diff --git a/apps/wiggle/src/wiggle_org_handler.erl b/apps/wiggle/src/wiggle_org_handler.erl
index c5e65d4..9f6c7ee 100644
--- a/apps/wiggle/src/wiggle_org_handler.erl
+++ b/apps/wiggle/src/wiggle_org_handler.erl
@@ -141,7 +141,7 @@ read(Req, State = #state{token = Token, path = [], full_list=FullList, full_list
                    [<<"orgs">>, {<<"res">>, <<"uuid">>}, <<"get">>],
                    Permissions}],
     Res = wiggle_handler:list(fun ls_org:list/2,
-                              fun ft_org:to_json/1, Token, Permission,
+                              fun to_json/1, Token, Permission,
                               FullList, Filter, org_list_ttl, ?FULL_CACHE,
                               ?LIST_CACHE),
 
@@ -153,7 +153,7 @@ read(Req, State = #state{path = [?UUID(_Org)], obj = OrgObj}) ->
 
 read(Req, State = #state{path = [?UUID(_Org), <<"triggers">>], obj = OrgObj}) ->
     %% can't get the ft_role:triggers since the json conversion would miss
-    {jsxd:get(<<"triggers">>, [], ft_org:to_json(OrgObj)), Req, State}.
+    {jsxd:get(<<"triggers">>, [], to_json(OrgObj)), Req, State}.
 
 %%--------------------------------------------------------------------
 %% PUT
@@ -186,7 +186,7 @@ create(Req, State =
 write(Req, State = #state{path = [?UUID(Org), <<"metadata">> | Path]}, [{K, V}])
   when is_binary(Org) ->
     Start = now(),
-    ls_org:set_metadata(Org, [{Path ++ [K], jsxd:from_list(V)}]),
+    ls_org:set_metadata(Org, [{[<<"public">> | Path] ++ [K], jsxd:from_list(V)}]),
     e2qc:evict(?CACHE, Org),
     e2qc:teardown(?FULL_CACHE),
     ?MSnarl(?P(State), Start),
@@ -198,7 +198,7 @@ write(Req, State = #state{path = [?UUID(Org), <<"metadata">> | Path]}, [{K, V}])
 
 delete(Req, State = #state{path = [?UUID(Org), <<"metadata">> | Path]}) ->
     Start = now(),
-    ok = ls_org:set_metadata(Org, [{Path, delete}]),
+    ok = ls_org:set_metadata(Org, [{[<<"public">> | Path], delete}]),
     e2qc:evict(?CACHE, Org),
     e2qc:teardown(?FULL_CACHE),
     ?MSnarl(?P(State), Start),
@@ -221,7 +221,16 @@ delete(Req, State = #state{path = [?UUID(Org)]}) ->
     ?MSnarl(?P(State), Start),
     {true, Req, State}.
 
+%%--------------------------------------------------------------------
 %% Internal Functions
+%%--------------------------------------------------------------------
+
+to_json(E) ->
+    E1 = ft_org:to_json(E),
+    jsxd:update([<<"metadata">>],
+                fun(M) ->
+                        jsxd:get([<<"public">>], [{}], M)
+                end, [{}], E1).
 
 erlangify_trigger(<<"user_create">>, Event) ->
     {user_create,
@@ -256,7 +265,3 @@ erlangify_trigger([{<<"action">>, <<"user_grant">>},
                    {<<"target">>, Target}]) ->
     {grant, user, Target,
      [Base, placeholder | Permission]}.
-
--ifdef(TEST).
-
--endif.
diff --git a/apps/wiggle/src/wiggle_role_handler.erl b/apps/wiggle/src/wiggle_role_handler.erl
index c059328..1a38d22 100644
--- a/apps/wiggle/src/wiggle_role_handler.erl
+++ b/apps/wiggle/src/wiggle_role_handler.erl
@@ -116,14 +116,14 @@ read(Req, State = #state{token = Token, path = [], full_list=FullList, full_list
                    [<<"roles">>, {<<"res">>, <<"uuid">>}, <<"get">>],
                    Permissions}],
     Res = wiggle_handler:list(fun ls_role:list/2,
-                              fun ft_role:to_json/1, Token, Permission,
+                              fun to_json/1, Token, Permission,
                               FullList, Filter, role_list_ttl, ?FULL_CACHE,
                               ?LIST_CACHE),
     ?MSniffle(?P(State), Start1),
     {Res, Req, State};
 
 read(Req, State = #state{path = [?UUID(_Role)], obj = RoleObj}) ->
-    {ft_role:to_json(RoleObj), Req, State};
+    {to_json(RoleObj), Req, State};
 
 read(Req, State = #state{path = [?UUID(_Role), <<"permissions">>], obj = RoleObj}) ->
     {ft_role:permissions(RoleObj), Req, State}.
@@ -148,7 +148,7 @@ write(Req, State = #state{path = [?UUID(Role), <<"metadata">> | Path]}, [{K, V}]
     Start = now(),
     e2qc:evict(?CACHE, Role),
     e2qc:teardown(?LIST_CACHE),
-    ls_role:set_metadata(Role, [{Path ++ [K], jsxd:from_list(V)}]),
+    ls_role:set_metadata(Role, [{[<<"public">> | Path] ++ [K], jsxd:from_list(V)}]),
     ?MSnarl(?P(State), Start),
     {true, Req, State};
 
@@ -168,7 +168,7 @@ delete(Req, State = #state{path = [?UUID(Role), <<"metadata">> | Path]}) ->
     Start = now(),
     e2qc:evict(?CACHE, Role),
     e2qc:teardown(?LIST_CACHE),
-    ls_role:set_metadata(Role, [{Path, delete}]),
+    ls_role:set_metadata(Role, [{[<<"public">> | Path], delete}]),
     ?MSnarl(?P(State), Start),
     {true, Req, State};
 
@@ -187,3 +187,14 @@ delete(Req, State = #state{path = [?UUID(Role)]}) ->
     ok = ls_role:delete(Role),
     ?MSnarl(?P(State), Start),
     {true, Req, State}.
+
+%%--------------------------------------------------------------------
+%% Internal Functions
+%%--------------------------------------------------------------------
+
+to_json(E) ->
+    E1 = ft_role:to_json(E),
+    jsxd:update([<<"metadata">>],
+                fun(M) ->
+                        jsxd:get([<<"public">>], [{}], M)
+                end, [{}], E1).
diff --git a/apps/wiggle/src/wiggle_user_handler.erl b/apps/wiggle/src/wiggle_user_handler.erl
index 5c16051..431bf81 100644
--- a/apps/wiggle/src/wiggle_user_handler.erl
+++ b/apps/wiggle/src/wiggle_user_handler.erl
@@ -229,7 +229,7 @@ read(Req, State = #state{token = Token, path = [], full_list=FullList, full_list
                    [<<"users">>, {<<"res">>, <<"uuid">>}, <<"get">>],
                    Permissions}],
     Res = wiggle_handler:list(fun ls_user:list/2,
-                              fun ft_user:to_json/1, Token, Permission,
+                              fun to_json/1, Token, Permission,
                               FullList, Filter, user_list_ttl, ?FULL_CACHE,
                               ?LIST_CACHE),
 
@@ -237,7 +237,7 @@ read(Req, State = #state{token = Token, path = [], full_list=FullList, full_list
     {Res, Req, State};
 
 read(Req, State = #state{path = [_User], obj = UserObj}) ->
-    UserObj2 = jsxd:delete(<<"password">>, ft_user:to_json(UserObj)),
+    UserObj2 = jsxd:delete(<<"password">>, to_json(UserObj)),
     {UserObj2, Req, State};
 
 read(Req, State = #state{path = [_User, <<"permissions">>], obj = UserObj}) ->
@@ -286,7 +286,7 @@ write(Req, State = #state{method = <<"POST">>, path = []}, _) ->
 
 write(Req, State = #state{path = [?UUID(User), <<"metadata">> | Path]}, [{K, V}]) ->
     Start = now(),
-    ok = ls_user:set_metadata(User, [{Path ++ [K], jsxd:from_list(V)}]),
+    ok = ls_user:set_metadata(User, [{[<<"public">> | Path] ++ [K], jsxd:from_list(V)}]),
     e2qc:evict(?CACHE, User),
     e2qc:teardown(?FULL_CACHE),
     ?MSnarl(?P(State), Start),
@@ -372,7 +372,7 @@ write(Req, State = #state{path = [?UUID(User), <<"permissions">> | Permission]},
 
 delete(Req, State = #state{path = [?UUID(User), <<"metadata">> | Path]}) ->
     Start = now(),
-    ok = ls_user:set_metadata(User, [{Path, delete}]),
+    ok = ls_user:set_metadata(User, [{[<<"public">> | Path], delete}]),
     e2qc:evict(?CACHE, User),
     e2qc:teardown(?FULL_CACHE),
     ?MSnarl(?P(State), Start),
@@ -431,4 +431,14 @@ delete(Req, State = #state{path = [?UUID(User), <<"roles">>, Role]}) ->
     ?MSnarl(?P(State), Start),
     {true, Req, State}.
 
+%%--------------------------------------------------------------------
 %% Internal Functions
+%%--------------------------------------------------------------------
+
+to_json(U) ->
+    U1 = ft_user:to_json(U),
+    U2 = jsxd:delete([<<"password">>], U1),
+    jsxd:update([<<"metadata">>],
+                fun(M) ->
+                        jsxd:get([<<"public">>], [{}], M)
+                end, [{}], U2).