diff --git a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/validators/HsHostingAssetEntityValidatorRegistry.java b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/validators/HsHostingAssetEntityValidatorRegistry.java
index c153784c..ef0a4899 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/validators/HsHostingAssetEntityValidatorRegistry.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/validators/HsHostingAssetEntityValidatorRegistry.java
@@ -52,12 +52,16 @@ public class HsHostingAssetEntityValidatorRegistry {
 
     public static void cleanup(final HsHostingAssetEntity entity, final HsHostingAssetResource resource) {
         final var validator = HsHostingAssetEntityValidatorRegistry.forType(entity.getType());
-//        final var validated = validator.cleanup(hostingAsset);
-        //validator.cleanup()
-        final var config = new HashMap<>((Map<String, Object>) resource.getConfig());
-        config.remove("password"); // FIXME
-        config.remove("totpKey"); // FIXME
+        final var config = validator.cleanup(asMap(resource));
         resource.setConfig(config);
     }
 
+    @SuppressWarnings("unchecked")
+    private static Map<String, Object> asMap(final HsHostingAssetResource resource) {
+        if (resource.getConfig() instanceof Map map) {
+            return map;
+        }
+        throw new IllegalArgumentException("expected a Map, but got a " + resource.getConfig().getClass());
+    }
+
 }
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/validation/HsEntityValidator.java b/src/main/java/net/hostsharing/hsadminng/hs/validation/HsEntityValidator.java
index 7dfced5c..67540554 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/validation/HsEntityValidator.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/validation/HsEntityValidator.java
@@ -3,6 +3,7 @@ package net.hostsharing.hsadminng.hs.validation;
 
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.function.Supplier;
@@ -86,4 +87,10 @@ public abstract class HsEntityValidator<E> {
         }
         throw new IllegalArgumentException("Integer value (or null) expected, but got " + value);
     }
+
+    public Map<String, Object> cleanup(final Map<String, Object> config) {
+        final var copy = new HashMap<>(config);
+        stream(propertyValidators).filter(p -> p.writeOnly).forEach(p -> copy.remove(p.propertyName));
+        return copy;
+    }
 }
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/validation/StringProperty.java b/src/main/java/net/hostsharing/hsadminng/hs/validation/StringProperty.java
index ab392383..805f3d0b 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/validation/StringProperty.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/validation/StringProperty.java
@@ -17,8 +17,6 @@ public class StringProperty extends ValidatableProperty<String> {
     private Pattern regExPattern;
     private Integer minLength;
     private Integer maxLength;
-    private boolean writeOnly;
-    private boolean readOnly;
     private boolean hidden;
 
     protected StringProperty(final String propertyName) {
@@ -49,18 +47,6 @@ public class StringProperty extends ValidatableProperty<String> {
         return this;
     }
 
-    public StringProperty writeOnly() {
-        this.writeOnly = true;
-        super.optional();
-        return this;
-    }
-
-    public StringProperty readOnly() {
-        this.readOnly = true;
-        super.optional();
-        return this;
-    }
-
     @Override
     protected void validate(final List<String> result, final String propValue, final PropertiesProvider propProvider) {
         if (minLength != null && propValue.length()<minLength) {
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/validation/ValidatableProperty.java b/src/main/java/net/hostsharing/hsadminng/hs/validation/ValidatableProperty.java
index 5bc85e29..9bdf064b 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/validation/ValidatableProperty.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/validation/ValidatableProperty.java
@@ -32,6 +32,9 @@ public abstract class ValidatableProperty<T> {
     private final String[] keyOrder;
     private Boolean required;
     private T defaultValue;
+    protected boolean readOnly;
+    protected boolean writeOnly;
+
     protected Function<ValidatableProperty<?>[], T[]> deferredInit;
     private boolean isTotalsValidator = false;
     @JsonIgnore
@@ -43,6 +46,20 @@ public abstract class ValidatableProperty<T> {
         return null;
     }
 
+
+    public ValidatableProperty<T> writeOnly() {
+        this.writeOnly = true;
+        optional();
+        return this;
+    }
+
+    public ValidatableProperty<T> readOnly() {
+        this.readOnly = true;
+        optional();
+        return this;
+    }
+
+
     public ValidatableProperty<T> required() {
         required = TRUE;
         return this;