diff --git a/CHANGELOG.md b/CHANGELOG.md
index 301b5658..86b01fa3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [0.16.5] - 2026-05-XX
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+
+## Fixed
+
 ## [0.16.3] - 2026-04-30
 
 If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
diff --git a/crates/http/src/api/mod.rs b/crates/http/src/api/mod.rs
index d271d5d4..205234d0 100644
--- a/crates/http/src/api/mod.rs
+++ b/crates/http/src/api/mod.rs
@@ -252,38 +252,45 @@ impl ManagementApi for Server {
     ) -> trc::Result<AccessToken> {
         let params = UrlParams::new(req.uri().query());
         if let Some(token) = params.get("token") {
-            // SPDX-SnippetBegin
-            // SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
-            // SPDX-License-Identifier: LicenseRef-SEL
-            #[cfg(feature = "enterprise")]
-            if self.core.is_enterprise_edition() {
-                let path = req.uri().path();
-                let (grant_type, permissions) = if path.starts_with("/api/live/tracing") {
-                    (GrantType::LiveTracing, Permission::LiveTracing)
-                } else if path.starts_with("/api/live/metrics") {
-                    (GrantType::LiveMetrics, Permission::LiveMetrics)
-                } else if path.starts_with("/api/live/delivery") {
-                    (GrantType::LiveDelivery, Permission::LiveDeliveryTest)
-                } else {
-                    return Err(trc::ResourceEvent::NotFound.into_err());
-                };
+            let path = req.uri().path();
+            let grant = if path.starts_with("/api/live/delivery") {
+                Some((GrantType::LiveDelivery, Permission::LiveDeliveryTest))
+            } else {
+                // SPDX-SnippetBegin
+                // SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
+                // SPDX-License-Identifier: LicenseRef-SEL
+                #[cfg(feature = "enterprise")]
+                {
+                    if self.core.is_enterprise_edition() {
+                        if path.starts_with("/api/live/tracing") {
+                            Some((GrantType::LiveTracing, Permission::LiveTracing))
+                        } else if path.starts_with("/api/live/metrics") {
+                            Some((GrantType::LiveMetrics, Permission::LiveMetrics))
+                        } else {
+                            None
+                        }
+                    } else {
+                        None
+                    }
+                }
+                // SPDX-SnippetEnd
+                #[cfg(not(feature = "enterprise"))]
+                {
+                    None
+                }
+            };
+
+            if let Some((grant_type, permission)) = grant {
                 self.validate_access_token(grant_type.into(), token)
                     .await
                     .map(|token_info| {
-                        AccessToken::from_permissions(token_info.account_id, [permissions])
+                        AccessToken::from_permissions(token_info.account_id, [permission])
                     })
             } else {
                 self.authenticate_headers(req, session)
                     .await
                     .map(|(_, token)| token)
             }
-            // SPDX-SnippetEnd
-            #[cfg(not(feature = "enterprise"))]
-            {
-                self.authenticate_headers(req, session)
-                    .await
-                    .map(|(_, token)| token)
-            }
         } else {
             self.authenticate_headers(req, session)
                 .await