diff --git a/pipewire-alsa/alsa-plugins/pcm_pipewire.c b/pipewire-alsa/alsa-plugins/pcm_pipewire.c
index 4e39059c8..c77ab2778 100644
--- a/pipewire-alsa/alsa-plugins/pcm_pipewire.c
+++ b/pipewire-alsa/alsa-plugins/pcm_pipewire.c
@@ -801,14 +801,14 @@ static int snd_pcm_pipewire_open(snd_pcm_t **pcmp, const char *name,
 	else
 		pw->node_name = strdup(node_name);
 
-	pw->target = SPA_ID_INVALID;
+	pw->target = PW_ID_ANY;
 	if (str != NULL)
 		pw->target = atoi(str);
 	else {
 		if (stream == SND_PCM_STREAM_PLAYBACK)
-			pw->target = playback_node ? (uint32_t)atoi(playback_node) : SPA_ID_INVALID;
+			pw->target = playback_node ? (uint32_t)atoi(playback_node) : PW_ID_ANY;
 		else
-			pw->target = capture_node ? (uint32_t)atoi(capture_node) : SPA_ID_INVALID;
+			pw->target = capture_node ? (uint32_t)atoi(capture_node) : PW_ID_ANY;
 	}
 
 	pw->main_loop = pw_thread_loop_new("alsa-pipewire", NULL);
diff --git a/pipewire-pulseaudio/src/stream.c b/pipewire-pulseaudio/src/stream.c
index 2173834ba..70ffe02e2 100644
--- a/pipewire-pulseaudio/src/stream.c
+++ b/pipewire-pulseaudio/src/stream.c
@@ -941,13 +941,13 @@ static int create_stream(pa_stream_direction_t direction,
 	if (direction == PA_STREAM_RECORD)
 		devid = s->direct_on_input;
 	else
-		devid = SPA_ID_INVALID;
+		devid = PW_ID_ANY;
 
 	if (dev == NULL) {
 		if ((str = getenv("PIPEWIRE_NODE")) != NULL)
 			devid = atoi(str);
 	}
-	else if (devid == SPA_ID_INVALID) {
+	else if (devid == PW_ID_ANY) {
 		uint32_t mask;
 
 		if (direction == PA_STREAM_PLAYBACK)
diff --git a/src/examples/audio-src.c b/src/examples/audio-src.c
index 416fe1b51..5753ee6f5 100644
--- a/src/examples/audio-src.c
+++ b/src/examples/audio-src.c
@@ -150,7 +150,7 @@ int main(int argc, char *argv[])
 	 * called in a realtime thread. */
 	pw_stream_connect(data.stream,
 			  PW_DIRECTION_OUTPUT,
-			  argc > 1 ? (uint32_t)atoi(argv[1]) : SPA_ID_INVALID,
+			  argc > 1 ? (uint32_t)atoi(argv[1]) : PW_ID_ANY,
 			  PW_STREAM_FLAG_AUTOCONNECT |
 			  PW_STREAM_FLAG_MAP_BUFFERS |
 			  PW_STREAM_FLAG_RT_PROCESS,
diff --git a/src/examples/export-sink.c b/src/examples/export-sink.c
index 42f790273..073a63815 100644
--- a/src/examples/export-sink.c
+++ b/src/examples/export-sink.c
@@ -486,11 +486,9 @@ static void set_permissions(struct data *data)
 
 	/* an example, set specific permissions on one object, this is the
 	 * core object. */
-	permissions[0].id = 0;
-	permissions[0].permissions = PW_PERM_R | PW_PERM_X;
+	permissions[0] = PW_PERMISSION_INIT(PW_ID_CORE, PW_PERM_R | PW_PERM_X);
 	/* remove WX from all other objects */
-	permissions[1].id = SPA_ID_INVALID;
-	permissions[1].permissions = PW_PERM_R;
+	permissions[1] = PW_PERMISSION_INIT(PW_ID_ANY, PW_PERM_R);
 
 	pw_client_update_permissions(
 			pw_core_get_client(data->core),
diff --git a/src/examples/video-play.c b/src/examples/video-play.c
index 682d12739..8747195a5 100644
--- a/src/examples/video-play.c
+++ b/src/examples/video-play.c
@@ -442,7 +442,7 @@ int main(int argc, char *argv[])
 	 */
 	if ((res = pw_stream_connect(data.stream,
 			  PW_DIRECTION_INPUT,
-			  data.path ? (uint32_t)atoi(data.path) : SPA_ID_INVALID,
+			  data.path ? (uint32_t)atoi(data.path) : PW_ID_ANY,
 			  PW_STREAM_FLAG_AUTOCONNECT |	/* try to automatically connect this stream */
 			  PW_STREAM_FLAG_INACTIVE |	/* we will activate ourselves */
 			  PW_STREAM_FLAG_EXCLUSIVE |	/* require exclusive access */
diff --git a/src/examples/video-src-alloc.c b/src/examples/video-src-alloc.c
index 0c00f3af0..c82265bf6 100644
--- a/src/examples/video-src-alloc.c
+++ b/src/examples/video-src-alloc.c
@@ -401,7 +401,7 @@ int main(int argc, char *argv[])
 	 * the server.  */
 	pw_stream_connect(data.stream,
 			  PW_DIRECTION_OUTPUT,
-			  SPA_ID_INVALID,
+			  PW_ID_ANY,
 			  PW_STREAM_FLAG_DRIVER |
 			  PW_STREAM_FLAG_ALLOC_BUFFERS,
 			  params, 1);
diff --git a/src/examples/video-src.c b/src/examples/video-src.c
index f45e6abf4..2fe056f65 100644
--- a/src/examples/video-src.c
+++ b/src/examples/video-src.c
@@ -311,7 +311,7 @@ int main(int argc, char *argv[])
 
 	pw_stream_connect(data.stream,
 			  PW_DIRECTION_OUTPUT,
-			  SPA_ID_INVALID,
+			  PW_ID_ANY,
 			  PW_STREAM_FLAG_DRIVER |
 			  PW_STREAM_FLAG_MAP_BUFFERS,
 			  params, 1);
diff --git a/src/gst/gstpipewiresink.c b/src/gst/gstpipewiresink.c
index 1737637a8..80b954e04 100644
--- a/src/gst/gstpipewiresink.c
+++ b/src/gst/gstpipewiresink.c
@@ -536,7 +536,7 @@ gst_pipewire_sink_setcaps (GstBaseSink * bsink, GstCaps * caps)
 
     pw_stream_connect (pwsink->stream,
                           PW_DIRECTION_OUTPUT,
-                          pwsink->path ? (uint32_t)atoi(pwsink->path) : SPA_ID_INVALID,
+                          pwsink->path ? (uint32_t)atoi(pwsink->path) : PW_ID_ANY,
                           flags,
                           (const struct spa_pod **) possible->pdata,
                           possible->len);
diff --git a/src/gst/gstpipewiresrc.c b/src/gst/gstpipewiresrc.c
index c96cdcbad..dc76f5f15 100644
--- a/src/gst/gstpipewiresrc.c
+++ b/src/gst/gstpipewiresrc.c
@@ -612,7 +612,7 @@ gst_pipewire_src_negotiate (GstBaseSrc * basesrc)
   GST_DEBUG_OBJECT (basesrc, "connect capture with path %s", pwsrc->path);
   pw_stream_connect (pwsrc->stream,
                      PW_DIRECTION_INPUT,
-                     pwsrc->path ? (uint32_t)atoi(pwsrc->path) : SPA_ID_INVALID,
+                     pwsrc->path ? (uint32_t)atoi(pwsrc->path) : PW_ID_ANY,
                      PW_STREAM_FLAG_AUTOCONNECT,
                      (const struct spa_pod **)possible->pdata,
                      possible->len);
diff --git a/src/modules/module-access.c b/src/modules/module-access.c
index d7f7cdfcb..d388997c2 100644
--- a/src/modules/module-access.c
+++ b/src/modules/module-access.c
@@ -174,7 +174,7 @@ context_check_access(void *data, struct pw_impl_client *client)
 
 granted:
 	pw_log_debug("module %p: client %p access granted", impl, client);
-	permissions[0] = PW_PERMISSION_INIT(-1, PW_PERM_RWX);
+	permissions[0] = PW_PERMISSION_INIT(PW_ID_ANY, PW_PERM_RWX);
 	pw_impl_client_update_permissions(client, 1, permissions);
 	return;
 
diff --git a/src/modules/module-link-factory.c b/src/modules/module-link-factory.c
index 4b353a112..77a735b88 100644
--- a/src/modules/module-link-factory.c
+++ b/src/modules/module-link-factory.c
@@ -149,7 +149,7 @@ static struct pw_impl_port *get_port(struct pw_impl_node *node, enum spa_directi
 	struct pw_context *context = pw_impl_node_get_context(node);
 	int res;
 
-	p = pw_impl_node_find_port(node, direction, SPA_ID_INVALID);
+	p = pw_impl_node_find_port(node, direction, PW_ID_ANY);
 
 	if (p == NULL || pw_impl_port_is_linked(p)) {
 		uint32_t port_id;
@@ -227,7 +227,7 @@ static void *create_object(void *_data,
 
 	input_node = pw_global_get_object(global);
 
-	if (output_port_id == SPA_ID_INVALID) {
+	if (output_port_id == PW_ID_ANY) {
 		outport = get_port(output_node, SPA_DIRECTION_OUTPUT);
 	}
 	else {
@@ -240,7 +240,7 @@ static void *create_object(void *_data,
 	if (outport == NULL)
 		goto error_output_port;
 
-	if (input_port_id == SPA_ID_INVALID)
+	if (input_port_id == PW_ID_ANY)
 		inport = get_port(input_node, SPA_DIRECTION_INPUT);
 	else {
 		global = pw_context_find_global(context, input_port_id);
diff --git a/src/modules/module-protocol-native.c b/src/modules/module-protocol-native.c
index afab88c12..06a8be323 100644
--- a/src/modules/module-protocol-native.c
+++ b/src/modules/module-protocol-native.c
@@ -824,8 +824,7 @@ static int pw_protocol_native_connect_internal(struct pw_protocol_client *client
 		pw_log_error("server %p: failed to create client: %m", s);
 		goto error_close;
 	}
-	permissions[0].id = SPA_ID_INVALID;
-	permissions[0].permissions = PW_PERM_RWX;
+	permissions[0] = PW_PERMISSION_INIT(PW_ID_ANY, PW_PERM_RWX);
 	pw_impl_client_update_permissions(c->client, 1, permissions);
 
 	res = pw_protocol_client_connect_fd(client, sv[1], true);
diff --git a/src/modules/module-protocol-native/protocol-native.c b/src/modules/module-protocol-native/protocol-native.c
index 04dd99169..750950265 100644
--- a/src/modules/module-protocol-native/protocol-native.c
+++ b/src/modules/module-protocol-native/protocol-native.c
@@ -1548,7 +1548,7 @@ static void client_marshal_permissions(void *object, uint32_t index, uint32_t n_
 	b = pw_protocol_native_begin_resource(resource, PW_CLIENT_EVENT_PERMISSIONS, NULL);
 
 	for (i = 0; i < n_permissions; i++) {
-		if (permissions[i].permissions != SPA_ID_INVALID)
+		if (permissions[i].permissions != PW_PERM_INVALID)
 			n++;
 	}
 
@@ -1558,7 +1558,7 @@ static void client_marshal_permissions(void *object, uint32_t index, uint32_t n_
 	spa_pod_builder_int(b, n);
 
 	for (i = 0; i < n_permissions; i++) {
-		if (permissions[i].permissions == SPA_ID_INVALID)
+		if (permissions[i].permissions == PW_PERM_INVALID)
 			continue;
 		spa_pod_builder_int(b, permissions[i].id);
 		spa_pod_builder_int(b, permissions[i].permissions);
diff --git a/src/modules/module-protocol-native/v0/interfaces.h b/src/modules/module-protocol-native/v0/interfaces.h
index 16509ee8f..a478d87a8 100644
--- a/src/modules/module-protocol-native/v0/interfaces.h
+++ b/src/modules/module-protocol-native/v0/interfaces.h
@@ -401,7 +401,7 @@ struct pw_node_v0_methods {
 	 * Start enumeration of node parameters. For each param, a
 	 * param event will be emited.
 	 *
-	 * \param id the parameter id to enum or SPA_ID_INVALID for all
+	 * \param id the parameter id to enum or PW_ID_ANY for all
 	 * \param start the start index or 0 for the first param
 	 * \param num the maximum number of params to retrieve
 	 * \param filter a param filter or NULL
diff --git a/src/pipewire/context.c b/src/pipewire/context.c
index 194f17296..e1ab207ec 100644
--- a/src/pipewire/context.c
+++ b/src/pipewire/context.c
@@ -455,7 +455,7 @@ struct pw_global *pw_context_find_global(struct pw_context *context, uint32_t id
  *
  * \param context a context
  * \param other_port a port to find a link with
- * \param id the id of a port or SPA_ID_INVALID
+ * \param id the id of a port or PW_ID_ANY
  * \param props extra properties
  * \param n_format_filters number of filters
  * \param format_filters array of format filters
@@ -476,7 +476,7 @@ struct pw_impl_port *pw_context_find_port(struct pw_context *context,
 	bool have_id;
 	struct pw_impl_node *n;
 
-	have_id = id != SPA_ID_INVALID;
+	have_id = id != PW_ID_ANY;
 
 	pw_log_debug(NAME" %p: id:%u", context, id);
 
@@ -500,7 +500,7 @@ struct pw_impl_port *pw_context_find_port(struct pw_context *context,
 				best =
 				    pw_impl_node_find_port(n,
 						pw_direction_reverse(other_port->direction),
-						SPA_ID_INVALID);
+						PW_ID_ANY);
 				if (best)
 					break;
 			}
@@ -512,7 +512,7 @@ struct pw_impl_port *pw_context_find_port(struct pw_context *context,
 
 			p = pw_impl_node_find_port(n,
 					pw_direction_reverse(other_port->direction),
-					SPA_ID_INVALID);
+					PW_ID_ANY);
 			if (p == NULL)
 				continue;
 
diff --git a/src/pipewire/core.h b/src/pipewire/core.h
index 2d2cabc75..57ec6bc73 100644
--- a/src/pipewire/core.h
+++ b/src/pipewire/core.h
@@ -45,6 +45,9 @@ struct pw_registry;
 /* default ID for the core object after connect */
 #define PW_ID_CORE		0
 
+/* invalid ID that matches any object when used for permissions */
+#define PW_ID_ANY		(uint32_t)(0xffffffff)
+
 /**  The core information. Extra information can be added in later versions \memberof pw_introspect */
 struct pw_core_info {
 	uint32_t id;			/**< id of the global */
diff --git a/src/pipewire/device.h b/src/pipewire/device.h
index 0219e1b89..0dffc065c 100644
--- a/src/pipewire/device.h
+++ b/src/pipewire/device.h
@@ -111,7 +111,7 @@ struct pw_device_methods {
 	 * param event will be emited.
 	 *
 	 * \param seq a sequence number to place in the reply
-	 * \param id the parameter id to enum or SPA_ID_INVALID for all
+	 * \param id the parameter id to enum or PW_ID_ANY for all
 	 * \param start the start index or 0 for the first param
 	 * \param num the maximum number of params to retrieve
 	 * \param filter a param filter or NULL
diff --git a/src/pipewire/impl-client.c b/src/pipewire/impl-client.c
index ac3d6fe59..0d2e11e0d 100644
--- a/src/pipewire/impl-client.c
+++ b/src/pipewire/impl-client.c
@@ -56,14 +56,14 @@ find_permission(struct pw_impl_client *client, uint32_t id)
 	struct pw_permission *p;
 	uint32_t idx = id + 1;
 
-	if (id == SPA_ID_INVALID)
+	if (id == PW_ID_ANY)
 		goto do_default;
 
 	if (!pw_array_check_index(&impl->permissions, idx, struct pw_permission))
 		goto do_default;
 
 	p = pw_array_get_unchecked(&impl->permissions, idx, struct pw_permission);
-	if (p->permissions == SPA_ID_INVALID)
+	if (p->permissions == PW_PERM_INVALID)
 		goto do_default;
 
 	return p;
@@ -88,8 +88,7 @@ static struct pw_permission *ensure_permissions(struct pw_impl_client *client, u
 			return NULL;
 
 		for (i = 0; i < diff; i++) {
-			p[i].id = len + i - 1;
-			p[i].permissions = SPA_ID_INVALID;
+			p[i] = PW_PERMISSION_INIT(len + i - 1, PW_PERM_INVALID);
 		}
 	}
 	p = pw_array_get_unchecked(&impl->permissions, idx, struct pw_permission);
@@ -258,8 +257,8 @@ context_global_removed(void *data, struct pw_global *global)
 
 	p = find_permission(client, global->id);
 	pw_log_debug(NAME" %p: global %d removed, %p", client, global->id, p);
-	if (p->id != SPA_ID_INVALID)
-		p->permissions = SPA_ID_INVALID;
+	if (p->id != PW_ID_ANY)
+		p->permissions = PW_PERM_INVALID;
 }
 
 static const struct pw_context_events context_events = {
@@ -313,7 +312,7 @@ struct pw_impl_client *pw_context_create_client(struct pw_impl_core *core,
 		res = -errno;
 		goto error_clear_array;
 	}
-	p->id = SPA_ID_INVALID;
+	p->id = PW_ID_ANY;
 	p->permissions = 0;
 
 	this->pool = pw_mempool_new(NULL);
@@ -572,7 +571,7 @@ int pw_impl_client_update_permissions(struct pw_impl_client *client,
 	struct pw_permission *def;
 	uint32_t i;
 
-	if ((def = find_permission(client, SPA_ID_INVALID)) == NULL)
+	if ((def = find_permission(client, PW_ID_ANY)) == NULL)
 		return -EIO;
 
 	for (i = 0; i < n_permissions; i++) {
@@ -580,7 +579,7 @@ int pw_impl_client_update_permissions(struct pw_impl_client *client,
 		uint32_t old_perm, new_perm;
 		struct pw_global *global;
 
-		if (permissions[i].id == SPA_ID_INVALID) {
+		if (permissions[i].id == PW_ID_ANY) {
 			old_perm = def->permissions;
 			new_perm = permissions[i].permissions;
 
@@ -596,7 +595,7 @@ int pw_impl_client_update_permissions(struct pw_impl_client *client,
 				if (global->id == client->info.id)
 					continue;
 				p = find_permission(client, global->id);
-				if (p->id != SPA_ID_INVALID)
+				if (p->id != PW_ID_ANY)
 					continue;
 				pw_global_update_permissions(global, client, old_perm, new_perm);
 			}
@@ -614,7 +613,7 @@ int pw_impl_client_update_permissions(struct pw_impl_client *client,
 				pw_log_warn(NAME" %p: can't ensure permission: %m", client);
 				continue;
 			}
-			old_perm = p->permissions == SPA_ID_INVALID ? def->permissions : p->permissions;
+			old_perm = p->permissions == PW_PERM_INVALID ? def->permissions : p->permissions;
 			new_perm = permissions[i].permissions;
 
 			if (context->current_client == client)
diff --git a/src/pipewire/impl-node.c b/src/pipewire/impl-node.c
index 335762101..b931251b6 100644
--- a/src/pipewire/impl-node.c
+++ b/src/pipewire/impl-node.c
@@ -1641,7 +1641,7 @@ pw_impl_node_find_port(struct pw_impl_node *node, enum pw_direction direction, u
 		ports = &node->output_ports;
 	}
 
-	if (port_id != SPA_ID_INVALID)
+	if (port_id != PW_ID_ANY)
 		port = pw_map_lookup(portmap, port_id);
 	else {
 		port = NULL;
diff --git a/src/pipewire/impl-node.h b/src/pipewire/impl-node.h
index dc89b8697..21fce9570 100644
--- a/src/pipewire/impl-node.h
+++ b/src/pipewire/impl-node.h
@@ -159,7 +159,7 @@ int pw_impl_node_for_each_param(struct pw_impl_node *node,
 			   void *data);
 
 /** Find the port with direction and port_id or NULL when not found. Passing
- * SPA_ID_INVALID for port_id will return any port, preferably an unlinked one. */
+ * PW_ID_ANY for port_id will return any port, preferably an unlinked one. */
 struct pw_impl_port *
 pw_impl_node_find_port(struct pw_impl_node *node, enum pw_direction direction, uint32_t port_id);
 
diff --git a/src/pipewire/node.h b/src/pipewire/node.h
index c60eb9b71..163659561 100644
--- a/src/pipewire/node.h
+++ b/src/pipewire/node.h
@@ -150,7 +150,7 @@ struct pw_node_methods {
 	 * param event will be emited.
 	 *
 	 * \param seq a sequence number to place in the reply
-	 * \param id the parameter id to enum or SPA_ID_INVALID for all
+	 * \param id the parameter id to enum or PW_ID_ANY for all
 	 * \param start the start index or 0 for the first param
 	 * \param num the maximum number of params to retrieve
 	 * \param filter a param filter or NULL
diff --git a/src/pipewire/permission.h b/src/pipewire/permission.h
index 09ed4b6c7..58189a17c 100644
--- a/src/pipewire/permission.h
+++ b/src/pipewire/permission.h
@@ -51,8 +51,10 @@ extern "C" {
 #define PW_PERM_IS_W(p) (((p)&PW_PERM_W) == PW_PERM_W)
 #define PW_PERM_IS_X(p) (((p)&PW_PERM_X) == PW_PERM_X)
 
+#define PW_PERM_INVALID	(uint32_t)(0xffffffff)
+
 struct pw_permission {
-	uint32_t id;		/**< id of object, SPA_ID_INVALID for default permission */
+	uint32_t id;		/**< id of object, PW_ID_ANY for default permission */
 	uint32_t permissions;	/**< bitmask of above permissions */
 };
 
diff --git a/src/pipewire/stream.c b/src/pipewire/stream.c
index 995688fd2..d92399864 100644
--- a/src/pipewire/stream.c
+++ b/src/pipewire/stream.c
@@ -1371,7 +1371,7 @@ pw_stream_connect(struct pw_stream *stream,
 	impl->disconnecting = false;
 	stream_set_state(stream, PW_STREAM_STATE_CONNECTING, NULL);
 
-	if (target_id != SPA_ID_INVALID)
+	if (target_id != PW_ID_ANY)
 		pw_properties_setf(stream->properties, PW_KEY_NODE_TARGET, "%d", target_id);
 	if (flags & PW_STREAM_FLAG_AUTOCONNECT)
 		pw_properties_set(stream->properties, PW_KEY_NODE_AUTOCONNECT, "1");
diff --git a/src/pipewire/stream.h b/src/pipewire/stream.h
index 25e086246..a6bcb9b9f 100644
--- a/src/pipewire/stream.h
+++ b/src/pipewire/stream.h
@@ -298,9 +298,9 @@ int pw_stream_update_properties(struct pw_stream *stream, const struct spa_dict
 int
 pw_stream_connect(struct pw_stream *stream,		/**< a \ref pw_stream */
 		  enum pw_direction direction,		/**< the stream direction */
-		  uint32_t target_id,			/**< the target node to connect to or
-							  *  SPA_ID_INVALID to let the manager
-							  *  select a node. */
+		  uint32_t target_id,			/**< the target object id to connect to or
+							  *  PW_ID_ANY to let the manager
+							  *  select a target. */
 		  enum pw_stream_flags flags,		/**< stream flags */
 		  const struct spa_pod **params,	/**< an array with params. The params
 							  *  should ideally contain supported
diff --git a/src/tools/pipewire-cli.c b/src/tools/pipewire-cli.c
index 0cae4b1cb..d8c0e44f9 100644
--- a/src/tools/pipewire-cli.c
+++ b/src/tools/pipewire-cli.c
@@ -837,7 +837,7 @@ static void client_event_permissions(void *object, uint32_t index,
 			rd->id, data->global->id, index);
 
 	for (i = 0; i < n_permissions; i++) {
-		if (permissions[i].id == SPA_ID_INVALID)
+		if (permissions[i].id == PW_ID_ANY)
 			fprintf(stdout, "  default:");
 		else
 			fprintf(stdout, "  %u:", permissions[i].id);
@@ -1487,7 +1487,6 @@ static bool do_permissions(struct data *data, const char *cmd, char *args, char
 			return false;
 	}
 
-
 	permissions[0] = PW_PERMISSION_INIT(atoi(a[1]), atoi(a[2]));
 
 	pw_client_update_permissions((struct pw_client*)global->proxy,