND_LOWER_types.go.tmpl b/hack/helpers/apis/GROUP_LOWER/APIVERSION/KIND_LOWER_types.go.tmpl
index b1fe54d..358cf07 100644
--- a/hack/helpers/apis/GROUP_LOWER/APIVERSION/KIND_LOWER_types.go.tmpl
+++ b/hack/helpers/apis/GROUP_LOWER/APIVERSION/KIND_LOWER_types.go.tmpl
@@ -22,7 +22,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 )
 
 // {{ .Env.KIND }}Parameters are the configurable fields of a {{ .Env.KIND }}.
diff --git a/hack/helpers/controller/KIND_LOWER/KIND_LOWER.go.tmpl b/hack/helpers/controller/KIND_LOWER/KIND_LOWER.go.tmpl
index e3758a4..cb33dc2 100644
--- a/hack/helpers/controller/KIND_LOWER/KIND_LOWER.go.tmpl
+++ b/hack/helpers/controller/KIND_LOWER/KIND_LOWER.go.tmpl
@@ -25,12 +25,12 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"github.com/crossplane/crossplane-runtime/pkg/connection"
-	"github.com/crossplane/crossplane-runtime/pkg/controller"
-	"github.com/crossplane/crossplane-runtime/pkg/event"
-	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
-	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
-	"github.com/crossplane/crossplane-runtime/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/connection"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/event"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 
 	"github.com/crossplane-contrib/provider-{{ .Env.PROVIDER | strings.ToLower }}/apis/{{ .Env.GROUP | strings.ToLower }}/{{ .Env.APIVERSION | strings.ToLower }}"
 	apisv1alpha1 "github.com/crossplane-contrib/provider-{{ .Env.PROVIDER | strings.ToLower }}/apis/v1alpha1"
diff --git a/hack/helpers/controller/KIND_LOWER/KIND_LOWER_test.go.tmpl b/hack/helpers/controller/KIND_LOWER/KIND_LOWER_test.go.tmpl
index 7eaf81a..ac52bff 100644
--- a/hack/helpers/controller/KIND_LOWER/KIND_LOWER_test.go.tmpl
+++ b/hack/helpers/controller/KIND_LOWER/KIND_LOWER_test.go.tmpl
@@ -22,9 +22,9 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 
-	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
-	"github.com/crossplane/crossplane-runtime/pkg/resource"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 )
 
 // Unlike many Kubernetes projects Crossplane does not use third party testing
diff --git a/internal/clients/http/client.go b/internal/clients/http/client.go
index 81a3d4d..562038b 100644
--- a/internal/clients/http/client.go
+++ b/internal/clients/http/client.go
@@ -12,7 +12,7 @@ import (
 	"time"
 
 	"github.com/crossplane-contrib/provider-http/apis/interfaces"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 )
 
 const (
diff --git a/internal/clients/http/client_test.go b/internal/clients/http/client_test.go
index 3ce2d3a..1dcb63f 100644
--- a/internal/clients/http/client_test.go
+++ b/internal/clients/http/client_test.go
@@ -13,7 +13,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 	"github.com/google/go-cmp/cmp"
 )
 
diff --git a/internal/clients/http/tls_loader.go b/internal/clients/http/tls_loader.go
index f4953a9..12e7623 100644
--- a/internal/clients/http/tls_loader.go
+++ b/internal/clients/http/tls_loader.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	kube "sigs.k8s.io/controller-runtime/pkg/client"
diff --git a/internal/clients/http/tls_loader_test.go b/internal/clients/http/tls_loader_test.go
index 7e9b2ae..e8352b6 100644
--- a/internal/clients/http/tls_loader_test.go
+++ b/internal/clients/http/tls_loader_test.go
@@ -5,9 +5,9 @@ import (
 	"testing"
 
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
-	"github.com/crossplane/crossplane-runtime/pkg/errors"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/errors"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/internal/controller/cluster/cluster.go b/internal/controller/cluster/cluster.go
new file mode 100644
index 0000000..546a14b
--- /dev/null
+++ b/internal/controller/cluster/cluster.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cluster
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	clusterdisposablerequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
+	clusterrequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
+	httpv1alpha1 "github.com/crossplane-contrib/provider-http/apis/cluster/v1alpha1"
+	"github.com/crossplane-contrib/provider-http/internal/controller/cluster/config"
+	"github.com/crossplane-contrib/provider-http/internal/controller/cluster/disposablerequest"
+	"github.com/crossplane-contrib/provider-http/internal/controller/cluster/request"
+)
+
+// Setup creates all cluster-scoped http controllers with the supplied logger and adds them to
+// the supplied manager.
+func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	for _, setup := range []func(ctrl.Manager, controller.Options, time.Duration) error{
+		config.Setup,
+		disposablerequest.Setup,
+		request.Setup,
+	} {
+		if err := setup(mgr, o, timeout); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SetupGated creates all cluster-scoped http controllers with SafeStart capability (controllers start as their CRDs appear)
+func SetupGated(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	o.Gate.Register(func() {
+		if err := config.Setup(mgr, o, timeout); err != nil {
+			panic(err)
+		}
+	}, httpv1alpha1.ProviderConfigGroupVersionKind)
+
+	o.Gate.Register(func() {
+		if err := disposablerequest.Setup(mgr, o, timeout); err != nil {
+			panic(err)
+		}
+	}, clusterdisposablerequestv1alpha2.DisposableRequestGroupVersionKind)
+
+	o.Gate.Register(func() {
+		if err := request.Setup(mgr, o, timeout); err != nil {
+			panic(err)
+		}
+	}, clusterrequestv1alpha2.RequestGroupVersionKind)
+
+	return nil
+}
diff --git a/internal/controller/config/config.go b/internal/controller/cluster/config/config.go
similarity index 77%
rename from internal/controller/config/config.go
rename to internal/controller/cluster/config/config.go
index 38ac4da..2fef102 100644
--- a/internal/controller/config/config.go
+++ b/internal/controller/cluster/config/config.go
@@ -19,14 +19,14 @@ package config
 import (
 	"time"
 
-	"github.com/crossplane/crossplane-runtime/pkg/controller"
-	"github.com/crossplane/crossplane-runtime/pkg/event"
-	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
-	"github.com/crossplane/crossplane-runtime/pkg/reconciler/providerconfig"
-	"github.com/crossplane/crossplane-runtime/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/event"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/providerconfig"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 	ctrl "sigs.k8s.io/controller-runtime"
 
-	"github.com/crossplane-contrib/provider-http/apis/v1alpha1"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/v1alpha1"
 )
 
 // Setup adds a controller that reconciles ProviderConfigs by accounting for
@@ -36,6 +36,7 @@ func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error
 
 	of := resource.ProviderConfigKinds{
 		Config:    v1alpha1.ProviderConfigGroupVersionKind,
+		Usage:     v1alpha1.ProviderConfigUsageGroupVersionKind,
 		UsageList: v1alpha1.ProviderConfigUsageListGroupVersionKind,
 	}
 
diff --git a/internal/controller/disposablerequest/disposablerequest.go b/internal/controller/cluster/disposablerequest/disposablerequest.go
similarity index 87%
rename from internal/controller/disposablerequest/disposablerequest.go
rename to internal/controller/cluster/disposablerequest/disposablerequest.go
index eb3db15..cfdc286 100644
--- a/internal/controller/disposablerequest/disposablerequest.go
+++ b/internal/controller/cluster/disposablerequest/disposablerequest.go
@@ -20,23 +20,24 @@ import (
 	"context"
 	"time"
 
-	"github.com/crossplane/crossplane-runtime/pkg/feature"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/meta"
 	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
-	"github.com/crossplane/crossplane-runtime/pkg/controller"
-	"github.com/crossplane/crossplane-runtime/pkg/event"
-	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
-	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
-	"github.com/crossplane/crossplane-runtime/pkg/resource"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/event"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 
+	"github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
+	apisv1alpha1 "github.com/crossplane-contrib/provider-http/apis/cluster/v1alpha1"
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	"github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha2"
-	apisv1alpha1 "github.com/crossplane-contrib/provider-http/apis/v1alpha1"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
 	"github.com/crossplane-contrib/provider-http/internal/service/disposablerequest"
@@ -56,13 +57,12 @@ const (
 // Setup adds a controller that reconciles DisposableRequest managed resources.
 func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
 	name := managed.ControllerName(v1alpha2.DisposableRequestGroupKind)
-	cps := []managed.ConnectionPublisher{managed.NewAPISecretPublisher(mgr.GetClient(), mgr.GetScheme())}
 
 	reconcilerOptions := []managed.ReconcilerOption{
 		managed.WithExternalConnecter(&connector{
 			logger:          o.Logger,
 			kube:            mgr.GetClient(),
-			usage:           resource.NewProviderConfigUsageTracker(mgr.GetClient(), &apisv1alpha1.ProviderConfigUsage{}),
+			usage:           resource.NewLegacyProviderConfigUsageTracker(mgr.GetClient(), &apisv1alpha1.ProviderConfigUsage{}),
 			newHttpClientFn: httpClient.NewClient,
 		}),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
@@ -70,7 +70,6 @@ func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error
 		WithCustomPollIntervalHook(),
 		managed.WithTimeout(timeout),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithConnectionPublishers(cps...),
 	}
 
 	if o.Features.Enabled(feature.EnableBetaManagementPolicies) {
@@ -93,7 +92,7 @@ func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error
 type connector struct {
 	logger          logging.Logger
 	kube            client.Client
-	usage           resource.Tracker
+	usage           *resource.LegacyProviderConfigUsageTracker
 	newHttpClientFn func(log logging.Logger, timeout time.Duration, creds string) (httpClient.Client, error)
 }
 
@@ -106,10 +105,18 @@ func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.E
 
 	l := c.logger.WithValues("disposableRequest", cr.Name)
 
-	if err := c.usage.Track(ctx, mg); err != nil {
+	if err := c.usage.Track(ctx, cr); err != nil {
 		return nil, errors.Wrap(err, errTrackPCUsage)
 	}
 
+	// Set default providerConfigRef if not specified
+	if cr.GetProviderConfigReference() == nil {
+		cr.SetProviderConfigReference(&xpv1.Reference{
+			Name: "default",
+		})
+		l.Debug("No providerConfigRef specified, defaulting to 'default'")
+	}
+
 	pc := &apisv1alpha1.ProviderConfig{}
 	n := types.NamespacedName{Name: cr.GetProviderConfigReference().Name}
 	if err := c.kube.Get(ctx, n, pc); err != nil {
@@ -164,12 +171,21 @@ type external struct {
 }
 
 // Observe checks the state of the DisposableRequest resource and updates its status accordingly.
+//
+//gocyclo:ignore
 func (c *external) Observe(ctx context.Context, mg resource.Managed) (managed.ExternalObservation, error) {
 	cr, ok := mg.(*v1alpha2.DisposableRequest)
 	if !ok {
 		return managed.ExternalObservation{}, errors.New(errNotDisposableRequest)
 	}
 
+	if meta.WasDeleted(mg) {
+		c.logger.Debug("DisposableRequest is being deleted, skipping observation and secret injection")
+		return managed.ExternalObservation{
+			ResourceExists: false,
+		}, nil
+	}
+
 	isUpToDate := !(utils.ShouldRetry(cr.Spec.ForProvider.RollbackRetriesLimit, cr.Status.Failed) && !utils.RetriesLimitReached(cr.Status.Failed, cr.Spec.ForProvider.RollbackRetriesLimit))
 	isAvailable := isUpToDate
 
diff --git a/internal/controller/disposablerequest/disposablerequest_test.go b/internal/controller/cluster/disposablerequest/disposablerequest_test.go
similarity index 80%
rename from internal/controller/disposablerequest/disposablerequest_test.go
rename to internal/controller/cluster/disposablerequest/disposablerequest_test.go
index fd462a9..dfc8984 100644
--- a/internal/controller/disposablerequest/disposablerequest_test.go
+++ b/internal/controller/cluster/disposablerequest/disposablerequest_test.go
@@ -22,22 +22,23 @@ import (
 	"testing"
 	"time"
 
-	"github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/common"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
 	"github.com/crossplane-contrib/provider-http/internal/service/disposablerequest"
 	"github.com/crossplane-contrib/provider-http/internal/utils"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"github.com/crossplane/crossplane-runtime/pkg/feature"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
-	"github.com/crossplane/crossplane-runtime/pkg/resource"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 )
 
 // Unlike many Kubernetes projects Crossplane does not use third party testing
@@ -838,6 +839,203 @@ func TestDisposableRequestManagementPoliciesResolver(t *testing.T) {
 	}
 }
 
+func TestObserve_DeletionMonitoring(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		obs managed.ExternalObservation
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "ResourceBeingDeleted",
+			args: args{
+				mg: disposableRequestWithDeletion(),
+			},
+			want: want{
+				obs: managed.ExternalObservation{
+					ResourceExists: false,
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			got, err := e.Observe(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Observe(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.obs, got); diff != "" {
+				t.Errorf("Observe(...): -want, +got: %s", diff)
+			}
+		})
+	}
+}
+
+func TestTLSConfiguration(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "TLSConfigAcceptedWithNilTLS",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the actual TLS config loading is handled by the service layer
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: clusterDisposableRequestWithTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+		{
+			name: "InsecureSkipTLSVerifyAccepted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the controller should handle insecure skip verify
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "insecure success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: clusterDisposableRequestWithInsecureSkipTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+		{
+			name: "TLSConfigWithClientCertsAccepted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the service layer handles TLS config merging
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "client cert success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: clusterDisposableRequestWithResourceTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			_, err := e.Create(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Create(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+// clusterDisposableRequestWithTLS creates a DisposableRequest with TLS configuration
+func clusterDisposableRequestWithTLS() *v1alpha2.DisposableRequest {
+	return httpDisposableRequest(func(cr *v1alpha2.DisposableRequest) {
+		cr.Spec.ForProvider.TLSConfig = &common.TLSConfig{
+			CACertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "ca-cert-secret",
+					Namespace: "default",
+				},
+				Key: "ca.crt",
+			},
+		}
+	})
+}
+
+// clusterDisposableRequestWithInsecureSkipTLS creates a DisposableRequest with insecureSkipTLSVerify
+func clusterDisposableRequestWithInsecureSkipTLS() *v1alpha2.DisposableRequest {
+	return httpDisposableRequest(func(cr *v1alpha2.DisposableRequest) {
+		cr.Spec.ForProvider.InsecureSkipTLSVerify = true
+	})
+}
+
+// clusterDisposableRequestWithResourceTLS creates a DisposableRequest with resource-level TLS config
+func clusterDisposableRequestWithResourceTLS() *v1alpha2.DisposableRequest {
+	return httpDisposableRequest(func(cr *v1alpha2.DisposableRequest) {
+		cr.Spec.ForProvider.TLSConfig = &common.TLSConfig{
+			ClientCertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "client-cert-secret",
+					Namespace: "default",
+				},
+				Key: "tls.crt",
+			},
+			ClientKeySecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "client-cert-secret",
+					Namespace: "default",
+				},
+				Key: "tls.key",
+			},
+		}
+	})
+}
+
 func TestDisposableRequestManagementPolicies(t *testing.T) {
 	cases := map[string]struct {
 		reason string
@@ -933,3 +1131,21 @@ func TestDisposableRequestManagementPolicies(t *testing.T) {
 		})
 	}
 }
+
+func disposableRequestWithDeletion() *v1alpha2.DisposableRequest {
+	now := v1.Now()
+	return &v1alpha2.DisposableRequest{
+		ObjectMeta: v1.ObjectMeta{
+			Name:              "test-disposable",
+			Namespace:         "default",
+			DeletionTimestamp: &now,
+		},
+		Spec: v1alpha2.DisposableRequestSpec{
+			ForProvider: v1alpha2.DisposableRequestParameters{
+				URL:    "http://example.com/test",
+				Method: "POST",
+				Body:   `{"test": true}`,
+			},
+		},
+	}
+}
diff --git a/internal/controller/request/request.go b/internal/controller/cluster/request/request.go
similarity index 82%
rename from internal/controller/request/request.go
rename to internal/controller/cluster/request/request.go
index 3487b68..65afa3c 100644
--- a/internal/controller/request/request.go
+++ b/internal/controller/cluster/request/request.go
@@ -20,23 +20,24 @@ import (
 	"context"
 	"time"
 
-	"github.com/crossplane/crossplane-runtime/pkg/feature"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/meta"
 	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
-	"github.com/crossplane/crossplane-runtime/pkg/controller"
-	"github.com/crossplane/crossplane-runtime/pkg/event"
-	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
-	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
-	"github.com/crossplane/crossplane-runtime/pkg/resource"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/event"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
+	apisv1alpha1 "github.com/crossplane-contrib/provider-http/apis/cluster/v1alpha1"
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
-	apisv1alpha1 "github.com/crossplane-contrib/provider-http/apis/v1alpha1"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
 	"github.com/crossplane-contrib/provider-http/internal/service/request"
@@ -46,36 +47,31 @@ import (
 )
 
 const (
-	errNotRequest                   = "managed resource is not a Request custom resource"
-	errTrackPCUsage                 = "cannot track ProviderConfig usage"
-	errNewHttpClient                = "cannot create new Http client"
-	errProviderNotRetrieved         = "provider could not be retrieved"
-	errFailedToSendHttpRequest      = "something went wrong"
-	errFailedToCheckIfUpToDate      = "failed to check if request is up to date"
-	errFailedToUpdateStatusFailures = "failed to reset status failures counter"
-	errFailedUpdateStatusConditions = "failed updating status conditions"
-	errPatchDataToSecret            = "Warning, couldn't patch data from request to secret %s:%s:%s, error: %s"
-	errGetLatestVersion             = "failed to get the latest version of the resource"
-	errExtractCredentials           = "cannot extract credentials"
+	errNotRequest              = "managed resource is not a Request custom resource"
+	errTrackPCUsage            = "cannot track ProviderConfig usage"
+	errNewHttpClient           = "cannot create new Http client"
+	errProviderNotRetrieved    = "provider could not be retrieved"
+	errFailedToSendHttpRequest = "something went wrong"
+	errFailedToCheckIfUpToDate = "failed to check if request is up to date"
+	errGetLatestVersion        = "failed to get the latest version of the resource"
+	errExtractCredentials      = "cannot extract credentials"
 )
 
 // Setup adds a controller that reconciles Request managed resources.
 func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
 	name := managed.ControllerName(v1alpha2.RequestGroupKind)
-	cps := []managed.ConnectionPublisher{managed.NewAPISecretPublisher(mgr.GetClient(), mgr.GetScheme())}
 
 	reconcilerOptions := []managed.ReconcilerOption{
 		managed.WithExternalConnecter(&connector{
 			logger:          o.Logger,
 			kube:            mgr.GetClient(),
-			usage:           resource.NewProviderConfigUsageTracker(mgr.GetClient(), &apisv1alpha1.ProviderConfigUsage{}),
+			usage:           resource.NewLegacyProviderConfigUsageTracker(mgr.GetClient(), &apisv1alpha1.ProviderConfigUsage{}),
 			newHttpClientFn: httpClient.NewClient,
 		}),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithPollInterval(o.PollInterval),
 		managed.WithTimeout(timeout),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithConnectionPublishers(cps...),
 	}
 
 	if o.Features.Enabled(feature.EnableBetaManagementPolicies) {
@@ -100,7 +96,7 @@ func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error
 type connector struct {
 	logger          logging.Logger
 	kube            client.Client
-	usage           resource.Tracker
+	usage           *resource.LegacyProviderConfigUsageTracker
 	newHttpClientFn func(log logging.Logger, timeout time.Duration, creds string) (httpClient.Client, error)
 }
 
@@ -113,10 +109,18 @@ func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.E
 
 	l := c.logger.WithValues("request", cr.Name)
 
-	if err := c.usage.Track(ctx, mg); err != nil {
+	if err := c.usage.Track(ctx, cr); err != nil {
 		return nil, errors.Wrap(err, errTrackPCUsage)
 	}
 
+	// Set default providerConfigRef if not specified
+	if cr.GetProviderConfigReference() == nil {
+		cr.SetProviderConfigReference(&xpv1.Reference{
+			Name: "default",
+		})
+		l.Debug("No providerConfigRef specified, defaulting to 'default'")
+	}
+
 	pc := &apisv1alpha1.ProviderConfig{}
 	n := types.NamespacedName{Name: cr.GetProviderConfigReference().Name}
 	if err := c.kube.Get(ctx, n, pc); err != nil {
@@ -178,6 +182,13 @@ func (c *external) Observe(ctx context.Context, mg resource.Managed) (managed.Ex
 		return managed.ExternalObservation{}, errors.New(errNotRequest)
 	}
 
+	if meta.WasDeleted(mg) {
+		c.logger.Debug("Request is being deleted, skipping observation")
+		return managed.ExternalObservation{
+			ResourceExists: false,
+		}, nil
+	}
+
 	svcCtx := service.NewServiceContext(ctx, c.localKube, c.logger, c.http, c.tlsConfigData)
 	crCtx := service.NewRequestCRContext(cr)
 	observeRequestDetails, err := request.IsUpToDate(svcCtx, crCtx)
diff --git a/internal/controller/request/request_test.go b/internal/controller/cluster/request/request_test.go
similarity index 78%
rename from internal/controller/request/request_test.go
rename to internal/controller/cluster/request/request_test.go
index 0681b0b..f6199a7 100644
--- a/internal/controller/request/request_test.go
+++ b/internal/controller/cluster/request/request_test.go
@@ -7,14 +7,15 @@ import (
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/common"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
-	"github.com/crossplane/crossplane-runtime/pkg/feature"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
-	"github.com/crossplane/crossplane-runtime/pkg/resource"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 )
@@ -818,3 +819,214 @@ func TestRequestManagementPoliciesResolver(t *testing.T) {
 		})
 	}
 }
+
+func httpRequestWithDeletion() *v1alpha2.Request {
+	now := v1.Now()
+	return httpRequest(func(r *v1alpha2.Request) {
+		r.DeletionTimestamp = &now
+	})
+}
+
+func TestTLSConfiguration(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "TLSConfigAcceptedWithNilTLS",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the actual TLS config loading is handled by the service layer
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: clusterRequestWithTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+		{
+			name: "InsecureSkipTLSVerifyAccepted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the controller should handle insecure skip verify
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "insecure success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: clusterRequestWithInsecureSkipTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+		{
+			name: "TLSConfigWithClientCertsAccepted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the service layer handles TLS config merging
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "client cert success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: clusterRequestWithMutualTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			_, err := e.Create(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Create(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+// clusterRequestWithTLS creates a Request with TLS configuration
+func clusterRequestWithTLS() *v1alpha2.Request {
+	return httpRequest(func(cr *v1alpha2.Request) {
+		cr.Spec.ForProvider.TLSConfig = &common.TLSConfig{
+			CACertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "ca-cert-secret",
+					Namespace: "default",
+				},
+				Key: "ca.crt",
+			},
+		}
+	})
+}
+
+// clusterRequestWithInsecureSkipTLS creates a Request with insecureSkipTLSVerify
+func clusterRequestWithInsecureSkipTLS() *v1alpha2.Request {
+	return httpRequest(func(cr *v1alpha2.Request) {
+		cr.Spec.ForProvider.InsecureSkipTLSVerify = true
+	})
+}
+
+// clusterRequestWithMutualTLS creates a Request with mutual TLS configuration
+func clusterRequestWithMutualTLS() *v1alpha2.Request {
+	return httpRequest(func(cr *v1alpha2.Request) {
+		cr.Spec.ForProvider.TLSConfig = &common.TLSConfig{
+			CACertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "ca-cert-secret",
+					Namespace: "default",
+				},
+				Key: "ca.crt",
+			},
+			ClientCertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "client-cert-secret",
+					Namespace: "default",
+				},
+				Key: "tls.crt",
+			},
+			ClientKeySecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "client-cert-secret",
+					Namespace: "default",
+				},
+				Key: "tls.key",
+			},
+		}
+	})
+}
+
+func TestObserve_DeletionMonitoring(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		obs managed.ExternalObservation
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "ResourceBeingDeleted",
+			args: args{
+				mg: httpRequestWithDeletion(),
+			},
+			want: want{
+				obs: managed.ExternalObservation{
+					ResourceExists: false,
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			got, err := e.Observe(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Observe(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.obs, got); diff != "" {
+				t.Errorf("Observe(...): -want, +got: %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/controller/http.go b/internal/controller/http.go
index 19cf6da..f65cdbe 100644
--- a/internal/controller/http.go
+++ b/internal/controller/http.go
@@ -19,21 +19,32 @@ package controller
 import (
 	"time"
 
-	"github.com/crossplane/crossplane-runtime/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
 	ctrl "sigs.k8s.io/controller-runtime"
 
-	"github.com/crossplane-contrib/provider-http/internal/controller/config"
-	disposablerequest "github.com/crossplane-contrib/provider-http/internal/controller/disposablerequest"
-	request "github.com/crossplane-contrib/provider-http/internal/controller/request"
+	"github.com/crossplane-contrib/provider-http/internal/controller/cluster"
+	"github.com/crossplane-contrib/provider-http/internal/controller/namespaced"
 )
 
-// Setup creates all http controllers with the supplied logger and adds them to
+// Setup creates all http controllers (both cluster and namespaced) with the supplied logger and adds them to
 // the supplied manager.
 func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
 	for _, setup := range []func(ctrl.Manager, controller.Options, time.Duration) error{
-		config.Setup,
-		disposablerequest.Setup,
-		request.Setup,
+		cluster.Setup,
+		namespaced.Setup,
+	} {
+		if err := setup(mgr, o, timeout); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SetupGated creates all http controllers with SafeStart capability (controllers start as their CRDs appear)
+func SetupGated(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	for _, setup := range []func(ctrl.Manager, controller.Options, time.Duration) error{
+		cluster.SetupGated,
+		namespaced.SetupGated,
 	} {
 		if err := setup(mgr, o, timeout); err != nil {
 			return err
diff --git a/internal/controller/namespaced/config/clusterconfig.go b/internal/controller/namespaced/config/clusterconfig.go
new file mode 100644
index 0000000..cd1bea7
--- /dev/null
+++ b/internal/controller/namespaced/config/clusterconfig.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/event"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/providerconfig"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	"github.com/crossplane-contrib/provider-http/apis/namespaced/v1alpha2"
+)
+
+// SetupCluster adds a controller that reconciles ClusterProviderConfigs by accounting for
+// their current usage.
+func SetupCluster(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	name := providerconfig.ControllerName(v1alpha2.ClusterProviderConfigGroupKind)
+
+	of := resource.ProviderConfigKinds{
+		Config:    v1alpha2.ClusterProviderConfigGroupVersionKind,
+		Usage:     v1alpha2.ClusterProviderConfigUsageGroupVersionKind,
+		UsageList: v1alpha2.ClusterProviderConfigUsageListGroupVersionKind,
+	}
+
+	r := providerconfig.NewReconciler(mgr, of,
+		providerconfig.WithLogger(o.Logger.WithValues("controller", name)),
+		providerconfig.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))))
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		For(&v1alpha2.ClusterProviderConfig{}).
+		Watches(&v1alpha2.ClusterProviderConfigUsage{}, &resource.EnqueueRequestForProviderConfig{}).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
diff --git a/internal/controller/namespaced/config/config.go b/internal/controller/namespaced/config/config.go
new file mode 100644
index 0000000..4c43116
--- /dev/null
+++ b/internal/controller/namespaced/config/config.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/event"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/providerconfig"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	"github.com/crossplane-contrib/provider-http/apis/namespaced/v1alpha2"
+)
+
+// Setup adds a controller that reconciles ProviderConfigs by accounting for
+// their current usage.
+func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	name := providerconfig.ControllerName(v1alpha2.ProviderConfigGroupKind)
+
+	of := resource.ProviderConfigKinds{
+		Config:    v1alpha2.ProviderConfigGroupVersionKind,
+		Usage:     v1alpha2.ProviderConfigUsageGroupVersionKind,
+		UsageList: v1alpha2.ProviderConfigUsageListGroupVersionKind,
+	}
+
+	r := providerconfig.NewReconciler(mgr, of,
+		providerconfig.WithLogger(o.Logger.WithValues("controller", name)),
+		providerconfig.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))))
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		For(&v1alpha2.ProviderConfig{}).
+		Watches(&v1alpha2.ProviderConfigUsage{}, &resource.EnqueueRequestForProviderConfig{}).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
diff --git a/internal/controller/namespaced/disposablerequest/disposablerequest.go b/internal/controller/namespaced/disposablerequest/disposablerequest.go
new file mode 100644
index 0000000..238debb
--- /dev/null
+++ b/internal/controller/namespaced/disposablerequest/disposablerequest.go
@@ -0,0 +1,319 @@
+/*
+Copyright 2023 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package disposablerequest
+
+import (
+	"context"
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/meta"
+	"github.com/pkg/errors"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/event"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+
+	"github.com/crossplane-contrib/provider-http/apis/namespaced/disposablerequest/v1alpha2"
+	apisv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
+	"github.com/crossplane-contrib/provider-http/internal/service"
+	"github.com/crossplane-contrib/provider-http/internal/service/disposablerequest"
+	"github.com/crossplane-contrib/provider-http/internal/utils"
+)
+
+const (
+	errNotNamespacedDisposableRequest      = "managed resource is not a namespaced DisposableRequest custom resource"
+	errTrackPCUsage                        = "cannot track ProviderConfig usage"
+	errNewHttpClient                       = "cannot create new Http client"
+	errFailedToSendHttpDisposableRequest   = "failed to send http request"
+	errExtractCredentials                  = "cannot extract credentials"
+	errResponseDoesntMatchExpectedCriteria = "response does not match expected criteria"
+
+	errGetPC  = "cannot get ProviderConfig"
+	errGetCPC = "cannot get ClusterProviderConfig"
+)
+
+// Setup adds a controller that reconciles namespaced DisposableRequest managed resources.
+func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	name := managed.ControllerName(v1alpha2.DisposableRequestGroupKind)
+
+	reconcilerOptions := []managed.ReconcilerOption{
+		managed.WithExternalConnecter(&connector{
+			logger:          o.Logger,
+			kube:            mgr.GetClient(),
+			usage:           resource.NewProviderConfigUsageTracker(mgr.GetClient(), &apisv1alpha2.ProviderConfigUsage{}),
+			newHttpClientFn: httpClient.NewClient,
+		}),
+		managed.WithLogger(o.Logger.WithValues("controller", name)),
+		managed.WithPollInterval(o.PollInterval),
+		WithCustomPollIntervalHook(),
+		managed.WithTimeout(timeout),
+		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
+	}
+
+	if o.Features.Enabled(feature.EnableBetaManagementPolicies) {
+		reconcilerOptions = append(reconcilerOptions, managed.WithManagementPolicies())
+	}
+
+	r := managed.NewReconciler(mgr,
+		resource.ManagedKind(v1alpha2.DisposableRequestGroupVersionKind),
+		reconcilerOptions...,
+	)
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		WithEventFilter(resource.DesiredStateChanged()).
+		For(&v1alpha2.DisposableRequest{}).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
+
+type connector struct {
+	logger          logging.Logger
+	kube            client.Client
+	usage           *resource.ProviderConfigUsageTracker
+	newHttpClientFn func(log logging.Logger, timeout time.Duration, creds string) (httpClient.Client, error)
+}
+
+// Connect returns a new ExternalClient.
+//
+//gocyclo:ignore
+func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.ExternalClient, error) {
+	cr, ok := mg.(*v1alpha2.DisposableRequest)
+	if !ok {
+		return nil, errors.New(errNotNamespacedDisposableRequest)
+	}
+
+	l := c.logger.WithValues("namespacedDisposableRequest", cr.Name)
+
+	if err := c.usage.Track(ctx, cr); err != nil {
+		return nil, errors.Wrap(err, errTrackPCUsage)
+	}
+
+	// Set default providerConfigRef if not specified
+	if cr.GetProviderConfigReference() == nil {
+		cr.SetProviderConfigReference(&xpv1.ProviderConfigReference{
+			Name: "default",
+			Kind: "ClusterProviderConfig",
+		})
+		l.Debug("No providerConfigRef specified, defaulting to 'default'")
+	}
+
+	var cd apisv1alpha2.ProviderCredentials
+	var providerTLS *common.TLSConfig
+
+	// Switch to ModernManaged resource to get ProviderConfigRef
+	m := mg.(resource.ModernManaged)
+	ref := m.GetProviderConfigReference()
+
+	switch ref.Kind {
+	case "ProviderConfig":
+		pc := &apisv1alpha2.ProviderConfig{}
+		if err := c.kube.Get(ctx, types.NamespacedName{Name: ref.Name, Namespace: m.GetNamespace()}, pc); err != nil {
+			return nil, errors.Wrap(err, errGetPC)
+		}
+		cd = pc.Spec.Credentials
+		providerTLS = pc.Spec.TLS
+	case "ClusterProviderConfig":
+		cpc := &apisv1alpha2.ClusterProviderConfig{}
+		if err := c.kube.Get(ctx, types.NamespacedName{Name: ref.Name}, cpc); err != nil {
+			return nil, errors.Wrap(err, errGetCPC)
+		}
+		cd = cpc.Spec.Credentials
+		providerTLS = cpc.Spec.TLS
+	default:
+		return nil, errors.Errorf("unsupported provider config kind: %s", ref.Kind)
+	}
+
+	creds := ""
+	if cd.Source == xpv1.CredentialsSourceSecret {
+		data, err := resource.CommonCredentialExtractor(ctx, cd.Source, c.kube, cd.CommonCredentialSelectors)
+		if err != nil {
+			return nil, errors.Wrap(err, errExtractCredentials)
+		}
+		creds = string(data)
+	}
+
+	h, err := c.newHttpClientFn(l, utils.WaitTimeout(cr.Spec.ForProvider.WaitTimeout), creds)
+	if err != nil {
+		return nil, errors.Wrap(err, errNewHttpClient)
+	}
+
+	// Merge TLS configs: resource-level overrides provider-level
+	mergedTLSConfig := httpClient.MergeTLSConfigs(cr.Spec.ForProvider.TLSConfig, providerTLS)
+
+	// Apply InsecureSkipTLSVerify from DisposableRequest spec if set
+	if cr.Spec.ForProvider.InsecureSkipTLSVerify {
+		if mergedTLSConfig == nil {
+			mergedTLSConfig = &common.TLSConfig{}
+		}
+		mergedTLSConfig.InsecureSkipVerify = true
+	}
+
+	// Load TLS configuration from secrets
+	tlsConfigData, err := httpClient.LoadTLSConfig(ctx, c.kube, mergedTLSConfig)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to load TLS configuration")
+	}
+
+	return &external{
+		localKube:     c.kube,
+		logger:        l,
+		http:          h,
+		tlsConfigData: tlsConfigData,
+	}, nil
+}
+
+type external struct {
+	localKube     client.Client
+	logger        logging.Logger
+	http          httpClient.Client
+	tlsConfigData *httpClient.TLSConfigData
+}
+
+// Observe checks the state of the DisposableRequest resource and updates its status accordingly.
+//
+//gocyclo:ignore
+func (c *external) Observe(ctx context.Context, mg resource.Managed) (managed.ExternalObservation, error) {
+	cr, ok := mg.(*v1alpha2.DisposableRequest)
+	if !ok {
+		return managed.ExternalObservation{}, errors.New(errNotNamespacedDisposableRequest)
+	}
+
+	if meta.WasDeleted(mg) {
+		c.logger.Debug("DisposableRequest is being deleted, skipping observation and secret injection")
+		return managed.ExternalObservation{
+			ResourceExists: false,
+		}, nil
+	}
+
+	isUpToDate := !(utils.ShouldRetry(cr.Spec.ForProvider.RollbackRetriesLimit, cr.Status.Failed) && !utils.RetriesLimitReached(cr.Status.Failed, cr.Spec.ForProvider.RollbackRetriesLimit))
+	isAvailable := isUpToDate
+
+	if !cr.Status.Synced {
+		return managed.ExternalObservation{
+			ResourceExists: false,
+		}, nil
+	}
+
+	svcCtx := service.NewServiceContext(ctx, c.localKube, c.logger, c.http, c.tlsConfigData)
+	crCtx := service.NewDisposableRequestCRContext(cr)
+	isExpected, storedResponse, err := disposablerequest.ValidateStoredResponse(svcCtx, crCtx)
+	if err != nil {
+		return managed.ExternalObservation{}, err
+	}
+	if !isExpected {
+		return managed.ExternalObservation{}, errors.New(errResponseDoesntMatchExpectedCriteria)
+	}
+
+	isUpToDate = disposablerequest.CalculateUpToDateStatus(crCtx, isUpToDate)
+
+	if isAvailable {
+		if err := disposablerequest.UpdateResourceStatus(ctx, cr, c.localKube); err != nil {
+			return managed.ExternalObservation{}, err
+		}
+	}
+
+	if len(cr.Spec.ForProvider.SecretInjectionConfigs) > 0 && cr.Status.Response.StatusCode != 0 {
+		disposablerequest.ApplySecretInjectionsFromStoredResponse(svcCtx, crCtx, storedResponse)
+	}
+
+	return managed.ExternalObservation{
+		ResourceExists:    isAvailable,
+		ResourceUpToDate:  isUpToDate,
+		ConnectionDetails: nil,
+	}, nil
+}
+
+func (c *external) Create(ctx context.Context, mg resource.Managed) (managed.ExternalCreation, error) {
+	cr, ok := mg.(*v1alpha2.DisposableRequest)
+	if !ok {
+		return managed.ExternalCreation{}, errors.New(errNotNamespacedDisposableRequest)
+	}
+
+	if err := utils.IsRequestValid(cr.Spec.ForProvider.Method, cr.Spec.ForProvider.URL); err != nil {
+		return managed.ExternalCreation{}, err
+	}
+
+	svcCtx := service.NewServiceContext(ctx, c.localKube, c.logger, c.http, c.tlsConfigData)
+	crCtx := service.NewDisposableRequestCRContext(cr)
+	return managed.ExternalCreation{}, errors.Wrap(disposablerequest.DeployAction(svcCtx, crCtx), errFailedToSendHttpDisposableRequest)
+}
+
+func (c *external) Update(ctx context.Context, mg resource.Managed) (managed.ExternalUpdate, error) {
+	cr, ok := mg.(*v1alpha2.DisposableRequest)
+	if !ok {
+		return managed.ExternalUpdate{}, errors.New(errNotNamespacedDisposableRequest)
+	}
+
+	if err := utils.IsRequestValid(cr.Spec.ForProvider.Method, cr.Spec.ForProvider.URL); err != nil {
+		return managed.ExternalUpdate{}, err
+	}
+
+	svcCtx := service.NewServiceContext(ctx, c.localKube, c.logger, c.http, c.tlsConfigData)
+	crCtx := service.NewDisposableRequestCRContext(cr)
+	return managed.ExternalUpdate{}, errors.Wrap(disposablerequest.DeployAction(svcCtx, crCtx), errFailedToSendHttpDisposableRequest)
+}
+
+func (c *external) Delete(_ context.Context, _ resource.Managed) (managed.ExternalDelete, error) {
+	return managed.ExternalDelete{}, nil
+}
+
+// Disconnect does nothing. It never returns an error.
+func (c *external) Disconnect(_ context.Context) error {
+	return nil
+}
+
+// WithCustomPollIntervalHook returns a managed.ReconcilerOption that sets a custom poll interval based on the DisposableRequest spec.
+func WithCustomPollIntervalHook() managed.ReconcilerOption {
+	return managed.WithPollIntervalHook(func(mg resource.Managed, pollInterval time.Duration) time.Duration {
+		defaultPollInterval := 30 * time.Second
+
+		cr, ok := mg.(*v1alpha2.DisposableRequest)
+		if !ok {
+			return defaultPollInterval
+		}
+
+		if cr.Spec.ForProvider.NextReconcile == nil {
+			return defaultPollInterval
+		}
+
+		// Calculate next reconcile time based on NextReconcile duration
+		nextReconcileDuration := cr.Spec.ForProvider.NextReconcile.Duration
+		lastReconcileTime := cr.Status.LastReconcileTime.Time
+		nextReconcileTime := lastReconcileTime.Add(nextReconcileDuration)
+
+		// Determine if the current time is past the next reconcile time
+		now := time.Now()
+		if now.Before(nextReconcileTime) {
+			// If not yet time to reconcile, calculate remaining time
+			return nextReconcileTime.Sub(now)
+		}
+
+		// Default poll interval if the next reconcile time is in the past
+		return defaultPollInterval
+	})
+}
diff --git a/internal/controller/namespaced/disposablerequest/disposablerequest_test.go b/internal/controller/namespaced/disposablerequest/disposablerequest_test.go
new file mode 100644
index 0000000..77590e1
--- /dev/null
+++ b/internal/controller/namespaced/disposablerequest/disposablerequest_test.go
@@ -0,0 +1,1158 @@
+/*
+Copyright 2023 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package disposablerequest
+
+import (
+	"context"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	"github.com/crossplane-contrib/provider-http/apis/namespaced/disposablerequest/v1alpha2"
+	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
+	"github.com/crossplane-contrib/provider-http/internal/service"
+	"github.com/crossplane-contrib/provider-http/internal/service/disposablerequest"
+	"github.com/crossplane-contrib/provider-http/internal/utils"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
+	"github.com/google/go-cmp/cmp"
+	"github.com/pkg/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+var (
+	errBoom = errors.New("boom")
+)
+
+const (
+	providerName                        = "http-test"
+	testNamespacedDisposableRequestName = "test-request"
+	testNamespace                       = "testns"
+)
+
+var testHeaders = map[string][]string{
+	"fruits":                {"apple", "banana", "orange"},
+	"colors":                {"red", "green", "blue"},
+	"countries":             {"USA", "UK", "India", "Germany"},
+	"programming_languages": {"Go", "Python", "JavaScript"},
+}
+
+var testTimeout = &metav1.Duration{
+	Duration: 5 * time.Minute,
+}
+
+const (
+	testURL    = "https://example-url"
+	testMethod = "GET"
+	testBody   = "{\"key1\": \"value1\"}"
+)
+
+type MockSendRequestFn func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error)
+
+type MockSendRequestWithTLSFn func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfig *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error)
+
+type MockHttpClient struct {
+	MockSendRequest        MockSendRequestFn
+	MockSendRequestWithTLS MockSendRequestWithTLSFn
+}
+
+func (c *MockHttpClient) SendRequest(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+	return c.MockSendRequest(ctx, method, url, body, headers, tlsConfigData)
+}
+
+func (c *MockHttpClient) SendRequestWithTLS(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfig *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+	if c.MockSendRequestWithTLS != nil {
+		return c.MockSendRequestWithTLS(ctx, method, url, body, headers, tlsConfig)
+	}
+	// Fallback to SendRequest for backward compatibility
+	return c.MockSendRequest(ctx, method, url, body, headers, tlsConfig)
+}
+
+type notNamespacedDisposableRequest struct {
+	resource.Managed
+}
+
+type httpNamespacedDisposableRequestModifier func(request *v1alpha2.DisposableRequest)
+
+func httpNamespacedDisposableRequest(rm ...httpNamespacedDisposableRequestModifier) *v1alpha2.DisposableRequest {
+	r := &v1alpha2.DisposableRequest{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      testNamespacedDisposableRequestName,
+			Namespace: testNamespace,
+		},
+		Spec: v1alpha2.DisposableRequestSpec{
+			ForProvider: v1alpha2.DisposableRequestParameters{
+				URL:         testURL,
+				Method:      testMethod,
+				Headers:     testHeaders,
+				Body:        testBody,
+				WaitTimeout: testTimeout,
+			},
+		},
+		Status: v1alpha2.DisposableRequestStatus{},
+	}
+
+	for _, m := range rm {
+		m(r)
+	}
+
+	return r
+}
+
+func namespacedDisposableRequest(modifiers ...func(*v1alpha2.DisposableRequest)) *v1alpha2.DisposableRequest {
+	cr := &v1alpha2.DisposableRequest{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-disposable",
+			Namespace: "default",
+		},
+		Spec: v1alpha2.DisposableRequestSpec{
+			ForProvider: v1alpha2.DisposableRequestParameters{
+				URL:    "http://example.com/test",
+				Method: "POST",
+				Body:   `{"test": true}`,
+			},
+		},
+	}
+
+	for _, modifier := range modifiers {
+		modifier(cr)
+	}
+
+	return cr
+}
+
+func namespacedDisposableRequestWithDeletion() *v1alpha2.DisposableRequest {
+	now := metav1.Now()
+	return &v1alpha2.DisposableRequest{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:              "test-disposable",
+			Namespace:         "default",
+			DeletionTimestamp: &now,
+		},
+		Spec: v1alpha2.DisposableRequestSpec{
+			ForProvider: v1alpha2.DisposableRequestParameters{
+				URL:    "http://example.com/test",
+				Method: "POST",
+				Body:   `{"test": true}`,
+			},
+		},
+	}
+}
+
+func TestObserve(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		obs managed.ExternalObservation
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "NotNamespacedDisposableRequest",
+			args: args{
+				mg: notNamespacedDisposableRequest{},
+			},
+			want: want{
+				err: errors.New(errNotNamespacedDisposableRequest),
+			},
+		},
+		{
+			name: "ResourceBeingDeleted",
+			args: args{
+				mg: namespacedDisposableRequestWithDeletion(),
+			},
+			want: want{
+				obs: managed.ExternalObservation{
+					ResourceExists: false,
+				},
+			},
+		},
+		{
+			name: "ResourceNotSynced",
+			args: args{
+				mg: namespacedDisposableRequest(),
+			},
+			want: want{
+				obs: managed.ExternalObservation{
+					ResourceExists: false,
+				},
+			},
+		},
+		{
+			name: "ResourceSyncedAndUpToDate",
+			args: args{
+				http: &MockHttpClient{},
+				localKube: &test.MockClient{
+					MockGet:          test.NewMockGetFn(nil),
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+				},
+				mg: &v1alpha2.DisposableRequest{
+					Spec: v1alpha2.DisposableRequestSpec{
+						ForProvider: v1alpha2.DisposableRequestParameters{
+							URL:    testURL,
+							Method: testMethod,
+						},
+					},
+					Status: v1alpha2.DisposableRequestStatus{
+						Synced: true,
+						Response: v1alpha2.Response{
+							StatusCode: 200,
+							Body:       testBody,
+							Headers:    testHeaders,
+						},
+					},
+				},
+			},
+			want: want{
+				obs: managed.ExternalObservation{
+					ResourceExists:   true,
+					ResourceUpToDate: true,
+				},
+				err: nil,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			got, err := e.Observe(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Observe(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.obs.ResourceExists, got.ResourceExists); diff != "" {
+				t.Fatalf("e.Observe(...): -want ResourceExists, +got ResourceExists: %s", diff)
+			}
+			if tc.want.err == nil {
+				if diff := cmp.Diff(tc.want.obs.ResourceUpToDate, got.ResourceUpToDate); diff != "" {
+					t.Fatalf("e.Observe(...): -want ResourceUpToDate, +got ResourceUpToDate: %s", diff)
+				}
+			}
+		})
+	}
+}
+
+func TestCreate(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "NotNamespacedDisposableRequest",
+			args: args{
+				mg: notNamespacedDisposableRequest{},
+			},
+			want: want{
+				err: errors.New(errNotNamespacedDisposableRequest),
+			},
+		},
+		{
+			name: "HttpRequestFailed",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, errBoom
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedDisposableRequest(),
+			},
+			want: want{
+				err: errors.Wrap(errBoom, errFailedToSendHttpDisposableRequest),
+			},
+		},
+		{
+			name: "Success",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedDisposableRequest(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			_, err := e.Create(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Create(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+func TestUpdate(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "NotNamespacedDisposableRequest",
+			args: args{
+				mg: notNamespacedDisposableRequest{},
+			},
+			want: want{
+				err: errors.New(errNotNamespacedDisposableRequest),
+			},
+		},
+		{
+			name: "Success",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "updated"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedDisposableRequest(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			_, err := e.Update(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Update(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+func TestDelete(t *testing.T) {
+	type args struct {
+		mg resource.Managed
+	}
+	type want struct {
+		result managed.ExternalDelete
+		err    error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "Success",
+			args: args{
+				mg: namespacedDisposableRequest(),
+			},
+			want: want{
+				result: managed.ExternalDelete{},
+				err:    nil,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger: logging.NewNopLogger(),
+			}
+
+			got, err := e.Delete(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Delete(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.result, got); diff != "" {
+				t.Errorf("Delete(...): -want result, +got result: %s", diff)
+			}
+		})
+	}
+}
+
+func Test_deployAction(t *testing.T) {
+	type args struct {
+		cr        *v1alpha2.DisposableRequest
+		http      httpClient.Client
+		localKube client.Client
+	}
+	type want struct {
+		err           error
+		failuresIndex int32
+		statusCode    int
+	}
+	cases := map[string]struct {
+		args      args
+		want      want
+		condition bool
+	}{
+		"SuccessUpdateStatusRequestFailure": {
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, errors.Errorf(utils.ErrInvalidURL, "invalid-url")
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				cr: &v1alpha2.DisposableRequest{
+					Spec: v1alpha2.DisposableRequestSpec{
+						ForProvider: v1alpha2.DisposableRequestParameters{
+							URL:     "invalid-url",
+							Method:  testMethod,
+							Headers: testHeaders,
+							Body:    testBody,
+						},
+					},
+					Status: v1alpha2.DisposableRequestStatus{},
+				},
+			},
+			want: want{
+				err:           errors.Errorf(utils.ErrInvalidURL, "invalid-url"),
+				failuresIndex: 1,
+			},
+		},
+		"SuccessUpdateStatusCodeError": {
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 400,
+								Body:       testBody,
+								Headers:    testHeaders,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				cr: &v1alpha2.DisposableRequest{
+					Spec: v1alpha2.DisposableRequestSpec{
+						ForProvider: v1alpha2.DisposableRequestParameters{
+							URL:     testURL,
+							Method:  testMethod,
+							Headers: testHeaders,
+							Body:    testBody,
+						},
+					},
+					Status: v1alpha2.DisposableRequestStatus{},
+				},
+			},
+			want: want{
+				err:           errors.Errorf(utils.ErrStatusCode, testMethod, strconv.Itoa(400)),
+				failuresIndex: 1,
+				statusCode:    400,
+			},
+			condition: true,
+		},
+		"SuccessUpdateStatusSuccessfulRequest": {
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       testBody,
+								Headers:    testHeaders,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				cr: &v1alpha2.DisposableRequest{
+					Spec: v1alpha2.DisposableRequestSpec{
+						ForProvider: v1alpha2.DisposableRequestParameters{
+							URL:     testURL,
+							Method:  testMethod,
+							Headers: testHeaders,
+							Body:    testBody,
+						},
+					},
+					Status: v1alpha2.DisposableRequestStatus{},
+				},
+			},
+			want: want{
+				err:        nil,
+				statusCode: 200,
+			},
+			condition: true,
+		},
+	}
+	for name, tc := range cases {
+		tc := tc // Create local copies of loop variables
+
+		t.Run(name, func(t *testing.T) {
+			svcCtx := service.NewServiceContext(
+				context.Background(),
+				tc.args.localKube,
+				logging.NewNopLogger(),
+				tc.args.http,
+				nil,
+			)
+			crCtx := service.NewDisposableRequestCRContext(
+				tc.args.cr,
+			)
+			gotErr := disposablerequest.DeployAction(svcCtx, crCtx)
+			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
+				t.Fatalf("deployAction(...): -want error, +got error: %s", diff)
+			}
+
+			if gotErr != nil {
+				if diff := cmp.Diff(tc.want.failuresIndex, tc.args.cr.Status.Failed); diff != "" {
+					t.Fatalf("deployAction(...): -want Status.Failed, +got Status.Failed: %s", diff)
+				}
+			}
+
+			if tc.condition {
+				if diff := cmp.Diff(tc.args.cr.Spec.ForProvider.Body, tc.args.cr.Status.Response.Body); diff != "" {
+					t.Fatalf("deployAction(...): -want Status.Response.Body, +got Status.Response.Body: %s", diff)
+				}
+
+				if diff := cmp.Diff(tc.want.statusCode, tc.args.cr.Status.Response.StatusCode); diff != "" {
+					t.Fatalf("deployAction(...): -want Status.Response.StatusCode, +got Status.Response.StatusCode: %s", diff)
+				}
+
+				if diff := cmp.Diff(tc.args.cr.Spec.ForProvider.Headers, tc.args.cr.Status.Response.Headers); diff != "" {
+					t.Fatalf("deployAction(...): -want Status.Response.Headers, +got Status.Response.Headers: %s", diff)
+				}
+
+				if tc.args.cr.Status.LastReconcileTime.IsZero() {
+					t.Fatalf("deployAction(...): -want Status.LastReconcileTime to not be nil, +got nil")
+				}
+			}
+		})
+	}
+}
+
+func TestManagementPoliciesFeatureFlag(t *testing.T) {
+	cases := map[string]struct {
+		reason   string
+		features *feature.Flags
+		want     bool
+	}{
+		"ManagementPoliciesEnabled": {
+			reason: "Feature flag should be enabled when explicitly set",
+			features: func() *feature.Flags {
+				f := &feature.Flags{}
+				f.Enable(feature.EnableBetaManagementPolicies)
+				return f
+			}(),
+			want: true,
+		},
+		"ManagementPoliciesDisabled": {
+			reason:   "Feature flag should be disabled when not set",
+			features: &feature.Flags{},
+			want:     false,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			enabled := tc.features.Enabled(feature.EnableBetaManagementPolicies)
+			if enabled != tc.want {
+				t.Errorf("\n%s\nEnabled(feature.EnableBetaManagementPolicies): want %v, got %v", tc.reason, tc.want, enabled)
+			}
+		})
+	}
+}
+
+func TestNamespacedDisposableRequestManagementPoliciesResolver(t *testing.T) {
+	type args struct {
+		enabled bool
+		policy  xpv1.ManagementPolicies
+	}
+	type want struct {
+		shouldCreate         bool
+		shouldUpdate         bool
+		shouldDelete         bool
+		shouldOnlyObserve    bool
+		shouldLateInitialize bool
+	}
+
+	cases := map[string]struct {
+		reason string
+		args   args
+		want   want
+	}{
+		"ManagementPoliciesDisabled": {
+			reason: "When management policies are disabled, all actions should be allowed",
+			args: args{
+				enabled: false,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionObserve},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         true,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: true,
+			},
+		},
+		"ObserveOnlyPolicy": {
+			reason: "Observe-only policy should only allow observation",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionObserve},
+			},
+			want: want{
+				shouldCreate:         false,
+				shouldUpdate:         false,
+				shouldDelete:         false,
+				shouldOnlyObserve:    true,
+				shouldLateInitialize: false,
+			},
+		},
+		"CreateOnlyPolicy": {
+			reason: "Create-only policy should only allow creation",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionCreate},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         false,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"UpdateOnlyPolicy": {
+			reason: "Update-only policy should only allow updates",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionUpdate},
+			},
+			want: want{
+				shouldCreate:         false,
+				shouldUpdate:         true,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"DeleteOnlyPolicy": {
+			reason: "Delete-only policy should only allow deletion",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionDelete},
+			},
+			want: want{
+				shouldCreate:         false,
+				shouldUpdate:         false,
+				shouldDelete:         true,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"CreateAndUpdatePolicy": {
+			reason: "Create and update policy should allow both creation and updates",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionCreate, xpv1.ManagementActionUpdate},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"ObserveCreateUpdatePolicy": {
+			reason: "Observe, create, and update policy should allow all three actions",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionObserve, xpv1.ManagementActionCreate, xpv1.ManagementActionUpdate},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"AllActionsExceptDeletePolicy": {
+			reason: "All actions except delete should allow observe, create, update, and late initialize",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionObserve, xpv1.ManagementActionCreate, xpv1.ManagementActionUpdate, xpv1.ManagementActionLateInitialize},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: true,
+			},
+		},
+		"ExplicitAllPolicy": {
+			reason: "Explicit all policy should allow all actions",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionAll},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         true,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: true,
+			},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			// Create a mock managed resource with the specified management policies
+			mg := httpNamespacedDisposableRequest()
+			mg.Spec.ManagementPolicies = tc.args.policy
+
+			// Test the management policies resolver logic
+			// Note: This is a simplified test that focuses on the policy logic
+			// The actual enforcement happens in the Crossplane managed reconciler
+
+			// Helper function to check if a ManagementPolicies slice contains a specific action
+			contains := func(policies xpv1.ManagementPolicies, action xpv1.ManagementAction) bool {
+				for _, p := range policies {
+					if p == action {
+						return true
+					}
+				}
+				return false
+			}
+
+			// Test ShouldCreate
+			shouldCreate := tc.want.shouldCreate
+			if tc.args.enabled {
+				shouldCreate = contains(tc.args.policy, xpv1.ManagementActionCreate) || contains(tc.args.policy, xpv1.ManagementActionAll)
+			}
+			if shouldCreate != tc.want.shouldCreate {
+				t.Errorf("ShouldCreate() = %v, want %v", shouldCreate, tc.want.shouldCreate)
+			}
+
+			// Test ShouldUpdate
+			shouldUpdate := tc.want.shouldUpdate
+			if tc.args.enabled {
+				shouldUpdate = contains(tc.args.policy, xpv1.ManagementActionUpdate) || contains(tc.args.policy, xpv1.ManagementActionAll)
+			}
+			if shouldUpdate != tc.want.shouldUpdate {
+				t.Errorf("ShouldUpdate() = %v, want %v", shouldUpdate, tc.want.shouldUpdate)
+			}
+
+			// Test ShouldDelete
+			shouldDelete := tc.want.shouldDelete
+			if tc.args.enabled {
+				shouldDelete = contains(tc.args.policy, xpv1.ManagementActionDelete) || contains(tc.args.policy, xpv1.ManagementActionAll)
+			}
+			if shouldDelete != tc.want.shouldDelete {
+				t.Errorf("ShouldDelete() = %v, want %v", shouldDelete, tc.want.shouldDelete)
+			}
+
+			// Test ShouldOnlyObserve
+			shouldOnlyObserve := tc.want.shouldOnlyObserve
+			if tc.args.enabled {
+				shouldOnlyObserve = len(tc.args.policy) == 1 && contains(tc.args.policy, xpv1.ManagementActionObserve)
+			}
+			if shouldOnlyObserve != tc.want.shouldOnlyObserve {
+				t.Errorf("ShouldOnlyObserve() = %v, want %v", shouldOnlyObserve, tc.want.shouldOnlyObserve)
+			}
+
+			// Test ShouldLateInitialize
+			shouldLateInitialize := tc.want.shouldLateInitialize
+			if tc.args.enabled {
+				shouldLateInitialize = contains(tc.args.policy, xpv1.ManagementActionLateInitialize) || contains(tc.args.policy, xpv1.ManagementActionAll)
+			}
+			if shouldLateInitialize != tc.want.shouldLateInitialize {
+				t.Errorf("ShouldLateInitialize() = %v, want %v", shouldLateInitialize, tc.want.shouldLateInitialize)
+			}
+		})
+	}
+}
+
+func TestObserve_DeletionMonitoring(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		obs managed.ExternalObservation
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "ResourceBeingDeleted",
+			args: args{
+				mg: namespacedDisposableRequestWithDeletion(),
+			},
+			want: want{
+				obs: managed.ExternalObservation{
+					ResourceExists: false,
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			got, err := e.Observe(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Observe(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.obs, got); diff != "" {
+				t.Errorf("Observe(...): -want, +got: %s", diff)
+			}
+		})
+	}
+}
+
+func TestTLSConfiguration(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "TLSConfigAcceptedWithNilTLS",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the actual TLS config loading is handled by the service layer
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedDisposableRequestWithTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+		{
+			name: "InsecureSkipTLSVerifyAccepted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the controller should handle insecure skip verify
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "insecure success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedDisposableRequestWithInsecureSkipTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+		{
+			name: "TLSConfigWithClientCertsAccepted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the service layer handles TLS config merging
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "client cert success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedDisposableRequestWithResourceTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			_, err := e.Create(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Create(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+// namespacedDisposableRequestWithTLS creates a DisposableRequest with TLS configuration
+func namespacedDisposableRequestWithTLS() *v1alpha2.DisposableRequest {
+	return namespacedDisposableRequest(func(cr *v1alpha2.DisposableRequest) {
+		cr.Spec.ForProvider.TLSConfig = &common.TLSConfig{
+			CACertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "ca-cert-secret",
+					Namespace: "default",
+				},
+				Key: "ca.crt",
+			},
+		}
+	})
+}
+
+// namespacedDisposableRequestWithInsecureSkipTLS creates a DisposableRequest with insecureSkipTLSVerify
+func namespacedDisposableRequestWithInsecureSkipTLS() *v1alpha2.DisposableRequest {
+	return namespacedDisposableRequest(func(cr *v1alpha2.DisposableRequest) {
+		cr.Spec.ForProvider.InsecureSkipTLSVerify = true
+	})
+}
+
+// namespacedDisposableRequestWithResourceTLS creates a DisposableRequest with resource-level TLS config
+func namespacedDisposableRequestWithResourceTLS() *v1alpha2.DisposableRequest {
+	return namespacedDisposableRequest(func(cr *v1alpha2.DisposableRequest) {
+		cr.Spec.ForProvider.TLSConfig = &common.TLSConfig{
+			ClientCertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "client-cert-secret",
+					Namespace: "default",
+				},
+				Key: "tls.crt",
+			},
+			ClientKeySecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "client-cert-secret",
+					Namespace: "default",
+				},
+				Key: "tls.key",
+			},
+		}
+	})
+}
+
+func TestNamespacedDisposableRequestManagementPolicies(t *testing.T) {
+	cases := map[string]struct {
+		reason string
+		mg     *v1alpha2.DisposableRequest
+		want   xpv1.ManagementPolicies
+	}{
+		"DefaultManagementPolicies": {
+			reason: "Default management policies should be nil when not explicitly set",
+			mg: func() *v1alpha2.DisposableRequest {
+				r := httpNamespacedDisposableRequest()
+				// Don't set managementPolicies explicitly to test default
+				return r
+			}(),
+			want: nil,
+		},
+		"ObserveOnlyManagementPolicies": {
+			reason: "Observe-only management policies should only allow observation",
+			mg: func() *v1alpha2.DisposableRequest {
+				r := httpNamespacedDisposableRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{xpv1.ManagementActionObserve}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{xpv1.ManagementActionObserve},
+		},
+		"CreateAndUpdateManagementPolicies": {
+			reason: "Create and update management policies should allow creation and updates",
+			mg: func() *v1alpha2.DisposableRequest {
+				r := httpNamespacedDisposableRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{
+					xpv1.ManagementActionCreate,
+					xpv1.ManagementActionUpdate,
+				}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{
+				xpv1.ManagementActionCreate,
+				xpv1.ManagementActionUpdate,
+			},
+		},
+		"ObserveCreateUpdateManagementPolicies": {
+			reason: "Observe, create, and update management policies should allow all three actions",
+			mg: func() *v1alpha2.DisposableRequest {
+				r := httpNamespacedDisposableRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{
+					xpv1.ManagementActionObserve,
+					xpv1.ManagementActionCreate,
+					xpv1.ManagementActionUpdate,
+				}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{
+				xpv1.ManagementActionObserve,
+				xpv1.ManagementActionCreate,
+				xpv1.ManagementActionUpdate,
+			},
+		},
+		"AllActionsExceptDeleteManagementPolicies": {
+			reason: "All actions except delete should allow observe, create, update, and late initialize",
+			mg: func() *v1alpha2.DisposableRequest {
+				r := httpNamespacedDisposableRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{
+					xpv1.ManagementActionObserve,
+					xpv1.ManagementActionCreate,
+					xpv1.ManagementActionUpdate,
+					xpv1.ManagementActionLateInitialize,
+				}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{
+				xpv1.ManagementActionObserve,
+				xpv1.ManagementActionCreate,
+				xpv1.ManagementActionUpdate,
+				xpv1.ManagementActionLateInitialize,
+			},
+		},
+		"ExplicitAllManagementPolicies": {
+			reason: "Explicit all management policies should allow all actions",
+			mg: func() *v1alpha2.DisposableRequest {
+				r := httpNamespacedDisposableRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{xpv1.ManagementActionAll}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{xpv1.ManagementActionAll},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			got := tc.mg.Spec.ManagementPolicies
+			if diff := cmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("\n%s\nManagementPolicies: -want, +got:\n%s", tc.reason, diff)
+			}
+		})
+	}
+}
diff --git a/internal/controller/namespaced/namespaced.go b/internal/controller/namespaced/namespaced.go
new file mode 100644
index 0000000..0c5f81d
--- /dev/null
+++ b/internal/controller/namespaced/namespaced.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2020 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package namespaced
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	namespaceddisposablerequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/disposablerequest/v1alpha2"
+	namespacedrequestv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/request/v1alpha2"
+	namespacedv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/internal/controller/namespaced/config"
+	"github.com/crossplane-contrib/provider-http/internal/controller/namespaced/disposablerequest"
+	"github.com/crossplane-contrib/provider-http/internal/controller/namespaced/request"
+)
+
+// Setup creates all namespaced http controllers with the supplied logger and adds them to
+// the supplied manager.
+func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	for _, setup := range []func(ctrl.Manager, controller.Options, time.Duration) error{
+		config.Setup,
+		config.SetupCluster,
+		disposablerequest.Setup,
+		request.Setup,
+	} {
+		if err := setup(mgr, o, timeout); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SetupGated creates all namespaced http controllers with SafeStart capability (controllers start as their CRDs appear)
+func SetupGated(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	// Register controllers with gate - they'll start when their CRDs are available
+	o.Gate.Register(func() {
+		if err := config.Setup(mgr, o, timeout); err != nil {
+			panic(err)
+		}
+	}, namespacedv1alpha2.ProviderConfigGroupVersionKind)
+
+	o.Gate.Register(func() {
+		if err := config.SetupCluster(mgr, o, timeout); err != nil {
+			panic(err)
+		}
+	}, namespacedv1alpha2.ClusterProviderConfigGroupVersionKind)
+
+	o.Gate.Register(func() {
+		if err := disposablerequest.Setup(mgr, o, timeout); err != nil {
+			panic(err)
+		}
+	}, namespaceddisposablerequestv1alpha2.DisposableRequestGroupVersionKind)
+
+	o.Gate.Register(func() {
+		if err := request.Setup(mgr, o, timeout); err != nil {
+			panic(err)
+		}
+	}, namespacedrequestv1alpha2.RequestGroupVersionKind)
+
+	return nil
+}
diff --git a/internal/controller/namespaced/request/request.go b/internal/controller/namespaced/request/request.go
new file mode 100644
index 0000000..69d0c2d
--- /dev/null
+++ b/internal/controller/namespaced/request/request.go
@@ -0,0 +1,297 @@
+/*
+Copyright 2024 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package request
+
+import (
+	"context"
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/meta"
+	"github.com/pkg/errors"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/event"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+
+	"github.com/crossplane-contrib/provider-http/apis/namespaced/request/v1alpha2"
+	apisv1alpha2 "github.com/crossplane-contrib/provider-http/apis/namespaced/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
+	"github.com/crossplane-contrib/provider-http/internal/service"
+	"github.com/crossplane-contrib/provider-http/internal/service/request"
+	"github.com/crossplane-contrib/provider-http/internal/service/request/observe"
+	"github.com/crossplane-contrib/provider-http/internal/service/request/statushandler"
+	"github.com/crossplane-contrib/provider-http/internal/utils"
+)
+
+const (
+	errNotRequest              = "managed resource is not a namespaced Request custom resource"
+	errTrackPCUsage            = "cannot track ProviderConfig usage"
+	errNewHttpClient           = "cannot create new Http client"
+	errFailedToSendHttpRequest = "something went wrong"
+	errFailedToCheckIfUpToDate = "failed to check if request is up to date"
+	errGetLatestVersion        = "failed to get the latest version of the resource"
+	errExtractCredentials      = "cannot extract credentials"
+
+	errGetPC  = "cannot get ProviderConfig"
+	errGetCPC = "cannot get ClusterProviderConfig"
+)
+
+// Setup adds a controller that reconciles namespaced Request managed resources.
+func Setup(mgr ctrl.Manager, o controller.Options, timeout time.Duration) error {
+	name := managed.ControllerName(v1alpha2.RequestGroupKind)
+
+	reconcilerOptions := []managed.ReconcilerOption{
+		managed.WithExternalConnecter(&connector{
+			logger:          o.Logger,
+			kube:            mgr.GetClient(),
+			usage:           resource.NewProviderConfigUsageTracker(mgr.GetClient(), &apisv1alpha2.ProviderConfigUsage{}),
+			newHttpClientFn: httpClient.NewClient,
+		}),
+		managed.WithLogger(o.Logger.WithValues("controller", name)),
+		managed.WithPollInterval(o.PollInterval),
+		managed.WithTimeout(timeout),
+		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
+	}
+
+	if o.Features.Enabled(feature.EnableBetaManagementPolicies) {
+		reconcilerOptions = append(reconcilerOptions, managed.WithManagementPolicies())
+	}
+
+	r := managed.NewReconciler(mgr,
+		resource.ManagedKind(v1alpha2.RequestGroupVersionKind),
+		reconcilerOptions...,
+	)
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		WithEventFilter(resource.DesiredStateChanged()).
+		For(&v1alpha2.Request{}).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
+
+// A connector is expected to produce an ExternalClient when its Connect method
+// is called.
+type connector struct {
+	logger          logging.Logger
+	kube            client.Client
+	usage           *resource.ProviderConfigUsageTracker
+	newHttpClientFn func(log logging.Logger, timeout time.Duration, creds string) (httpClient.Client, error)
+}
+
+// Connect creates a new external client using the provider config.
+func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.ExternalClient, error) {
+	cr, ok := mg.(*v1alpha2.Request)
+	if !ok {
+		return nil, errors.New(errNotRequest)
+	}
+
+	l := c.logger.WithValues("namespacedRequest", cr.Name)
+
+	if err := c.usage.Track(ctx, cr); err != nil {
+		return nil, errors.Wrap(err, errTrackPCUsage)
+	}
+
+	// Set default providerConfigRef if not specified
+	if cr.GetProviderConfigReference() == nil {
+		cr.SetProviderConfigReference(&xpv1.ProviderConfigReference{
+			Name: "default",
+			Kind: "ClusterProviderConfig",
+		})
+		l.Debug("No providerConfigRef specified, defaulting to 'default'")
+	}
+
+	var cd apisv1alpha2.ProviderCredentials
+	var providerTLS *common.TLSConfig
+
+	// Switch to ModernManaged resource to get ProviderConfigRef
+	m := mg.(resource.ModernManaged)
+	ref := m.GetProviderConfigReference()
+
+	switch ref.Kind {
+	case "ProviderConfig":
+		pc := &apisv1alpha2.ProviderConfig{}
+		if err := c.kube.Get(ctx, types.NamespacedName{Name: ref.Name, Namespace: m.GetNamespace()}, pc); err != nil {
+			return nil, errors.Wrap(err, errGetPC)
+		}
+		cd = pc.Spec.Credentials
+		providerTLS = pc.Spec.TLS
+	case "ClusterProviderConfig":
+		cpc := &apisv1alpha2.ClusterProviderConfig{}
+		if err := c.kube.Get(ctx, types.NamespacedName{Name: ref.Name}, cpc); err != nil {
+			return nil, errors.Wrap(err, errGetCPC)
+		}
+		cd = cpc.Spec.Credentials
+		providerTLS = cpc.Spec.TLS
+	default:
+		return nil, errors.Errorf("unsupported provider config kind: %s", ref.Kind)
+	}
+
+	data, err := resource.CommonCredentialExtractor(ctx, cd.Source, c.kube, cd.CommonCredentialSelectors)
+	if err != nil {
+		return nil, errors.Wrap(err, errExtractCredentials)
+	}
+
+	h, err := c.newHttpClientFn(l, utils.WaitTimeout(cr.Spec.ForProvider.WaitTimeout), string(data))
+	if err != nil {
+		return nil, errors.Wrap(err, errNewHttpClient)
+	}
+
+	// Merge TLS configs: resource-level overrides provider-level
+	mergedTLSConfig := httpClient.MergeTLSConfigs(cr.Spec.ForProvider.TLSConfig, providerTLS)
+
+	// Apply InsecureSkipTLSVerify from Request spec if set
+	if cr.Spec.ForProvider.InsecureSkipTLSVerify {
+		if mergedTLSConfig == nil {
+			mergedTLSConfig = &common.TLSConfig{}
+		}
+		mergedTLSConfig.InsecureSkipVerify = true
+	}
+
+	// Load TLS configuration from secrets
+	tlsConfigData, err := httpClient.LoadTLSConfig(ctx, c.kube, mergedTLSConfig)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to load TLS configuration")
+	}
+
+	return &external{
+		localKube:     c.kube,
+		logger:        l,
+		http:          h,
+		tlsConfigData: tlsConfigData,
+	}, nil
+}
+
+// An ExternalClient observes, then either creates, updates, or deletes an
+// external resource to ensure it reflects the managed resource's desired state.
+type external struct {
+	localKube     client.Client
+	logger        logging.Logger
+	http          httpClient.Client
+	tlsConfigData *httpClient.TLSConfigData
+}
+
+func (c *external) Observe(ctx context.Context, mg resource.Managed) (managed.ExternalObservation, error) {
+	cr, ok := mg.(*v1alpha2.Request)
+	if !ok {
+		return managed.ExternalObservation{}, errors.New(errNotRequest)
+	}
+
+	if meta.WasDeleted(mg) {
+		c.logger.Debug("Request is being deleted, skipping observation")
+		return managed.ExternalObservation{
+			ResourceExists: false,
+		}, nil
+	}
+
+	svcCtx := service.NewServiceContext(ctx, c.localKube, c.logger, c.http, c.tlsConfigData)
+	crCtx := service.NewRequestCRContext(cr)
+	observeRequestDetails, err := request.IsUpToDate(svcCtx, crCtx)
+	if err != nil && err.Error() == observe.ErrObjectNotFound {
+		return managed.ExternalObservation{
+			ResourceExists: false,
+		}, nil
+	}
+
+	if err != nil {
+		return managed.ExternalObservation{}, errors.Wrap(err, errFailedToCheckIfUpToDate)
+	}
+
+	statusHandler, err := statushandler.NewStatusHandler(svcCtx, crCtx, observeRequestDetails.Details, observeRequestDetails.ResponseError)
+	if err != nil {
+		return managed.ExternalObservation{}, err
+	}
+
+	synced := observeRequestDetails.Synced
+	if synced {
+		statusHandler.ResetFailures()
+	}
+
+	cr.Status.SetConditions(xpv1.Available())
+	err = statusHandler.SetRequestStatus()
+	if err != nil {
+		return managed.ExternalObservation{}, errors.Wrap(err, " failed updating status")
+	}
+
+	return managed.ExternalObservation{
+		ResourceExists:    true,
+		ResourceUpToDate:  synced,
+		ConnectionDetails: nil,
+	}, nil
+}
+
+func (c *external) Create(ctx context.Context, mg resource.Managed) (managed.ExternalCreation, error) {
+	cr, ok := mg.(*v1alpha2.Request)
+	if !ok {
+		return managed.ExternalCreation{}, errors.New(errNotRequest)
+	}
+
+	// Get the latest version of the resource before deploying
+	if err := c.localKube.Get(ctx, types.NamespacedName{Name: cr.Name, Namespace: cr.Namespace}, cr); err != nil {
+		return managed.ExternalCreation{}, errors.Wrap(err, errGetLatestVersion)
+	}
+
+	svcCtx := service.NewServiceContext(ctx, c.localKube, c.logger, c.http, c.tlsConfigData)
+	crCtx := service.NewRequestCRContext(cr)
+	return managed.ExternalCreation{}, errors.Wrap(request.DeployAction(svcCtx, crCtx, v1alpha2.ActionCreate), errFailedToSendHttpRequest)
+}
+
+func (c *external) Update(ctx context.Context, mg resource.Managed) (managed.ExternalUpdate, error) {
+	cr, ok := mg.(*v1alpha2.Request)
+	if !ok {
+		return managed.ExternalUpdate{}, errors.New(errNotRequest)
+	}
+
+	// Get the latest version of the resource before deploying
+	if err := c.localKube.Get(ctx, types.NamespacedName{Name: cr.Name, Namespace: cr.Namespace}, cr); err != nil {
+		return managed.ExternalUpdate{}, errors.Wrap(err, errGetLatestVersion)
+	}
+
+	svcCtx := service.NewServiceContext(ctx, c.localKube, c.logger, c.http, c.tlsConfigData)
+	crCtx := service.NewRequestCRContext(cr)
+	return managed.ExternalUpdate{}, errors.Wrap(request.DeployAction(svcCtx, crCtx, v1alpha2.ActionUpdate), errFailedToSendHttpRequest)
+}
+
+func (c *external) Delete(ctx context.Context, mg resource.Managed) (managed.ExternalDelete, error) {
+	cr, ok := mg.(*v1alpha2.Request)
+	if !ok {
+		return managed.ExternalDelete{}, errors.New(errNotRequest)
+	}
+
+	// Get the latest version of the resource before deploying
+	if err := c.localKube.Get(ctx, types.NamespacedName{Name: cr.Name, Namespace: cr.Namespace}, cr); err != nil {
+		return managed.ExternalDelete{}, errors.Wrap(err, errGetLatestVersion)
+	}
+
+	svcCtx := service.NewServiceContext(ctx, c.localKube, c.logger, c.http, c.tlsConfigData)
+	crCtx := service.NewRequestCRContext(cr)
+	return managed.ExternalDelete{}, errors.Wrap(request.DeployAction(svcCtx, crCtx, v1alpha2.ActionRemove), errFailedToSendHttpRequest)
+}
+
+// Disconnect does nothing. It never returns an error.
+func (c *external) Disconnect(_ context.Context) error {
+	return nil
+}
diff --git a/internal/controller/namespaced/request/request_test.go b/internal/controller/namespaced/request/request_test.go
new file mode 100644
index 0000000..3255816
--- /dev/null
+++ b/internal/controller/namespaced/request/request_test.go
@@ -0,0 +1,1020 @@
+package request
+
+import (
+	"context"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	"github.com/crossplane-contrib/provider-http/apis/namespaced/request/v1alpha2"
+	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
+	"github.com/google/go-cmp/cmp"
+	"github.com/pkg/errors"
+)
+
+var (
+	errBoom = errors.New("boom")
+)
+
+const (
+	providerName              = "http-test"
+	testNamespacedRequestName = "test-request"
+	testNamespace             = "testns"
+)
+
+var (
+	testPostMapping = v1alpha2.Mapping{
+		Method: "POST",
+		Body:   "{ username: .payload.body.username, email: .payload.body.email }",
+		URL:    ".payload.baseUrl",
+	}
+
+	testPutMapping = v1alpha2.Mapping{
+		Method: "PUT",
+		Body:   "{ username: \"john_doe_new_username\" }",
+		URL:    "(.payload.baseUrl + \"/\" + .response.body.id)",
+	}
+
+	testGetMapping = v1alpha2.Mapping{
+		Method: "GET",
+		URL:    "(.payload.baseUrl + \"/\" + .response.body.id)",
+	}
+
+	testDeleteMapping = v1alpha2.Mapping{
+		Method: "DELETE",
+		URL:    "(.payload.baseUrl + \"/\" + .response.body.id)",
+	}
+)
+
+var (
+	testForProvider = v1alpha2.RequestParameters{
+		Payload: v1alpha2.Payload{
+			Body:    "{\"username\": \"john_doe\", \"email\": \"john.doe@example.com\"}",
+			BaseUrl: "https://api.example.com/users",
+		},
+		Mappings: []v1alpha2.Mapping{
+			testPostMapping,
+			testGetMapping,
+			testPutMapping,
+			testDeleteMapping,
+		},
+	}
+)
+
+type MockSendRequestFn func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error)
+
+type MockSendRequestWithTLSFn func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfig *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error)
+
+type MockHttpClient struct {
+	MockSendRequest        MockSendRequestFn
+	MockSendRequestWithTLS MockSendRequestWithTLSFn
+}
+
+func (m *MockHttpClient) SendRequest(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+	return m.MockSendRequest(ctx, method, url, body, headers, tlsConfigData)
+}
+
+func (m *MockHttpClient) SendRequestWithTLS(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfig *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+	if m.MockSendRequestWithTLS != nil {
+		return m.MockSendRequestWithTLS(ctx, method, url, body, headers, tlsConfig)
+	}
+	// Fallback to SendRequest for backward compatibility
+	return m.MockSendRequest(ctx, method, url, body, headers, tlsConfig)
+}
+
+type httpNamespacedRequestModifier func(request *v1alpha2.Request)
+
+func httpNamespacedRequest(rm ...httpNamespacedRequestModifier) *v1alpha2.Request {
+	r := &v1alpha2.Request{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      testNamespacedRequestName,
+			Namespace: testNamespace,
+		},
+		Spec: v1alpha2.RequestSpec{
+			ForProvider: testForProvider,
+		},
+		Status: v1alpha2.RequestStatus{
+			Response: v1alpha2.Response{
+				Body:       `{"id": "123"}`,
+				StatusCode: 200,
+			},
+		},
+	}
+
+	for _, m := range rm {
+		m(r)
+	}
+
+	return r
+}
+
+type notNamespacedRequest struct {
+	resource.Managed
+}
+
+func namespacedRequest(modifiers ...func(*v1alpha2.Request)) *v1alpha2.Request {
+	cr := &v1alpha2.Request{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-request",
+			Namespace: "default",
+		},
+		Spec: v1alpha2.RequestSpec{
+			ForProvider: v1alpha2.RequestParameters{
+				Payload: v1alpha2.Payload{
+					Body:    `{"test": true}`,
+					BaseUrl: "http://example.com/test",
+				},
+				Mappings: []v1alpha2.Mapping{
+					{
+						Method: "POST",
+						Action: "CREATE",
+						URL:    ".payload.baseUrl",
+						Body:   ".payload.body",
+					},
+					{
+						Method: "GET",
+						Action: "OBSERVE",
+						URL:    ".payload.baseUrl",
+					},
+				},
+			},
+		},
+	}
+
+	for _, modifier := range modifiers {
+		modifier(cr)
+	}
+
+	return cr
+}
+
+func namespacedRequestWithDeletion() *v1alpha2.Request {
+	now := metav1.Now()
+	return namespacedRequest(func(cr *v1alpha2.Request) {
+		cr.DeletionTimestamp = &now
+	})
+}
+
+func TestObserve(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		obs managed.ExternalObservation
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "NotNamespacedRequest",
+			args: args{
+				mg: notNamespacedRequest{},
+			},
+			want: want{
+				err: errors.New(errNotRequest),
+			},
+		},
+		{
+			name: "ResourceBeingDeleted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, errors.New("resource not found")
+					},
+				},
+				localKube: &test.MockClient{
+					MockGet:          test.NewMockGetFn(nil),
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+				},
+				mg: namespacedRequestWithDeletion(),
+			},
+			want: want{
+				obs: managed.ExternalObservation{
+					ResourceExists: false,
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			got, err := e.Observe(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Observe(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.obs, got); diff != "" {
+				t.Errorf("Observe(...): -want, +got: %s", diff)
+			}
+		})
+	}
+}
+
+func TestCreate(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "NotRequestResource",
+			args: args{
+				mg: notNamespacedRequest{},
+			},
+			want: want{
+				err: errors.New(errNotRequest),
+			},
+		},
+		{
+			name: "RequestFailed",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, errBoom
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: httpNamespacedRequest(),
+			},
+			want: want{
+				err: errors.Wrap(errBoom, errFailedToSendHttpRequest),
+			},
+		},
+		{
+			name: "Success",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockCreate:       test.NewMockCreateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: httpNamespacedRequest(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+	for _, tc := range cases {
+		tc := tc // Create local copies of loop variables
+
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				localKube: tc.args.localKube,
+				logger:    logging.NewNopLogger(),
+				http:      tc.args.http,
+			}
+			_, gotErr := e.Create(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
+				t.Fatalf("e.Create(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+func TestUpdate(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "NotRequestResource",
+			args: args{
+				mg: notNamespacedRequest{},
+			},
+			want: want{
+				err: errors.New(errNotRequest),
+			},
+		},
+		{
+			name: "RequestFailed",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, errBoom
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: httpNamespacedRequest(),
+			},
+			want: want{
+				err: errors.Wrap(errBoom, errFailedToSendHttpRequest),
+			},
+		},
+		{
+			name: "Success",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockCreate:       test.NewMockCreateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: httpNamespacedRequest(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+	for _, tc := range cases {
+		tc := tc // Create local copies of loop variables
+
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				localKube: tc.args.localKube,
+				logger:    logging.NewNopLogger(),
+				http:      tc.args.http,
+			}
+			_, gotErr := e.Update(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
+				t.Fatalf("e.Update(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+func TestDelete(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "NotRequestResource",
+			args: args{
+				mg: notNamespacedRequest{},
+			},
+			want: want{
+				err: errors.New(errNotRequest),
+			},
+		},
+		{
+			name: "RequestFailed",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, errBoom
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: httpNamespacedRequest(),
+			},
+			want: want{
+				err: errors.Wrap(errBoom, errFailedToSendHttpRequest),
+			},
+		},
+		{
+			name: "Success",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body httpClient.Data, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						return httpClient.HttpDetails{}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockCreate:       test.NewMockCreateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: httpNamespacedRequest(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+	for _, tc := range cases {
+		tc := tc // Create local copies of loop variables
+
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				localKube: tc.args.localKube,
+				logger:    logging.NewNopLogger(),
+				http:      tc.args.http,
+			}
+			_, gotErr := e.Delete(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
+				t.Fatalf("e.Delete(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+func TestManagementPoliciesFeatureFlag(t *testing.T) {
+	cases := map[string]struct {
+		reason   string
+		features *feature.Flags
+		want     bool
+	}{
+		"ManagementPoliciesEnabled": {
+			reason: "Feature flag should be enabled when explicitly set",
+			features: func() *feature.Flags {
+				f := &feature.Flags{}
+				f.Enable(feature.EnableBetaManagementPolicies)
+				return f
+			}(),
+			want: true,
+		},
+		"ManagementPoliciesDisabled": {
+			reason:   "Feature flag should be disabled when not set",
+			features: &feature.Flags{},
+			want:     false,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			enabled := tc.features.Enabled(feature.EnableBetaManagementPolicies)
+			if enabled != tc.want {
+				t.Errorf("\n%s\nEnabled(feature.EnableBetaManagementPolicies): want %v, got %v", tc.reason, tc.want, enabled)
+			}
+		})
+	}
+}
+
+func TestNamespacedRequestManagementPolicies(t *testing.T) {
+	cases := map[string]struct {
+		reason string
+		mg     *v1alpha2.Request
+		want   xpv1.ManagementPolicies
+	}{
+		"DefaultManagementPolicies": {
+			reason: "Default management policies should be nil when not explicitly set",
+			mg: func() *v1alpha2.Request {
+				r := httpNamespacedRequest()
+				// Don't set managementPolicies explicitly to test default
+				return r
+			}(),
+			want: nil,
+		},
+		"ObserveOnlyManagementPolicies": {
+			reason: "Observe-only management policies should only allow observation",
+			mg: func() *v1alpha2.Request {
+				r := httpNamespacedRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{xpv1.ManagementActionObserve}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{xpv1.ManagementActionObserve},
+		},
+		"CreateAndUpdateManagementPolicies": {
+			reason: "Create and update management policies should allow creation and updates",
+			mg: func() *v1alpha2.Request {
+				r := httpNamespacedRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{
+					xpv1.ManagementActionCreate,
+					xpv1.ManagementActionUpdate,
+				}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{
+				xpv1.ManagementActionCreate,
+				xpv1.ManagementActionUpdate,
+			},
+		},
+		"ObserveCreateUpdateManagementPolicies": {
+			reason: "Observe, create, and update management policies should allow all three actions",
+			mg: func() *v1alpha2.Request {
+				r := httpNamespacedRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{
+					xpv1.ManagementActionObserve,
+					xpv1.ManagementActionCreate,
+					xpv1.ManagementActionUpdate,
+				}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{
+				xpv1.ManagementActionObserve,
+				xpv1.ManagementActionCreate,
+				xpv1.ManagementActionUpdate,
+			},
+		},
+		"AllActionsExceptDeleteManagementPolicies": {
+			reason: "All actions except delete should allow observe, create, update, and late initialize",
+			mg: func() *v1alpha2.Request {
+				r := httpNamespacedRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{
+					xpv1.ManagementActionObserve,
+					xpv1.ManagementActionCreate,
+					xpv1.ManagementActionUpdate,
+					xpv1.ManagementActionLateInitialize,
+				}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{
+				xpv1.ManagementActionObserve,
+				xpv1.ManagementActionCreate,
+				xpv1.ManagementActionUpdate,
+				xpv1.ManagementActionLateInitialize,
+			},
+		},
+		"ExplicitAllManagementPolicies": {
+			reason: "Explicit all management policies should allow all actions",
+			mg: func() *v1alpha2.Request {
+				r := httpNamespacedRequest()
+				r.Spec.ManagementPolicies = xpv1.ManagementPolicies{xpv1.ManagementActionAll}
+				return r
+			}(),
+			want: xpv1.ManagementPolicies{xpv1.ManagementActionAll},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			got := tc.mg.Spec.ManagementPolicies
+			if diff := cmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("\n%s\nManagementPolicies: -want, +got:\n%s", tc.reason, diff)
+			}
+		})
+	}
+}
+
+func TestNamespacedRequestManagementPoliciesResolver(t *testing.T) {
+	type args struct {
+		enabled bool
+		policy  xpv1.ManagementPolicies
+	}
+	type want struct {
+		shouldCreate         bool
+		shouldUpdate         bool
+		shouldDelete         bool
+		shouldOnlyObserve    bool
+		shouldLateInitialize bool
+	}
+
+	cases := map[string]struct {
+		reason string
+		args   args
+		want   want
+	}{
+		"ManagementPoliciesDisabled": {
+			reason: "When management policies are disabled, all actions should be allowed",
+			args: args{
+				enabled: false,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionObserve},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         true,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: true,
+			},
+		},
+		"ObserveOnlyPolicy": {
+			reason: "Observe-only policy should only allow observation",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionObserve},
+			},
+			want: want{
+				shouldCreate:         false,
+				shouldUpdate:         false,
+				shouldDelete:         false,
+				shouldOnlyObserve:    true,
+				shouldLateInitialize: false,
+			},
+		},
+		"CreateOnlyPolicy": {
+			reason: "Create-only policy should only allow creation",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionCreate},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         false,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"UpdateOnlyPolicy": {
+			reason: "Update-only policy should only allow updates",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionUpdate},
+			},
+			want: want{
+				shouldCreate:         false,
+				shouldUpdate:         true,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"DeleteOnlyPolicy": {
+			reason: "Delete-only policy should only allow deletion",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionDelete},
+			},
+			want: want{
+				shouldCreate:         false,
+				shouldUpdate:         false,
+				shouldDelete:         true,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"CreateAndUpdatePolicy": {
+			reason: "Create and update policy should allow both creation and updates",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionCreate, xpv1.ManagementActionUpdate},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"ObserveCreateUpdatePolicy": {
+			reason: "Observe, create, and update policy should allow all three actions",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionObserve, xpv1.ManagementActionCreate, xpv1.ManagementActionUpdate},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: false,
+			},
+		},
+		"AllActionsExceptDeletePolicy": {
+			reason: "All actions except delete should allow observe, create, update, and late initialize",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionObserve, xpv1.ManagementActionCreate, xpv1.ManagementActionUpdate, xpv1.ManagementActionLateInitialize},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         false,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: true,
+			},
+		},
+		"ExplicitAllPolicy": {
+			reason: "Explicit all policy should allow all actions",
+			args: args{
+				enabled: true,
+				policy:  xpv1.ManagementPolicies{xpv1.ManagementActionAll},
+			},
+			want: want{
+				shouldCreate:         true,
+				shouldUpdate:         true,
+				shouldDelete:         true,
+				shouldOnlyObserve:    false,
+				shouldLateInitialize: true,
+			},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			// Create a mock managed resource with the specified management policies
+			mg := httpNamespacedRequest()
+			mg.Spec.ManagementPolicies = tc.args.policy
+
+			// Test the management policies resolver logic
+			// Note: This is a simplified test that focuses on the policy logic
+			// The actual enforcement happens in the Crossplane managed reconciler
+
+			// Helper function to check if a ManagementPolicies slice contains a specific action
+			contains := func(policies xpv1.ManagementPolicies, action xpv1.ManagementAction) bool {
+				for _, p := range policies {
+					if p == action {
+						return true
+					}
+				}
+				return false
+			}
+
+			// Test ShouldCreate
+			shouldCreate := tc.want.shouldCreate
+			if tc.args.enabled {
+				shouldCreate = contains(tc.args.policy, xpv1.ManagementActionCreate) || contains(tc.args.policy, xpv1.ManagementActionAll)
+			}
+			if shouldCreate != tc.want.shouldCreate {
+				t.Errorf("ShouldCreate() = %v, want %v", shouldCreate, tc.want.shouldCreate)
+			}
+
+			// Test ShouldUpdate
+			shouldUpdate := tc.want.shouldUpdate
+			if tc.args.enabled {
+				shouldUpdate = contains(tc.args.policy, xpv1.ManagementActionUpdate) || contains(tc.args.policy, xpv1.ManagementActionAll)
+			}
+			if shouldUpdate != tc.want.shouldUpdate {
+				t.Errorf("ShouldUpdate() = %v, want %v", shouldUpdate, tc.want.shouldUpdate)
+			}
+
+			// Test ShouldDelete
+			shouldDelete := tc.want.shouldDelete
+			if tc.args.enabled {
+				shouldDelete = contains(tc.args.policy, xpv1.ManagementActionDelete) || contains(tc.args.policy, xpv1.ManagementActionAll)
+			}
+			if shouldDelete != tc.want.shouldDelete {
+				t.Errorf("ShouldDelete() = %v, want %v", shouldDelete, tc.want.shouldDelete)
+			}
+
+			// Test ShouldOnlyObserve
+			shouldOnlyObserve := tc.want.shouldOnlyObserve
+			if tc.args.enabled {
+				shouldOnlyObserve = len(tc.args.policy) == 1 && contains(tc.args.policy, xpv1.ManagementActionObserve)
+			}
+			if shouldOnlyObserve != tc.want.shouldOnlyObserve {
+				t.Errorf("ShouldOnlyObserve() = %v, want %v", shouldOnlyObserve, tc.want.shouldOnlyObserve)
+			}
+
+			// Test ShouldLateInitialize
+			shouldLateInitialize := tc.want.shouldLateInitialize
+			if tc.args.enabled {
+				shouldLateInitialize = contains(tc.args.policy, xpv1.ManagementActionLateInitialize) || contains(tc.args.policy, xpv1.ManagementActionAll)
+			}
+			if shouldLateInitialize != tc.want.shouldLateInitialize {
+				t.Errorf("ShouldLateInitialize() = %v, want %v", shouldLateInitialize, tc.want.shouldLateInitialize)
+			}
+		})
+	}
+}
+
+func httpNamespacedRequestWithDeletion() *v1alpha2.Request {
+	now := metav1.Now()
+	return httpNamespacedRequest(func(r *v1alpha2.Request) {
+		r.DeletionTimestamp = &now
+	})
+}
+
+func TestTLSConfiguration(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "TLSConfigAcceptedWithNilTLS",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the actual TLS config loading is handled by the service layer
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedRequestWithTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+		{
+			name: "InsecureSkipTLSVerifyAccepted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the controller should handle insecure skip verify
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "insecure success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedRequestWithInsecureSkipTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+		{
+			name: "TLSConfigWithClientCertsAccepted",
+			args: args{
+				http: &MockHttpClient{
+					MockSendRequest: func(ctx context.Context, method string, url string, body, headers httpClient.Data, tlsConfigData *httpClient.TLSConfigData) (resp httpClient.HttpDetails, err error) {
+						// Accept any TLS config - the service layer handles TLS config merging
+						return httpClient.HttpDetails{
+							HttpResponse: httpClient.HttpResponse{
+								StatusCode: 200,
+								Body:       `{"result": "client cert success"}`,
+							},
+						}, nil
+					},
+				},
+				localKube: &test.MockClient{
+					MockStatusUpdate: test.NewMockSubResourceUpdateFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+				},
+				mg: namespacedRequestWithMutualTLS(),
+			},
+			want: want{
+				err: nil,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			_, err := e.Create(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Create(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+// namespacedRequestWithTLS creates a Request with TLS configuration
+func namespacedRequestWithTLS() *v1alpha2.Request {
+	return namespacedRequest(func(cr *v1alpha2.Request) {
+		cr.Spec.ForProvider.TLSConfig = &common.TLSConfig{
+			CACertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "ca-cert-secret",
+					Namespace: "default",
+				},
+				Key: "ca.crt",
+			},
+		}
+	})
+}
+
+// namespacedRequestWithInsecureSkipTLS creates a Request with insecureSkipTLSVerify
+func namespacedRequestWithInsecureSkipTLS() *v1alpha2.Request {
+	return namespacedRequest(func(cr *v1alpha2.Request) {
+		cr.Spec.ForProvider.InsecureSkipTLSVerify = true
+	})
+}
+
+// namespacedRequestWithMutualTLS creates a Request with mutual TLS configuration
+func namespacedRequestWithMutualTLS() *v1alpha2.Request {
+	return namespacedRequest(func(cr *v1alpha2.Request) {
+		cr.Spec.ForProvider.TLSConfig = &common.TLSConfig{
+			CACertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "ca-cert-secret",
+					Namespace: "default",
+				},
+				Key: "ca.crt",
+			},
+			ClientCertSecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "client-cert-secret",
+					Namespace: "default",
+				},
+				Key: "tls.crt",
+			},
+			ClientKeySecretRef: &xpv1.SecretKeySelector{
+				SecretReference: xpv1.SecretReference{
+					Name:      "client-cert-secret",
+					Namespace: "default",
+				},
+				Key: "tls.key",
+			},
+		}
+	})
+}
+
+func TestObserve_DeletionMonitoring(t *testing.T) {
+	type args struct {
+		http      httpClient.Client
+		localKube client.Client
+		mg        resource.Managed
+	}
+	type want struct {
+		obs managed.ExternalObservation
+		err error
+	}
+
+	cases := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "ResourceBeingDeleted",
+			args: args{
+				mg: httpNamespacedRequestWithDeletion(),
+			},
+			want: want{
+				obs: managed.ExternalObservation{
+					ResourceExists: false,
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			e := &external{
+				logger:    logging.NewNopLogger(),
+				localKube: tc.args.localKube,
+				http:      tc.args.http,
+			}
+
+			got, err := e.Observe(context.Background(), tc.args.mg)
+			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
+				t.Errorf("Observe(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.obs, got); diff != "" {
+				t.Errorf("Observe(...): -want, +got: %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/data-patcher/parser.go b/internal/data-patcher/parser.go
index b8d63dc..79947e5 100644
--- a/internal/data-patcher/parser.go
+++ b/internal/data-patcher/parser.go
@@ -11,7 +11,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	kubehandler "github.com/crossplane-contrib/provider-http/internal/kube-handler"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 )
 
 const (
diff --git a/internal/data-patcher/parser_test.go b/internal/data-patcher/parser_test.go
index 14b120c..3405ba7 100644
--- a/internal/data-patcher/parser_test.go
+++ b/internal/data-patcher/parser_test.go
@@ -5,8 +5,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/internal/data-patcher/patch.go b/internal/data-patcher/patch.go
index 3c25fdd..8064ede 100644
--- a/internal/data-patcher/patch.go
+++ b/internal/data-patcher/patch.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	"github.com/crossplane-contrib/provider-http/apis/common"
 	"github.com/crossplane-contrib/provider-http/apis/interfaces"
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	kubehandler "github.com/crossplane-contrib/provider-http/internal/kube-handler"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 	"github.com/pkg/errors"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -145,7 +145,13 @@ func ApplyResponseDataToSecrets(ctx context.Context, localKube client.Client, lo
 		var owner metav1.Object = nil
 
 		if ref.SetOwnerReference {
-			owner = cr
+			// Kubernetes disallows cross-namespace owner references
+			// Only set owner reference if the secret is in the same namespace as the owner
+			if cr.GetNamespace() == ref.SecretRef.Namespace {
+				owner = cr
+			} else {
+				logger.Debug(fmt.Sprintf("Skipping owner reference for cross-namespace secret injection: owner in %s, secret in %s", cr.GetNamespace(), ref.SecretRef.Namespace))
+			}
 		}
 
 		// Use the cumulative response for patching (gets updated with secret placeholders)
diff --git a/internal/data-patcher/patch_test.go b/internal/data-patcher/patch_test.go
index 113c55f..9fd792f 100644
--- a/internal/data-patcher/patch_test.go
+++ b/internal/data-patcher/patch_test.go
@@ -4,11 +4,14 @@ import (
 	"context"
 	"testing"
 
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane-contrib/provider-http/apis/common"
+	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -195,3 +198,144 @@ func TestPatchSecretsIntoHeaders(t *testing.T) {
 		})
 	}
 }
+
+func TestApplyResponseDataToSecrets_CrossNamespaceOwnerReference(t *testing.T) {
+	type args struct {
+		ctx           context.Context
+		localKube     client.Client
+		logger        logging.Logger
+		response      *httpClient.HttpResponse
+		secretConfigs []common.SecretInjectionConfig
+		cr            metav1.Object
+	}
+
+	// Mock managed resource for testing
+	mockCR := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-cr",
+			Namespace: "default",
+		},
+	}
+
+	response := &httpClient.HttpResponse{
+		StatusCode: 200,
+		Body:       `{"status": "success", "id": "123"}`,
+		Headers:    map[string][]string{"Content-Type": {"application/json"}},
+	}
+
+	cases := map[string]struct {
+		args args
+	}{
+		"SameNamespaceSecretInjectionWithOwnerReference": {
+			args: args{
+				ctx:    context.Background(),
+				logger: logging.NewNopLogger(),
+				localKube: &test.MockClient{
+					MockGet: func(ctx context.Context, key client.ObjectKey, obj client.Object) error {
+						return errors.New("secret not found") // Simulate secret doesn't exist
+					},
+					MockUpdate: func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+						return nil
+					},
+					MockCreate: func(ctx context.Context, obj client.Object, opts ...client.CreateOption) error {
+						return nil
+					},
+				},
+				response: response,
+				secretConfigs: []common.SecretInjectionConfig{
+					{
+						SecretRef: common.SecretRef{
+							Name:      "test-secret",
+							Namespace: "default", // Same namespace as CR
+						},
+						SetOwnerReference: true,
+						KeyMappings: []common.KeyInjection{
+							{
+								SecretKey:  "result",
+								ResponseJQ: ".status",
+							},
+						},
+					},
+				},
+				cr: mockCR,
+			},
+		},
+		"CrossNamespaceSecretInjectionWithOwnerReferenceIgnored": {
+			args: args{
+				ctx:    context.Background(),
+				logger: logging.NewNopLogger(),
+				localKube: &test.MockClient{
+					MockGet: func(ctx context.Context, key client.ObjectKey, obj client.Object) error {
+						return errors.New("secret not found") // Simulate secret doesn't exist
+					},
+					MockUpdate: func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+						return nil
+					},
+					MockCreate: func(ctx context.Context, obj client.Object, opts ...client.CreateOption) error {
+						return nil
+					},
+				},
+				response: response,
+				secretConfigs: []common.SecretInjectionConfig{
+					{
+						SecretRef: common.SecretRef{
+							Name:      "test-secret",
+							Namespace: "crossplane-system", // Different namespace than CR
+						},
+						SetOwnerReference: true, // This should be ignored
+						KeyMappings: []common.KeyInjection{
+							{
+								SecretKey:  "result",
+								ResponseJQ: ".status",
+							},
+						},
+					},
+				},
+				cr: mockCR,
+			},
+		},
+		"CrossNamespaceSecretInjectionWithoutOwnerReference": {
+			args: args{
+				ctx:    context.Background(),
+				logger: logging.NewNopLogger(),
+				localKube: &test.MockClient{
+					MockGet: func(ctx context.Context, key client.ObjectKey, obj client.Object) error {
+						return errors.New("secret not found") // Simulate secret doesn't exist
+					},
+					MockUpdate: func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+						return nil
+					},
+					MockCreate: func(ctx context.Context, obj client.Object, opts ...client.CreateOption) error {
+						return nil
+					},
+				},
+				response: response,
+				secretConfigs: []common.SecretInjectionConfig{
+					{
+						SecretRef: common.SecretRef{
+							Name:      "test-secret",
+							Namespace: "crossplane-system", // Different namespace than CR
+						},
+						SetOwnerReference: false, // Explicitly disabled
+						KeyMappings: []common.KeyInjection{
+							{
+								SecretKey:  "result",
+								ResponseJQ: ".status",
+							},
+						},
+					},
+				},
+				cr: mockCR,
+			},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			// Test that the function doesn't panic and handles cross-namespace scenarios gracefully
+			ApplyResponseDataToSecrets(tc.args.ctx, tc.args.localKube, tc.args.logger, tc.args.response, tc.args.secretConfigs, tc.args.cr)
+
+			// Test passes if no panic occurs - the cross-namespace logic should handle this gracefully
+		})
+	}
+}
diff --git a/internal/data-patcher/secret_patcher.go b/internal/data-patcher/secret_patcher.go
index a748604..c12707c 100644
--- a/internal/data-patcher/secret_patcher.go
+++ b/internal/data-patcher/secret_patcher.go
@@ -12,7 +12,7 @@ import (
 	"github.com/crossplane-contrib/provider-http/internal/jq"
 	json_util "github.com/crossplane-contrib/provider-http/internal/json"
 	kubehandler "github.com/crossplane-contrib/provider-http/internal/kube-handler"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
diff --git a/internal/data-patcher/secret_patcher_test.go b/internal/data-patcher/secret_patcher_test.go
index f99b3f5..8a02e8f 100644
--- a/internal/data-patcher/secret_patcher_test.go
+++ b/internal/data-patcher/secret_patcher_test.go
@@ -6,7 +6,7 @@ import (
 	"github.com/crossplane-contrib/provider-http/apis/common"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	json_util "github.com/crossplane-contrib/provider-http/internal/json"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 	"github.com/google/go-cmp/cmp"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/internal/jq/parser_test.go b/internal/jq/parser_test.go
index 427079e..1c31e3a 100644
--- a/internal/jq/parser_test.go
+++ b/internal/jq/parser_test.go
@@ -3,7 +3,7 @@ package jq
 import (
 	"testing"
 
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 )
 
diff --git a/internal/json/util_test.go b/internal/json/util_test.go
index 68def0a..ae9fb56 100644
--- a/internal/json/util_test.go
+++ b/internal/json/util_test.go
@@ -3,7 +3,7 @@ package json
 import (
 	"testing"
 
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	"github.com/google/go-cmp/cmp"
 )
 
diff --git a/internal/kube-handler/client_test.go b/internal/kube-handler/client_test.go
index 8a8b31f..a3ffc84 100644
--- a/internal/kube-handler/client_test.go
+++ b/internal/kube-handler/client_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	errorspkg "github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
diff --git a/internal/service/context.go b/internal/service/context.go
index 9c1a248..5db9072 100644
--- a/internal/service/context.go
+++ b/internal/service/context.go
@@ -3,7 +3,7 @@ package service
 import (
 	"context"
 
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
diff --git a/internal/service/disposablerequest/deployaction_test.go b/internal/service/disposablerequest/deployaction_test.go
index fbaeb7b..3be2c04 100644
--- a/internal/service/disposablerequest/deployaction_test.go
+++ b/internal/service/disposablerequest/deployaction_test.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"testing"
 
-	"github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
 	"github.com/crossplane-contrib/provider-http/internal/utils"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/internal/service/disposablerequest/observe.go b/internal/service/disposablerequest/observe.go
index cc091f4..044a80c 100644
--- a/internal/service/disposablerequest/observe.go
+++ b/internal/service/disposablerequest/observe.go
@@ -7,7 +7,7 @@ import (
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	datapatcher "github.com/crossplane-contrib/provider-http/internal/data-patcher"
 	"github.com/crossplane-contrib/provider-http/internal/service"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
diff --git a/internal/service/disposablerequest/observe_test.go b/internal/service/disposablerequest/observe_test.go
index 79fc5d5..0af5f8f 100644
--- a/internal/service/disposablerequest/observe_test.go
+++ b/internal/service/disposablerequest/observe_test.go
@@ -4,11 +4,11 @@ import (
 	"context"
 	"testing"
 
-	"github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
diff --git a/internal/service/disposablerequest/validation_test.go b/internal/service/disposablerequest/validation_test.go
index 0cf9692..a7b41c1 100644
--- a/internal/service/disposablerequest/validation_test.go
+++ b/internal/service/disposablerequest/validation_test.go
@@ -3,9 +3,9 @@ package disposablerequest
 import (
 	"testing"
 
-	"github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 )
 
diff --git a/internal/service/request/deployaction.go b/internal/service/request/deployaction.go
index 080152c..74346d4 100644
--- a/internal/service/request/deployaction.go
+++ b/internal/service/request/deployaction.go
@@ -6,6 +6,7 @@ import (
 	"github.com/crossplane-contrib/provider-http/internal/service/request/requestgen"
 	"github.com/crossplane-contrib/provider-http/internal/service/request/requestmapping"
 	"github.com/crossplane-contrib/provider-http/internal/service/request/statushandler"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/meta"
 )
 
 // DeployAction executes the action based on the given Request resource and Mapping configuration.
@@ -24,9 +25,14 @@ func DeployAction(svcCtx *service.ServiceContext, crCtx *service.RequestCRContex
 
 	details, sendErr := svcCtx.HTTP.SendRequest(svcCtx.Ctx, requestmapping.GetEffectiveMethod(mapping), requestDetails.Url, requestDetails.Body, requestDetails.Headers, svcCtx.TLSConfigData)
 
-	// Apply response data to secrets and update CR status
-	secretConfigs := spec.GetSecretInjectionConfigs()
-	datapatcher.ApplyResponseDataToSecrets(svcCtx.Ctx, svcCtx.LocalKube, svcCtx.Logger, &details.HttpResponse, secretConfigs, crCtx.GetCR())
+	// Skip secret injection during deletion to avoid cross-namespace owner reference issues
+	if !meta.WasDeleted(crCtx.GetCR()) {
+		// Apply response data to secrets and update CR status
+		secretConfigs := spec.GetSecretInjectionConfigs()
+		datapatcher.ApplyResponseDataToSecrets(svcCtx.Ctx, svcCtx.LocalKube, svcCtx.Logger, &details.HttpResponse, secretConfigs, crCtx.GetCR())
+	} else {
+		svcCtx.Logger.Debug("Request is being deleted, skipping secret injection")
+	}
 
 	statusHandler, err := statushandler.NewStatusHandler(svcCtx, crCtx, details, sendErr)
 	if err != nil {
diff --git a/internal/service/request/deployaction_test.go b/internal/service/request/deployaction_test.go
index 054a229..9f6f40d 100644
--- a/internal/service/request/deployaction_test.go
+++ b/internal/service/request/deployaction_test.go
@@ -4,11 +4,11 @@ import (
 	"context"
 	"testing"
 
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/internal/service/request/observe/is_deleted_check_test.go b/internal/service/request/observe/is_deleted_check_test.go
index e1d6d99..9353209 100644
--- a/internal/service/request/observe/is_deleted_check_test.go
+++ b/internal/service/request/observe/is_deleted_check_test.go
@@ -5,12 +5,13 @@ import (
 	"net/http"
 	"testing"
 
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 )
diff --git a/internal/service/request/observe/is_synced_check_test.go b/internal/service/request/observe/is_synced_check_test.go
index 2d58eec..58ea66b 100644
--- a/internal/service/request/observe/is_synced_check_test.go
+++ b/internal/service/request/observe/is_synced_check_test.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"testing"
 
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 )
diff --git a/internal/service/request/observe/jq_check_test.go b/internal/service/request/observe/jq_check_test.go
index c9d9b08..65821f3 100644
--- a/internal/service/request/observe/jq_check_test.go
+++ b/internal/service/request/observe/jq_check_test.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"testing"
 
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	"github.com/crossplane-contrib/provider-http/apis/common"
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 )
 
diff --git a/internal/service/request/observe_test.go b/internal/service/request/observe_test.go
index d02ea25..d3002e4 100644
--- a/internal/service/request/observe_test.go
+++ b/internal/service/request/observe_test.go
@@ -5,15 +5,15 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
 	"github.com/crossplane-contrib/provider-http/internal/service/request/observe"
 	"github.com/crossplane-contrib/provider-http/internal/service/request/requestgen"
 	"github.com/crossplane-contrib/provider-http/internal/service/request/requestmapping"
-	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/internal/service/request/requestgen/request_generator.go b/internal/service/request/requestgen/request_generator.go
index 9f41275..60dcc4f 100644
--- a/internal/service/request/requestgen/request_generator.go
+++ b/internal/service/request/requestgen/request_generator.go
@@ -4,9 +4,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
-	"golang.org/x/exp/maps"
-
 	"github.com/crossplane-contrib/provider-http/apis/interfaces"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	datapatcher "github.com/crossplane-contrib/provider-http/internal/data-patcher"
@@ -14,6 +11,8 @@ import (
 	"github.com/crossplane-contrib/provider-http/internal/service"
 	"github.com/crossplane-contrib/provider-http/internal/service/request/requestprocessing"
 	"github.com/crossplane-contrib/provider-http/internal/utils"
+	"github.com/pkg/errors"
+	"golang.org/x/exp/maps"
 )
 
 type RequestDetails struct {
diff --git a/internal/service/request/requestgen/request_generator_test.go b/internal/service/request/requestgen/request_generator_test.go
index 5a883af..88b5cdb 100644
--- a/internal/service/request/requestgen/request_generator_test.go
+++ b/internal/service/request/requestgen/request_generator_test.go
@@ -4,13 +4,13 @@ import (
 	"context"
 	"testing"
 
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 )
 
diff --git a/internal/service/request/requestmapping/mapping.go b/internal/service/request/requestmapping/mapping.go
index 0f23c9a..78d153b 100644
--- a/internal/service/request/requestmapping/mapping.go
+++ b/internal/service/request/requestmapping/mapping.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/crossplane-contrib/provider-http/apis/common"
 	"github.com/crossplane-contrib/provider-http/apis/interfaces"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
 	"github.com/pkg/errors"
 )
 
diff --git a/internal/service/request/requestmapping/mapping_test.go b/internal/service/request/requestmapping/mapping_test.go
index 82f032d..241f5d5 100644
--- a/internal/service/request/requestmapping/mapping_test.go
+++ b/internal/service/request/requestmapping/mapping_test.go
@@ -4,11 +4,11 @@ import (
 	"net/http"
 	"testing"
 
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	"github.com/crossplane-contrib/provider-http/apis/common"
 	"github.com/crossplane-contrib/provider-http/apis/interfaces"
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 )
diff --git a/internal/service/request/requestprocessing/request_processing_test.go b/internal/service/request/requestprocessing/request_processing_test.go
index 8d80c81..24fafb5 100644
--- a/internal/service/request/requestprocessing/request_processing_test.go
+++ b/internal/service/request/requestprocessing/request_processing_test.go
@@ -3,7 +3,7 @@ package requestprocessing
 import (
 	"testing"
 
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 )
 
diff --git a/internal/service/request/statushandler/status_test.go b/internal/service/request/statushandler/status_test.go
index afec10a..6965e64 100644
--- a/internal/service/request/statushandler/status_test.go
+++ b/internal/service/request/statushandler/status_test.go
@@ -6,11 +6,11 @@ import (
 
 	"github.com/pkg/errors"
 
-	"github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
+	"github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/service"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
diff --git a/internal/utils/set_status_test.go b/internal/utils/set_status_test.go
index 9d82c89..5a7613d 100644
--- a/internal/utils/set_status_test.go
+++ b/internal/utils/set_status_test.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"testing"
 
-	v1alpha1_disposable "github.com/crossplane-contrib/provider-http/apis/disposablerequest/v1alpha2"
-	v1alpha1_request "github.com/crossplane-contrib/provider-http/apis/request/v1alpha2"
+	v1alpha1_disposable "github.com/crossplane-contrib/provider-http/apis/cluster/disposablerequest/v1alpha2"
+	v1alpha1_request "github.com/crossplane-contrib/provider-http/apis/cluster/request/v1alpha2"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/pkg/errors"
 
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 )
 
diff --git a/internal/utils/validate_test.go b/internal/utils/validate_test.go
index e8831a4..444043c 100644
--- a/internal/utils/validate_test.go
+++ b/internal/utils/validate_test.go
@@ -4,7 +4,7 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/crossplane/crossplane-runtime/pkg/test"
+	"github.com/crossplane/crossplane-runtime/v2/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 )
diff --git a/package/crds/http.crossplane.io_disposablerequests.yaml b/package/crds/http.crossplane.io_disposablerequests.yaml
index c843593..43fc45d 100644
--- a/package/crds/http.crossplane.io_disposablerequests.yaml
+++ b/package/crds/http.crossplane.io_disposablerequests.yaml
@@ -185,93 +185,12 @@ spec:
                 required:
                 - name
                 type: object
-              publishConnectionDetailsTo:
-                description: |-
-                  PublishConnectionDetailsTo specifies the connection secret config which
-                  contains a name, metadata and a reference to secret store config to
-                  which any connection details for this managed resource should be written.
-                  Connection details frequently include the endpoint, username,
-                  and password required to connect to the managed resource.
-                properties:
-                  configRef:
-                    default:
-                      name: default
-                    description: |-
-                      SecretStoreConfigRef specifies which secret store config should be used
-                      for this ConnectionSecret.
-                    properties:
-                      name:
-                        description: Name of the referenced object.
-                        type: string
-                      policy:
-                        description: Policies for referencing.
-                        properties:
-                          resolution:
-                            default: Required
-                            description: |-
-                              Resolution specifies whether resolution of this reference is required.
-                              The default is 'Required', which means the reconcile will fail if the
-                              reference cannot be resolved. 'Optional' means this reference will be
-                              a no-op if it cannot be resolved.
-                            enum:
-                            - Required
-                            - Optional
-                            type: string
-                          resolve:
-                            description: |-
-                              Resolve specifies when this reference should be resolved. The default
-                              is 'IfNotPresent', which will attempt to resolve the reference only when
-                              the corresponding field is not present. Use 'Always' to resolve the
-                              reference on every reconcile.
-                            enum:
-                            - Always
-                            - IfNotPresent
-                            type: string
-                        type: object
-                    required:
-                    - name
-                    type: object
-                  metadata:
-                    description: Metadata is the metadata for connection secret.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations are the annotations to be added to connection secret.
-                          - For Kubernetes secrets, this will be used as "metadata.annotations".
-                          - It is up to Secret Store implementation for others store types.
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels are the labels/tags to be added to connection secret.
-                          - For Kubernetes secrets, this will be used as "metadata.labels".
-                          - It is up to Secret Store implementation for others store types.
-                        type: object
-                      type:
-                        description: |-
-                          Type is the SecretType for the connection secret.
-                          - Only valid for Kubernetes Secret Stores.
-                        type: string
-                    type: object
-                  name:
-                    description: Name is the name of the connection secret.
-                    type: string
-                required:
-                - name
-                type: object
               writeConnectionSecretToRef:
                 description: |-
                   WriteConnectionSecretToReference specifies the namespace and name of a
                   Secret to which any connection details for this managed resource should
                   be written. Connection details frequently include the endpoint, username,
                   and password required to connect to the managed resource.
-                  This field is planned to be replaced in a future release in favor of
-                  PublishConnectionDetailsTo. Currently, both could be set independently
-                  and connection details would be published to both without affecting
-                  each other.
                 properties:
                   name:
                     description: Name of the secret.
@@ -736,93 +655,12 @@ spec:
                 required:
                 - name
                 type: object
-              publishConnectionDetailsTo:
-                description: |-
-                  PublishConnectionDetailsTo specifies the connection secret config which
-                  contains a name, metadata and a reference to secret store config to
-                  which any connection details for this managed resource should be written.
-                  Connection details frequently include the endpoint, username,
-                  and password required to connect to the managed resource.
-                properties:
-                  configRef:
-                    default:
-                      name: default
-                    description: |-
-                      SecretStoreConfigRef specifies which secret store config should be used
-                      for this ConnectionSecret.
-                    properties:
-                      name:
-                        description: Name of the referenced object.
-                        type: string
-                      policy:
-                        description: Policies for referencing.
-                        properties:
-                          resolution:
-                            default: Required
-                            description: |-
-                              Resolution specifies whether resolution of this reference is required.
-                              The default is 'Required', which means the reconcile will fail if the
-                              reference cannot be resolved. 'Optional' means this reference will be
-                              a no-op if it cannot be resolved.
-                            enum:
-                            - Required
-                            - Optional
-                            type: string
-                          resolve:
-                            description: |-
-                              Resolve specifies when this reference should be resolved. The default
-                              is 'IfNotPresent', which will attempt to resolve the reference only when
-                              the corresponding field is not present. Use 'Always' to resolve the
-                              reference on every reconcile.
-                            enum:
-                            - Always
-                            - IfNotPresent
-                            type: string
-                        type: object
-                    required:
-                    - name
-                    type: object
-                  metadata:
-                    description: Metadata is the metadata for connection secret.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations are the annotations to be added to connection secret.
-                          - For Kubernetes secrets, this will be used as "metadata.annotations".
-                          - It is up to Secret Store implementation for others store types.
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels are the labels/tags to be added to connection secret.
-                          - For Kubernetes secrets, this will be used as "metadata.labels".
-                          - It is up to Secret Store implementation for others store types.
-                        type: object
-                      type:
-                        description: |-
-                          Type is the SecretType for the connection secret.
-                          - Only valid for Kubernetes Secret Stores.
-                        type: string
-                    type: object
-                  name:
-                    description: Name is the name of the connection secret.
-                    type: string
-                required:
-                - name
-                type: object
               writeConnectionSecretToRef:
                 description: |-
                   WriteConnectionSecretToReference specifies the namespace and name of a
                   Secret to which any connection details for this managed resource should
                   be written. Connection details frequently include the endpoint, username,
                   and password required to connect to the managed resource.
-                  This field is planned to be replaced in a future release in favor of
-                  PublishConnectionDetailsTo. Currently, both could be set independently
-                  and connection details would be published to both without affecting
-                  each other.
                 properties:
                   name:
                     description: Name of the secret.
diff --git a/package/crds/http.crossplane.io_requests.yaml b/package/crds/http.crossplane.io_requests.yaml
index 27fa358..dc493ae 100644
--- a/package/crds/http.crossplane.io_requests.yaml
+++ b/package/crds/http.crossplane.io_requests.yaml
@@ -187,93 +187,12 @@ spec:
                 required:
                 - name
                 type: object
-              publishConnectionDetailsTo:
-                description: |-
-                  PublishConnectionDetailsTo specifies the connection secret config which
-                  contains a name, metadata and a reference to secret store config to
-                  which any connection details for this managed resource should be written.
-                  Connection details frequently include the endpoint, username,
-                  and password required to connect to the managed resource.
-                properties:
-                  configRef:
-                    default:
-                      name: default
-                    description: |-
-                      SecretStoreConfigRef specifies which secret store config should be used
-                      for this ConnectionSecret.
-                    properties:
-                      name:
-                        description: Name of the referenced object.
-                        type: string
-                      policy:
-                        description: Policies for referencing.
-                        properties:
-                          resolution:
-                            default: Required
-                            description: |-
-                              Resolution specifies whether resolution of this reference is required.
-                              The default is 'Required', which means the reconcile will fail if the
-                              reference cannot be resolved. 'Optional' means this reference will be
-                              a no-op if it cannot be resolved.
-                            enum:
-                            - Required
-                            - Optional
-                            type: string
-                          resolve:
-                            description: |-
-                              Resolve specifies when this reference should be resolved. The default
-                              is 'IfNotPresent', which will attempt to resolve the reference only when
-                              the corresponding field is not present. Use 'Always' to resolve the
-                              reference on every reconcile.
-                            enum:
-                            - Always
-                            - IfNotPresent
-                            type: string
-                        type: object
-                    required:
-                    - name
-                    type: object
-                  metadata:
-                    description: Metadata is the metadata for connection secret.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations are the annotations to be added to connection secret.
-                          - For Kubernetes secrets, this will be used as "metadata.annotations".
-                          - It is up to Secret Store implementation for others store types.
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels are the labels/tags to be added to connection secret.
-                          - For Kubernetes secrets, this will be used as "metadata.labels".
-                          - It is up to Secret Store implementation for others store types.
-                        type: object
-                      type:
-                        description: |-
-                          Type is the SecretType for the connection secret.
-                          - Only valid for Kubernetes Secret Stores.
-                        type: string
-                    type: object
-                  name:
-                    description: Name is the name of the connection secret.
-                    type: string
-                required:
-                - name
-                type: object
               writeConnectionSecretToRef:
                 description: |-
                   WriteConnectionSecretToReference specifies the namespace and name of a
                   Secret to which any connection details for this managed resource should
                   be written. Connection details frequently include the endpoint, username,
                   and password required to connect to the managed resource.
-                  This field is planned to be replaced in a future release in favor of
-                  PublishConnectionDetailsTo. Currently, both could be set independently
-                  and connection details would be published to both without affecting
-                  each other.
                 properties:
                   name:
                     description: Name of the secret.
@@ -811,93 +730,12 @@ spec:
                 required:
                 - name
                 type: object
-              publishConnectionDetailsTo:
-                description: |-
-                  PublishConnectionDetailsTo specifies the connection secret config which
-                  contains a name, metadata and a reference to secret store config to
-                  which any connection details for this managed resource should be written.
-                  Connection details frequently include the endpoint, username,
-                  and password required to connect to the managed resource.
-                properties:
-                  configRef:
-                    default:
-                      name: default
-                    description: |-
-                      SecretStoreConfigRef specifies which secret store config should be used
-                      for this ConnectionSecret.
-                    properties:
-                      name:
-                        description: Name of the referenced object.
-                        type: string
-                      policy:
-                        description: Policies for referencing.
-                        properties:
-                          resolution:
-                            default: Required
-                            description: |-
-                              Resolution specifies whether resolution of this reference is required.
-                              The default is 'Required', which means the reconcile will fail if the
-                              reference cannot be resolved. 'Optional' means this reference will be
-                              a no-op if it cannot be resolved.
-                            enum:
-                            - Required
-                            - Optional
-                            type: string
-                          resolve:
-                            description: |-
-                              Resolve specifies when this reference should be resolved. The default
-                              is 'IfNotPresent', which will attempt to resolve the reference only when
-                              the corresponding field is not present. Use 'Always' to resolve the
-                              reference on every reconcile.
-                            enum:
-                            - Always
-                            - IfNotPresent
-                            type: string
-                        type: object
-                    required:
-                    - name
-                    type: object
-                  metadata:
-                    description: Metadata is the metadata for connection secret.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Annotations are the annotations to be added to connection secret.
-                          - For Kubernetes secrets, this will be used as "metadata.annotations".
-                          - It is up to Secret Store implementation for others store types.
-                        type: object
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          Labels are the labels/tags to be added to connection secret.
-                          - For Kubernetes secrets, this will be used as "metadata.labels".
-                          - It is up to Secret Store implementation for others store types.
-                        type: object
-                      type:
-                        description: |-
-                          Type is the SecretType for the connection secret.
-                          - Only valid for Kubernetes Secret Stores.
-                        type: string
-                    type: object
-                  name:
-                    description: Name is the name of the connection secret.
-                    type: string
-                required:
-                - name
-                type: object
               writeConnectionSecretToRef:
                 description: |-
                   WriteConnectionSecretToReference specifies the namespace and name of a
                   Secret to which any connection details for this managed resource should
                   be written. Connection details frequently include the endpoint, username,
                   and password required to connect to the managed resource.
-                  This field is planned to be replaced in a future release in favor of
-                  PublishConnectionDetailsTo. Currently, both could be set independently
-                  and connection details would be published to both without affecting
-                  each other.
                 properties:
                   name:
                     description: Name of the secret.
diff --git a/package/crds/http.m.crossplane.io_clusterproviderconfigs.yaml b/package/crds/http.m.crossplane.io_clusterproviderconfigs.yaml
new file mode 100644
index 0000000..dda54d1
--- /dev/null
+++ b/package/crds/http.m.crossplane.io_clusterproviderconfigs.yaml
@@ -0,0 +1,242 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.18.0
+  name: clusterproviderconfigs.http.m.crossplane.io
+spec:
+  group: http.m.crossplane.io
+  names:
+    kind: ClusterProviderConfig
+    listKind: ClusterProviderConfigList
+    plural: clusterproviderconfigs
+    singular: clusterproviderconfig
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    - jsonPath: .spec.credentials.secretRef.name
+      name: SECRET-NAME
+      priority: 1
+      type: string
+    name: v1alpha2
+    schema:
+      openAPIV3Schema:
+        description: A ClusterProviderConfig configures a Http provider at the cluster
+          level for cross-namespace access.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: A ProviderConfigSpec defines the desired state of a ProviderConfig.
+            properties:
+              credentials:
+                description: Credentials required to authenticate to this provider.
+                properties:
+                  env:
+                    description: |-
+                      Env is a reference to an environment variable that contains credentials
+                      that must be used to connect to the provider.
+                    properties:
+                      name:
+                        description: Name is the name of an environment variable.
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  fs:
+                    description: |-
+                      Fs is a reference to a filesystem location that contains credentials that
+                      must be used to connect to the provider.
+                    properties:
+                      path:
+                        description: Path is a filesystem path.
+                        type: string
+                    required:
+                    - path
+                    type: object
+                  secretRef:
+                    description: |-
+                      A SecretRef is a reference to a secret key that contains the credentials
+                      that must be used to connect to the provider.
+                    properties:
+                      key:
+                        description: The key to select.
+                        type: string
+                      name:
+                        description: Name of the secret.
+                        type: string
+                      namespace:
+                        description: Namespace of the secret.
+                        type: string
+                    required:
+                    - key
+                    - name
+                    - namespace
+                    type: object
+                  source:
+                    description: Source of the provider credentials.
+                    enum:
+                    - None
+                    - Secret
+                    - InjectedIdentity
+                    - Environment
+                    - Filesystem
+                    type: string
+                required:
+                - source
+                type: object
+              tls:
+                description: TLS configuration for HTTPS requests.
+                properties:
+                  caBundle:
+                    description: |-
+                      CABundle is a PEM encoded CA bundle which will be used to validate the server certificate.
+                      If empty, system root CAs will be used.
+                    format: byte
+                    type: string
+                  caCertSecretRef:
+                    description: |-
+                      CACertSecretRef is a reference to a secret containing the CA certificate(s).
+                      The secret must contain a key specified in the SecretKeySelector.
+                    properties:
+                      key:
+                        description: The key to select.
+                        type: string
+                      name:
+                        description: Name of the secret.
+                        type: string
+                      namespace:
+                        description: Namespace of the secret.
+                        type: string
+                    required:
+                    - key
+                    - name
+                    - namespace
+                    type: object
+                  clientCertSecretRef:
+                    description: |-
+                      ClientCertSecretRef is a reference to a secret containing the client certificate.
+                      The secret must contain a key specified in the SecretKeySelector.
+                    properties:
+                      key:
+                        description: The key to select.
+                        type: string
+                      name:
+                        description: Name of the secret.
+                        type: string
+                      namespace:
+                        description: Namespace of the secret.
+                        type: string
+                    required:
+                    - key
+                    - name
+                    - namespace
+                    type: object
+                  clientKeySecretRef:
+                    description: |-
+                      ClientKeySecretRef is a reference to a secret containing the client private key.
+                      The secret must contain a key specified in the SecretKeySelector.
+                    properties:
+                      key:
+                        description: The key to select.
+                        type: string
+                      name:
+                        description: Name of the secret.
+                        type: string
+                      namespace:
+                        description: Namespace of the secret.
+                        type: string
+                    required:
+                    - key
+                    - name
+                    - namespace
+                    type: object
+                  insecureSkipVerify:
+                    description: |-
+                      InsecureSkipVerify controls whether the client verifies the server's certificate chain and host name.
+                      If true, any certificate presented by the server and any host name in that certificate is accepted.
+                    type: boolean
+                type: object
+            required:
+            - credentials
+            type: object
+          status:
+            description: A ProviderConfigStatus reflects the observed state of a ProviderConfig.
+            properties:
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              users:
+                description: Users of this provider configuration.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/package/crds/http.m.crossplane.io_clusterproviderconfigusages.yaml b/package/crds/http.m.crossplane.io_clusterproviderconfigusages.yaml
new file mode 100644
index 0000000..f686559
--- /dev/null
+++ b/package/crds/http.m.crossplane.io_clusterproviderconfigusages.yaml
@@ -0,0 +1,97 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.18.0
+  name: clusterproviderconfigusages.http.m.crossplane.io
+spec:
+  group: http.m.crossplane.io
+  names:
+    categories:
+    - crossplane
+    - provider
+    - http
+    kind: ClusterProviderConfigUsage
+    listKind: ClusterProviderConfigUsageList
+    plural: clusterproviderconfigusages
+    singular: clusterproviderconfigusage
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    - jsonPath: .providerConfigRef.name
+      name: CONFIG-NAME
+      type: string
+    - jsonPath: .resourceRef.kind
+      name: RESOURCE-KIND
+      type: string
+    - jsonPath: .resourceRef.name
+      name: RESOURCE-NAME
+      type: string
+    name: v1alpha2
+    schema:
+      openAPIV3Schema:
+        description: A ClusterProviderConfigUsage indicates that a resource is using
+          a ClusterProviderConfig.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          providerConfigRef:
+            description: ProviderConfigReference to the provider config being used.
+            properties:
+              kind:
+                description: Kind of the referenced object.
+                type: string
+              name:
+                description: Name of the referenced object.
+                type: string
+            required:
+            - kind
+            - name
+            type: object
+          resourceRef:
+            description: ResourceReference to the managed resource using the provider
+              config.
+            properties:
+              apiVersion:
+                description: APIVersion of the referenced object.
+                type: string
+              kind:
+                description: Kind of the referenced object.
+                type: string
+              name:
+                description: Name of the referenced object.
+                type: string
+              uid:
+                description: UID of the referenced object.
+                type: string
+            required:
+            - apiVersion
+            - kind
+            - name
+            type: object
+        required:
+        - providerConfigRef
+        - resourceRef
+        type: object
+    served: true
+    storage: true
+    subresources: {}
diff --git a/package/crds/http.m.crossplane.io_disposablerequests.yaml b/package/crds/http.m.crossplane.io_disposablerequests.yaml
new file mode 100644
index 0000000..9147c63
--- /dev/null
+++ b/package/crds/http.m.crossplane.io_disposablerequests.yaml
@@ -0,0 +1,453 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.18.0
+  name: disposablerequests.http.m.crossplane.io
+spec:
+  group: http.m.crossplane.io
+  names:
+    categories:
+    - crossplane
+    - managed
+    - http
+    kind: DisposableRequest
+    listKind: DisposableRequestList
+    plural: disposablerequests
+    singular: disposablerequest
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: READY
+      type: string
+    - jsonPath: .status.conditions[?(@.type=='Synced')].status
+      name: SYNCED
+      type: string
+    - jsonPath: .metadata.annotations.crossplane\.io/external-name
+      name: EXTERNAL-NAME
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    name: v1alpha2
+    schema:
+      openAPIV3Schema:
+        description: A DisposableRequest is a namespaced HTTP disposable request resource.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: A DisposableRequestSpec defines the desired state of a DisposableRequest.
+            properties:
+              forProvider:
+                description: DisposableRequestParameters are the configurable fields
+                  of a DisposableRequest.
+                properties:
+                  body:
+                    type: string
+                    x-kubernetes-validations:
+                    - message: Field 'forProvider.body' is immutable
+                      rule: self == oldSelf
+                  expectedResponse:
+                    description: |-
+                      ExpectedResponse is a jq filter expression used to evaluate the HTTP response and determine if it matches the expected criteria.
+                      The expression should return a boolean; if true, the response is considered expected.
+                      Example: '.body.job_status == "success"'
+                    type: string
+                  headers:
+                    additionalProperties:
+                      items:
+                        type: string
+                      type: array
+                    type: object
+                    x-kubernetes-validations:
+                    - message: Field 'forProvider.headers' is immutable
+                      rule: self == oldSelf
+                  insecureSkipTLSVerify:
+                    description: |-
+                      InsecureSkipTLSVerify, when set to true, skips TLS certificate checks for the HTTP request.
+                      This field is mutually exclusive with TLSConfig.
+                    type: boolean
+                  method:
+                    type: string
+                    x-kubernetes-validations:
+                    - message: Field 'forProvider.method' is immutable
+                      rule: self == oldSelf
+                  nextReconcile:
+                    description: NextReconcile specifies the duration after which
+                      the next reconcile should occur.
+                    type: string
+                  rollbackRetriesLimit:
+                    description: RollbackRetriesLimit is max number of attempts to
+                      retry HTTP request by sending again the request.
+                    format: int32
+                    type: integer
+                  secretInjectionConfigs:
+                    description: SecretInjectionConfig specifies the secrets receiving
+                      patches from response data.
+                    items:
+                      description: SecretInjectionConfig represents the configuration
+                        for injecting secret data into a Kubernetes secret.
+                      properties:
+                        keyMappings:
+                          description: KeyMappings allows injecting data into single
+                            or multiple keys within the same Kubernetes secret.
+                          items:
+                            description: KeyInjection represents the configuration
+                              for injecting data into a specific key in a Kubernetes
+                              secret.
+                            properties:
+                              missingFieldStrategy:
+                                default: delete
+                                description: |-
+                                  MissingFieldStrategy determines how to handle cases where the field is missing from the response.
+                                  Possible values are:
+                                  - "preserve": keeps the existing value in the secret
+                                  - "setEmpty": sets the value to the empty string
+                                  - "delete": removes the key from the s
+                                enum:
+                                - preserve
+                                - setEmpty
+                                - delete
+                                type: string
+                              responseJQ:
+                                description: ResponseJQ is a jq filter expression
+                                  representing the path in the response where the
+                                  secret value will be extracted from.
+                                type: string
+                              secretKey:
+                                description: SecretKey is the key within the Kubernetes
+                                  secret where the data will be injected.
+                                type: string
+                            required:
+                            - responseJQ
+                            - secretKey
+                            type: object
+                          type: array
+                        metadata:
+                          description: Metadata contains labels and annotations to
+                            apply to the Kubernetes secret.
+                          properties:
+                            annotations:
+                              additionalProperties:
+                                type: string
+                              description: Annotations contains key-value pairs to
+                                apply as annotations to the Kubernetes secret.
+                              type: object
+                            labels:
+                              additionalProperties:
+                                type: string
+                              description: Labels contains key-value pairs to apply
+                                as labels to the Kubernetes secret.
+                              type: object
+                          type: object
+                        responsePath:
+                          description: |-
+                            ResponsePath is a jq filter expression representing the path in the response where the secret value will be extracted from.
+                            Deprecated: Use KeyMappings for injecting single or multiple keys.
+                          type: string
+                        secretKey:
+                          description: |-
+                            SecretKey is the key within the Kubernetes secret where the data will be injected.
+                            Deprecated: Use KeyMappings for injecting single or multiple keys.
+                          type: string
+                        secretRef:
+                          description: SecretRef contains the name and namespace of
+                            the Kubernetes secret where the data will be injected.
+                          properties:
+                            name:
+                              description: Name is the name of the Kubernetes secret.
+                              type: string
+                            namespace:
+                              description: Namespace is the namespace of the Kubernetes
+                                secret.
+                              type: string
+                          required:
+                          - name
+                          - namespace
+                          type: object
+                        setOwnerReference:
+                          description: SetOwnerReference determines whether to set
+                            the owner reference on the Kubernetes secret.
+                          type: boolean
+                      required:
+                      - secretRef
+                      type: object
+                    type: array
+                  shouldLoopInfinitely:
+                    description: ShouldLoopInfinitely specifies whether the reconciliation
+                      should loop indefinitely.
+                    type: boolean
+                  tlsConfig:
+                    description: |-
+                      TLSConfig allows overriding the TLS configuration from ProviderConfig for this specific request.
+                      This field is mutually exclusive with InsecureSkipTLSVerify.
+                    properties:
+                      caBundle:
+                        description: |-
+                          CABundle is a PEM encoded CA bundle which will be used to validate the server certificate.
+                          If empty, system root CAs will be used.
+                        format: byte
+                        type: string
+                      caCertSecretRef:
+                        description: |-
+                          CACertSecretRef is a reference to a secret containing the CA certificate(s).
+                          The secret must contain a key specified in the SecretKeySelector.
+                        properties:
+                          key:
+                            description: The key to select.
+                            type: string
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        - namespace
+                        type: object
+                      clientCertSecretRef:
+                        description: |-
+                          ClientCertSecretRef is a reference to a secret containing the client certificate.
+                          The secret must contain a key specified in the SecretKeySelector.
+                        properties:
+                          key:
+                            description: The key to select.
+                            type: string
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        - namespace
+                        type: object
+                      clientKeySecretRef:
+                        description: |-
+                          ClientKeySecretRef is a reference to a secret containing the client private key.
+                          The secret must contain a key specified in the SecretKeySelector.
+                        properties:
+                          key:
+                            description: The key to select.
+                            type: string
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        - namespace
+                        type: object
+                      insecureSkipVerify:
+                        description: |-
+                          InsecureSkipVerify controls whether the client verifies the server's certificate chain and host name.
+                          If true, any certificate presented by the server and any host name in that certificate is accepted.
+                        type: boolean
+                    type: object
+                  url:
+                    type: string
+                    x-kubernetes-validations:
+                    - message: Field 'forProvider.url' is immutable
+                      rule: self == oldSelf
+                  waitTimeout:
+                    description: WaitTimeout specifies the maximum time duration for
+                      waiting.
+                    type: string
+                required:
+                - method
+                - url
+                type: object
+                x-kubernetes-validations:
+                - message: insecureSkipTLSVerify and tlsConfig are mutually exclusive
+                  rule: '!(self.insecureSkipTLSVerify == true && has(self.tlsConfig))'
+              managementPolicies:
+                default:
+                - '*'
+                description: |-
+                  THIS IS A BETA FIELD. It is on by default but can be opted out
+                  through a Crossplane feature flag.
+                  ManagementPolicies specify the array of actions Crossplane is allowed to
+                  take on the managed and external resources.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                  and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
+                items:
+                  description: |-
+                    A ManagementAction represents an action that the Crossplane controllers
+                    can take on an external resource.
+                  enum:
+                  - Observe
+                  - Create
+                  - Update
+                  - Delete
+                  - LateInitialize
+                  - '*'
+                  type: string
+                type: array
+              providerConfigRef:
+                default:
+                  kind: ClusterProviderConfig
+                  name: default
+                description: |-
+                  ProviderConfigReference specifies how the provider that will be used to
+                  create, observe, update, and delete this managed resource should be
+                  configured.
+                properties:
+                  kind:
+                    description: Kind of the referenced object.
+                    type: string
+                  name:
+                    description: Name of the referenced object.
+                    type: string
+                required:
+                - kind
+                - name
+                type: object
+              writeConnectionSecretToRef:
+                description: |-
+                  WriteConnectionSecretToReference specifies the namespace and name of a
+                  Secret to which any connection details for this managed resource should
+                  be written. Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                properties:
+                  name:
+                    description: Name of the secret.
+                    type: string
+                required:
+                - name
+                type: object
+            required:
+            - forProvider
+            type: object
+          status:
+            description: A DisposableRequestStatus represents the observed state of
+              a DisposableRequest.
+            properties:
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              error:
+                type: string
+              failed:
+                format: int32
+                type: integer
+              lastReconcileTime:
+                description: LastReconcileTime records the last time the resource
+                  was reconciled.
+                format: date-time
+                type: string
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the latest metadata.generation
+                  which resulted in either a ready state, or stalled due to error
+                  it can not recover from without human intervention.
+                format: int64
+                type: integer
+              requestDetails:
+                properties:
+                  body:
+                    type: string
+                  headers:
+                    additionalProperties:
+                      items:
+                        type: string
+                      type: array
+                    type: object
+                  method:
+                    type: string
+                  url:
+                    type: string
+                required:
+                - method
+                - url
+                type: object
+              response:
+                properties:
+                  body:
+                    type: string
+                  headers:
+                    additionalProperties:
+                      items:
+                        type: string
+                      type: array
+                    type: object
+                  statusCode:
+                    type: integer
+                type: object
+              synced:
+                type: boolean
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/package/crds/http.m.crossplane.io_providerconfigs.yaml b/package/crds/http.m.crossplane.io_providerconfigs.yaml
new file mode 100644
index 0000000..68f0f3e
--- /dev/null
+++ b/package/crds/http.m.crossplane.io_providerconfigs.yaml
@@ -0,0 +1,241 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.18.0
+  name: providerconfigs.http.m.crossplane.io
+spec:
+  group: http.m.crossplane.io
+  names:
+    kind: ProviderConfig
+    listKind: ProviderConfigList
+    plural: providerconfigs
+    singular: providerconfig
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    - jsonPath: .spec.credentials.secretRef.name
+      name: SECRET-NAME
+      priority: 1
+      type: string
+    name: v1alpha2
+    schema:
+      openAPIV3Schema:
+        description: A ProviderConfig configures a Http provider.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: A ProviderConfigSpec defines the desired state of a ProviderConfig.
+            properties:
+              credentials:
+                description: Credentials required to authenticate to this provider.
+                properties:
+                  env:
+                    description: |-
+                      Env is a reference to an environment variable that contains credentials
+                      that must be used to connect to the provider.
+                    properties:
+                      name:
+                        description: Name is the name of an environment variable.
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  fs:
+                    description: |-
+                      Fs is a reference to a filesystem location that contains credentials that
+                      must be used to connect to the provider.
+                    properties:
+                      path:
+                        description: Path is a filesystem path.
+                        type: string
+                    required:
+                    - path
+                    type: object
+                  secretRef:
+                    description: |-
+                      A SecretRef is a reference to a secret key that contains the credentials
+                      that must be used to connect to the provider.
+                    properties:
+                      key:
+                        description: The key to select.
+                        type: string
+                      name:
+                        description: Name of the secret.
+                        type: string
+                      namespace:
+                        description: Namespace of the secret.
+                        type: string
+                    required:
+                    - key
+                    - name
+                    - namespace
+                    type: object
+                  source:
+                    description: Source of the provider credentials.
+                    enum:
+                    - None
+                    - Secret
+                    - InjectedIdentity
+                    - Environment
+                    - Filesystem
+                    type: string
+                required:
+                - source
+                type: object
+              tls:
+                description: TLS configuration for HTTPS requests.
+                properties:
+                  caBundle:
+                    description: |-
+                      CABundle is a PEM encoded CA bundle which will be used to validate the server certificate.
+                      If empty, system root CAs will be used.
+                    format: byte
+                    type: string
+                  caCertSecretRef:
+                    description: |-
+                      CACertSecretRef is a reference to a secret containing the CA certificate(s).
+                      The secret must contain a key specified in the SecretKeySelector.
+                    properties:
+                      key:
+                        description: The key to select.
+                        type: string
+                      name:
+                        description: Name of the secret.
+                        type: string
+                      namespace:
+                        description: Namespace of the secret.
+                        type: string
+                    required:
+                    - key
+                    - name
+                    - namespace
+                    type: object
+                  clientCertSecretRef:
+                    description: |-
+                      ClientCertSecretRef is a reference to a secret containing the client certificate.
+                      The secret must contain a key specified in the SecretKeySelector.
+                    properties:
+                      key:
+                        description: The key to select.
+                        type: string
+                      name:
+                        description: Name of the secret.
+                        type: string
+                      namespace:
+                        description: Namespace of the secret.
+                        type: string
+                    required:
+                    - key
+                    - name
+                    - namespace
+                    type: object
+                  clientKeySecretRef:
+                    description: |-
+                      ClientKeySecretRef is a reference to a secret containing the client private key.
+                      The secret must contain a key specified in the SecretKeySelector.
+                    properties:
+                      key:
+                        description: The key to select.
+                        type: string
+                      name:
+                        description: Name of the secret.
+                        type: string
+                      namespace:
+                        description: Namespace of the secret.
+                        type: string
+                    required:
+                    - key
+                    - name
+                    - namespace
+                    type: object
+                  insecureSkipVerify:
+                    description: |-
+                      InsecureSkipVerify controls whether the client verifies the server's certificate chain and host name.
+                      If true, any certificate presented by the server and any host name in that certificate is accepted.
+                    type: boolean
+                type: object
+            required:
+            - credentials
+            type: object
+          status:
+            description: A ProviderConfigStatus reflects the observed state of a ProviderConfig.
+            properties:
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              users:
+                description: Users of this provider configuration.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/package/crds/http.m.crossplane.io_providerconfigusages.yaml b/package/crds/http.m.crossplane.io_providerconfigusages.yaml
new file mode 100644
index 0000000..ba9eb80
--- /dev/null
+++ b/package/crds/http.m.crossplane.io_providerconfigusages.yaml
@@ -0,0 +1,96 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.18.0
+  name: providerconfigusages.http.m.crossplane.io
+spec:
+  group: http.m.crossplane.io
+  names:
+    categories:
+    - crossplane
+    - provider
+    - http
+    kind: ProviderConfigUsage
+    listKind: ProviderConfigUsageList
+    plural: providerconfigusages
+    singular: providerconfigusage
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    - jsonPath: .providerConfigRef.name
+      name: CONFIG-NAME
+      type: string
+    - jsonPath: .resourceRef.kind
+      name: RESOURCE-KIND
+      type: string
+    - jsonPath: .resourceRef.name
+      name: RESOURCE-NAME
+      type: string
+    name: v1alpha2
+    schema:
+      openAPIV3Schema:
+        description: A ProviderConfigUsage indicates that a resource is using a ProviderConfig.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          providerConfigRef:
+            description: ProviderConfigReference to the provider config being used.
+            properties:
+              kind:
+                description: Kind of the referenced object.
+                type: string
+              name:
+                description: Name of the referenced object.
+                type: string
+            required:
+            - kind
+            - name
+            type: object
+          resourceRef:
+            description: ResourceReference to the managed resource using the provider
+              config.
+            properties:
+              apiVersion:
+                description: APIVersion of the referenced object.
+                type: string
+              kind:
+                description: Kind of the referenced object.
+                type: string
+              name:
+                description: Name of the referenced object.
+                type: string
+              uid:
+                description: UID of the referenced object.
+                type: string
+            required:
+            - apiVersion
+            - kind
+            - name
+            type: object
+        required:
+        - providerConfigRef
+        - resourceRef
+        type: object
+    served: true
+    storage: true
+    subresources: {}
diff --git a/package/crds/http.m.crossplane.io_requests.yaml b/package/crds/http.m.crossplane.io_requests.yaml
new file mode 100644
index 0000000..c45702a
--- /dev/null
+++ b/package/crds/http.m.crossplane.io_requests.yaml
@@ -0,0 +1,535 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.18.0
+  name: requests.http.m.crossplane.io
+spec:
+  group: http.m.crossplane.io
+  names:
+    categories:
+    - crossplane
+    - managed
+    - http
+    kind: Request
+    listKind: RequestList
+    plural: requests
+    singular: request
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: READY
+      type: string
+    - jsonPath: .status.conditions[?(@.type=='Synced')].status
+      name: SYNCED
+      type: string
+    - jsonPath: .metadata.annotations.crossplane\.io/external-name
+      name: EXTERNAL-NAME
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    name: v1alpha2
+    schema:
+      openAPIV3Schema:
+        description: A Request is a namespaced HTTP request resource.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: A RequestSpec defines the desired state of a Request.
+            properties:
+              forProvider:
+                description: RequestParameters are the configurable fields of a Request.
+                properties:
+                  expectedResponseCheck:
+                    description: ExpectedResponseCheck specifies the mechanism to
+                      validate the OBSERVE response against expected value.
+                    properties:
+                      logic:
+                        description: Logic specifies the custom logic for the expected
+                          response check.
+                        type: string
+                      type:
+                        description: Type specifies the type of the expected response
+                          check.
+                        enum:
+                        - DEFAULT
+                        - CUSTOM
+                        type: string
+                    type: object
+                  headers:
+                    additionalProperties:
+                      items:
+                        type: string
+                      type: array
+                    description: Headers defines default headers for each request.
+                    type: object
+                  insecureSkipTLSVerify:
+                    description: |-
+                      InsecureSkipTLSVerify, when set to true, skips TLS certificate checks for the HTTP request.
+                      This field is mutually exclusive with TLSConfig.
+                    type: boolean
+                  isRemovedCheck:
+                    description: IsRemovedCheck specifies the mechanism to validate
+                      the OBSERVE response after removal against expected value.
+                    properties:
+                      logic:
+                        description: Logic specifies the custom logic for the expected
+                          response check.
+                        type: string
+                      type:
+                        description: Type specifies the type of the expected response
+                          check.
+                        enum:
+                        - DEFAULT
+                        - CUSTOM
+                        type: string
+                    type: object
+                  mappings:
+                    description: |-
+                      Mappings defines the HTTP mappings for different methods.
+                      Either Method or Action must be specified. If both are omitted, the mapping will not be used.
+                    items:
+                      properties:
+                        action:
+                          description: Action specifies the intended action for the
+                            request.
+                          enum:
+                          - CREATE
+                          - OBSERVE
+                          - UPDATE
+                          - REMOVE
+                          type: string
+                        body:
+                          description: Body specifies the body of the request.
+                          type: string
+                        headers:
+                          additionalProperties:
+                            items:
+                              type: string
+                            type: array
+                          description: Headers specifies the headers for the request.
+                          type: object
+                        method:
+                          description: Method specifies the HTTP method for the request.
+                          enum:
+                          - POST
+                          - GET
+                          - PUT
+                          - DELETE
+                          - PATCH
+                          - HEAD
+                          - OPTIONS
+                          type: string
+                        url:
+                          description: URL specifies the URL for the request.
+                          type: string
+                      required:
+                      - url
+                      type: object
+                    minItems: 1
+                    type: array
+                  payload:
+                    description: Payload defines the payload for the request.
+                    properties:
+                      baseUrl:
+                        description: BaseUrl specifies the base URL for the request.
+                        type: string
+                      body:
+                        description: Body specifies data to be used in the request
+                          body.
+                        type: string
+                    type: object
+                  secretInjectionConfigs:
+                    description: SecretInjectionConfig specifies the secrets receiving
+                      patches for response data.
+                    items:
+                      description: SecretInjectionConfig represents the configuration
+                        for injecting secret data into a Kubernetes secret.
+                      properties:
+                        keyMappings:
+                          description: KeyMappings allows injecting data into single
+                            or multiple keys within the same Kubernetes secret.
+                          items:
+                            description: KeyInjection represents the configuration
+                              for injecting data into a specific key in a Kubernetes
+                              secret.
+                            properties:
+                              missingFieldStrategy:
+                                default: delete
+                                description: |-
+                                  MissingFieldStrategy determines how to handle cases where the field is missing from the response.
+                                  Possible values are:
+                                  - "preserve": keeps the existing value in the secret
+                                  - "setEmpty": sets the value to the empty string
+                                  - "delete": removes the key from the s
+                                enum:
+                                - preserve
+                                - setEmpty
+                                - delete
+                                type: string
+                              responseJQ:
+                                description: ResponseJQ is a jq filter expression
+                                  representing the path in the response where the
+                                  secret value will be extracted from.
+                                type: string
+                              secretKey:
+                                description: SecretKey is the key within the Kubernetes
+                                  secret where the data will be injected.
+                                type: string
+                            required:
+                            - responseJQ
+                            - secretKey
+                            type: object
+                          type: array
+                        metadata:
+                          description: Metadata contains labels and annotations to
+                            apply to the Kubernetes secret.
+                          properties:
+                            annotations:
+                              additionalProperties:
+                                type: string
+                              description: Annotations contains key-value pairs to
+                                apply as annotations to the Kubernetes secret.
+                              type: object
+                            labels:
+                              additionalProperties:
+                                type: string
+                              description: Labels contains key-value pairs to apply
+                                as labels to the Kubernetes secret.
+                              type: object
+                          type: object
+                        responsePath:
+                          description: |-
+                            ResponsePath is a jq filter expression representing the path in the response where the secret value will be extracted from.
+                            Deprecated: Use KeyMappings for injecting single or multiple keys.
+                          type: string
+                        secretKey:
+                          description: |-
+                            SecretKey is the key within the Kubernetes secret where the data will be injected.
+                            Deprecated: Use KeyMappings for injecting single or multiple keys.
+                          type: string
+                        secretRef:
+                          description: SecretRef contains the name and namespace of
+                            the Kubernetes secret where the data will be injected.
+                          properties:
+                            name:
+                              description: Name is the name of the Kubernetes secret.
+                              type: string
+                            namespace:
+                              description: Namespace is the namespace of the Kubernetes
+                                secret.
+                              type: string
+                          required:
+                          - name
+                          - namespace
+                          type: object
+                        setOwnerReference:
+                          description: SetOwnerReference determines whether to set
+                            the owner reference on the Kubernetes secret.
+                          type: boolean
+                      required:
+                      - secretRef
+                      type: object
+                    type: array
+                  tlsConfig:
+                    description: |-
+                      TLSConfig allows overriding the TLS configuration from ProviderConfig for this specific request.
+                      This field is mutually exclusive with InsecureSkipTLSVerify.
+                    properties:
+                      caBundle:
+                        description: |-
+                          CABundle is a PEM encoded CA bundle which will be used to validate the server certificate.
+                          If empty, system root CAs will be used.
+                        format: byte
+                        type: string
+                      caCertSecretRef:
+                        description: |-
+                          CACertSecretRef is a reference to a secret containing the CA certificate(s).
+                          The secret must contain a key specified in the SecretKeySelector.
+                        properties:
+                          key:
+                            description: The key to select.
+                            type: string
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        - namespace
+                        type: object
+                      clientCertSecretRef:
+                        description: |-
+                          ClientCertSecretRef is a reference to a secret containing the client certificate.
+                          The secret must contain a key specified in the SecretKeySelector.
+                        properties:
+                          key:
+                            description: The key to select.
+                            type: string
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        - namespace
+                        type: object
+                      clientKeySecretRef:
+                        description: |-
+                          ClientKeySecretRef is a reference to a secret containing the client private key.
+                          The secret must contain a key specified in the SecretKeySelector.
+                        properties:
+                          key:
+                            description: The key to select.
+                            type: string
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        - namespace
+                        type: object
+                      insecureSkipVerify:
+                        description: |-
+                          InsecureSkipVerify controls whether the client verifies the server's certificate chain and host name.
+                          If true, any certificate presented by the server and any host name in that certificate is accepted.
+                        type: boolean
+                    type: object
+                  waitTimeout:
+                    description: WaitTimeout specifies the maximum time duration for
+                      waiting.
+                    type: string
+                required:
+                - mappings
+                - payload
+                type: object
+                x-kubernetes-validations:
+                - message: insecureSkipTLSVerify and tlsConfig are mutually exclusive
+                  rule: '!(self.insecureSkipTLSVerify == true && has(self.tlsConfig))'
+              managementPolicies:
+                default:
+                - '*'
+                description: |-
+                  THIS IS A BETA FIELD. It is on by default but can be opted out
+                  through a Crossplane feature flag.
+                  ManagementPolicies specify the array of actions Crossplane is allowed to
+                  take on the managed and external resources.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                  and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
+                items:
+                  description: |-
+                    A ManagementAction represents an action that the Crossplane controllers
+                    can take on an external resource.
+                  enum:
+                  - Observe
+                  - Create
+                  - Update
+                  - Delete
+                  - LateInitialize
+                  - '*'
+                  type: string
+                type: array
+              providerConfigRef:
+                default:
+                  kind: ClusterProviderConfig
+                  name: default
+                description: |-
+                  ProviderConfigReference specifies how the provider that will be used to
+                  create, observe, update, and delete this managed resource should be
+                  configured.
+                properties:
+                  kind:
+                    description: Kind of the referenced object.
+                    type: string
+                  name:
+                    description: Name of the referenced object.
+                    type: string
+                required:
+                - kind
+                - name
+                type: object
+              writeConnectionSecretToRef:
+                description: |-
+                  WriteConnectionSecretToReference specifies the namespace and name of a
+                  Secret to which any connection details for this managed resource should
+                  be written. Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                properties:
+                  name:
+                    description: Name of the secret.
+                    type: string
+                required:
+                - name
+                type: object
+            required:
+            - forProvider
+            type: object
+          status:
+            description: A RequestStatus represents the observed state of a Request.
+            properties:
+              cache:
+                properties:
+                  lastUpdated:
+                    type: string
+                  response:
+                    description: RequestObservation are the observable fields of a
+                      Request.
+                    properties:
+                      body:
+                        type: string
+                      headers:
+                        additionalProperties:
+                          items:
+                            type: string
+                          type: array
+                        type: object
+                      statusCode:
+                        type: integer
+                    type: object
+                type: object
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              error:
+                type: string
+              failed:
+                format: int32
+                type: integer
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the latest metadata.generation
+                  which resulted in either a ready state, or stalled due to error
+                  it can not recover from without human intervention.
+                format: int64
+                type: integer
+              requestDetails:
+                properties:
+                  action:
+                    description: Action specifies the intended action for the request.
+                    enum:
+                    - CREATE
+                    - OBSERVE
+                    - UPDATE
+                    - REMOVE
+                    type: string
+                  body:
+                    description: Body specifies the body of the request.
+                    type: string
+                  headers:
+                    additionalProperties:
+                      items:
+                        type: string
+                      type: array
+                    description: Headers specifies the headers for the request.
+                    type: object
+                  method:
+                    description: Method specifies the HTTP method for the request.
+                    enum:
+                    - POST
+                    - GET
+                    - PUT
+                    - DELETE
+                    - PATCH
+                    - HEAD
+                    - OPTIONS
+                    type: string
+                  url:
+                    description: URL specifies the URL for the request.
+                    type: string
+                required:
+                - url
+                type: object
+              response:
+                description: RequestObservation are the observable fields of a Request.
+                properties:
+                  body:
+                    type: string
+                  headers:
+                    additionalProperties:
+                      items:
+                        type: string
+                      type: array
+                    type: object
+                  statusCode:
+                    type: integer
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/package/crossplane.yaml b/package/crossplane.yaml
index eab1fe0..065af78 100644
--- a/package/crossplane.yaml
+++ b/package/crossplane.yaml
@@ -20,3 +20,6 @@ metadata:
       join our community discussions on [slack.crossplane.io](https://slack.crossplane.io). 
       Feel free to create issues or contribute to the development at [crossplane-contrib/provider-http](https://github.com/crossplane-contrib/provider-http).
 
+spec:
+  capabilities:
+  - safe-start