diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc9a0b7..14ff12d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v1.3.0-SNAPSHOT] - [2023-01-27]
+
+- Feature #24253 add support for decrypted ServiceEndpoint
+
 ## [v1.2.0] - [2021-06-08]
 
 - Feature #21584 added support for /ServiceEndpoint/{category} REST call
diff --git a/pom.xml b/pom.xml
index 2c73844..e13802a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>org.gcube.information-system</groupId>
 	<artifactId>icproxy</artifactId>
-	<version>1.2.0</version>
+	<version>1.3.0-SNAPSHOT</version>
 	<name>ICProxy</name>
 
 	<packaging>war</packaging>
@@ -27,6 +27,8 @@
 	<properties>
 		<webappDirectory>${project.basedir}/src/main/webapp/WEB-INF</webappDirectory>
 		<distroDirectory>${project.basedir}/distro</distroDirectory>
+		<maven.compiler.target>1.8</maven.compiler.target>
+		<maven.compiler.source>1.8</maven.compiler.source>
 	</properties>
 
 	<dependencyManagement>
@@ -73,6 +75,10 @@
 			<groupId>org.gcube.resources</groupId>
 			<artifactId>common-gcore-resources</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.gcube.core</groupId>
+			<artifactId>common-encryption</artifactId>
+		</dependency>
 		
 		<!-- jersey -->
 
@@ -104,7 +110,7 @@
 		<dependency>
 			<groupId>org.projectlombok</groupId>
 			<artifactId>lombok</artifactId>
-			<version>1.14.8</version>
+			<version>1.18.2</version>
 		</dependency>
 
 		<dependency>
@@ -125,8 +131,34 @@
 			<version>4.12</version>
 			<scope>test</scope>
 		</dependency>
+ <!--jaxb jdk11 support-->
+		<dependency>
+			<groupId>javax.xml.bind</groupId>
+			<artifactId>jaxb-api</artifactId>
+			<version>2.3.1</version>
+		</dependency>
+		<dependency>
+			<groupId>org.glassfish.jaxb</groupId>
+			<artifactId>jaxb-runtime</artifactId>
+			<version>2.3.1</version>
+		</dependency>
+		<dependency>
+			<groupId>javax.activation</groupId>
+			<artifactId>activation</artifactId>
+			<version>1.1</version>
+		</dependency>
+		<dependency>
+			<groupId>com.sun.xml.ws</groupId>
+			<artifactId>jaxws-ri</artifactId>
+			<version>2.3.2</version>
+			<type>pom</type>
+		</dependency>
+		<dependency>
+			<groupId>org.gcube.common</groupId>
+			<artifactId>keycloak-client</artifactId>
+			<version>[1.0.0,2.0.0-SNAPSHOT)</version>
+		</dependency>
 	</dependencies>
-
 	<build>
 		<finalName>${artifactId}</finalName>
 	</build>
diff --git a/src/main/java/org/gcube/informationsystem/icproxy/resources/ServiceEndpointResource.java b/src/main/java/org/gcube/informationsystem/icproxy/resources/ServiceEndpointResource.java
index fb20b48..21c2ad5 100644
--- a/src/main/java/org/gcube/informationsystem/icproxy/resources/ServiceEndpointResource.java
+++ b/src/main/java/org/gcube/informationsystem/icproxy/resources/ServiceEndpointResource.java
@@ -4,21 +4,23 @@ import static org.gcube.resources.discovery.icclient.ICFactory.client;
 import static org.gcube.resources.discovery.icclient.ICFactory.clientFor;
 import static org.gcube.resources.discovery.icclient.ICFactory.queryFor;
 
+import java.util.ArrayList;
 import java.util.List;
+import java.util.Objects;
 
 import javax.validation.constraints.NotNull;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
+import javax.ws.rs.*;
 import javax.ws.rs.core.MediaType;
 
 import lombok.extern.slf4j.Slf4j;
 
-import org.gcube.common.resources.gcore.ServiceEndpoint;
+import org.gcube.common.resources.gcore.*;
+import org.gcube.common.resources.gcore.utils.Group;
 import org.gcube.common.scope.api.ScopeProvider;
 import org.gcube.resources.discovery.client.api.DiscoveryClient;
 import org.gcube.resources.discovery.client.queries.api.SimpleQuery;
+import org.gcube.resources.discovery.client.queries.impl.XQuery;
+import org.gcube.common.encryption.StringEncrypter;
 
 @Slf4j
 @Path("ServiceEndpoint")
@@ -37,20 +39,61 @@ public class ServiceEndpointResource {
 		return endpoints; 
 	}
 
+//	@GET
+//	@Path("/{category}/{name}")
+//	@Produces(MediaType.APPLICATION_XML)
+//	public List<ServiceEndpoint> retrieve(@NotNull @PathParam("name") String resourceName,
+//			@NotNull @PathParam("category") String resourceCategory) {
+//		log.info("ServiceEndpoint called with category {} and name {} in scope {}",resourceCategory, resourceName, ScopeProvider.instance.get());
+//
+//		DiscoveryClient<ServiceEndpoint> client = clientFor(ServiceEndpoint.class);
+//
+//		List<ServiceEndpoint> endpoints = client.submit(getQuery(resourceName, resourceCategory));
+//		log.debug("retrieved resources are "+endpoints.size());
+//		return endpoints;
+//	}
+
 	@GET
 	@Path("/{category}/{name}")
 	@Produces(MediaType.APPLICATION_XML)
-	public List<ServiceEndpoint> retrieve(@NotNull @PathParam("name") String resourceName, 
-			@NotNull @PathParam("category") String resourceCategory) {
+	public List<ServiceEndpoint> retrieve(@NotNull @PathParam("name") String resourceName,
+										  @NotNull @PathParam("category") String resourceCategory, @QueryParam("decrypt") boolean isDecrypt) {
 		log.info("ServiceEndpoint called with category {} and name {} in scope {}",resourceCategory, resourceName, ScopeProvider.instance.get());
-		
 		DiscoveryClient<ServiceEndpoint> client = clientFor(ServiceEndpoint.class);
-
 		List<ServiceEndpoint> endpoints = client.submit(getQuery(resourceName, resourceCategory));
-		log.debug("retrieved resources are "+endpoints.size());
-		return endpoints; 
+		if(Objects.nonNull(endpoints)) {
+			log.debug("retrieved resources are "+endpoints.size());
+			if (isDecrypt) {
+				List<ServiceEndpoint> ses = new ArrayList<>(endpoints.size());
+				for (ServiceEndpoint resource : endpoints) {
+					ses.add(decryptResource(resource));
+				}
+				return ses;
+			}
+		}
+		return endpoints;
 	}
 
+//	@GET
+//	@Path("/{category}/{name}/{ap}")
+//	@Produces(MediaType.TEXT_XML)
+//	public String retrieve(@NotNull @PathParam("name") String resourceName,
+//										  @NotNull @PathParam("category") String resourceCategory,
+//										  @NotNull @PathParam("ap") String accessPoint) {
+//		log.info("ServiceEndpoint called with category {}, name {} and accessPoint {} in scope {}",resourceCategory, resourceName, accessPoint, ScopeProvider.instance.get());
+//		XQuery query=queryFor(ServiceEndpoint.class);
+//		query.addCondition(String.format("$resource/Profile/Name/text() eq '%s'",resourceName));
+//		query.addCondition(String.format("$resource/Profile/Category/text() eq '%s'",resourceCategory));
+//		query.setResult("$resource/Profile/AccessPoint/Interface/Endpoint[@EntryName='"+accessPoint+"']/text()");
+//		DiscoveryClient<String> client = client();
+//		List<String> accessList= client.submit(query);
+//		if (Objects.nonNull(accessList))
+//			return accessList.get(0).toString();
+//		else
+//			log.warn("endpoint not found with following coordinates: {} {} and accesspoint: {}", resourceCategory, resourceName,accessPoint);
+//		return null;
+//	}
+
 	@GET
 	@Path("/{category}/{name}/Result/{result:([^$\\?]+)}")
 	@Produces(MediaType.TEXT_XML)
@@ -90,5 +133,24 @@ public class ServiceEndpointResource {
 		query.addCondition(String.format("$resource/Profile/Category/text() eq '%s'",resourceCategory));
 		return query;
 	}
-	
+
+	private ServiceEndpoint decryptResource(ServiceEndpoint resource) {
+		Group<ServiceEndpoint.AccessPoint> aps=resource.profile().accessPoints();
+		for (ServiceEndpoint.AccessPoint ap : aps){
+			String decrypted =decryptString(ap.password());
+			String user= ap.username();
+
+			ap.credentials(decrypted, user);
+		}
+		return resource;
+	}
+
+	public static String decryptString(String toDecrypt){
+		try{
+			return StringEncrypter.getEncrypter().decrypt(toDecrypt);
+		}catch(Exception e) {
+			throw new RuntimeException("Unable to decrypt : "+toDecrypt,e);
+		}
+	}
+
 }
diff --git a/src/test/java/org/gcube/informationsystem/icproxy/TestCall.java b/src/test/java/org/gcube/informationsystem/icproxy/TestCall.java
index bf68e34..c67f1d6 100644
--- a/src/test/java/org/gcube/informationsystem/icproxy/TestCall.java
+++ b/src/test/java/org/gcube/informationsystem/icproxy/TestCall.java
@@ -2,6 +2,8 @@ package org.gcube.informationsystem.icproxy;
 
 import javax.ws.rs.core.Application;
 
+//import org.gcube.common.authorization.library.provider.SecurityTokenProvider;
+import org.gcube.common.scope.api.ScopeProvider;
 import org.gcube.informationsystem.icproxy.resources.GCoreEndpointResource;
 import org.gcube.informationsystem.icproxy.resources.GenericResourceResource;
 import org.gcube.informationsystem.icproxy.resources.HostingNodeResource;
@@ -15,7 +17,9 @@ public class TestCall extends JerseyTest{
 
 	@Override
 	protected Application configure() {
+		ScopeProvider.instance.set("/gcube/devsec");
 		return new ResourceConfig(ICResource.class,GCoreEndpointResource.class, ServiceEndpointResource.class, HostingNodeResource.class, GenericResourceResource.class);
+
 	}
 
 	@Test
@@ -34,8 +38,6 @@ public class TestCall extends JerseyTest{
 	
 	@Test
 	public void gcoreEndpointWithResult() {
-		
-		
 		final String ret = target("GCoreEndpoint").path("DataAnalysis")
 				.queryParam("result","/Profile/AccessPoint/RunningInstanceInterfaces//Endpoint[@EntryName/string() eq \"querymanager\"]")
 				.queryParam("scope", "/gcube/devsec").request().get(String.class);
@@ -47,6 +49,12 @@ public class TestCall extends JerseyTest{
 		final String ret = target("ServiceEndpoint").path("BiodiversityRepository").path("CatalogueOfLife").queryParam("scope", "/gcube/devsec").request().get(String.class);
 		System.out.println(ret);
 	}
+
+	@Test
+	public void serviceEndpointFree() {
+		final String ret = target("ServiceEndpoint").path("Storage").path("StorageManager").queryParam("decrypt", true).queryParam("scope", "/gcube/devsec").request().get(String.class);
+		System.out.println(ret);
+	}
 	
 	@Test
 	public void hostingNode() {
@@ -62,7 +70,7 @@ public class TestCall extends JerseyTest{
 	
 	@Test
 	public void getById() {
-		final String ret = target("/").path("92ee1020-5604-11e3-8182-e7053f61b8fe").queryParam("scope", "/gcube/devsec").request().get(String.class);
+		final String ret = target("/").path("aab08cf4-ed27-406c-b4a2-89888300976f").queryParam("scope", "/gcube/devsec").request().get(String.class);
 		System.out.println(ret);
 	}