diff --git a/full/src/main/java/de/ids_mannheim/korap/dao/VirtualCorpusAccessDao.java b/full/src/main/java/de/ids_mannheim/korap/dao/VirtualCorpusAccessDao.java
index 80cdf3b..db49626 100644
--- a/full/src/main/java/de/ids_mannheim/korap/dao/VirtualCorpusAccessDao.java
+++ b/full/src/main/java/de/ids_mannheim/korap/dao/VirtualCorpusAccessDao.java
@@ -108,24 +108,16 @@
         TypedQuery<VirtualCorpusAccess> q = entityManager.createQuery(query);
         return q.getResultList();
     }
-
-    // for system admins
-    @Deprecated
-    public List<VirtualCorpusAccess> retrieveAllAccessByVC (int vcId)
+    
+    public List<VirtualCorpusAccess> retrieveAllAccess ()
             throws KustvaktException {
-        ParameterChecker.checkIntegerValue(vcId, "vcId");
 
         CriteriaBuilder builder = entityManager.getCriteriaBuilder();
         CriteriaQuery<VirtualCorpusAccess> query =
                 builder.createQuery(VirtualCorpusAccess.class);
-
         Root<VirtualCorpusAccess> access =
                 query.from(VirtualCorpusAccess.class);
-        Join<VirtualCorpusAccess, VirtualCorpus> accessVC =
-                access.join(VirtualCorpusAccess_.virtualCorpus);
-
         query.select(access);
-        query.where(builder.equal(accessVC.get(VirtualCorpus_.id), vcId));
         TypedQuery<VirtualCorpusAccess> q = entityManager.createQuery(query);
         return q.getResultList();
     }
diff --git a/full/src/main/java/de/ids_mannheim/korap/dto/VirtualCorpusAccessDto.java b/full/src/main/java/de/ids_mannheim/korap/dto/VirtualCorpusAccessDto.java
index 5e8a6e7..d79b7d3 100644
--- a/full/src/main/java/de/ids_mannheim/korap/dto/VirtualCorpusAccessDto.java
+++ b/full/src/main/java/de/ids_mannheim/korap/dto/VirtualCorpusAccessDto.java
@@ -19,4 +19,11 @@
     private String vcName;
     private int userGroupId;
     private String userGroupName;
+
+    @Override
+    public String toString () {
+        return "accessId=" + accessId + ", createdBy=" + createdBy + " , vcId="
+                + vcId + ", vcName=" + vcName + ", userGroupId=" + userGroupId
+                + ", userGroupName=" + userGroupName;
+    }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/service/UserGroupService.java b/full/src/main/java/de/ids_mannheim/korap/service/UserGroupService.java
index ef44901..e094c33 100644
--- a/full/src/main/java/de/ids_mannheim/korap/service/UserGroupService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/service/UserGroupService.java
@@ -23,6 +23,7 @@
 import de.ids_mannheim.korap.dao.UserGroupMemberDao;
 import de.ids_mannheim.korap.dto.UserGroupDto;
 import de.ids_mannheim.korap.dto.converter.UserGroupConverter;
+import de.ids_mannheim.korap.encryption.RandomCodeGenerator;
 import de.ids_mannheim.korap.entity.Role;
 import de.ids_mannheim.korap.entity.UserGroup;
 import de.ids_mannheim.korap.entity.UserGroupMember;
@@ -61,7 +62,9 @@
     private FullConfiguration config;
     @Autowired
     private MailService mailService;
-
+    @Autowired
+    private RandomCodeGenerator random;
+    
     private static Set<Role> memberRoles;
 
     /**
@@ -75,14 +78,20 @@
      * 
      * @see {@link PredefinedRole}
      */
-    public List<UserGroupDto> retrieveUserGroup (String username)
+    public List<UserGroup> retrieveUserGroup (String username)
             throws KustvaktException {
 
         List<UserGroup> userGroups =
                 userGroupDao.retrieveGroupByUserId(username);
         Collections.sort(userGroups);
+        return userGroups;
+    }
+    
+    public List<UserGroupDto> retrieveUserGroupDto (String username)
+            throws KustvaktException {
+        List<UserGroup> userGroups = retrieveUserGroup(username);
+        
         ArrayList<UserGroupDto> dtos = new ArrayList<>(userGroups.size());
-
         UserGroupMember userAsMember;
         List<UserGroupMember> members;
         UserGroupDto groupDto;
@@ -96,6 +105,7 @@
         }
 
         return dtos;
+
     }
 
     private List<UserGroupMember> retrieveMembers (int groupId, String username)
@@ -118,6 +128,11 @@
             throws KustvaktException {
         return userGroupDao.retrieveGroupById(groupId);
     }
+    
+    public UserGroup retrieveUserGroupByName (String groupName)
+            throws KustvaktException {
+        return userGroupDao.retrieveGroupByName(groupName);
+    }
 
     public UserGroup retrieveHiddenUserGroupByVC (int vcId)
             throws KustvaktException {
@@ -257,7 +272,8 @@
     }
 
     public int createAutoHiddenGroup (int vcId) throws KustvaktException {
-        String groupName = "auto-hidden-group";
+        String code = random.createRandomCode();
+        String groupName = "auto-"+code;
         int groupId = userGroupDao.createGroup(groupName, "system",
                 UserGroupStatus.HIDDEN);
 
diff --git a/full/src/main/java/de/ids_mannheim/korap/service/VirtualCorpusService.java b/full/src/main/java/de/ids_mannheim/korap/service/VirtualCorpusService.java
index 8628328..556c2e4 100644
--- a/full/src/main/java/de/ids_mannheim/korap/service/VirtualCorpusService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/service/VirtualCorpusService.java
@@ -77,8 +77,19 @@
     @Autowired
     private VirtualCorpusAccessConverter accessConverter;
 
-    public List<VirtualCorpusDto> listOwnerVC (String username)
+    private void verifyUsername (String contextUsername, String pathUsername)
             throws KustvaktException {
+        if (!contextUsername.equals(pathUsername)
+                && !adminDao.isAdmin(contextUsername)) {
+            throw new KustvaktException(StatusCodes.AUTHORIZATION_FAILED,
+                    "Unauthorized operation for user: " + contextUsername,
+                    contextUsername);
+        }
+    }
+
+    public List<VirtualCorpusDto> listOwnerVC (String username, String vcCreator)
+            throws KustvaktException {
+        verifyUsername(username, vcCreator);
         List<VirtualCorpus> vcList = vcDao.retrieveOwnerVC(username);
         return createVCDtos(vcList);
     }
@@ -210,22 +221,18 @@
         }
     }
 
-    @Deprecated
-    public void editVC (VirtualCorpusJson vcJson, String username)
-            throws KustvaktException {
-        ParameterChecker.checkIntegerValue(vcJson.getId(), "id");
-        VirtualCorpus vc = vcDao.retrieveVCById(vcJson.getId());
-        editVC(vc, vcJson, vcJson.getName(), username);
-    }
+//    @Deprecated
+//    public void editVC (VirtualCorpusJson vcJson, String username)
+//            throws KustvaktException {
+//        ParameterChecker.checkIntegerValue(vcJson.getId(), "id");
+//        VirtualCorpus vc = vcDao.retrieveVCById(vcJson.getId());
+//        editVC(vc, vcJson, vcJson.getName(), username);
+//    }
 
     public void handlePutRequest (String username, String vcCreator,
             String vcName, VirtualCorpusJson vcJson) throws KustvaktException {
-        if (!username.equals(vcCreator)) {
-            throw new KustvaktException(StatusCodes.INVALID_ARGUMENT,
-                    "VC creator verification failed. Path parameter vcCreator "
-                            + "must be the same as the authenticated username.");
-        }
         
+        verifyUsername(username, vcCreator);
         VirtualCorpus vc = vcDao.retrieveVCByName(vcName, vcCreator);
         if (vc == null) {
             storeVC(vcJson, vcName, username);
@@ -416,23 +423,18 @@
         return (numberOfDoc > 0) ? true : false;
     }
 
-    @Deprecated
-    public List<VirtualCorpusAccess> retrieveAllVCAccess (int vcId)
-            throws KustvaktException {
-        return accessDao.retrieveAllAccessByVC(vcId);
-    }
 
-    public void shareVC (String username, int vcId, int groupId)
-            throws KustvaktException {
+    public void shareVC (String username, String createdBy, String vcName,
+            String groupName) throws KustvaktException {
 
-        VirtualCorpus vc = vcDao.retrieveVCById(vcId);
+        VirtualCorpus vc = vcDao.retrieveVCByName(vcName, createdBy);
         if (!username.equals(vc.getCreatedBy())
                 && !adminDao.isAdmin(username)) {
             throw new KustvaktException(StatusCodes.AUTHORIZATION_FAILED,
                     "Unauthorized operation for user: " + username, username);
         }
 
-        UserGroup userGroup = userGroupService.retrieveUserGroupById(groupId);
+        UserGroup userGroup = userGroupService.retrieveUserGroupByName(groupName);
 
         if (!isVCAccessAdmin(userGroup, username)
                 && !adminDao.isAdmin(username)) {
@@ -491,28 +493,25 @@
     // }
     // }
 
-    @Deprecated
-    public List<VirtualCorpusAccessDto> listVCAccessByVC (String username,
-            int vcId) throws KustvaktException {
-
-        List<VirtualCorpusAccess> accessList;
+    
+    public List<VirtualCorpusAccessDto> listVCAccessByUsername (String username)
+            throws KustvaktException {
+        List<VirtualCorpusAccess> accessList = new ArrayList<>();
         if (adminDao.isAdmin(username)) {
-            accessList = accessDao.retrieveAllAccessByVC(vcId);
+            accessList = accessDao.retrieveAllAccess();
         }
         else {
-            accessList = accessDao.retrieveActiveAccessByVC(vcId);
-            List<VirtualCorpusAccess> filteredAccessList = new ArrayList<>();
-            for (VirtualCorpusAccess access : accessList) {
-                UserGroup userGroup = access.getUserGroup();
-                if (isVCAccessAdmin(userGroup, username)) {
-                    filteredAccessList.add(access);
-                }
+            List<UserGroup> groups = userGroupService.retrieveUserGroup(username);
+            for (UserGroup g: groups){
+                if (isVCAccessAdmin(g, username)){
+                    accessList.addAll(accessDao.retrieveActiveAccessByGroup(g.getId()));
+                }   
             }
-            accessList = filteredAccessList;
         }
         return accessConverter.createVCADto(accessList);
     }
-
+    
+    
     public List<VirtualCorpusAccessDto> listVCAccessByVC (String username,
             String vcCreator, String vcName) throws KustvaktException {
 
@@ -534,6 +533,7 @@
         return accessConverter.createVCADto(accessList);
     }
 
+    @Deprecated
     public List<VirtualCorpusAccessDto> listVCAccessByGroup (String username,
             int groupId) throws KustvaktException {
         UserGroup userGroup = userGroupService.retrieveUserGroupById(groupId);
@@ -552,6 +552,24 @@
 
         return accessConverter.createVCADto(accessList);
     }
+    
+    public List<VirtualCorpusAccessDto> listVCAccessByGroup (String username,
+            String groupName) throws KustvaktException {
+        UserGroup userGroup = userGroupService.retrieveUserGroupByName(groupName);
+
+        List<VirtualCorpusAccess> accessList;
+        if (adminDao.isAdmin(username)) {
+            accessList = accessDao.retrieveAllAccessByGroup(userGroup.getId());
+        }
+        else if (isVCAccessAdmin(userGroup, username)) {
+            accessList = accessDao.retrieveActiveAccessByGroup(userGroup.getId());
+        }
+        else {
+            throw new KustvaktException(StatusCodes.AUTHORIZATION_FAILED,
+                    "Unauthorized operation for user: " + username, username);
+        }
+        return accessConverter.createVCADto(accessList);
+    }
 
     public void deleteVCAccess (int accessId, String username)
             throws KustvaktException {
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
index e287be6..75fd96c 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
@@ -80,7 +80,7 @@
                 (TokenContext) securityContext.getUserPrincipal();
         try {
             scopeService.verifyScope(context, OAuth2Scope.USER_GROUP_INFO);
-            return service.retrieveUserGroup(context.getUsername());
+            return service.retrieveUserGroupDto(context.getUsername());
         }
         catch (KustvaktException e) {
             throw kustvaktResponseHandler.throwit(e);
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
index a2aa625..60beaea 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
@@ -4,7 +4,6 @@
 
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
-import javax.ws.rs.FormParam;
 import javax.ws.rs.GET;
 import javax.ws.rs.POST;
 import javax.ws.rs.PUT;
@@ -23,7 +22,6 @@
 import com.sun.jersey.spi.container.ResourceFilters;
 
 import de.ids_mannheim.korap.constant.OAuth2Scope;
-import de.ids_mannheim.korap.constant.VirtualCorpusAccessStatus;
 import de.ids_mannheim.korap.constant.VirtualCorpusType;
 import de.ids_mannheim.korap.dto.VirtualCorpusAccessDto;
 import de.ids_mannheim.korap.dto.VirtualCorpusDto;
@@ -67,72 +65,27 @@
     private OAuth2ScopeService scopeService;
 
     /**
-     * Creates a user virtual corpus, also for system admins
+     * Updates a vc according to the given VirtualCorpusJson, if the
+     * VC exists, otherwise creates a new VC with the given VC creator
+     * and VC name specified as the path parameters. The vc creator
+     * must be the same as the authenticated username.
      * 
-     * @see VirtualCorpusJson
+     * VC name cannot be updated.
      * 
      * @param securityContext
-     * @param vc
-     *            a JSON object describing the virtual corpus
-     * @return HTTP Response OK if successful
-     */
-    @POST
-    @Path("create")
-    @Consumes("application/json")
-    @Deprecated
-    public Response createVC (@Context SecurityContext securityContext,
-            VirtualCorpusJson vc) {
-        try {
-            // get user info
-            TokenContext context =
-                    (TokenContext) securityContext.getUserPrincipal();
-
-            scopeService.verifyScope(context, OAuth2Scope.CREATE_VC);
-            service.storeVC(vc, vc.getName(), context.getUsername());
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-        return Response.ok().build();
-    }
-
-    /**
-     * Edits a virtual corpus attributes including name, type and
-     * corpus query. Only the virtual corpus owner and system admins
-     * can edit a virtual corpus.
-     * 
-     * @see VirtualCorpusJson
-     * 
-     * @param securityContext
-     * @param vc
-     *            a JSON object describing the virtual corpus
-     * @return HTTP Response OK if successful
+     * @param vcCreator
+     *            the username of the vc creator, must be the same
+     *            as the authenticated username
+     * @param vcName
+     *           the vc name
+     * @param vc a json object describing the VC
+     * @return
      * @throws KustvaktException
      */
-    @POST
-    @Path("edit")
-    @Consumes("application/json")
-    @Deprecated
-    public Response editVC (@Context SecurityContext securityContext,
-            VirtualCorpusJson vc) throws KustvaktException {
-        TokenContext context =
-                (TokenContext) securityContext.getUserPrincipal();
-
-        try {
-            scopeService.verifyScope(context, OAuth2Scope.EDIT_VC);
-            service.editVC(vc, context.getUsername());
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-        return Response.ok().build();
-    }
-
-    // EM: changing vc name is disabled
     @PUT
     @Path("/{vcCreator}/{vcName}")
     @Consumes(MediaType.APPLICATION_JSON + ";charset=utf-8")
-    public Response editVC (@Context SecurityContext securityContext,
+    public Response createUpdateVC (@Context SecurityContext securityContext,
             @PathParam("vcCreator") String vcCreator,
             @PathParam("vcName") String vcName,
             VirtualCorpusJson vc) throws KustvaktException {
@@ -150,32 +103,6 @@
     }
 
     /**
-     * Searches for a specific VC given the VC id.
-     * 
-     * @param securityContext
-     * @param vcId
-     *            a virtual corpus id
-     * @return a list of virtual corpora
-     */
-    @GET
-    @Path("{vcId}")
-    @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
-    @Deprecated
-    public VirtualCorpusDto retrieveVC (
-            @Context SecurityContext securityContext,
-            @PathParam("vcId") int vcId) {
-        TokenContext context =
-                (TokenContext) securityContext.getUserPrincipal();
-        try {
-            scopeService.verifyScope(context, OAuth2Scope.VC_INFO);
-            return service.searchVCById(context.getUsername(), vcId);
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-    }
-
-    /**
      * Returns the virtual corpus with the given name and creator.
      * 
      * @param securityContext
@@ -214,24 +141,12 @@
      * available for other users. Thus, username parameter is optional
      * and must be identical to the authenticated username.
      * 
-     * 
-     * 
      * @param securityContext
      * @param username
      *            a username (optional)
      * @return a list of virtual corpora
      */
     @GET
-    @Path("list")
-    @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
-    @Deprecated
-    public List<VirtualCorpusDto> listVCByUser (
-            @Context SecurityContext securityContext,
-            @QueryParam("username") String username) {
-        return listAvailableVC(securityContext, username);
-    }
-
-    @GET
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public List<VirtualCorpusDto> listAvailableVC (
             @Context SecurityContext securityContext,
@@ -248,25 +163,29 @@
         }
     }
 
-    // EM: TODO: change path to @Path("{createdBy}"), currently
-    // conflicted with /{vcId}
     /**
-     * Lists all virtual corpora created by a user
+     * Lists all virtual corpora created by a user. This list is only
+     * available to the owner of the vc. Users, except system-admins, 
+     * are not allowed to list vc created by other users. 
+     * 
+     * Thus, the path parameter "createdBy" must be the same as the
+     * authenticated username. 
      * 
      * @param securityContext
      * @return a list of virtual corpora created by the user
      *         in the security context.
      */
     @GET
-    @Path("list/user")
+    @Path("{createdBy}")
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public List<VirtualCorpusDto> listUserVC (
+            @PathParam("createdBy") String createdBy, 
             @Context SecurityContext securityContext) {
         TokenContext context =
                 (TokenContext) securityContext.getUserPrincipal();
         try {
             scopeService.verifyScope(context, OAuth2Scope.VC_INFO);
-            return service.listOwnerVC(context.getUsername());
+            return service.listOwnerVC(context.getUsername(), createdBy);
         }
         catch (KustvaktException e) {
             throw kustvaktResponseHandler.throwit(e);
@@ -291,7 +210,7 @@
     @GET
     @Path("list/system-admin")
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
-    public List<VirtualCorpusDto> listVCByStatus (
+    public List<VirtualCorpusDto> listVCByType (
             @Context SecurityContext securityContext,
             @QueryParam("createdBy") String createdBy,
             @QueryParam("type") VirtualCorpusType type) {
@@ -306,32 +225,6 @@
         }
     }
 
-    /**
-     * Only the VC owner and system admins can delete VC. VCA admins
-     * can delete VC-accesses e.g. of project VC, but not the VC
-     * themselves.
-     * 
-     * @param securityContext
-     * @param vcId
-     *            the id of the virtual corpus
-     * @return HTTP status 200, if successful
-     */
-    @DELETE
-    @Path("delete/{vcId}")
-    @Deprecated
-    public Response deleteVC (@Context SecurityContext securityContext,
-            @PathParam("vcId") int vcId) {
-        TokenContext context =
-                (TokenContext) securityContext.getUserPrincipal();
-        try {
-            scopeService.verifyScope(context, OAuth2Scope.DELETE_VC);
-            service.deleteVC(context.getUsername(), vcId);
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-        return Response.ok().build();
-    }
 
     /**
      * Only the VC owner and system admins can delete VC. VCA admins
@@ -362,7 +255,6 @@
         return Response.ok().build();
     }
 
-    // EM: TODO: replace vcId with vcCreator and vcUsername
     /**
      * VC can only be shared with a group, not individuals.
      * Only VCA admins are allowed to share VC and the VC must have
@@ -372,22 +264,25 @@
      * Not allowed via third-party apps.
      * 
      * @param securityContext
-     * @param vcId
-     *            a virtual corpus id
-     * @param groupId
-     *            a user group id
+     * @param vcCreator
+     *            the username of the vc creator
+     * @param vcName
+     *            the name of the vc
+     * @param groupName
+     *            the name of the group to share
      * @return HTTP status 200, if successful
      */
     @POST
-    @Path("access/share")
-    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    @Path("{vcCreator}/{vcName}/share/{groupName}")
     public Response shareVC (@Context SecurityContext securityContext,
-            @FormParam("vcId") int vcId, @FormParam("groupId") int groupId) {
+            @PathParam("vcCreator") String vcCreator,
+            @PathParam("vcName") String vcName, 
+            @PathParam("groupName") String groupName) {
         TokenContext context =
                 (TokenContext) securityContext.getUserPrincipal();
         try {
             scopeService.verifyScope(context, OAuth2Scope.SHARE_VC);
-            service.shareVC(context.getUsername(), vcId, groupId);
+            service.shareVC(context.getUsername(), vcCreator, vcName, groupName);
         }
         catch (KustvaktException e) {
             throw kustvaktResponseHandler.throwit(e);
@@ -407,14 +302,6 @@
      * @return
      */
     @DELETE
-    @Path("access/delete/{accessId}")
-    @Deprecated
-    public Response deleteVCAccess (@Context SecurityContext securityContext,
-            @PathParam("accessId") int accessId) {
-        return deleteVCAccessById(securityContext, accessId);
-    }
-
-    @DELETE
     @Path("access/{accessId}")
     public Response deleteVCAccessById (
             @Context SecurityContext securityContext,
@@ -432,105 +319,34 @@
     }
 
     /**
-     * Lists active VC accesses to the specified VC.
-     * Only available to VCA and system admins.
-     * For system admins, lists all VCA of the VC.
-     * 
-     * <br /><br />
-     * Not allowed via third-party apps.
-     * 
-     * @see VirtualCorpusAccessStatus
-     * 
-     * @param securityContext
-     * @param vcId
-     *            virtual corpus id
-     * @return a list of access to the specified virtual corpus
-     */
-    @GET
-    @Path("access/list")
-    @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
-    @Deprecated
-    public List<VirtualCorpusAccessDto> listVCAccess (
-            @Context SecurityContext securityContext,
-            @QueryParam("vcId") int vcId) {
-        TokenContext context =
-                (TokenContext) securityContext.getUserPrincipal();
-        try {
-            scopeService.verifyScope(context, OAuth2Scope.VC_ACCESS_INFO);
-            return service.listVCAccessByVC(context.getUsername(), vcId);
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-    }
-
-    /**
-     * Lists active VC-accesses available to a given VC or user-group.
+     * Lists active VC-accesses available to user.
      * 
      * Only available to VCA and system admins.
-     * For system admins, list all VCA for the group.
+     * For system admins, list all VCA regardless of status.
      * 
      * @param securityContext
-     * @param vcCreator
-     *            the username of a VC creator
-     * @param vcName
-     *            the name of a VC
-     * @param groupId
-     *            a group id number
-     * @return
+     * @return a list of VC accesses
      */
     @GET
     @Path("access")
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public List<VirtualCorpusAccessDto> listVCAccesses (
             @Context SecurityContext securityContext,
-            @QueryParam("vcCreator") String vcCreator,
-            @QueryParam("vcName") String vcName,
-            @QueryParam("groupId") int groupId) {
+            @QueryParam("groupName") String groupName) {
         TokenContext context =
                 (TokenContext) securityContext.getUserPrincipal();
         try {
             scopeService.verifyScope(context, OAuth2Scope.VC_ACCESS_INFO);
-            if (groupId > 0) {
-                return service.listVCAccessByGroup(context.getUsername(),
-                        groupId);
+            if (groupName!=null && !groupName.isEmpty()){
+                return service.listVCAccessByGroup(context.getUsername(), groupName);
             }
-            return service.listVCAccessByVC(context.getUsername(), vcCreator,
-                    vcName);
+            else {
+                return service.listVCAccessByUsername(context.getUsername());
+            }
         }
         catch (KustvaktException e) {
             throw kustvaktResponseHandler.throwit(e);
         }
     }
 
-    /**
-     * Lists active VC-accesses available for a user-group.
-     * Only available to VCA and system admins.
-     * For system admins, list all VCA for the group.
-     * 
-     * <br /><br />
-     * Not allowed via third-party apps.
-     * 
-     * @param securityContext
-     * @param groupId
-     *            a group id
-     * @return a list of VC-access
-     */
-    @GET
-    @Path("access/list/byGroup")
-    @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
-    @Deprecated
-    public List<VirtualCorpusAccessDto> listVCAccessByGroup (
-            @Context SecurityContext securityContext,
-            @QueryParam("groupId") int groupId) {
-        TokenContext context =
-                (TokenContext) securityContext.getUserPrincipal();
-        try {
-            scopeService.verifyScope(context, OAuth2Scope.VC_ACCESS_INFO);
-            return service.listVCAccessByGroup(context.getUsername(), groupId);
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-    }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/input/VirtualCorpusJson.java b/full/src/main/java/de/ids_mannheim/korap/web/input/VirtualCorpusJson.java
index 419eff4..1f14f9c 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/input/VirtualCorpusJson.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/input/VirtualCorpusJson.java
@@ -17,19 +17,13 @@
 @Getter
 @Setter
 public class VirtualCorpusJson {
-    // required
+    // default false
     private boolean isCached;
     
     // required in creating VCs
-    @Deprecated
-    private String name;
     private VirtualCorpusType type;
     private String corpusQuery;
     
-    // required in editing VCs
-    @Deprecated
-    private int id;
-    
     // optional
     private String definition;
     private String description;