diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UIPluginDto.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UIPluginDto.java
new file mode 100644
index 0000000000..dfed9a3612
--- /dev/null
+++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UIPluginDto.java
@@ -0,0 +1,25 @@
+package sonia.scm.api.v2.resources;
+
+import de.otto.edison.hal.HalRepresentation;
+import de.otto.edison.hal.Links;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+@Getter @Setter @NoArgsConstructor
+public class UIPluginDto extends HalRepresentation {
+
+  private String name;
+  private Iterable<String> bundles;
+
+  public UIPluginDto(String name, Iterable<String> bundles) {
+    this.name = name;
+    this.bundles = bundles;
+  }
+
+  @Override
+  protected HalRepresentation add(Links links) {
+    return super.add(links);
+  }
+
+}
diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UIRootResource.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UIRootResource.java
new file mode 100644
index 0000000000..36c4f85c25
--- /dev/null
+++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UIRootResource.java
@@ -0,0 +1,46 @@
+package sonia.scm.api.v2.resources;
+
+import sonia.scm.plugin.PluginLoader;
+import sonia.scm.plugin.PluginWrapper;
+
+import javax.inject.Inject;
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+import java.util.List;
+import java.util.stream.Collectors;
+
+@Path("v2/ui")
+public class UIRootResource {
+
+  private final PluginLoader pluginLoader;
+
+  @Inject
+  public UIRootResource(PluginLoader pluginLoader) {
+    this.pluginLoader = pluginLoader;
+  }
+
+  @GET
+  @Path("plugins")
+  @Produces(MediaType.APPLICATION_JSON)
+  public List<UIPluginDto> getInstalledPlugins() {
+    return pluginLoader.getInstalledPlugins()
+      .stream()
+      .filter(this::filter)
+      .map(this::map)
+      .collect(Collectors.toList());
+  }
+
+  private boolean filter(PluginWrapper plugin) {
+    return plugin.getPlugin().getResources() != null;
+  }
+
+  private UIPluginDto map(PluginWrapper plugin) {
+    return new UIPluginDto(
+      plugin.getPlugin().getInformation().getName(),
+      plugin.getPlugin().getResources().getScriptResources()
+    );
+  }
+
+}
diff --git a/scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java b/scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java
index 01967afd00..0d59d77027 100644
--- a/scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java
+++ b/scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java
@@ -62,7 +62,8 @@ import javax.servlet.http.HttpServletResponse;
  * @author Sebastian Sdorra
  */
 @Priority(Filters.PRIORITY_AUTHORIZATION)
-@WebElement(value = Filters.PATTERN_RESTAPI, morePatterns = { Filters.PATTERN_DEBUG })
+// TODO find a better way for unprotected resources
+@WebElement(value = "/api/rest/(?!v2/ui).*", regex = true)
 public class SecurityFilter extends HttpFilter
 {