diff --git a/api/src/controllers/files.ts b/api/src/controllers/files.ts
index 7cc5ff3e58..d96a2d9c5b 100644
--- a/api/src/controllers/files.ts
+++ b/api/src/controllers/files.ts
@@ -229,12 +229,12 @@ router.get(
 router.get(
 	'/:pk',
 	asyncHandler(async (req, res, next) => {
-		const keys = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
 		const service = new FilesService({
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const record = await service.readByKey(keys as any, req.sanitizedQuery);
+
+		const record = await service.readByKey(req.params.pk, req.sanitizedQuery);
 		res.locals.payload = { data: record || null };
 		return next();
 	}),
@@ -308,8 +308,7 @@ router.patch(
 		if (req.is('multipart/form-data')) {
 			keys = res.locals.savedFiles;
 		} else {
-			keys = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-			await service.update(req.body, keys as any);
+			await service.update(req.body, req.params.pk);
 		}
 
 		try {
@@ -348,12 +347,13 @@ router.delete(
 router.delete(
 	'/:pk',
 	asyncHandler(async (req, res, next) => {
-		const keys = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
 		const service = new FilesService({
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		await service.delete(keys as any);
+
+		await service.delete(req.params.pk);
+
 		return next();
 	}),
 	respond
diff --git a/api/src/controllers/folders.ts b/api/src/controllers/folders.ts
index 317006a9e3..433cdb8448 100644
--- a/api/src/controllers/folders.ts
+++ b/api/src/controllers/folders.ts
@@ -1,10 +1,11 @@
 import express from 'express';
 import asyncHandler from '../utils/async-handler';
 import { FoldersService, MetaService } from '../services';
-import { ForbiddenException, InvalidPayloadException } from '../exceptions';
+import { ForbiddenException, InvalidPayloadException, FailedValidationException } from '../exceptions';
 import useCollection from '../middleware/use-collection';
 import { respond } from '../middleware/respond';
 import { PrimaryKey } from '../types';
+import Joi from 'joi';
 
 const router = express.Router();
 
@@ -63,8 +64,7 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const primaryKey = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const record = await service.readByKey(primaryKey as any, req.sanitizedQuery);
+		const record = await service.readByKey(req.params.pk, req.sanitizedQuery);
 
 		res.locals.payload = { data: record || null };
 		return next();
@@ -72,6 +72,60 @@ router.get(
 	respond
 );
 
+router.patch(
+	'/:collection',
+	asyncHandler(async (req, res, next) => {
+		const service = new FoldersService({
+			accountability: req.accountability,
+			schema: req.schema,
+		});
+
+		if (Array.isArray(req.body)) {
+			const primaryKeys = await service.update(req.body);
+
+			try {
+				const result = await service.readByKey(primaryKeys, req.sanitizedQuery);
+				res.locals.payload = { data: result || null };
+			} catch (error) {
+				if (error instanceof ForbiddenException) {
+					return next();
+				}
+
+				throw error;
+			}
+
+			return next();
+		}
+
+		const updateSchema = Joi.object({
+			keys: Joi.array().items(Joi.alternatives(Joi.string(), Joi.number())).required(),
+			data: Joi.object().required().unknown(),
+		});
+
+		const { error } = updateSchema.validate(req.body);
+
+		if (error) {
+			throw new FailedValidationException(error.details[0]);
+		}
+
+		const primaryKeys = await service.update(req.body.data, req.body.keys);
+
+		try {
+			const result = await service.readByKey(primaryKeys, req.sanitizedQuery);
+			res.locals.payload = { data: result || null };
+		} catch (error) {
+			if (error instanceof ForbiddenException) {
+				return next();
+			}
+
+			throw error;
+		}
+
+		return next();
+	}),
+	respond
+);
+
 router.patch(
 	'/:pk',
 	asyncHandler(async (req, res, next) => {
@@ -79,8 +133,8 @@ router.patch(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const primaryKey = await service.update(req.body, pk as any);
+
+		const primaryKey = await service.update(req.body, req.params.pk);
 
 		try {
 			const record = await service.readByKey(primaryKey, req.sanitizedQuery);
@@ -122,8 +176,9 @@ router.delete(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const primaryKey = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		await service.delete(primaryKey as any);
+
+		await service.delete(req.params.pk);
+
 		return next();
 	}),
 	respond
diff --git a/api/src/controllers/items.ts b/api/src/controllers/items.ts
index c29d0cba3b..32fbf301aa 100644
--- a/api/src/controllers/items.ts
+++ b/api/src/controllers/items.ts
@@ -89,8 +89,8 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const primaryKey = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const result = await service.readByKey(primaryKey as any, req.sanitizedQuery);
+
+		const result = await service.readByKey(req.params.pk, req.sanitizedQuery);
 
 		res.locals.payload = {
 			data: result || null,
@@ -179,9 +179,8 @@ router.patch(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const primaryKey = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
 
-		const updatedPrimaryKey = await service.update(req.body, primaryKey as any);
+		const updatedPrimaryKey = await service.update(req.body, req.params.pk);
 
 		try {
 			const result = await service.readByKey(updatedPrimaryKey, req.sanitizedQuery);
@@ -232,9 +231,7 @@ router.delete(
 			schema: req.schema,
 		});
 
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-
-		await service.delete(pk as any);
+		await service.delete(req.params.pk);
 		return next();
 	}),
 	respond
diff --git a/api/src/controllers/permissions.ts b/api/src/controllers/permissions.ts
index 0952c692fe..0690813836 100644
--- a/api/src/controllers/permissions.ts
+++ b/api/src/controllers/permissions.ts
@@ -64,8 +64,8 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const primaryKey = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const record = await service.readByKey(primaryKey as any, req.sanitizedQuery);
+
+		const record = await service.readByKey(req.params.pk, req.sanitizedQuery);
 
 		res.locals.payload = { data: record || null };
 		return next();
@@ -80,8 +80,8 @@ router.patch(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const primaryKey = await service.update(req.body, pk as any);
+
+		const primaryKey = await service.update(req.body, req.params.pk);
 
 		try {
 			const item = await service.readByKey(primaryKey, req.sanitizedQuery);
@@ -123,8 +123,9 @@ router.delete(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		await service.delete(pk as any);
+
+		await service.delete(req.params.pk);
+
 		return next();
 	}),
 	respond
diff --git a/api/src/controllers/presets.ts b/api/src/controllers/presets.ts
index 9aec5166fa..b52f7e758c 100644
--- a/api/src/controllers/presets.ts
+++ b/api/src/controllers/presets.ts
@@ -64,8 +64,8 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const record = await service.readByKey(pk as any, req.sanitizedQuery);
+
+		const record = await service.readByKey(req.params.pk, req.sanitizedQuery);
 
 		res.locals.payload = { data: record || null };
 		return next();
@@ -80,8 +80,8 @@ router.patch(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const primaryKey = await service.update(req.body, pk as any);
+
+		const primaryKey = await service.update(req.body, req.params.pk);
 
 		try {
 			const record = await service.readByKey(primaryKey, req.sanitizedQuery);
@@ -110,7 +110,9 @@ router.delete(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
+
 		await service.delete(req.body as PrimaryKey[]);
+
 		return next();
 	}),
 	respond
@@ -123,8 +125,9 @@ router.delete(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		await service.delete(pk as any);
+
+		await service.delete(req.params.pk);
+
 		return next();
 	}),
 	respond
diff --git a/api/src/controllers/relations.ts b/api/src/controllers/relations.ts
index a71443ff5b..572ab7c7f1 100644
--- a/api/src/controllers/relations.ts
+++ b/api/src/controllers/relations.ts
@@ -17,6 +17,7 @@ router.post(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
+
 		const primaryKey = await service.create(req.body);
 
 		try {
@@ -42,6 +43,7 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
+
 		const metaService = new MetaService({
 			accountability: req.accountability,
 			schema: req.schema,
@@ -63,8 +65,9 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const record = await service.readByKey(pk as any, req.sanitizedQuery);
+
+		const record = await service.readByKey(req.params.pk, req.sanitizedQuery);
+
 		res.locals.payload = { data: record || null };
 		return next();
 	}),
@@ -78,8 +81,8 @@ router.patch(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const primaryKey = await service.update(req.body, pk as any);
+
+		const primaryKey = await service.update(req.body, req.params.pk);
 
 		try {
 			const item = await service.readByKey(primaryKey, req.sanitizedQuery);
@@ -121,8 +124,9 @@ router.delete(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		await service.delete(pk as any);
+
+		await service.delete(req.params.pk);
+
 		return next();
 	}),
 	respond
diff --git a/api/src/controllers/revisions.ts b/api/src/controllers/revisions.ts
index 374d444c7d..fba6e0ca49 100644
--- a/api/src/controllers/revisions.ts
+++ b/api/src/controllers/revisions.ts
@@ -36,8 +36,9 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const record = await service.readByKey(pk as any, req.sanitizedQuery);
+
+		const record = await service.readByKey(req.params.pk, req.sanitizedQuery);
+
 		res.locals.payload = { data: record || null };
 		return next();
 	}),
diff --git a/api/src/controllers/roles.ts b/api/src/controllers/roles.ts
index 5609129189..793a5c6d26 100644
--- a/api/src/controllers/roles.ts
+++ b/api/src/controllers/roles.ts
@@ -63,8 +63,9 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const record = await service.readByKey(pk as any, req.sanitizedQuery);
+
+		const record = await service.readByKey(req.params.pk, req.sanitizedQuery);
+
 		res.locals.payload = { data: record || null };
 		return next();
 	}),
@@ -78,8 +79,8 @@ router.patch(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const primaryKey = await service.update(req.body, pk as any);
+
+		const primaryKey = await service.update(req.body, req.params.pk);
 
 		try {
 			const item = await service.readByKey(primaryKey, req.sanitizedQuery);
@@ -121,8 +122,9 @@ router.delete(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		await service.delete(pk as any);
+
+		await service.delete(req.params.pk);
+
 		return next();
 	}),
 	respond
diff --git a/api/src/controllers/users.ts b/api/src/controllers/users.ts
index 8a6b429cb4..05ea419e60 100644
--- a/api/src/controllers/users.ts
+++ b/api/src/controllers/users.ts
@@ -94,8 +94,9 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const items = await service.readByKey(pk as any, req.sanitizedQuery);
+
+		const items = await service.readByKey(req.params.pk, req.sanitizedQuery);
+
 		res.locals.payload = { data: items || null };
 		return next();
 	}),
@@ -148,8 +149,8 @@ router.patch(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const primaryKey = await service.update(req.body, pk as any);
+
+		const primaryKey = await service.update(req.body, req.params.pk);
 
 		try {
 			const item = await service.readByKey(primaryKey, req.sanitizedQuery);
@@ -192,8 +193,8 @@ router.delete(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		await service.delete(pk as any);
+
+		await service.delete(req.params.pk);
 
 		return next();
 	}),
diff --git a/api/src/controllers/webhooks.ts b/api/src/controllers/webhooks.ts
index 4a5dc38960..908337863e 100644
--- a/api/src/controllers/webhooks.ts
+++ b/api/src/controllers/webhooks.ts
@@ -63,8 +63,8 @@ router.get(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const record = await service.readByKey(pk as any, req.sanitizedQuery);
+
+		const record = await service.readByKey(req.params.pk, req.sanitizedQuery);
 
 		res.locals.payload = { data: record || null };
 		return next();
@@ -79,8 +79,8 @@ router.patch(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		const primaryKey = await service.update(req.body, pk as any);
+
+		const primaryKey = await service.update(req.body, req.params.pk);
 
 		try {
 			const item = await service.readByKey(primaryKey, req.sanitizedQuery);
@@ -123,8 +123,8 @@ router.delete(
 			accountability: req.accountability,
 			schema: req.schema,
 		});
-		const pk = req.params.pk.includes(',') ? req.params.pk.split(',') : req.params.pk;
-		await service.delete(pk as any);
+
+		await service.delete(req.params.pk);
 
 		return next();
 	}),
diff --git a/app/src/modules/files/components/navigation-folder.vue b/app/src/modules/files/components/navigation-folder.vue
index 21fe521a35..2395ce0699 100644
--- a/app/src/modules/files/components/navigation-folder.vue
+++ b/app/src/modules/files/components/navigation-folder.vue
@@ -245,11 +245,21 @@ export default defineComponent({
 					const fileKeys = filesToUpdate.data.data.map((file: { id: string }) => file.id);
 
 					if (folderKeys.length > 0) {
-						await api.patch(`/folders/${folderKeys.join(',')}`, { parent: newParent });
+						await api.patch(`/folders`, {
+							keys: folderKeys,
+							data: {
+								parent: newParent,
+							},
+						});
 					}
 
 					if (fileKeys.length > 0) {
-						await api.patch(`/files/${fileKeys.join(',')}`, { folder: newParent });
+						await api.patch(`/files`, {
+							keys: fileKeys,
+							data: {
+								folder: newParent,
+							},
+						});
 					}
 
 					await api.delete(`/folders/${props.folder.id}`);
diff --git a/app/src/modules/settings/routes/presets/collection/collection.vue b/app/src/modules/settings/routes/presets/collection/collection.vue
index 54fbc5cb65..bad888b641 100644
--- a/app/src/modules/settings/routes/presets/collection/collection.vue
+++ b/app/src/modules/settings/routes/presets/collection/collection.vue
@@ -40,13 +40,7 @@
 		</template>
 
 		<div class="presets-collection">
-			<v-info
-				center
-				type="warning"
-				v-if="!loading && presets.length === 0"
-				:title="$t('no_presets')"
-				icon="bookmark"
-			>
+			<v-info center type="warning" v-if="!loading && presets.length === 0" :title="$t('no_presets')" icon="bookmark">
 				{{ $t('no_presets_copy') }}
 
 				<template #append>
@@ -276,8 +270,8 @@ export default defineComponent({
 				deleting.value = true;
 
 				try {
-					const IDs = selection.value.map((item) => item.id).join(',');
-					await api.delete(`/presets/${IDs}`);
+					const IDs = selection.value.map((item) => item.id);
+					await api.delete(`/presets/${IDs}`, { data: IDs });
 					selection.value = [];
 					await getPresets();
 					confirmDelete.value = false;
diff --git a/app/src/modules/settings/routes/roles/item/components/permissions-overview.vue b/app/src/modules/settings/routes/roles/item/components/permissions-overview.vue
index f36dbafc37..baacc30eb0 100644
--- a/app/src/modules/settings/routes/roles/item/components/permissions-overview.vue
+++ b/app/src/modules/settings/routes/roles/item/components/permissions-overview.vue
@@ -191,7 +191,7 @@ export default defineComponent({
 
 				try {
 					if (toBeDeleted.length > 0) {
-						await api.delete(`/permissions/${toBeDeleted.join(',')}`);
+						await api.delete(`/permissions`, { data: toBeDeleted });
 					}
 
 					if (props.role !== null && props.appAccess === true && useRecommended === true) {
diff --git a/app/src/modules/settings/routes/roles/item/composables/use-update-permissions.ts b/app/src/modules/settings/routes/roles/item/composables/use-update-permissions.ts
index 649e891a53..7ecb5392dd 100644
--- a/app/src/modules/settings/routes/roles/item/composables/use-update-permissions.ts
+++ b/app/src/modules/settings/routes/roles/item/composables/use-update-permissions.ts
@@ -126,7 +126,7 @@ export default function useUpdatePermissions(
 		saving.value = true;
 
 		try {
-			await api.delete(`/permissions/${permissions.value.map((p) => p.id).join(',')}`);
+			await api.delete('/permissions', { data: permissions.value.map((p) => p.id) });
 		} catch (err) {
 			unexpectedError(err);
 		} finally {