diff --git a/lib/base/configobject.cpp b/lib/base/configobject.cpp
index 0cfa71b93..3f0590f79 100644
--- a/lib/base/configobject.cpp
+++ b/lib/base/configobject.cpp
@@ -130,7 +130,7 @@ void ConfigObject::ModifyAttribute(const String& attr, const Value& value, bool
 	int fid = type->GetFieldId(fieldName);
 	Field field = type->GetFieldInfo(fid);
 
-	if (field.Attributes & FAInternal || field.Attributes & FANoModify)
+	if (field.Attributes & FANoUserModify)
 		BOOST_THROW_EXCEPTION(std::invalid_argument("Attribute cannot be modified."));
 
 	if (field.Attributes & FAConfig) {
diff --git a/lib/base/configobject.ti b/lib/base/configobject.ti
index 90a514a1c..ba19b7bc1 100644
--- a/lib/base/configobject.ti
+++ b/lib/base/configobject.ti
@@ -68,8 +68,8 @@ private:
 
 abstract class ConfigObject : ConfigObjectBase
 {
-	[config, internal, no_modify] String __name (Name);
-	[config, no_modify] String "name" (ShortName) {
+	[config, no_user_modify] String __name (Name);
+	[config, no_user_modify] String "name" (ShortName) {
 		get {{{
 			if (m_ShortName.IsEmpty())
 				return GetName();
@@ -77,24 +77,24 @@ abstract class ConfigObject : ConfigObjectBase
 				return m_ShortName;
 		}}}
 	};
-	[config, internal, get_protected, no_modify] String type (TypeNameV);
+	[config, get_protected, no_user_modify] String type (TypeNameV);
 	[config] name(Zone) zone (ZoneName);
-	[config] String package;
-	[config, internal, get_protected, no_modify] Array::Ptr templates;
-	[get_protected] bool active;
-	[get_protected] bool paused {
+	[config, no_user_modify] String package;
+	[config, get_protected, no_user_modify] Array::Ptr templates;
+	[get_protected, no_user_modify] bool active;
+	[get_protected, no_user_modify] bool paused {
 		default {{{ return true; }}}
 	};
-	[get_protected, internal, no_modify] bool start_called;
-	[get_protected, internal, no_modify] bool stop_called;
-	[get_protected, internal, no_modify] bool pause_called;
-	[get_protected, internal, no_modify] bool resume_called;
+	[get_protected, no_user_view, no_user_modify] bool start_called;
+	[get_protected, no_user_view, no_user_modify] bool stop_called;
+	[get_protected, no_user_view, no_user_modify] bool pause_called;
+	[get_protected, no_user_view, no_user_modify] bool resume_called;
 	[enum] HAMode ha_mode (HAMode);
-	[protected, no_modify] Dictionary::Ptr extensions;
+	[protected, no_user_view, no_user_modify] Dictionary::Ptr extensions;
 
-	[protected, no_modify] bool state_loaded;
-	Dictionary::Ptr original_attributes;
-	[state] double version {
+	[protected, no_user_view, no_user_modify] bool state_loaded;
+	[no_user_modify] Dictionary::Ptr original_attributes;
+	[state, no_user_modify] double version {
 		default {{{ return 0; }}}
 	};
 };
diff --git a/lib/base/type.hpp b/lib/base/type.hpp
index dd13d9902..f5687a375 100644
--- a/lib/base/type.hpp
+++ b/lib/base/type.hpp
@@ -36,10 +36,10 @@ enum FieldAttribute
 	FAEphemeral = 1,
 	FAConfig = 2,
 	FAState = 4,
-	FAInternal = 64,
-	FARequired = 512,
-	FANavigation = 1024,
-	FANoModify = 2048
+	FARequired = 256,
+	FANavigation = 512,
+	FANoUserModify = 1024,
+	FANoUserView = 2048
 };
 
 class Type;
diff --git a/lib/cli/clicommand.cpp b/lib/cli/clicommand.cpp
index 0694c8964..30d52aa28 100644
--- a/lib/cli/clicommand.cpp
+++ b/lib/cli/clicommand.cpp
@@ -73,7 +73,7 @@ std::vector<String> icinga::GetFieldCompletionSuggestions(const Type::Ptr& type,
 	for (int i = 0; i < type->GetFieldCount(); i++) {
 		Field field = type->GetFieldInfo(i);
 
-		if (!(field.Attributes & FAConfig) || field.Attributes & FAInternal)
+		if (field.Attributes & FANoUserView)
 			continue;
 
 		if (strcmp(field.TypeName, "int") != 0 && strcmp(field.TypeName, "double") != 0
diff --git a/lib/db_ido/dbconnection.ti b/lib/db_ido/dbconnection.ti
index f1f2bef44..57d47c70d 100644
--- a/lib/db_ido/dbconnection.ti
+++ b/lib/db_ido/dbconnection.ti
@@ -51,9 +51,9 @@ abstract class DbConnection : ConfigObject
 		default {{{ return 60; }}}
 	};
 
-	String schema_version;
-	bool connected;
-	bool should_connect {
+	[no_user_modify] String schema_version;
+	[no_user_modify] bool connected;
+	[no_user_modify] bool should_connect {
 		default {{{ return true; }}}
 	};
 };
diff --git a/lib/icinga/checkable.ti b/lib/icinga/checkable.ti
index afb5a7594..d6ed943c2 100644
--- a/lib/icinga/checkable.ti
+++ b/lib/icinga/checkable.ti
@@ -137,10 +137,10 @@ abstract class Checkable : CustomVarObject
 		default {{{ return AcknowledgementNone; }}}
 	};
 	[state] double acknowledgement_expiry;
-	[state] Dictionary::Ptr comments {
+	[state, no_user_modify] Dictionary::Ptr comments {
 		default {{{ return new Dictionary(); }}}
 	};
-	[state] Dictionary::Ptr downtimes {
+	[state, no_user_modify] Dictionary::Ptr downtimes {
 		default {{{ return new Dictionary(); }}}
 	};
 	[state] bool force_next_notification;
diff --git a/lib/icinga/host.ti b/lib/icinga/host.ti
index c183998c9..37af43437 100644
--- a/lib/icinga/host.ti
+++ b/lib/icinga/host.ti
@@ -27,7 +27,7 @@ namespace icinga
 
 class Host : Checkable
 {
-	[config, no_modify] array(name(HostGroup)) groups {
+	[config, no_user_modify] array(name(HostGroup)) groups {
 		default {{{ return new Array(); }}}
 	};
 
diff --git a/lib/icinga/hostgroup.ti b/lib/icinga/hostgroup.ti
index 2b8d4175c..8a8b41774 100644
--- a/lib/icinga/hostgroup.ti
+++ b/lib/icinga/hostgroup.ti
@@ -35,7 +35,7 @@ class HostGroup : CustomVarObject
 		}}}
 	};
 
-	[config] array(name(HostGroup)) groups;
+	[config, no_user_modify] array(name(HostGroup)) groups;
 	[config] String notes;
 	[config] String notes_url;
 	[config] String action_url;
diff --git a/lib/icinga/notification.ti b/lib/icinga/notification.ti
index 5df94ed1f..06a03f4ba 100644
--- a/lib/icinga/notification.ti
+++ b/lib/icinga/notification.ti
@@ -86,7 +86,7 @@ class Notification : CustomVarObject < NotificationNameComposer
 		}}}
 	};
 
-	[state] Array::Ptr notified_users {
+	[state, no_user_modify] Array::Ptr notified_users {
 		default {{{ return new Array(); }}}
 	};
 
diff --git a/lib/icinga/service.ti b/lib/icinga/service.ti
index db09fe945..224e5fc58 100644
--- a/lib/icinga/service.ti
+++ b/lib/icinga/service.ti
@@ -40,7 +40,7 @@ class Service : Checkable < ServiceNameComposer
 {
 	load_after Host;
 
-	[config, no_modify] array(name(ServiceGroup)) groups {
+	[config, no_user_modify] array(name(ServiceGroup)) groups {
 		default {{{ return new Array(); }}}
 	};
 
diff --git a/lib/icinga/servicegroup.ti b/lib/icinga/servicegroup.ti
index eb69b56dc..12b9d738b 100644
--- a/lib/icinga/servicegroup.ti
+++ b/lib/icinga/servicegroup.ti
@@ -35,7 +35,7 @@ class ServiceGroup : CustomVarObject
 		}}}
 	};
 
-	[config] array(name(ServiceGroup)) groups;
+	[config, no_user_modify] array(name(ServiceGroup)) groups;
 	[config] String notes;
 	[config] String notes_url;
 	[config] String action_url;
diff --git a/lib/icinga/timeperiod.ti b/lib/icinga/timeperiod.ti
index f7cf8ff4d..5bd6d0885 100644
--- a/lib/icinga/timeperiod.ti
+++ b/lib/icinga/timeperiod.ti
@@ -37,9 +37,9 @@ class TimePeriod : CustomVarObject
 	};
 	[config] Dictionary::Ptr ranges;
 	[config, required] Function::Ptr update;
-	[state] Value valid_begin;
-	[state] Value valid_end;
-	[state] Array::Ptr segments;
+	[state, no_user_modify] Value valid_begin;
+	[state, no_user_modify] Value valid_end;
+	[state, no_user_modify] Array::Ptr segments;
 	[no_storage] bool is_inside {
 		get;
 	};
diff --git a/lib/icinga/user.ti b/lib/icinga/user.ti
index e6781ade7..0443eca30 100644
--- a/lib/icinga/user.ti
+++ b/lib/icinga/user.ti
@@ -35,7 +35,7 @@ class User : CustomVarObject
 				return m_DisplayName;
 		}}}
 	};
-	[config, no_modify] array(name(UserGroup)) groups {
+	[config, no_user_modify] array(name(UserGroup)) groups {
 		default {{{ return new Array(); }}}
 	};
 	[config, navigation] name(TimePeriod) period (PeriodRaw) {
diff --git a/lib/icinga/usergroup.ti b/lib/icinga/usergroup.ti
index f1c480a41..1ebcb8b1f 100644
--- a/lib/icinga/usergroup.ti
+++ b/lib/icinga/usergroup.ti
@@ -35,7 +35,7 @@ class UserGroup : CustomVarObject
 		}}}
 	};
 
-	[config] array(name(UserGroup)) groups;
+	[config, no_user_modify] array(name(UserGroup)) groups;
 };
 
 }
diff --git a/lib/remote/apilistener.ti b/lib/remote/apilistener.ti
index 2b7e82be2..9432d6f2f 100644
--- a/lib/remote/apilistener.ti
+++ b/lib/remote/apilistener.ti
@@ -43,9 +43,9 @@ class ApiListener : ConfigObject
 
 	[config] String ticket_salt;
 
-	[state] double log_message_timestamp;
+	[state, no_user_modify] double log_message_timestamp;
 
-	String identity;
+	[no_user_modify] String identity;
 };
 
 }
diff --git a/lib/remote/apiuser.ti b/lib/remote/apiuser.ti
index ac4666e99..21087c90a 100644
--- a/lib/remote/apiuser.ti
+++ b/lib/remote/apiuser.ti
@@ -27,7 +27,7 @@ namespace icinga
 
 class ApiUser : ConfigObject
 {
-	[config] String password;
+	[config, no_user_view] String password;
 	[config] String client_cn (ClientCN);
 	[config] array(Value) permissions;
 };
diff --git a/lib/remote/endpoint.ti b/lib/remote/endpoint.ti
index eab3fb739..f4eccef99 100644
--- a/lib/remote/endpoint.ti
+++ b/lib/remote/endpoint.ti
@@ -37,8 +37,8 @@ class Endpoint : ConfigObject
 	[state] double local_log_position;
 	[state] double remote_log_position;
 
-	bool connecting;
-	bool syncing;
+	[no_user_modify] bool connecting;
+	[no_user_modify] bool syncing;
 };
 
 }
diff --git a/lib/remote/objectqueryhandler.cpp b/lib/remote/objectqueryhandler.cpp
index 888d5a50f..ad85955ed 100644
--- a/lib/remote/objectqueryhandler.cpp
+++ b/lib/remote/objectqueryhandler.cpp
@@ -160,6 +160,10 @@ bool ObjectQueryHandler::HandleRequest(const ApiUser::Ptr& user, HttpRequest& re
 
 				Value val = joinedObj->GetField(fid);
 
+				/* hide attributes which shouldn't be user-visible */
+				if (field.Attributes & FANoUserView)
+					continue;
+
 				/* hide internal navigation fields */
 				if (field.Attributes & FANavigation) {
 					Value nval = joinedObj->NavigateField(fid);
diff --git a/lib/remote/typequeryhandler.cpp b/lib/remote/typequeryhandler.cpp
index c278177cb..4e4029665 100644
--- a/lib/remote/typequeryhandler.cpp
+++ b/lib/remote/typequeryhandler.cpp
@@ -148,9 +148,10 @@ bool TypeQueryHandler::HandleRequest(const ApiUser::Ptr& user, HttpRequest& requ
 
 			attributeInfo->Set("config", static_cast<bool>(field.Attributes & FAConfig));
 			attributeInfo->Set("state", static_cast<bool>(field.Attributes & FAState));
-			attributeInfo->Set("internal", static_cast<bool>(field.Attributes & FAInternal));
 			attributeInfo->Set("required", static_cast<bool>(field.Attributes & FARequired));
 			attributeInfo->Set("navigation", static_cast<bool>(field.Attributes & FANavigation));
+			attributeInfo->Set("no_user_modify", static_cast<bool>(field.Attributes & FANoUserModify));
+			attributeInfo->Set("no_user_view", static_cast<bool>(field.Attributes & FANoUserView));
 		}
 	}
 
diff --git a/tools/mkclass/class_lexer.ll b/tools/mkclass/class_lexer.ll
index 63eaf1ddb..679a651eb 100644
--- a/tools/mkclass/class_lexer.ll
+++ b/tools/mkclass/class_lexer.ll
@@ -143,10 +143,10 @@ enum				{ yylval->num = FAEnum; return T_FIELD_ATTRIBUTE; }
 get_protected			{ yylval->num = FAGetProtected; return T_FIELD_ATTRIBUTE; }
 set_protected			{ yylval->num = FASetProtected; return T_FIELD_ATTRIBUTE; }
 protected			{ yylval->num = FAGetProtected | FASetProtected; return T_FIELD_ATTRIBUTE; }
-internal			{ yylval->num = FAInternal; return T_FIELD_ATTRIBUTE; }
 no_storage			{ yylval->num = FANoStorage; return T_FIELD_ATTRIBUTE; }
+no_user_modify			{ yylval->num = FANoUserModify; return T_FIELD_ATTRIBUTE; }
+no_user_view			{ yylval->num = FANoUserView; return T_FIELD_ATTRIBUTE; }
 navigation			{ return T_NAVIGATION; }
-no_modify			{ yylval->num = FANoModify; return T_FIELD_ATTRIBUTE; }
 validator			{ return T_VALIDATOR; }
 required			{ return T_REQUIRED; }
 name				{ return T_NAME; }
diff --git a/tools/mkclass/classcompiler.hpp b/tools/mkclass/classcompiler.hpp
index 576cd61ad..456b5ffdc 100644
--- a/tools/mkclass/classcompiler.hpp
+++ b/tools/mkclass/classcompiler.hpp
@@ -67,12 +67,12 @@ enum FieldAttribute
 	FAEnum = 8,
 	FAGetProtected = 16,
 	FASetProtected = 32,
-	FAInternal = 64,
-	FANoStorage = 128,
-	FALoadDependency = 256,
-	FARequired = 512,
-	FANavigation = 1024,
-	FANoModify = 2048
+	FANoStorage = 64,
+	FALoadDependency = 128,
+	FARequired = 256,
+	FANavigation = 512,
+	FANoUserModify = 1024,
+	FANoUserView = 2048
 };
 
 struct FieldType