diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/User2UserDtoMapper.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/User2UserDtoMapper.java
index 213cf56949..3a8caa437d 100644
--- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/User2UserDtoMapper.java
+++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/User2UserDtoMapper.java
@@ -25,8 +25,8 @@ public abstract class User2UserDtoMapper {
 
   @AfterMapping
   void appendLinks(@MappingTarget UserDto target, @Context UriInfo uriInfo) {
-    LinkBuilder userLinkBuilder = new LinkBuilder(uriInfo, UserNewResource.class, UserSubResource.class);
-    LinkBuilder collectionLinkBuilder = new LinkBuilder(uriInfo, UserNewResource.class, UserCollectionResource.class);
+    LinkBuilder userLinkBuilder = new LinkBuilder(uriInfo, UserV2Resource.class, UserSubResource.class);
+    LinkBuilder collectionLinkBuilder = new LinkBuilder(uriInfo, UserV2Resource.class, UserCollectionResource.class);
     Map<String, Link> links = new HashMap<>();
     links.put("self", userLinkBuilder.method("getUserSubResource").parameters(target.getName()).method("get").parameters().create());
     if (SecurityUtils.getSubject().hasRole(Role.ADMIN)) {
diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserCollectionResource.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserCollectionResource.java
index 5ea797e0f2..2dbc8e8ef7 100644
--- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserCollectionResource.java
+++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserCollectionResource.java
@@ -74,7 +74,7 @@ public class UserCollectionResource extends AbstractManagerResource<User, UserEx
     User user = dtoToUserMapper.userDtoToUser(userDto, "");
     manager.create(user);
 
-    LinkBuilder builder = new LinkBuilder(uriInfo, UserNewResource.class, UserSubResource.class);
+    LinkBuilder builder = new LinkBuilder(uriInfo, UserV2Resource.class, UserSubResource.class);
     return Response.created(builder.method("getUserSubResource").parameters(user.getName()).method("get").parameters().create().getHref()).build();
   }
 
diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserNewResource.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserV2Resource.java
similarity index 78%
rename from scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserNewResource.java
rename to scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserV2Resource.java
index 6eeb7a8cc6..6da7937b35 100644
--- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserNewResource.java
+++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserV2Resource.java
@@ -6,15 +6,15 @@ import com.google.inject.Singleton;
 import javax.ws.rs.Path;
 
 @Singleton
-@Path(UserNewResource.USERS_PATH_V2)
-public class UserNewResource {
+@Path(UserV2Resource.USERS_PATH_V2)
+public class UserV2Resource {
 
   public static final String USERS_PATH_V2 = "v2/users/";
   private final UserCollectionResource userCollectionResource;
   private final UserSubResource userSubResource;
 
   @Inject
-  public UserNewResource(UserCollectionResource userCollectionResource, UserSubResource userSubResource) {
+  public UserV2Resource(UserCollectionResource userCollectionResource, UserSubResource userSubResource) {
     this.userCollectionResource = userCollectionResource;
     this.userSubResource = userSubResource;
   }
diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/User2UserDtoMapperTest.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/User2UserDtoMapperTest.java
index c9b8ea36c9..65a5dd8f50 100644
--- a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/User2UserDtoMapperTest.java
+++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/User2UserDtoMapperTest.java
@@ -31,7 +31,7 @@ public class User2UserDtoMapperTest {
   @Before
   public void init() throws URISyntaxException {
     baseUri = new URI("http://example.com/base/");
-    expextedBaseUri = baseUri.resolve(UserNewResource.USERS_PATH_V2 + "/");
+    expextedBaseUri = baseUri.resolve(UserV2Resource.USERS_PATH_V2 + "/");
     when(uriInfo.getBaseUri()).thenReturn(baseUri);
     subjectThreadState.bind();
   }
diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserV2ResourceTest.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserV2ResourceTest.java
new file mode 100644
index 0000000000..d3c332231c
--- /dev/null
+++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserV2ResourceTest.java
@@ -0,0 +1,84 @@
+package sonia.scm.api.v2.resources;
+
+import com.github.sdorra.shiro.ShiroRule;
+import com.github.sdorra.shiro.SubjectAware;
+import org.jboss.resteasy.core.Dispatcher;
+import org.jboss.resteasy.mock.MockDispatcherFactory;
+import org.jboss.resteasy.mock.MockHttpRequest;
+import org.jboss.resteasy.mock.MockHttpResponse;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import sonia.scm.user.User;
+import sonia.scm.user.UserManager;
+
+import javax.servlet.http.HttpServletResponse;
+import java.net.URISyntaxException;
+import java.util.Collections;
+
+import static org.junit.Assert.*;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+@SubjectAware(
+  username = "trillian",
+  password = "secret",
+  configuration = "classpath:sonia/scm/repository/shiro.ini"
+)
+public class UserV2ResourceTest {
+
+  @Rule
+  public ShiroRule shiro = new ShiroRule();
+
+  private Dispatcher dispatcher = MockDispatcherFactory.createDispatcher();
+
+  @Before
+  public void prepareEnvironment() {
+    UserManager userManager = mock(UserManager.class);
+    when(userManager.getAll()).thenReturn(Collections.singletonList(createDummyUser()));
+
+    UserDto2UserMapperImpl dtoToUserMapper = new UserDto2UserMapperImpl();
+    User2UserDtoMapperImpl userToDtoMapper = new User2UserDtoMapperImpl();
+    UserCollectionResource userCollectionResource = new UserCollectionResource(userManager, dtoToUserMapper, userToDtoMapper);
+    UserSubResource userSubResource = new UserSubResource(dtoToUserMapper, userToDtoMapper, userManager);
+    UserV2Resource userV2Resource = new UserV2Resource(userCollectionResource, userSubResource);
+
+    dispatcher.getRegistry().addSingletonResource(userV2Resource);
+  }
+
+  @Test
+  public void shouldCreateFullResponseForAdmin() throws URISyntaxException {
+    MockHttpRequest request = MockHttpRequest.get("/" + UserV2Resource.USERS_PATH_V2);
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_OK, response.getStatus());
+    assertTrue(response.getContentAsString().contains("\"name\":\"Neo\""));
+    assertTrue(response.getContentAsString().contains("\"password\":\"__dummypassword__\""));
+    assertTrue(response.getContentAsString().contains("\"self\":{\"href\":\"/v2/users/Neo\"}"));
+    assertTrue(response.getContentAsString().contains("\"delete\":{\"href\":\"/v2/users/Neo\"}"));
+  }
+
+  @Test
+  @SubjectAware(username = "unpriv")
+  public void shouldCreateLimitedResponseForAdmin() throws URISyntaxException {
+    MockHttpRequest request = MockHttpRequest.get("/" + UserV2Resource.USERS_PATH_V2);
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_OK, response.getStatus());
+    assertTrue(response.getContentAsString().contains("\"name\":\"Neo\""));
+    assertTrue(response.getContentAsString().contains("\"password\":\"__dummypassword__\""));
+    assertTrue(response.getContentAsString().contains("\"self\":{\"href\":\"/v2/users/Neo\"}"));
+    assertFalse(response.getContentAsString().contains("\"delete\":{\"href\":\"/v2/users/Neo\"}"));
+  }
+
+  private User createDummyUser() {
+    User user = new User();
+    user.setName("Neo");
+    user.setPassword("redpill");
+    return user;
+  }
+}