diff --git a/framework/core/tests/integration/api/Controller/CreateUserControllerTest.php b/framework/core/tests/integration/api/Controller/CreateUserControllerTest.php
deleted file mode 100644
index d2caad23e..000000000
--- a/framework/core/tests/integration/api/Controller/CreateUserControllerTest.php
+++ /dev/null
@@ -1,111 +0,0 @@
-<?php
-
-/*
- * This file is part of Flarum.
- *
- * (c) Toby Zerner <toby.zerner@gmail.com>
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-namespace Flarum\Tests\integration\api\Controller;
-
-use Flarum\Api\Controller\CreateUserController;
-use Flarum\Settings\SettingsRepositoryInterface;
-use Flarum\User\User;
-use Illuminate\Support\Arr;
-
-class CreateUserControllerTest extends ApiControllerTestCase
-{
-    protected $controller = CreateUserController::class;
-
-    protected $data = [
-        'username' => 'test',
-        'password' => 'too-obscure',
-        'email' => 'test@machine.local'
-    ];
-
-    public function setUp()
-    {
-        parent::setUp();
-
-        $this->prepareDatabase([
-            'users' => [
-                $this->adminUser(),
-            ],
-            'groups' => [
-                $this->adminGroup(),
-            ],
-            'group_user' => [
-                ['user_id' => 1, 'group_id' => 1],
-            ],
-            'settings' => [
-                ['key' => 'mail_driver', 'value' => 'log']
-            ]
-        ]);
-    }
-
-    /**
-     * @test
-     */
-    public function cannot_create_user_without_data()
-    {
-        $response = $this->callWith();
-
-        $this->assertEquals(422, $response->getStatusCode());
-    }
-
-    /**
-     * @test
-     */
-    public function can_create_user()
-    {
-        $response = $this->callWith($this->data);
-
-        $this->assertEquals(201, $response->getStatusCode());
-
-        /** @var User $user */
-        $user = User::where('username', 'test')->firstOrFail();
-
-        $this->assertEquals(0, $user->is_activated);
-
-        foreach (Arr::except($this->data, 'password') as $property => $value) {
-            $this->assertEquals($value, $user->{$property});
-        }
-    }
-
-    /**
-     * @test
-     */
-    public function admins_can_create_activated_users()
-    {
-        $this->actor = User::find(1);
-
-        $response = $this->callWith(array_merge($this->data, [
-            'isEmailConfirmed' => 1
-        ]));
-
-        $this->assertEquals(201, $response->getStatusCode());
-
-        /** @var User $user */
-        $user = User::where('username', 'test')->firstOrFail();
-
-        $this->assertEquals(1, $user->is_email_confirmed);
-    }
-
-    /**
-     * @test
-     */
-    public function disabling_sign_up_prevents_user_creation()
-    {
-        /** @var SettingsRepositoryInterface $settings */
-        $settings = app(SettingsRepositoryInterface::class);
-        $settings->set('allow_sign_up', false);
-
-        $response = $this->callWith($this->data);
-        $this->assertEquals(403, $response->getStatusCode());
-
-        $settings->set('allow_sign_up', true);
-    }
-}
diff --git a/framework/core/tests/integration/api/users/CreationTest.php b/framework/core/tests/integration/api/users/CreationTest.php
new file mode 100644
index 000000000..20963a0a8
--- /dev/null
+++ b/framework/core/tests/integration/api/users/CreationTest.php
@@ -0,0 +1,155 @@
+<?php
+
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Tests\integration\api\users;
+
+use Flarum\Settings\SettingsRepositoryInterface;
+use Flarum\Tests\integration\RetrievesAuthorizedUsers;
+use Flarum\Tests\integration\TestCase;
+use Flarum\User\User;
+
+class CreationTest extends TestCase
+{
+    use RetrievesAuthorizedUsers;
+
+    public function setUp()
+    {
+        parent::setUp();
+
+        $this->prepareDatabase([
+            'users' => [
+                $this->adminUser(),
+            ],
+            'groups' => [
+                $this->adminGroup(),
+            ],
+            'group_user' => [
+                ['user_id' => 1, 'group_id' => 1],
+            ],
+            'settings' => [
+                ['key' => 'mail_driver', 'value' => 'log'],
+            ],
+            'access_tokens' => [
+                ['token' => 'admintoken', 'user_id' => 1],
+            ],
+        ]);
+    }
+
+    /**
+     * @test
+     */
+    public function cannot_create_user_without_data()
+    {
+        $response = $this->send(
+            $this->request(
+                'POST', '/api/users',
+                [
+                    'json' => ['data' => ['attributes' => []]],
+                ]
+            )->withAttribute('bypassCsrfToken', true)
+        );
+
+        $this->assertEquals(422, $response->getStatusCode());
+    }
+
+    /**
+     * @test
+     */
+    public function can_create_user()
+    {
+        $response = $this->send(
+            $this->request(
+                'POST', '/api/users',
+                [
+                    'json' => [
+                        'data' => [
+                            'attributes' => [
+                                'username' => 'test',
+                                'password' => 'too-obscure',
+                                'email' => 'test@machine.local',
+                            ],
+                        ]
+                    ],
+                ]
+            )->withAttribute('bypassCsrfToken', true)
+        );
+
+        $this->assertEquals(201, $response->getStatusCode());
+
+        /** @var User $user */
+        $user = User::where('username', 'test')->firstOrFail();
+
+        $this->assertEquals(0, $user->is_activated);
+        $this->assertEquals('test', $user->username);
+        $this->assertEquals('test@machine.local', $user->email);
+    }
+
+    /**
+     * @test
+     */
+    public function admins_can_create_activated_users()
+    {
+        $response = $this->send(
+            $this->request(
+                'POST', '/api/users',
+                [
+                    'json' => [
+                        'data' => [
+                            'attributes' => [
+                                'username' => 'test',
+                                'password' => 'too-obscure',
+                                'email' => 'test@machine.local',
+                                'isEmailConfirmed' => 1,
+                            ],
+                        ]
+                    ],
+                ]
+            )->withHeader('Authorization', 'Token admintoken')
+        );
+
+        $this->assertEquals(201, $response->getStatusCode());
+
+        /** @var User $user */
+        $user = User::where('username', 'test')->firstOrFail();
+
+        $this->assertEquals(1, $user->is_email_confirmed);
+    }
+
+    /**
+     * @test
+     */
+    public function disabling_sign_up_prevents_user_creation()
+    {
+        /** @var SettingsRepositoryInterface $settings */
+        $settings = app(SettingsRepositoryInterface::class);
+        $settings->set('allow_sign_up', false);
+
+        $response = $this->send(
+            $this->request(
+                'POST', '/api/users',
+                [
+                    'json' => [
+                        'data' => [
+                            'attributes' => [
+                                'username' => 'test',
+                                'password' => 'too-obscure',
+                                'email' => 'test@machine.local',
+                            ],
+                        ]
+                    ],
+                ]
+            )->withAttribute('bypassCsrfToken', true)
+        );
+        $this->assertEquals(403, $response->getStatusCode());
+
+        $settings->set('allow_sign_up', true);
+    }
+}