It will be most efficient to do one full pass on the API and Operations after refactoring of authorization (access consents, grants) is completed.