diff --git a/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsDELETEAuth.feature b/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsDELETEAuth.feature
index ce20879ac..5aa7c63de 100644
--- a/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsDELETEAuth.feature
+++ b/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsDELETEAuth.feature
@@ -24,11 +24,17 @@ Feature: auth
     When the administrator requests these endpoints with "DELETE" using password "invalid" about user "Alice"
       | endpoint                                                        |
       | /ocs/v1.php/cloud/users/%username%                              |
-      | /ocs/v2.php/cloud/users/%username%                              |
       | /ocs/v1.php/cloud/users/%username%/subadmins                    |
     Then the HTTP status code of responses on all endpoints should be "200"
     And the OCS status code of responses on all endpoints should be "998"
 
+  Scenario: send DELETE requests to OCS endpoints as admin with wrong password
+    When the administrator requests these endpoints with "DELETE" using password "invalid" about user "Alice"
+      | endpoint                                                        |
+      | /ocs/v2.php/cloud/users/%username%                              |
+    Then the HTTP status code of responses on all endpoints should be "404"
+    And the OCS status code of responses on all endpoints should be "998"
+
   Scenario: send DELETE requests to OCS endpoints as admin with wrong password
     When the administrator requests these endpoints with "DELETE" using password "invalid" about user "Alice"
       | endpoint                                                        |
diff --git a/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsPOSTAuth.feature b/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsPOSTAuth.feature
index 3b3927e6e..fd3b34436 100644
--- a/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsPOSTAuth.feature
+++ b/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsPOSTAuth.feature
@@ -4,7 +4,7 @@ Feature: auth
   Background:
     Given user "Alice" has been created with default attributes and skeleton files
 
-  @issue-ocis-reva-30
+  @issue-ocis-ocs-26 @issue-ocis-reva-30
   # after fixing all issues delete this Scenario and use the one from oC10 core
   Scenario: send POST requests to OCS endpoints as normal user with wrong password
     When user "Alice" requests these endpoints with "POST" including body "doesnotmatter" using password "invalid" about user "Alice"
@@ -19,12 +19,6 @@ Feature: auth
       | /ocs/v2.php/cloud/apps/testing                                  |
       | /ocs/v1.php/cloud/groups                                        |
       | /ocs/v2.php/cloud/groups                                        |
-      | /ocs/v1.php/cloud/users                                         |
-      | /ocs/v2.php/cloud/users                                         |
-      | /ocs/v1.php/cloud/users/%username%/groups                       |
-      | /ocs/v2.php/cloud/users/%username%/groups                       |
-      | /ocs/v1.php/cloud/users/%username%/subadmins                    |
-      | /ocs/v2.php/cloud/users/%username%/subadmins                    |
       | /ocs/v1.php/person/check                                        |
       | /ocs/v2.php/person/check                                        |
       | /ocs/v1.php/privatedata/deleteattribute/testing/test            |
@@ -33,3 +27,44 @@ Feature: auth
       | /ocs/v2.php/privatedata/setattribute/testing/test               |
     Then the HTTP status code of responses on all endpoints should be "401"
     And the OCS status code of responses on all endpoints should be "notset"
+
+  # after fixing all issues delete this Scenario and use the one from oC10 core
+  Scenario: send POST requests to OCS endpoints as normal user with wrong password
+    When user "Alice" requests these endpoints with "POST" including body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                                        |
+      | /ocs/v1.php/cloud/users                                         |
+    Then the HTTP status code of responses on all endpoints should be "200"
+    And the OCS status code of responses on all endpoints should be "400"
+    When user "Alice" requests these endpoints with "POST" including body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                                        |
+      | /ocs/v2.php/cloud/users                                         |
+    Then the HTTP status code of responses on all endpoints should be "400"
+    And the OCS status code of responses on all endpoints should be "400"
+
+  @issue-ocis-reva-30
+  # after fixing all issues delete this Scenario and use the one from oC10 core
+  Scenario: send POST requests to OCS endpoints as normal user with wrong password
+    When user "Alice" requests these endpoints with "POST" including body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                                        |
+      | /ocs/v1.php/cloud/users/%username%/groups                       |
+    Then the HTTP status code of responses on all endpoints should be "200"
+    And the OCS status code of responses on all endpoints should be "400"
+    When user "Alice" requests these endpoints with "POST" including body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                                        |
+      | /ocs/v2.php/cloud/users/%username%/groups                       |
+    Then the HTTP status code of responses on all endpoints should be "400"
+    And the OCS status code of responses on all endpoints should be "400"
+
+  @issue-ocis-reva-30
+  # after fixing all issues delete this Scenario and use the one from oC10 core
+  Scenario: send POST requests to OCS endpoints as normal user with wrong password
+    When user "Alice" requests these endpoints with "POST" including body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                                        |
+      | /ocs/v1.php/cloud/users/%username%/subadmins                    |
+    Then the HTTP status code of responses on all endpoints should be "200"
+    And the OCS status code of responses on all endpoints should be "998"
+    When user "Alice" requests these endpoints with "POST" including body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                                        |
+      | /ocs/v2.php/cloud/users/%username%/subadmins                    |
+    Then the HTTP status code of responses on all endpoints should be "404"
+    And the OCS status code of responses on all endpoints should be "998"
diff --git a/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsPUTAuth.feature b/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsPUTAuth.feature
index b8e54da9a..1f76bdc68 100644
--- a/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsPUTAuth.feature
+++ b/tests/acceptance/features/apiOcisSpecific/apiAuthOcs-ocsPUTAuth.feature
@@ -2,17 +2,45 @@
 Feature: auth
 
   @issue-ocis-reva-30
+  @issue-ocis-ocs-26
+  # after fixing all issues delete this Scenario and use the one from oC10 core
+  Scenario: send PUT request to OCS endpoints as admin with wrong password
+    When the administrator requests these endpoints with "PUT" with body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                         |
+      | /ocs/v1.php/apps/files_sharing/api/v1/shares/123 |
+      | /ocs/v2.php/apps/files_sharing/api/v1/shares/123 |
+    Then the HTTP status code of responses on all endpoints should be "401"
+    And the OCS status code of responses on all endpoints should be "notset"
+
+  @issue-ocis-reva-30
+  @issue-ocis-ocs-26
   # after fixing all issues delete this Scenario and use the one from oC10 core
   Scenario: send PUT request to OCS endpoints as admin with wrong password
     When the administrator requests these endpoints with "PUT" with body "doesnotmatter" using password "invalid" about user "Alice"
       | endpoint                                         |
       | /ocs/v1.php/cloud/users/%username%               |
+    Then the HTTP status code of responses on all endpoints should be "200"
+    And the OCS status code of responses on all endpoints should be "103"
+    When the administrator requests these endpoints with "PUT" with body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                         |
       | /ocs/v2.php/cloud/users/%username%               |
+    Then the HTTP status code of responses on all endpoints should be "400"
+    And the OCS status code of responses on all endpoints should be "103"
+
+  @issue-ocis-reva-30
+  @issue-ocis-ocs-28
+  # after fixing all issues delete this Scenario and use the one from oC10 core
+  Scenario: send PUT request to OCS endpoints as admin with wrong password
+    When the administrator requests these endpoints with "PUT" with body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                         |
       | /ocs/v1.php/cloud/users/%username%/disable       |
-      | /ocs/v2.php/cloud/users/%username%/disable       |
       | /ocs/v1.php/cloud/users/%username%/enable        |
+    Then the HTTP status code of responses on all endpoints should be "200"
+    And the OCS status code of responses on all endpoints should be "998"
+    When the administrator requests these endpoints with "PUT" with body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                         |
+      | /ocs/v2.php/cloud/users/%username%/disable       |
       | /ocs/v2.php/cloud/users/%username%/enable        |
-      | /ocs/v1.php/apps/files_sharing/api/v1/shares/123 |
-      | /ocs/v2.php/apps/files_sharing/api/v1/shares/123 |
-    Then the HTTP status code of responses on all endpoints should be "401"
-    And the OCS status code of responses on all endpoints should be "notset"
+    Then the HTTP status code of responses on all endpoints should be "404"
+    And the OCS status code of responses on all endpoints should be "998"
+