diff --git a/full/Changes b/full/Changes
index e4c7a6c..04f388e 100644
--- a/full/Changes
+++ b/full/Changes
@@ -13,6 +13,9 @@
 - Fixed content-type in error responses by changing it to application/json
 2023-02-06
 - Allow admin access using admin token for the clean token API
+2023-02-10
+- Use admin filter instead of OAuth2 ADMIN scope  
+
 
 # version 0.69.1
 
diff --git a/full/src/main/java/de/ids_mannheim/korap/service/QueryService.java b/full/src/main/java/de/ids_mannheim/korap/service/QueryService.java
index c3081ee..981cb41 100644
--- a/full/src/main/java/de/ids_mannheim/korap/service/QueryService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/service/QueryService.java
@@ -134,21 +134,14 @@
         return createQueryDtos(list, queryType);
     }
 
-    public List<QueryDto> listQueryByType (String username, String createdBy,
-            ResourceType type, QueryType queryType) throws KustvaktException {
+    public List<QueryDto> listQueryByType (String createdBy, ResourceType type,
+            QueryType queryType) throws KustvaktException {
 
-        boolean isAdmin = adminDao.isAdmin(username);
+        List<QueryDO> virtualCorpora =
+                queryDao.retrieveQueryByType(type, createdBy, queryType);
+        Collections.sort(virtualCorpora);
+        return createQueryDtos(virtualCorpora, queryType);
 
-        if (isAdmin) {
-            List<QueryDO> virtualCorpora =
-                    queryDao.retrieveQueryByType(type, createdBy, queryType);
-            Collections.sort(virtualCorpora);
-            return createQueryDtos(virtualCorpora, queryType);
-        }
-        else {
-            throw new KustvaktException(StatusCodes.AUTHORIZATION_FAILED,
-                    "Unauthorized operation for user: " + username, username);
-        }
     }
 
     private ArrayList<QueryDto> createQueryDtos (List<QueryDO> queryList,
@@ -631,10 +624,10 @@
         
         ParameterChecker.checkStringValue(fieldName, "fieldName");
         
-        if (!adminDao.isAdmin(username)) {
-            throw new KustvaktException(StatusCodes.AUTHORIZATION_FAILED,
-                    "Unauthorized operation for user: " + username, username);
-        }
+//        if (!adminDao.isAdmin(username)) {
+//            throw new KustvaktException(StatusCodes.AUTHORIZATION_FAILED,
+//                    "Unauthorized operation for user: " + username, username);
+//        }
         
         if (fieldName.equals("tokens") || fieldName.equals("base")) {
             throw new KustvaktException(StatusCodes.NOT_ALLOWED,
diff --git a/full/src/main/java/de/ids_mannheim/korap/service/UserGroupService.java b/full/src/main/java/de/ids_mannheim/korap/service/UserGroupService.java
index 47d2c0c..51aa1c0 100644
--- a/full/src/main/java/de/ids_mannheim/korap/service/UserGroupService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/service/UserGroupService.java
@@ -144,33 +144,22 @@
     }
 
     public List<UserGroupDto> retrieveUserGroupByStatus (String username,
-            String contextUsername, UserGroupStatus status)
-            throws KustvaktException {
+            UserGroupStatus status) throws KustvaktException {
 
-        boolean isAdmin = adminDao.isAdmin(contextUsername);
+        List<UserGroup> userGroups =
+                userGroupDao.retrieveGroupByStatus(username, status);
+        Collections.sort(userGroups);
+        ArrayList<UserGroupDto> dtos = new ArrayList<>(userGroups.size());
 
-        if (isAdmin) {
-            List<UserGroup> userGroups =
-                    userGroupDao.retrieveGroupByStatus(username, status);
-            Collections.sort(userGroups);
-            ArrayList<UserGroupDto> dtos = new ArrayList<>(userGroups.size());
-
-            List<UserGroupMember> members;
-            UserGroupDto groupDto;
-            for (UserGroup group : userGroups) {
-                members = groupMemberDao.retrieveMemberByGroupId(group.getId(),
-                        true);
-                groupDto = converter.createUserGroupDto(group, members, null,
-                        null);
-                dtos.add(groupDto);
-            }
-            return dtos;
+        List<UserGroupMember> members;
+        UserGroupDto groupDto;
+        for (UserGroup group : userGroups) {
+            members =
+                    groupMemberDao.retrieveMemberByGroupId(group.getId(), true);
+            groupDto = converter.createUserGroupDto(group, members, null, null);
+            dtos.add(groupDto);
         }
-        else {
-            throw new KustvaktException(StatusCodes.AUTHORIZATION_FAILED,
-                    "Unauthorized operation for user: " + contextUsername,
-                    contextUsername);
-        }
+        return dtos;
     }
 
     public List<UserGroupMember> retrieveQueryAccessAdmins (UserGroup userGroup)
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupAdminController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupAdminController.java
new file mode 100644
index 0000000..c881cb9
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupAdminController.java
@@ -0,0 +1,64 @@
+package de.ids_mannheim.korap.web.controller;
+
+import java.util.List;
+
+import javax.ws.rs.Consumes;
+import javax.ws.rs.FormParam;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+
+import de.ids_mannheim.korap.constant.UserGroupStatus;
+import de.ids_mannheim.korap.dto.UserGroupDto;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.service.UserGroupService;
+import de.ids_mannheim.korap.web.KustvaktResponseHandler;
+import de.ids_mannheim.korap.web.filter.APIVersionFilter;
+import de.ids_mannheim.korap.web.filter.AdminFilter;
+import de.ids_mannheim.korap.web.utils.ResourceFilters;
+
+@Controller
+@Path("{version}/group/admin")
+@Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
+@ResourceFilters({ APIVersionFilter.class, AdminFilter.class })
+public class UserGroupAdminController {
+
+    @Autowired
+    private KustvaktResponseHandler kustvaktResponseHandler;
+    @Autowired
+    private UserGroupService service;
+    
+    /**
+     * Lists user-groups for system-admin purposes. If username is
+     * specified, lists user-groups of the given user, otherwise list
+     * user-groups of all users. If status specified, list only
+     * user-groups with the given status, otherwise list user-groups
+     * regardless of their status.
+     * 
+     * @param securityContext
+     * @param username
+     *            a username
+     * @param status
+     *            {@link UserGroupStatus}
+     * @return a list of user-groups
+     */
+    @POST
+    @Path("list")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public List<UserGroupDto> listUserGroupBySystemAdmin (
+            @FormParam("username") String username,
+            @FormParam("status") UserGroupStatus status) {
+        try {
+            return service.retrieveUserGroupByStatus(username,
+                    status);
+        }
+        catch (KustvaktException e) {
+            throw kustvaktResponseHandler.throwit(e);
+        }
+    }
+
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
index 2d053fa..cf16395 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/UserGroupController.java
@@ -11,7 +11,6 @@
 import javax.ws.rs.Path;
 import javax.ws.rs.PathParam;
 import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.Context;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
@@ -21,8 +20,6 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Controller;
 
-import de.ids_mannheim.korap.web.utils.ResourceFilters;
-
 import de.ids_mannheim.korap.constant.OAuth2Scope;
 import de.ids_mannheim.korap.constant.UserGroupStatus;
 import de.ids_mannheim.korap.dto.UserGroupDto;
@@ -32,9 +29,11 @@
 import de.ids_mannheim.korap.service.UserGroupService;
 import de.ids_mannheim.korap.web.KustvaktResponseHandler;
 import de.ids_mannheim.korap.web.filter.APIVersionFilter;
+import de.ids_mannheim.korap.web.filter.AdminFilter;
 import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
 import de.ids_mannheim.korap.web.filter.BlockingFilter;
 import de.ids_mannheim.korap.web.filter.PiwikFilter;
+import de.ids_mannheim.korap.web.utils.ResourceFilters;
 
 /**
  * UserGroupController defines web APIs related to user groups,
@@ -88,38 +87,7 @@
         }
     }
 
-    /**
-     * Lists user-groups for system-admin purposes. If username is
-     * specified, lists user-groups of the given user, otherwise list
-     * user-groups of all users. If status specified, list only
-     * user-groups with the given status, otherwise list user-groups
-     * regardless of their status.
-     * 
-     * @param securityContext
-     * @param username
-     *            a username
-     * @param status
-     *            {@link UserGroupStatus}
-     * @return a list of user-groups
-     */
-    @GET
-    @Path("list/system-admin")
-    public List<UserGroupDto> getUserGroupBySystemAdmin (
-            @Context SecurityContext securityContext,
-            @QueryParam("username") String username,
-            @QueryParam("status") UserGroupStatus status) {
-        TokenContext context =
-                (TokenContext) securityContext.getUserPrincipal();
-        try {
-            scopeService.verifyScope(context, OAuth2Scope.ADMIN);
-            return service.retrieveUserGroupByStatus(username,
-                    context.getUsername(), status);
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-    }
-
+    
     /**
      * Retrieves a specific user-group. Only system admins are
      * allowed.
@@ -131,13 +99,13 @@
      */
     @GET
     @Path("@{groupName}")
+    @ResourceFilters({ APIVersionFilter.class, AdminFilter.class })
     public UserGroupDto retrieveUserGroup (
             @Context SecurityContext securityContext,
             @PathParam("groupName") String groupName) {
         TokenContext context =
                 (TokenContext) securityContext.getUserPrincipal();
         try {
-            scopeService.verifyScope(context, OAuth2Scope.ADMIN);
             return service.searchByName(context.getUsername(), groupName);
         }
         catch (KustvaktException e) {
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusAdminController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusAdminController.java
new file mode 100644
index 0000000..d9fb208
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusAdminController.java
@@ -0,0 +1,65 @@
+package de.ids_mannheim.korap.web.controller;
+
+import java.util.List;
+
+import javax.ws.rs.Consumes;
+import javax.ws.rs.FormParam;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+
+import de.ids_mannheim.korap.constant.QueryType;
+import de.ids_mannheim.korap.constant.ResourceType;
+import de.ids_mannheim.korap.dto.QueryDto;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.service.QueryService;
+import de.ids_mannheim.korap.web.KustvaktResponseHandler;
+import de.ids_mannheim.korap.web.filter.APIVersionFilter;
+import de.ids_mannheim.korap.web.filter.AdminFilter;
+import de.ids_mannheim.korap.web.utils.ResourceFilters;
+
+@Controller
+@Path("{version}/vc/admin")
+@Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
+@ResourceFilters({ APIVersionFilter.class, AdminFilter.class })
+public class VirtualCorpusAdminController {
+
+    @Autowired
+    private KustvaktResponseHandler kustvaktResponseHandler;
+    @Autowired
+    private QueryService service;
+    
+    /**
+     * Lists virtual corpora by creator and type. This is a controller
+     * for system admin requiring valid system admin authentication.
+     * 
+     * If type is not specified, retrieves virtual corpora of all
+     * types. If createdBy is not specified, retrieves virtual corpora
+     * of all users.
+     * 
+     * @param securityContext
+     * @param createdBy
+     *            username of virtual corpus creator (optional)
+     * @param type
+     *            {@link ResourceType}
+     * @return a list of virtual corpora
+     */
+    @POST
+    @Path("list")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public List<QueryDto> listVCByType (
+            @FormParam("createdBy") String createdBy,
+            @FormParam("type") ResourceType type) {
+        try {
+            return service.listQueryByType(createdBy, type,
+                    QueryType.VIRTUAL_CORPUS);
+        }
+        catch (KustvaktException e) {
+            throw kustvaktResponseHandler.throwit(e);
+        }
+    }
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
index 19e4b2b..20be6dc 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
@@ -21,11 +21,9 @@
 import org.springframework.stereotype.Controller;
 
 import com.fasterxml.jackson.databind.JsonNode;
-import de.ids_mannheim.korap.web.utils.ResourceFilters;
 
 import de.ids_mannheim.korap.constant.OAuth2Scope;
 import de.ids_mannheim.korap.constant.QueryType;
-import de.ids_mannheim.korap.constant.ResourceType;
 import de.ids_mannheim.korap.dto.QueryAccessDto;
 import de.ids_mannheim.korap.dto.QueryDto;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
@@ -35,11 +33,13 @@
 import de.ids_mannheim.korap.utils.ParameterChecker;
 import de.ids_mannheim.korap.web.KustvaktResponseHandler;
 import de.ids_mannheim.korap.web.filter.APIVersionFilter;
+import de.ids_mannheim.korap.web.filter.AdminFilter;
 import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
 import de.ids_mannheim.korap.web.filter.BlockingFilter;
 import de.ids_mannheim.korap.web.filter.DemoUserFilter;
 import de.ids_mannheim.korap.web.filter.PiwikFilter;
 import de.ids_mannheim.korap.web.input.QueryJson;
+import de.ids_mannheim.korap.web.utils.ResourceFilters;
 
 /**
  * VirtualCorpusController defines web APIs related to virtual corpus
@@ -81,8 +81,8 @@
      * VC name cannot be updated.
      * 
      * The VC creator must be the same as the authenticated username,
-     * except for admins. Admins can create or update system VC as
-     * well as VC for any users.
+     * except for system admins. System admins can create or update 
+     * system VC and any VC for any users.
      * 
      * 
      * @param securityContext
@@ -127,6 +127,8 @@
      * Returns the virtual corpus with the given name and creator.
      * This web-service is also available for guests.
      * 
+     * System admin can retrieve private or project vc of any users.
+     * 
      * @param securityContext
      * @param createdBy
      *            vc creator
@@ -172,8 +174,19 @@
         }
     }
     
+    /** Retrieves field values of a virtual corpus, e.g. corpus sigle.
+     * 
+     * This service is restricted to system admin only.
+     * 
+     * @param securityContext
+     * @param createdBy
+     * @param vcName
+     * @param fieldName
+     * @return
+     */
     @GET
     @Path("/field/~{createdBy}/{vcName}")
+    @ResourceFilters({ APIVersionFilter.class, AdminFilter.class })
     public JsonNode retrieveVCField (
             @Context SecurityContext securityContext,
             @PathParam("createdBy") String createdBy,
@@ -182,7 +195,6 @@
         TokenContext context =
                 (TokenContext) securityContext.getUserPrincipal();
         try {
-            scopeService.verifyScope(context, OAuth2Scope.ADMIN);
             return service.retrieveFieldValues(context.getUsername(), vcName,
                     createdBy, QueryType.VIRTUAL_CORPUS, fieldName);
         }
@@ -263,40 +275,7 @@
         }
     }
     
-    /**
-     * Lists virtual corpora by creator and type. This is a controller
-     * for system admin requiring valid system admin authentication.
-     * 
-     * If type is not specified, retrieves virtual corpora of all
-     * types. If createdBy is not specified, retrieves virtual corpora
-     * of all users.
-     * 
-     * @param securityContext
-     * @param createdBy
-     *            username of virtual corpus creator (optional)
-     * @param type
-     *            {@link ResourceType}
-     * @return a list of virtual corpora
-     */
-    @GET
-    @Path("list/system-admin")
-    public List<QueryDto> listVCByType (
-            @Context SecurityContext securityContext,
-            @QueryParam("createdBy") String createdBy,
-            @QueryParam("type") ResourceType type) {
-        TokenContext context =
-                (TokenContext) securityContext.getUserPrincipal();
-        try {
-            scopeService.verifyScope(context, OAuth2Scope.ADMIN);
-            return service.listQueryByType(context.getUsername(), createdBy, type,
-                    QueryType.VIRTUAL_CORPUS);
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-    }
-
-
+   
     /**
      * Only the VC owner and system admins can delete VC. VCA admins
      * can delete VC-accesses e.g. of project VC, but not the VC
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
index 07db0a2..354f6f9 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerAdminTest.java
@@ -3,6 +3,7 @@
 import static org.junit.Assert.assertEquals;
 
 import javax.ws.rs.core.Form;
+import javax.ws.rs.core.MediaType;
 
 import org.junit.Test;
 
@@ -19,6 +20,8 @@
 import de.ids_mannheim.korap.constant.GroupMemberStatus;
 import de.ids_mannheim.korap.constant.PredefinedRole;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.service.UserGroupService;
 import de.ids_mannheim.korap.utils.JsonUtils;
 
 /**
@@ -27,8 +30,8 @@
  */
 public class UserGroupControllerAdminTest extends SpringJerseyTest {
 
-    private String adminUser = "admin";
-    private String testUser = "UserGroupControllerAdminTest";
+    private String sysAdminUser = "admin";
+    private String testUser = "group-admin";
 
     private JsonNode listGroup (String username)
             throws ProcessingException,
@@ -47,33 +50,81 @@
     }
 
     @Test
-    public void testListDoryGroups () throws KustvaktException {
+    public void testListUserGroupsUsingAdminToken () throws KustvaktException {
+        Form f = new Form();
+        f.param("username", "dory");
+        f.param("token", "secret");
+        
         Response response = target().path(API_VERSION).path("group")
-                .path("list").path("system-admin")
-                .queryParam("username", "dory")
+                .path("admin").path("list")
                 .request()
-                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .get();
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.readEntity(String.class);
-        // System.out.println(entity);
         JsonNode node = JsonUtils.readTree(entity);
         assertEquals(3, node.size());
     }
+    
+    
+    /**
+     * Cannot use admin token
+     * see
+     * {@link UserGroupService#retrieveUserGroupByStatus(String, 
+     * String, de.ids_mannheim.korap.constant.UserGroupStatus)}
+     * 
+     * @throws KustvaktException
+     */
+//    @Test
+//    public void testListUserGroupsWithAdminToken () throws KustvaktException {
+//        Response response = target().path(API_VERSION).path("group")
+//                .path("list").path("system-admin")
+//                .queryParam("username", "dory")
+//                .queryParam("token", "secret")
+//                .request()
+//                .get();
+//
+//        assertEquals(Status.OK.getStatusCode(), response.getStatus());
+//        String entity = response.readEntity(String.class);
+//        JsonNode node = JsonUtils.readTree(entity);
+//        assertEquals(3, node.size());
+//    }
+    
+    
+    @Test
+    public void testListUserGroupsUnauthorized () throws KustvaktException {
+        Form f = new Form();
+        f.param("username", "dory");
+        
+        Response response = target().path(API_VERSION).path("group")
+                .path("admin").path("list")
+                .request()
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
+
+        assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
+        String entity = response.readEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+        assertEquals(StatusCodes.AUTHORIZATION_FAILED, node.at("/errors/0/0").asInt());
+    }
 
     @Test
-    public void testListDoryActiveGroups () throws KustvaktException {
+    public void testListUserGroupsWithStatus () throws KustvaktException {
+        Form f = new Form();
+        f.param("username", "dory");
+        f.param("status", "ACTIVE");
+        
         Response response = target().path(API_VERSION).path("group")
-                .path("list").path("system-admin")
+                .path("admin").path("list")
                 .queryParam("username", "dory").queryParam("status", "ACTIVE")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .get();
+                        .createBasicAuthorizationHeaderValue(sysAdminUser, "pass"))
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.readEntity(String.class);
@@ -89,7 +140,7 @@
         Response response = target().path(API_VERSION).path("group")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                        .createBasicAuthorizationHeaderValue(sysAdminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get();
 
@@ -102,12 +153,12 @@
     public void testListByStatusAll () throws
             ProcessingException, KustvaktException {
         Response response = target().path(API_VERSION).path("group")
-                .path("list").path("system-admin")
+                .path("admin").path("list")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .get();
+                        .createBasicAuthorizationHeaderValue(sysAdminUser, "pass"))
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(null);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.readEntity(String.class);
@@ -125,14 +176,18 @@
     @Test
     public void testListByStatusHidden () throws
             ProcessingException, KustvaktException {
+        Form f = new Form();
+        f.param("status", "HIDDEN");
+        
         Response response = target().path(API_VERSION).path("group")
-                .path("list").path("system-admin")
+                .path("admin").path("list")
                 .queryParam("status", "HIDDEN")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                        .createBasicAuthorizationHeaderValue(sysAdminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .get();
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.readEntity(String.class);
@@ -142,7 +197,7 @@
     }
 
     @Test
-    public void testUserGroup () throws
+    public void testUserGroupAdmin () throws
             ProcessingException, KustvaktException {
 
         String groupName = "admin-test-group";
@@ -205,7 +260,7 @@
                 .request()
                 .header(Attributes.AUTHORIZATION,
                         HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(adminUser,
+                                .createBasicAuthorizationHeaderValue(sysAdminUser,
                                         "password"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .post(Entity.form(form));
@@ -237,7 +292,7 @@
                 .request()
                 .header(Attributes.AUTHORIZATION,
                         HttpAuthorizationHandler
-                                .createBasicAuthorizationHeaderValue(adminUser,
+                                .createBasicAuthorizationHeaderValue(sysAdminUser,
                                         "password"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .post(Entity.form(form));
@@ -262,7 +317,7 @@
                 .path("@" + groupName)
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                        .createBasicAuthorizationHeaderValue(sysAdminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .get();
 
@@ -281,7 +336,7 @@
                 .path("@" + groupName)
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                        .createBasicAuthorizationHeaderValue(sysAdminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .delete();
 
@@ -300,7 +355,7 @@
                 .path("@" + groupName).path("~marlin")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                        .createBasicAuthorizationHeaderValue(sysAdminUser, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .delete();
 
@@ -326,7 +381,7 @@
                 .request()
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(adminUser, "pass"))
+                        .createBasicAuthorizationHeaderValue(sysAdminUser, "pass"))
                 .post(Entity.form(form));
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerTest.java
index f30baa9..853d5cc 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/UserGroupControllerTest.java
@@ -5,6 +5,7 @@
 import java.util.Set;
 
 import javax.ws.rs.core.Form;
+import javax.ws.rs.core.MediaType;
 
 import org.junit.Test;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -380,17 +381,19 @@
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
 
+        Form f = new Form();
+        f.param("username", username);
+        f.param("status", "DELETED");
         // EM: this is so complicated because the group retrieval are not allowed 
         // for delete groups
         // check group
-        response = target().path(API_VERSION).path("group").path("list")
-                .path("system-admin").queryParam("username", username)
-                .queryParam("status", "DELETED")
+        response = target().path(API_VERSION).path("group")
+                .path("admin").path("list")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .get();
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
         
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.readEntity(String.class);
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/VCReferenceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/VCReferenceTest.java
index 128d6a5..baeed7c 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/VCReferenceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/VCReferenceTest.java
@@ -12,6 +12,10 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.google.common.net.HttpHeaders;
+
+import javax.ws.rs.client.Entity;
+import javax.ws.rs.core.Form;
+import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.Response.Status;
 
@@ -220,15 +224,17 @@
         JsonNode node = JsonUtils.readTree(ent);
         assertTrue(node.at("/matches").size() > 0);
         
+        Form f = new Form();
+        f.param("status", "HIDDEN");
+        
         // check dory in the hidden group of the vc
         response = target().path(API_VERSION).path("group")
-                .path("list").path("system-admin")
-                .queryParam("status", "HIDDEN")
+                .path("admin").path("list")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("admin", "pass"))
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .get();
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.readEntity(String.class);
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerAdminTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerAdminTest.java
index 24caf0b..484a7d1 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerAdminTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerAdminTest.java
@@ -2,22 +2,24 @@
 
 import static org.junit.Assert.assertEquals;
 
+import javax.ws.rs.ProcessingException;
+import javax.ws.rs.client.Entity;
 import javax.ws.rs.core.Form;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.Response.Status;
 
 import org.apache.http.entity.ContentType;
 import org.junit.Test;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.google.common.net.HttpHeaders;
-import javax.ws.rs.ProcessingException;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.Status;
-import javax.ws.rs.client.Entity;
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
 import de.ids_mannheim.korap.constant.ResourceType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.utils.JsonUtils;
 
 /**
@@ -27,10 +29,23 @@
 public class VirtualCorpusControllerAdminTest extends VirtualCorpusTestBase {
 
     private String admin = "admin";
-    private String username = "VirtualCorpusControllerAdminTest";
+    private String testUser = "VirtualCorpusControllerAdminTest";
 
+    
+    private void testResponseUnauthorized (Response response) throws KustvaktException {
+        assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
+
+        String entity = response.readEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+
+        assertEquals(StatusCodes.AUTHORIZATION_FAILED,
+                node.at("/errors/0/0").asInt());
+        assertEquals("Unauthorized operation for user: " + testUser,
+                node.at("/errors/0/1").asText());
+    }
+    
     @Test
-    public void testSearchPrivateVC () throws
+    public void testRetrievePrivateVC () throws
             ProcessingException, KustvaktException {
         Response response = target().path(API_VERSION).path("vc")
                 .path("~dory").path("dory-vc")
@@ -48,9 +63,21 @@
         assertEquals(1, node.at("/id").asInt());
         assertEquals("dory-vc", node.at("/name").asText());
     }
+    
+    @Test
+    public void testRetrievePrivateVCUnauthorized ()
+            throws ProcessingException, KustvaktException {
+        Response response = target().path(API_VERSION).path("vc").path("~dory")
+                .path("dory-vc").request()
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32").get();
+
+        testResponseUnauthorized(response);
+    }
 
     @Test
-    public void testSearchProjectVC () throws
+    public void testRetrieveProjectVC () throws
             ProcessingException, KustvaktException {
 
         Response response = target().path(API_VERSION).path("vc")
@@ -70,8 +97,23 @@
                 node.at("/type").asText());
     }
 
+    
     @Test
-    public void testListDoryVC () throws
+    public void testRetrieveProjectVCUnauthorized () throws
+            ProcessingException, KustvaktException {
+
+        Response response = target().path(API_VERSION).path("vc")
+                .path("~dory").path("group-vc")
+                .request()
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(testUser, "pass"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                .get();
+        testResponseUnauthorized(response);
+    }
+
+    @Test
+    public void testListUserVC () throws
             ProcessingException, KustvaktException {
         Response response = target().path(API_VERSION).path("vc")
                 .queryParam("username", "dory")
@@ -87,17 +129,40 @@
         JsonNode node = JsonUtils.readTree(entity);
         assertEquals(4, node.size());
     }
-
-    private JsonNode testListSystemVC () throws
-            ProcessingException, KustvaktException {
+    
+    private JsonNode testAdminListVC (String username)
+            throws ProcessingException,
+            KustvaktException {
+        Form f = new Form();
+        f.param("createdBy", username);
+        
         Response response = target().path(API_VERSION).path("vc")
-                .path("list").path("system-admin").queryParam("type", "SYSTEM")
-                .queryParam("createdBy", "system")
+                .path("admin").path("list")
                 .request()
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(admin, "pass"))
-                .get();
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
+
+        assertEquals(Status.OK.getStatusCode(), response.getStatus());
+
+        String entity = response.readEntity(String.class);
+        return JsonUtils.readTree(entity);
+    }
+
+    private JsonNode testAdminListVC_UsingAdminToken (String username, ResourceType type)
+            throws ProcessingException, KustvaktException {
+        Form f = new Form();
+        f.param("createdBy", username);
+        f.param("type", type.toString());
+        f.param("token", "secret");
+        
+        Response response = target().path(API_VERSION).path("vc").path("admin")
+                .path("list").request()
+                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+                        .createBasicAuthorizationHeaderValue(admin, "pass"))
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
 
@@ -121,7 +186,7 @@
 
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
 
-        JsonNode node = testListSystemVC();
+        JsonNode node = testAdminListVC_UsingAdminToken("system",ResourceType.SYSTEM);
         assertEquals(2, node.size());
 
         testDeleteSystemVC(admin, "new-system-vc");
@@ -140,12 +205,12 @@
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
 
-        JsonNode node = testListSystemVC();
+        JsonNode node = testAdminListVC_UsingAdminToken("system",ResourceType.SYSTEM);
         assertEquals(1, node.size());
     }
 
     @Test
-    public void testPrivateVC () throws
+    public void testCreatePrivateVC () throws
             ProcessingException, KustvaktException {
         String json = "{\"type\": \"PRIVATE\""
                 + ",\"queryType\": \"VIRTUAL_CORPUS\""
@@ -153,41 +218,24 @@
 
         String vcName = "new-vc";
         Response response = target().path(API_VERSION).path("vc")
-                .path("~"+username).path(vcName)
+                .path("~"+testUser).path(vcName)
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(username, "pass"))
+                        .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .put(Entity.json(json));
 
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
 
-        JsonNode node = testListUserVC(username);
+        JsonNode node = testAdminListVC(testUser);
         assertEquals(1, node.size());
 
-        testEditPrivateVC(username, vcName);
-        testDeletePrivateVC(username, vcName);
+        testEditPrivateVC(testUser, vcName);
+        testDeletePrivateVC(testUser, vcName);
     }
 
-    private JsonNode testListUserVC (String username)
-            throws ProcessingException,
-            KustvaktException {
-        Response response = target().path(API_VERSION).path("vc")
-                .path("list").path("system-admin")
-                .queryParam("createdBy", username)
-                .request()
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue(admin, "pass"))
-                .get();
-
-        assertEquals(Status.OK.getStatusCode(), response.getStatus());
-
-        String entity = response.readEntity(String.class);
-        return JsonUtils.readTree(entity);
-    }
-
+    
     private void testEditPrivateVC (String vcCreator, String vcName)
             throws ProcessingException,
             KustvaktException {
@@ -205,7 +253,7 @@
 
         assertEquals(Status.NO_CONTENT.getStatusCode(), response.getStatus());
 
-        JsonNode node = testListUserVC(username);
+        JsonNode node = testAdminListVC(testUser);
         assertEquals("edited vc", node.at("/0/description").asText());
     }
 
@@ -222,7 +270,7 @@
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
 
-        JsonNode node = testListUserVC(vcCreator);
+        JsonNode node = testAdminListVC(vcCreator);
         assertEquals(0, node.size());
     }
 
@@ -274,13 +322,22 @@
         String vcName = "marlin-vc";
         String groupName = "marlin-group";
 
+        JsonNode node2 = testAdminListVC_UsingAdminToken(vcCreator,ResourceType.PROJECT);
+        assertEquals(0, node2.size());
+        
         testCreateVCAccess(vcCreator, vcName, groupName);
         JsonNode node = testlistAccessByGroup(groupName);
 
         String accessId = node.at("/accessId").asText();
         testDeleteVCAccess(accessId);
 
+        node2 = testAdminListVC_UsingAdminToken(vcCreator,ResourceType.PROJECT);
+        assertEquals(1, node2.size());
+        
         testEditVCType(admin, vcCreator, vcName, ResourceType.PRIVATE);
+        
+        node2 = testAdminListVC_UsingAdminToken(vcCreator,ResourceType.PROJECT);
+        assertEquals(0, node2.size());
     }
 
     private void testCreateVCAccess (String vcCreator, String vcName,
@@ -308,7 +365,7 @@
                 .path("access").path(accessId)
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
-                        .createBasicAuthorizationHeaderValue("dory", "pass"))
+                        .createBasicAuthorizationHeaderValue(admin, "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
                 .delete();
 
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerTest.java
index c91cec8..c764225 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/VirtualCorpusControllerTest.java
@@ -13,18 +13,20 @@
 import java.util.Map.Entry;
 import java.util.Set;
 
+import javax.ws.rs.ProcessingException;
+import javax.ws.rs.client.Entity;
+import javax.ws.rs.core.Form;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.Response.Status;
+
 import org.apache.http.HttpStatus;
 import org.apache.http.entity.ContentType;
+import org.glassfish.jersey.server.ContainerRequest;
 import org.junit.Test;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.google.common.net.HttpHeaders;
-import javax.ws.rs.ProcessingException;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.Response.Status;
-import javax.ws.rs.client.Entity;
-import org.glassfish.jersey.server.ContainerRequest;
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
@@ -221,15 +223,16 @@
         assertEquals(ResourceType.PUBLISHED.displayName(),
                 node.at("/type").asText());
 
+        Form f = new Form();
+        f.param("status", "HIDDEN");
         // check gill in the hidden group of the vc
         Response response = target().path(API_VERSION).path("group")
-                .path("list").path("system-admin")
-                .queryParam("status", "HIDDEN")
+                .path("admin").path("list")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue("admin", "pass"))
-                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
-                .get();
+                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED)
+                .post(Entity.form(f));
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         String entity = response.readEntity(String.class);