diff --git a/full/Changes b/full/Changes
index 8ebee1b..c8eeab2 100644
--- a/full/Changes
+++ b/full/Changes
@@ -9,6 +9,8 @@
 12/11/2019
    - Removed UserGroupJson & updated listUserGroups and createUserGroup 
      services (margaretha)
+   - Added prefixes to username and groupname parameters in service paths 
+     (margaretha, resolved #35)  
      
 
 # version 0.62.1
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
index 3b5ed18..84c0afa 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
@@ -131,7 +131,7 @@
      * @return a user-group
      */
     @GET
-    @Path("{groupName}")
+    @Path("@{groupName}")
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public UserGroupDto retrieveUserGroup (
             @Context SecurityContext securityContext,
@@ -173,7 +173,7 @@
      *         Created, otherwise 204 No Content.
      */
     @PUT
-    @Path("{groupName}")
+    @Path("@{groupName}")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response createUserGroup (@Context SecurityContext securityContext,
             @PathParam("groupName") String groupName,
@@ -207,7 +207,7 @@
      * @return HTTP 200, if successful.
      */
     @DELETE
-    @Path("{groupName}")
+    @Path("@{groupName}")
     public Response deleteUserGroup (@Context SecurityContext securityContext,
             @PathParam("groupName") String groupName) {
         TokenContext context =
@@ -235,7 +235,7 @@
      * @return if successful, HTTP response status OK
      */
     @DELETE
-    @Path("{groupName}/{memberUsername}")
+    @Path("@{groupName}/~{memberUsername}")
     public Response removeUserFromGroup (
             @Context SecurityContext securityContext,
             @PathParam("memberUsername") String memberUsername,
@@ -264,7 +264,7 @@
      * @return if successful, HTTP response status OK
      */
     @POST
-    @Path("{groupName}/invite")
+    @Path("@{groupName}/invite")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response inviteGroupMembers (
             @Context SecurityContext securityContext,
@@ -295,7 +295,7 @@
      * @return
      */
     @POST
-    @Path("{groupName}/role/edit")
+    @Path("@{groupName}/role/edit")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response editMemberRoles (@Context SecurityContext securityContext,
             @PathParam("groupName") String groupName,
@@ -329,7 +329,7 @@
      * @return if successful, HTTP response status OK
      */
     @POST
-    @Path("{groupName}/role/add")
+    @Path("@{groupName}/role/add")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response addMemberRoles (@Context SecurityContext securityContext,
             @PathParam("groupName") String groupName,
@@ -364,7 +364,7 @@
      * @return if successful, HTTP response status OK
      */
     @POST
-    @Path("{groupName}/role/delete")
+    @Path("@{groupName}/role/delete")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response deleteMemberRoles (@Context SecurityContext securityContext,
             @PathParam("groupName") String groupName,
@@ -394,7 +394,7 @@
      * @return if successful, HTTP response status OK
      */
     @POST
-    @Path("{groupName}/subscribe")
+    @Path("@{groupName}/subscribe")
     public Response subscribeToGroup (@Context SecurityContext securityContext,
             @PathParam("groupName") String groupName) {
         TokenContext context =
@@ -422,7 +422,7 @@
      * @return if successful, HTTP response status OK
      */
     @DELETE
-    @Path("{groupName}/unsubscribe")
+    @Path("@{groupName}/unsubscribe")
     public Response unsubscribeFromGroup (
             @Context SecurityContext securityContext,
             @PathParam("groupName") String groupName) {
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
index 6c37850..3509d03 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
@@ -88,7 +88,7 @@
      * @throws KustvaktException
      */
     @PUT
-    @Path("/{vcCreator}/{vcName}")
+    @Path("/~{vcCreator}/{vcName}")
     @Consumes(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public Response createUpdateVC (@Context SecurityContext securityContext,
             @PathParam("vcCreator") String vcCreator,
@@ -120,7 +120,7 @@
      * @return the virtual corpus with the given name and creator.
      */
     @GET
-    @Path("{createdBy}/{vcName}")
+    @Path("~{createdBy}/{vcName}")
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     @ResourceFilters({ APIVersionFilter.class, AuthenticationFilter.class,
         DemoUserFilter.class, PiwikFilter.class })
@@ -185,7 +185,7 @@
      *         in the security context.
      */
     @GET
-    @Path("{createdBy}")
+    @Path("~{createdBy}")
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public List<VirtualCorpusDto> listUserVC (
             @PathParam("createdBy") String createdBy, 
@@ -248,7 +248,7 @@
      * @return HTTP status 200, if successful
      */
     @DELETE
-    @Path("{createdBy}/{vcName}")
+    @Path("~{createdBy}/{vcName}")
     public Response deleteVCByName (@Context SecurityContext securityContext,
             @PathParam("createdBy") String createdBy,
             @PathParam("vcName") String vcName) {
@@ -282,7 +282,7 @@
      * @return HTTP status 200, if successful
      */
     @POST
-    @Path("{vcCreator}/{vcName}/share/{groupName}")
+    @Path("~{vcCreator}/{vcName}/share/@{groupName}")
     public Response shareVC (@Context SecurityContext securityContext,
             @PathParam("vcCreator") String vcCreator,
             @PathParam("vcName") String vcName, 
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/IndexControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/IndexControllerTest.java
index fbf56e3..42814e1 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/IndexControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/IndexControllerTest.java
@@ -71,13 +71,13 @@
         
         Thread.sleep(200);
 
-        response = resource().path(API_VERSION).path("vc").path("system")
+        response = resource().path(API_VERSION).path("vc").path("~system")
                 .path("named-vc1")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("admin", "pass"))
                 .delete(ClientResponse.class);
 
-        response = resource().path(API_VERSION).path("vc").path("system")
+        response = resource().path(API_VERSION).path("vc").path("~system")
                 .path("named-vc1")
                 .get(ClientResponse.class);
         
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
index 455d311..cc28512 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
@@ -97,7 +97,7 @@
 
     private void testScopeNotAuthorized (String accessToken)
             throws KustvaktException {
-        ClientResponse response = resource().path(API_VERSION).path("vc").path("list")
+        ClientResponse response = resource().path(API_VERSION).path("vc")
                 .header(Attributes.AUTHORIZATION, "Bearer " + accessToken)
                 .get(ClientResponse.class);
 
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
index 2178de6..f56292e 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
@@ -427,11 +427,9 @@
         assertTrue(node.at("/isSuper").asBoolean());
 
         // list vc
-        ClientResponse response =
-                resource().path(API_VERSION).path("vc").path("list")
-                        .header(Attributes.AUTHORIZATION,
-                                "Bearer " + accessToken)
-                        .get(ClientResponse.class);
+        ClientResponse response = resource().path(API_VERSION).path("vc")
+                .header(Attributes.AUTHORIZATION, "Bearer " + accessToken)
+                .get(ClientResponse.class);
 
         assertEquals(ClientResponse.Status.UNAUTHORIZED.getStatusCode(),
                 response.getStatus());
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
index 0dff701..77765e1 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
@@ -29,17 +29,15 @@
  */
 public class UserGroupControllerAdminTest extends SpringJerseyTest {
 
-    private String adminUsername = "admin";
-    private String testUsername = "UserGroupControllerAdminTest";
+    private String adminUser = "admin";
+    private String testUser = "UserGroupControllerAdminTest";
 
     private JsonNode listGroup (String username)
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        testUsername, "pass"))
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get(ClientResponse.class);
 
@@ -51,12 +49,11 @@
 
     @Test
     public void testListDoryGroups () throws KustvaktException {
-        ClientResponse response = resource().path(API_VERSION).path("group").path("list")
-                .path("system-admin").queryParam("username", "dory")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        adminUsername, "pass"))
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .path("list").path("system-admin")
+                .queryParam("username", "dory")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get(ClientResponse.class);
 
@@ -69,13 +66,11 @@
 
     @Test
     public void testListDoryActiveGroups () throws KustvaktException {
-        ClientResponse response = resource().path(API_VERSION).path("group").path("list")
-                .path("system-admin").queryParam("username", "dory")
-                .queryParam("status", "ACTIVE")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        adminUsername, "pass"))
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .path("list").path("system-admin")
+                .queryParam("username", "dory").queryParam("status", "ACTIVE")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get(ClientResponse.class);
 
@@ -86,18 +81,15 @@
         assertEquals(2, node.size());
     }
 
-
     // same as list user-groups of the admin
     @Test
     public void testListWithoutUsername () throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
-        ClientResponse response =
-                resource().path(API_VERSION).path("group")
-                        .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                                        .createBasicAuthorizationHeaderValue(
-                                                adminUsername, "pass"))
-                        .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                        .get(ClientResponse.class);
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                .get(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.getEntity(String.class);
@@ -107,14 +99,12 @@
     @Test
     public void testListByStatusAll () throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
-        ClientResponse response =
-                resource().path(API_VERSION).path("group").path("list").path("system-admin")
-                        .header(Attributes.AUTHORIZATION,
-                                HttpAuthorizationHandler
-                                        .createBasicAuthorizationHeaderValue(
-                                                adminUsername, "pass"))
-                        .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                        .get(ClientResponse.class);
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .path("list").path("system-admin")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                .get(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.getEntity(String.class);
@@ -132,12 +122,11 @@
     @Test
     public void testListByStatusHidden () throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
-        ClientResponse response = resource().path(API_VERSION).path("group").path("list")
-                .path("system-admin").queryParam("status", "HIDDEN")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        adminUsername, "pass"))
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .path("list").path("system-admin")
+                .queryParam("status", "HIDDEN")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get(ClientResponse.class);
 
@@ -153,24 +142,24 @@
             ClientHandlerException, KustvaktException {
 
         String groupName = "admin-test-group";
-        
+
         MultivaluedMap<String, String> form = new MultivaluedMapImpl();
         form.add("members", "marlin,nemo");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName)
+                .path("@" + groupName)
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION,
                         HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        testUsername, "password"))
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .entity(form).put(ClientResponse.class);
+                                .createBasicAuthorizationHeaderValue(testUser,
+                                        "password"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32").entity(form)
+                .put(ClientResponse.class);
 
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
 
         // list user group
-        JsonNode node = listGroup(testUsername);
+        JsonNode node = listGroup(testUser);
         assertEquals(1, node.size());
         node = node.get(0);
         assertEquals(groupName, node.get("name").asText());
@@ -187,10 +176,12 @@
 
         // accept invitation
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("subscribe")
+                .path("@" + groupName).path("subscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(memberUsername, "pass"))
+                .header(Attributes.AUTHORIZATION,
+                        HttpAuthorizationHandler
+                                .createBasicAuthorizationHeaderValue(
+                                        memberUsername, "pass"))
                 .post(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
@@ -207,16 +198,15 @@
         map.add("roleIds", "1"); // USER_GROUP_ADMIN
         map.add("roleIds", "2"); // USER_GROUP_MEMBER
 
-        ClientResponse response =
-                resource().path(API_VERSION).path("group").path(groupName)
-                        .path("role").path("add")
-                        .type(MediaType.APPLICATION_FORM_URLENCODED)
-                        .header(Attributes.AUTHORIZATION,
-                                HttpAuthorizationHandler
-                                        .createBasicAuthorizationHeaderValue(
-                                                adminUsername, "password"))
-                        .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                        .entity(map).post(ClientResponse.class);
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .path("@" + groupName).path("role").path("add")
+                .type(MediaType.APPLICATION_FORM_URLENCODED)
+                .header(Attributes.AUTHORIZATION,
+                        HttpAuthorizationHandler
+                                .createBasicAuthorizationHeaderValue(adminUser,
+                                        "password"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32").entity(map)
+                .post(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
 
@@ -240,13 +230,13 @@
         map.add("memberUsername", memberUsername);
         map.add("roleIds", "1"); // USER_GROUP_ADMIN
 
-        ClientResponse response = resource().path(API_VERSION).path("group").path(groupName)
-                .path("role").path("delete")
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .path("@" + groupName).path("role").path("delete")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION,
                         HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        adminUsername, "password"))
+                                .createBasicAuthorizationHeaderValue(adminUser,
+                                        "password"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32").entity(map)
                 .post(ClientResponse.class);
 
@@ -266,10 +256,10 @@
     private JsonNode retrieveGroup (String groupName)
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
-        ClientResponse response = resource().path(API_VERSION).path("group").path(groupName)
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler.createBasicAuthorizationHeaderValue(
-                        adminUsername, "pass"))
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .path("@" + groupName)
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get(ClientResponse.class);
 
@@ -284,19 +274,17 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         // delete group
-        ClientResponse response =
-                resource().path(API_VERSION).path("group").path(groupName)
-                        .header(Attributes.AUTHORIZATION,
-                                HttpAuthorizationHandler
-                                        .createBasicAuthorizationHeaderValue(
-                                                adminUsername, "pass"))
-                        .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                        .delete(ClientResponse.class);
+        ClientResponse response = resource().path(API_VERSION).path("group")
+                .path("@" + groupName)
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                .delete(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
 
         // check group
-        JsonNode node = listGroup(testUsername);
+        JsonNode node = listGroup(testUser);
         assertEquals(0, node.size());
     }
 
@@ -305,18 +293,16 @@
             KustvaktException {
         // delete marlin from group
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("marlin")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        adminUsername, "pass"))
+                .path("@" + groupName).path("~marlin")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .delete(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
 
         // check group member
-        JsonNode node = listGroup(testUsername);
+        JsonNode node = listGroup(testUser);
         node = node.get(0);
         assertEquals(3, node.get("members").size());
         assertEquals("nemo", node.at("/members/1/userId").asText());
@@ -331,19 +317,17 @@
         form.add("members", "darla");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("invite")
+                .path("@" + groupName).path("invite")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        adminUsername, "pass"))
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
                 .entity(form).post(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
 
         // list group
-        JsonNode node = listGroup(testUsername);
+        JsonNode node = listGroup(testUser);
         node = node.get(0);
         assertEquals(4, node.get("members").size());
 
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerTest.java
index d81a3c3..59524af 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerTest.java
@@ -59,7 +59,7 @@
     
     private void deleteGroupByName (String groupName) throws KustvaktException{
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName)
+                .path("@"+groupName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -166,7 +166,7 @@
         form.add("members", members);
         
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).type(MediaType.APPLICATION_FORM_URLENCODED)
+                .path("@"+groupName).type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32").entity(form)
@@ -179,7 +179,7 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).type(MediaType.APPLICATION_FORM_URLENCODED)
+                .path("@"+groupName).type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -253,7 +253,7 @@
             KustvaktException {
         // delete marlin from group
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("marlin")
+                .path("@"+groupName).path("~marlin")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -276,7 +276,7 @@
             KustvaktException {
         // nemo is a group member
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("marlin")
+                .path("@"+groupName).path("~marlin")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("nemo", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -297,7 +297,7 @@
             ClientHandlerException, KustvaktException {
         // dory delete pearl
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("pearl")
+                .path("@dory-group").path("~pearl")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -314,7 +314,7 @@
     public void testDeleteDeletedMember () throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("pearl")
+                .path("@dory-group").path("~pearl")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -336,7 +336,7 @@
             KustvaktException {
         // delete group
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName)
+                .path("@"+groupName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -373,7 +373,7 @@
             ClientHandlerException, KustvaktException {
         // dory is a group admin in marlin-group
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("marlin-group")
+                .path("@marlin-group")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -393,7 +393,7 @@
     public void testDeleteDeletedGroup () throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("deleted-group")
+                .path("@deleted-group")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -415,7 +415,7 @@
         // delete marlin from marlin-group
         // dory is a group admin in marlin-group
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("marlin-group").path("marlin")
+                .path("@marlin-group").path("~marlin")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -437,7 +437,7 @@
         form.add("members", "darla");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("invite")
+                .path("@"+groupName).path("invite")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
@@ -471,7 +471,7 @@
         form.add("members", "marlin");
         
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("invite")
+                .path("@dory-group").path("invite")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
@@ -497,7 +497,7 @@
         form.add("members", "pearl");
         
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("invite")
+                .path("@dory-group").path("invite")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
@@ -524,7 +524,7 @@
         form.add("members", "marlin");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("invite")
+                .path("@dory-group").path("invite")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
@@ -552,7 +552,7 @@
         form.add("members", "nemo");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("invite")
+                .path("@dory-group").path("invite")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
@@ -581,7 +581,7 @@
         form.add("members", "nemo");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("deleted-group").path("invite")
+                .path("@deleted-group").path("invite")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
@@ -602,7 +602,7 @@
     @Test
     public void testSubscribePendingMember () throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("subscribe")
+                .path("@dory-group").path("subscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("marlin", "pass"))
@@ -641,7 +641,7 @@
     @Test
     public void testSubscribeDeletedMember () throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("subscribe")
+                .path("@dory-group").path("subscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("pearl", "pass"))
@@ -664,14 +664,14 @@
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("bruce", "pass"))
                 .post(ClientResponse.class);
-        assertEquals(Status.METHOD_NOT_ALLOWED.getStatusCode(),
+        assertEquals(Status.NOT_FOUND.getStatusCode(),
                 response.getStatus());
     }
 
     @Test
     public void testSubscribeNonExistentMember () throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("subscribe")
+                .path("@dory-group").path("subscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("bruce", "pass"))
@@ -690,7 +690,7 @@
     @Test
     public void testSubscribeToNonExistentGroup () throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("non-existent").path("subscribe")
+                .path("@non-existent").path("subscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("pearl", "pass"))
@@ -709,7 +709,7 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("subscribe")
+                .path("@"+groupName).path("subscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("nemo", "pass"))
@@ -728,7 +728,7 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("unsubscribe")
+                .path("@"+groupName).path("unsubscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("marlin", "pass"))
@@ -743,7 +743,7 @@
     private void checkGroupMemberRole (String groupName, String deletedMemberName)
             throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName)
+                .path("@"+groupName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -769,7 +769,7 @@
             KustvaktException {
         // pearl unsubscribes from dory-group
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("unsubscribe")
+                .path("@dory-group").path("unsubscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("pearl", "pass"))
@@ -795,7 +795,7 @@
         assertEquals(2, node.size());
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("unsubscribe")
+                .path("@dory-group").path("unsubscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("marlin", "pass"))
@@ -826,7 +826,7 @@
     @Test
     public void testUnsubscribeNonExistentMember () throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("dory-group").path("unsubscribe")
+                .path("@dory-group").path("unsubscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("bruce", "pass"))
@@ -846,7 +846,7 @@
     @Test
     public void testUnsubscribeToNonExistentGroup () throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("tralala-group").path("unsubscribe")
+                .path("@tralala-group").path("unsubscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("pearl", "pass"))
@@ -868,7 +868,7 @@
             KustvaktException {
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName).path("unsubscribe")
+                .path("@"+groupName).path("unsubscribe")
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("nemo", "pass"))
@@ -891,7 +891,7 @@
         form.add("roleIds", "1");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("marlin-group").path("role").path("add")
+                .path("@marlin-group").path("role").path("add")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("marlin", "pass"))
@@ -912,7 +912,7 @@
         form.add("roleIds", "1");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("marlin-group").path("role").path("delete")
+                .path("@marlin-group").path("role").path("delete")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("marlin", "pass"))
@@ -934,7 +934,7 @@
         form.add("memberUsername", "dory");
         
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("marlin-group").path("role").path("edit")
+                .path("@marlin-group").path("role").path("edit")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("marlin", "pass"))
@@ -958,7 +958,7 @@
         form.add("roleIds", "3");
 
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path("marlin-group").path("role").path("edit")
+                .path("@marlin-group").path("role").path("edit")
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("marlin", "pass"))
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerAdminTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerAdminTest.java
index aa0da5d..a23ce28 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerAdminTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerAdminTest.java
@@ -33,7 +33,7 @@
     public void testSearchPrivateVC () throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path("dory-vc")
+                .path("~dory").path("dory-vc")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -53,7 +53,7 @@
             ClientHandlerException, KustvaktException {
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path("group-vc")
+                .path("~dory").path("group-vc")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -107,7 +107,7 @@
                 + "\"corpusQuery\": \"creationDate since 1820\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(admin).path("new-system-vc")
+                .path("~"+admin).path("new-system-vc")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
@@ -125,7 +125,7 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(vcCreator).path(vcName)
+                .path("~"+vcCreator).path(vcName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -145,7 +145,7 @@
 
         String vcName = "new-vc";
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(username).path(vcName)
+                .path("~"+username).path(vcName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -185,7 +185,7 @@
         String json = "{\"description\": \"edited vc\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(vcCreator).path(vcName)
+                .path("~"+vcCreator).path(vcName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -202,7 +202,7 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(vcCreator).path(vcName)
+                .path("~"+vcCreator).path(vcName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -274,8 +274,8 @@
             ClientHandlerException, KustvaktException {
         ClientResponse response;
         // share VC
-        response = resource().path(API_VERSION).path("vc").path(vcCreator)
-                .path(vcName).path("share").path(groupName)
+        response = resource().path(API_VERSION).path("vc").path("~"+vcCreator)
+                .path(vcName).path("share").path("@"+groupName)
                 .type(MediaType.APPLICATION_FORM_URLENCODED)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerTest.java
index 13e1ec9..418ffb5 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerTest.java
@@ -37,6 +37,8 @@
  */
 public class VirtualCorpusControllerTest extends VirtualCorpusTestBase {
 
+    private String testUser = "vcControllerTest";
+
     private void checkWWWAuthenticateHeader (ClientResponse response) {
         Set<Entry<String, List<String>>> headers =
                 response.getHeaders().entrySet();
@@ -45,8 +47,6 @@
             if (header.getKey().equals(ContainerRequest.WWW_AUTHENTICATE)) {
                 assertEquals("Api realm=\"Kustvakt\"",
                         header.getValue().get(0));
-                // assertEquals("Session realm=\"Kustvakt\"",
-                // header.getValue().get(1));
                 assertEquals("Bearer realm=\"Kustvakt\"",
                         header.getValue().get(1));
                 assertEquals("Basic realm=\"Kustvakt\"",
@@ -62,7 +62,6 @@
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-
                 .get(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
@@ -75,11 +74,10 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(username)
+                .path("~" + username)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-
                 .get(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
@@ -91,7 +89,7 @@
     private void testDeleteVC (String vcName, String username)
             throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(username).path(vcName)
+                .path("~" + username).path(vcName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -117,19 +115,18 @@
     public void testRetrieveSystemVCInfo () throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
 
-        JsonNode node = testSearchVC("VirtualCorpusControllerTest", "system",
-                "system-vc");
+        JsonNode node = testSearchVC(testUser, "system", "system-vc");
         assertEquals("system-vc", node.at("/name").asText());
         assertEquals(VirtualCorpusType.SYSTEM.displayName(),
                 node.at("/type").asText());
     }
-    
+
     @Test
     public void testRetrieveSystemVCGuest () throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("system").path("system-vc").get(ClientResponse.class);
+                .path("~system").path("system-vc").get(ClientResponse.class);
         JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
         assertEquals("system-vc", node.at("/name").asText());
         assertEquals(VirtualCorpusType.SYSTEM.displayName(),
@@ -152,11 +149,9 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path("dory-vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~dory").path("dory-vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get(ClientResponse.class);
         String entity = response.getEntity(String.class);
@@ -164,8 +159,7 @@
         assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
         assertEquals(StatusCodes.AUTHORIZATION_FAILED,
                 node.at("/errors/0/0").asInt());
-        assertEquals(
-                "Unauthorized operation for user: VirtualCorpusControllerTest",
+        assertEquals("Unauthorized operation for user: " + testUser,
                 node.at("/errors/0/1").asText());
 
         checkWWWAuthenticateHeader(response);
@@ -187,7 +181,7 @@
             KustvaktException {
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path("group-vc")
+                .path("~dory").path("group-vc")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("marlin", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -257,7 +251,8 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                .path("~dory")
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("pearl", "pass"))
                 .get(ClientResponse.class);
@@ -297,11 +292,9 @@
                 + "\"corpusQuery\": \"corpusSigle=GOE\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~"+testUser).path("new_vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .put(ClientResponse.class, json);
@@ -309,15 +302,15 @@
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
 
         // list user VC
-        JsonNode node = testListVC("VirtualCorpusControllerTest");
+        JsonNode node = testListVC(testUser);
         assertEquals(2, node.size());
         assertEquals("new_vc", node.get(1).get("name").asText());
 
         // delete new VC
-        testDeleteVC("new_vc", "VirtualCorpusControllerTest");
+        testDeleteVC("new_vc", testUser);
 
         // list VC
-        node = testListVC("VirtualCorpusControllerTest");
+        node = testListVC(testUser);
         assertEquals(1, node.size());
     }
 
@@ -329,11 +322,9 @@
         String vcName = "new-published-vc";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path(vcName)
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~"+testUser).path(vcName)
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .put(ClientResponse.class, json);
@@ -341,7 +332,7 @@
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
 
         // test list owner vc
-        JsonNode node = testListOwnerVC("VirtualCorpusControllerTest");
+        JsonNode node = testListOwnerVC(testUser);
         assertEquals(1, node.size());
         assertEquals(vcName, node.get(0).get("name").asText());
 
@@ -360,13 +351,13 @@
         assertEquals("HIDDEN", node.at("/status").asText());
 
         // EM: delete vc
-        testDeleteVC(vcName, "VirtualCorpusControllerTest");
+        testDeleteVC(vcName, testUser);
 
         // EM: check if the hidden groups are deleted as well
         node = testCheckHiddenGroup(groupName);
         assertEquals(StatusCodes.NO_RESOURCE_FOUND,
                 node.at("/errors/0/0").asInt());
-        assertEquals("Group "+ groupName + " is not found",
+        assertEquals("Group " + groupName + " is not found",
                 node.at("/errors/0/1").asText());
     }
 
@@ -374,7 +365,7 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("group")
-                .path(groupName)
+                .path("@"+groupName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("admin", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -400,7 +391,7 @@
         }
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
+                .path("~"+testUser).path("new_vc")
                 .header(Attributes.AUTHORIZATION,
                         AuthenticationScheme.API.displayName() + " "
                                 + authToken)
@@ -432,7 +423,7 @@
                 + "CuYAfytr_LWqY8woJs";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
+                .path("~"+testUser).path("new_vc")
                 .header(Attributes.AUTHORIZATION,
                         AuthenticationScheme.API.displayName() + " "
                                 + authToken)
@@ -457,11 +448,9 @@
                 + "\"corpusQuery\": \"creationDate since 1820\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~"+testUser).path("new_vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .entity(json).put(ClientResponse.class);
 
@@ -471,8 +460,7 @@
         JsonNode node = JsonUtils.readTree(entity);
         assertEquals(StatusCodes.AUTHORIZATION_FAILED,
                 node.at("/errors/0/0").asInt());
-        assertEquals(
-                "Unauthorized operation for user: VirtualCorpusControllerTest",
+        assertEquals("Unauthorized operation for user: " + testUser,
                 node.at("/errors/0/1").asText());
 
         checkWWWAuthenticateHeader(response);
@@ -484,11 +472,9 @@
                 + "\"corpusQuery\": \"creationDate since 1820\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new $vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~"+testUser).path("new $vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .entity(json).put(ClientResponse.class);
         String entity = response.getEntity(String.class);
@@ -505,7 +491,7 @@
                 + "\"corpusQuery\": \"creationDate since 1820\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
+                .path("~"+testUser).path("new_vc")
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .entity(json).put(ClientResponse.class);
 
@@ -526,11 +512,9 @@
         String json = "{\"type\": \"PRIVATE\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~"+testUser).path("new_vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .entity(json).put(ClientResponse.class);
         String entity = response.getEntity(String.class);
@@ -547,11 +531,9 @@
     @Test
     public void testCreateVCWithoutEntity () throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~"+testUser).path("new_vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .put(ClientResponse.class);
         String entity = response.getEntity(String.class);
@@ -569,11 +551,9 @@
         String json = "{\"corpusQuery\": " + "\"creationDate since 1820\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~"+testUser).path("new_vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .entity(json).put(ClientResponse.class);
         String entity = response.getEntity(String.class);
@@ -593,11 +573,9 @@
                 + "\"corpusQuery\": \"creationDate since 1820\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("VirtualCorpusControllerTest").path("new_vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~"+testUser).path("new_vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .entity(json).put(ClientResponse.class);
 
@@ -611,15 +589,13 @@
                 "Cannot deserialize value of type `de.ids_mannheim.korap.constant."
                         + "VirtualCorpusType` from String \"PRIVAT\""));
     }
-    
+
     @Test
     public void testDeleteVCUnauthorized () throws KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path("dory-vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~dory").path("dory-vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
 
                 .delete(ClientResponse.class);
@@ -630,8 +606,7 @@
         assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
         assertEquals(StatusCodes.AUTHORIZATION_FAILED,
                 node.at("/errors/0/0").asInt());
-        assertEquals(
-                "Unauthorized operation for user: VirtualCorpusControllerTest",
+        assertEquals("Unauthorized operation for user: " + testUser,
                 node.at("/errors/0/1").asText());
 
         checkWWWAuthenticateHeader(response);
@@ -644,7 +619,7 @@
         String json = "{\"description\": \"edited vc\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path("dory-vc")
+                .path("~dory").path("dory-vc")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -660,7 +635,7 @@
         // 2nd edit
         json = "{\"description\": \"test vc\"}";
 
-        response = resource().path(API_VERSION).path("vc").path("dory")
+        response = resource().path(API_VERSION).path("vc").path("~dory")
                 .path("dory-vc")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
@@ -681,7 +656,7 @@
         String json = "{\"corpusQuery\": \"corpusSigle=WPD17\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path("dory-vc")
+                .path("~dory").path("dory-vc")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -703,11 +678,9 @@
         String json = "{\"description\": \"edited vc\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path("dory-vc")
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .path("~dory").path("dory-vc")
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .put(ClientResponse.class, json);
@@ -717,8 +690,7 @@
         assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
         assertEquals(StatusCodes.AUTHORIZATION_FAILED,
                 node.at("/errors/0/0").asInt());
-        assertEquals(
-                "Unauthorized operation for user: VirtualCorpusControllerTest",
+        assertEquals("Unauthorized operation for user: " + testUser,
                 node.at("/errors/0/1").asText());
 
         checkWWWAuthenticateHeader(response);
@@ -737,7 +709,7 @@
         // edit vc
         String json = "{\"type\": \"PUBLISHED\"}";
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("dory").path(vcName)
+                .path("~dory").path(vcName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -762,7 +734,7 @@
         // edit 2nd
         json = "{\"type\": \"PROJECT\"}";
 
-        response = resource().path(API_VERSION).path("vc").path("dory")
+        response = resource().path(API_VERSION).path("vc").path("~dory")
                 .path("group-vc")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
@@ -799,7 +771,7 @@
     // .header(Attributes.AUTHORIZATION,
     // HttpAuthorizationHandler
     // .createBasicAuthorizationHeaderValue(
-    // "VirtualCorpusControllerTest", "pass"))
+    // testUser, "pass"))
     // .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
     // .get(ClientResponse.class);
     // String entity = response.getEntity(String.class);
@@ -880,8 +852,8 @@
             String vcName, String groupName) throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
 
-        return resource().path(API_VERSION).path("vc").path(vcCreator)
-                .path(vcName).path("share").path(groupName)
+        return resource().path(API_VERSION).path("vc").path("~"+vcCreator)
+                .path(vcName).path("share").path("@"+groupName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(vcCreator, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -932,8 +904,8 @@
 
         // dory is VCA in marlin group
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("marlin").path("marlin-vc").path("share")
-                .path("marlin group")
+                .path("~marlin").path("marlin-vc").path("share")
+                .path("@marlin group")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("dory", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -954,7 +926,7 @@
 
         // nemo is not VCA in marlin group
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path("nemo").path("nemo-vc").path("share").path("marlin-group")
+                .path("~nemo").path("nemo-vc").path("share").path("@marlin-group")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("nemo", "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -987,10 +959,8 @@
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
                 .path("access").path(accessId)
-                .header(Attributes.AUTHORIZATION,
-                        HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(
-                                        "VirtualCorpusControllerTest", "pass"))
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .delete(ClientResponse.class);
 
@@ -1000,8 +970,7 @@
         assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
         assertEquals(StatusCodes.AUTHORIZATION_FAILED,
                 node.at("/errors/0/0").asInt());
-        assertEquals(
-                "Unauthorized operation for user: VirtualCorpusControllerTest",
+        assertEquals("Unauthorized operation for user: " + testUser,
                 node.at("/errors/0/1").asText());
     }
 
@@ -1012,6 +981,7 @@
         assertEquals(Status.NOT_FOUND.getStatusCode(), response.getStatus());
 
         JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
-        assertEquals(StatusCodes.NO_RESOURCE_FOUND, node.at("/errors/0/0").asInt());
+        assertEquals(StatusCodes.NO_RESOURCE_FOUND,
+                node.at("/errors/0/0").asInt());
     }
 }
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusTestBase.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusTestBase.java
index 7246375..c3493f3 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusTestBase.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusTestBase.java
@@ -24,7 +24,7 @@
             throws UniformInterfaceException, ClientHandlerException,
             KustvaktException {
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(vcCreator).path(vcName)
+                .path("~"+vcCreator).path(vcName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
@@ -42,7 +42,7 @@
         String json = "{\"type\": \"" + type + "\"}";
 
         ClientResponse response = resource().path(API_VERSION).path("vc")
-                .path(vcCreator).path(vcName)
+                .path("~"+vcCreator).path(vcName)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")