diff --git a/app/model/models.py b/app/model/models.py
index 7157b94..cced809 100644
--- a/app/model/models.py
+++ b/app/model/models.py
@@ -1,6 +1,7 @@
 from sqlmodel import Field, Relationship, Session, SQLModel
-from typing import List
-from datetime import time
+from typing import List, Literal, Union
+from datetime import datetime, time
+from pydantic import model_validator
 
 class Base(SQLModel):
     pass
@@ -60,19 +61,49 @@ class GroupResponse(GroupBase):
 #### AccessAuthorization
 class AccessAuthorizationBase(Base):
     name: str = Field(index=True)
+    type: Literal["timetable", "oneshot", "somefuturespec"]
     is_active: bool
 
 class AccessAuthorizationDB(AccessAuthorizationBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
+    type: str
     groups: List["GroupDB"] = Relationship(back_populates="accessauths", link_model=AaGroupLink)
     timetables: List["Timetable"] = Relationship(back_populates="accessauth", cascade_delete=True)
+    oneshot: "OneShotAccess" = Relationship(back_populates="accessauth", cascade_delete=True)
+
+class OneShotAccessBase(Base):
+    uses: int = 1
+    ends_at: datetime
+
+class OneShotAccess(OneShotAccessBase, table=True):
+    id: int | None = Field(default=None, primary_key=True)
+    accessauth_id: int = Field(default=None, foreign_key="accessauthorizationdb.id")
+    accessauth: AccessAuthorizationDB = Relationship(back_populates="oneshot")
 
 class AccessAuthorizationCreate(AccessAuthorizationBase):
-    timetables: List["TimetableCreate"]
+    timetables: List["TimetableCreate"] = []
+    oneshot: OneShotAccessBase | None = None
+    
+    @model_validator(mode="after")
+    def check_type(self):
+        if self.type == "timetable":
+            if not self.timetables:
+                raise ValueError("timetable auths require at least one timetable object")
+            if self.oneshot is not None:
+                raise ValueError("timetable auths are not allowed oneshot objects")
+        elif self.type == "oneshot":
+            if not self.oneshot:
+                raise ValueError("oneshot auths require a oneshot object")
+            if self.timetables:
+                raise ValueError("oneshot auths are not allowed timetable objects")
+        elif self.type == "somefuturespec":
+            raise ValueError("somefuturespec is not jet implemented. Please do not use")
+        return self
 
 class AccessAuthorizationResponse(AccessAuthorizationBase):
     id: int
-    timetables: List["Timetable"]
+    timetables: List["Timetable"] = []
+    oneshot: OneShotAccessBase | None = None
     groups: List["GroupDB"]
 
 class AccessAuthorizationUpdate(Base):