diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2AdminController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2AdminController.java
index 0ca1368..957d31b 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2AdminController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2AdminController.java
@@ -19,7 +19,7 @@
 import de.ids_mannheim.korap.web.utils.ResourceFilters;
 
 @Controller
-@Path("{version}/oauth2/admin")
+@Path("{version}/admin/oauth2")
 @ResourceFilters({ APIVersionFilter.class, AdminFilter.class })
 @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
 public class OAuth2AdminController {
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AdminControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AdminControllerTest.java
index 42431c8..75e29e6 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AdminControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AdminControllerTest.java
@@ -46,8 +46,8 @@
             Form form)
             throws ProcessingException,
             KustvaktException {
-        Response response = target().path(API_VERSION).path("oauth2")
-                .path("admin").path("client").path("privilege")
+        Response response = target().path(API_VERSION).path("admin")
+                .path("oauth2").path("client").path("privilege")
                 .request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
@@ -67,8 +67,8 @@
         form.param("super", Boolean.toString(false));
         form.param("token", "secret"); //adminToken
         
-        Response response = target().path(API_VERSION).path("oauth2")
-                .path("admin").path("client").path("privilege")
+        Response response = target().path(API_VERSION).path("admin")
+                .path("oauth2").path("client").path("privilege")
                 .request()
                 .header(HttpHeaders.CONTENT_TYPE,
                         ContentType.APPLICATION_FORM_URLENCODED)
@@ -99,7 +99,7 @@
         Form form = new Form();
         form.param("token", "secret");
         
-        target().path(API_VERSION).path("oauth2").path("admin").path("token")
+        target().path(API_VERSION).path("admin").path("oauth2").path("token")
                 .path("clean")
                 .request()
                 .post(Entity.form(form));
@@ -125,7 +125,7 @@
         int accessTokensAfter = accessDao.retrieveInvalidAccessTokens().size();
         assertEquals(accessTokensAfter, accessTokensBefore + 1);
 
-        target().path(API_VERSION).path("oauth2").path("admin").path("token")
+        target().path(API_VERSION).path("admin").path("oauth2").path("token")
                 .path("clean")
                 .request()
                 .header(Attributes.AUTHORIZATION, adminAuthHeader)