diff --git a/src/main/java/de/ids_mannheim/korap/constant/OAuth2Scope.java b/src/main/java/de/ids_mannheim/korap/constant/OAuth2Scope.java
index c37a471..6240d4c 100644
--- a/src/main/java/de/ids_mannheim/korap/constant/OAuth2Scope.java
+++ b/src/main/java/de/ids_mannheim/korap/constant/OAuth2Scope.java
@@ -27,7 +27,7 @@
 
     ADD_USER_GROUP_MEMBER_ROLE, DELETE_USER_GROUP_MEMBER_ROLE,
 
-    CREATE_VC, VC_INFO, EDIT_VC, DELETE_VC,
+    CREATE_VC, VC_INFO, DELETE_VC,
 
     SHARE_VC, DELETE_VC_ACCESS, VC_ACCESS_INFO,
 
diff --git a/src/main/java/de/ids_mannheim/korap/web/controller/QueryReferenceController.java b/src/main/java/de/ids_mannheim/korap/web/controller/QueryReferenceController.java
index 5216963..0be121d 100644
--- a/src/main/java/de/ids_mannheim/korap/web/controller/QueryReferenceController.java
+++ b/src/main/java/de/ids_mannheim/korap/web/controller/QueryReferenceController.java
@@ -91,7 +91,7 @@
                 .getUserPrincipal();
 
         try {
-            scopeService.verifyScope(context, OAuth2Scope.EDIT_VC);
+            scopeService.verifyScope(context, OAuth2Scope.CREATE_VC);
             ParameterChecker.checkObjectValue(query, "request entity");
             if (query.getQueryType() == null) {
                 query.setQueryType(QueryType.QUERY);
diff --git a/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java b/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
index 27aff66..4d09022 100644
--- a/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
+++ b/src/main/java/de/ids_mannheim/korap/web/controller/VirtualCorpusController.java
@@ -108,7 +108,7 @@
                 .getUserPrincipal();
 
         try {
-            scopeService.verifyScope(context, OAuth2Scope.EDIT_VC);
+            scopeService.verifyScope(context, OAuth2Scope.CREATE_VC);
             ParameterChecker.checkObjectValue(vc, "request entity");
             if (vc.getQueryType() == null) {
                 vc.setQueryType(QueryType.VIRTUAL_CORPUS);
@@ -375,7 +375,8 @@
         return Response.ok().build();
     }
 
-    /**
+    /** DEPRECATED **
+     * 
      * Only VCA Admins and system admins are allowed to delete a
      * VC-access.
      * 
@@ -398,8 +399,10 @@
                 + "in API v1.1."));
     }
     
-    /**
-     * Lists all member roles in a group.
+    /** This service may not be necessary thus it is hidden in the wiki.
+     * 
+     * Lists member roles in a group. It can be filtered by query, so only query
+     * related roles should be listed.
      * 
      * Only available to group and system admins.
      * 
diff --git a/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2TestBase.java b/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2TestBase.java
index 062a04e..6df3347 100644
--- a/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2TestBase.java
+++ b/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2TestBase.java
@@ -493,7 +493,7 @@
         ZonedDateTime now = ZonedDateTime
                 .now(ZoneId.of(Attributes.DEFAULT_TIME_ZONE));
         Set<AccessScope> scopes = new HashSet<>();
-        scopes.add(new AccessScope(OAuth2Scope.EDIT_VC));
+        scopes.add(new AccessScope(OAuth2Scope.CREATE_VC));
 
         AccessToken accessToken = new AccessToken();
         accessToken.setCreatedDate(now.minusSeconds(5));
diff --git a/src/test/java/de/ids_mannheim/korap/web/controller/vc/VirtualCorpusClientTest.java b/src/test/java/de/ids_mannheim/korap/web/controller/vc/VirtualCorpusClientTest.java
index 00ad027..e9ae432 100644
--- a/src/test/java/de/ids_mannheim/korap/web/controller/vc/VirtualCorpusClientTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/controller/vc/VirtualCorpusClientTest.java
@@ -27,7 +27,7 @@
         String userAuthHeader = HttpAuthorizationHandler
                 .createBasicAuthorizationHeaderValue(username, "password");
         response = requestAuthorizationCode("code", clientId, clientRedirectUri,
-                "create_vc vc_info delete_vc edit_vc", "myState",
+                "create_vc vc_info delete_vc create_vc", "myState",
                 userAuthHeader);
         String code = parseAuthorizationCode(response);
         response = requestTokenWithAuthorizationCodeAndForm(clientId,