diff --git a/api/users/user_test.go b/api/users/user_test.go
index 9266ae337d..cef7578ad1 100644
--- a/api/users/user_test.go
+++ b/api/users/user_test.go
@@ -1,43 +1,60 @@
 package users_test
 
-/*
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/watchtower/api/users"
+	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/watchtower/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
 func TestUsers_List(t *testing.T) {
-	assert := assert.New(t)
-	tc := controller.NewTestController(t, &controller.TestControllerOpts{DisableAuthorizationFailures: true})
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultUsername:              "user",
+		DefaultPassword:              "passpass",
+	})
 	defer tc.Shutdown()
 
 	client := tc.Client()
-	org := &scopes.Org{
-		Client: client,
-	}
-	ctx := context.Background()
+	userClient := users.NewUsersClient(client)
 
-	ul, apiErr, err := org.ListUsers(ctx)
+	ul, apiErr, err := userClient.List(tc.Context())
 	assert.NoError(err)
 	assert.Nil(apiErr)
 	assert.Empty(ul)
 
 	var expected []*users.User
 	for i := 0; i < 10; i++ {
-		expected = append(expected, &users.User{Name: api.String(fmt.Sprint(i))})
+		expected = append(expected, &users.User{Name: fmt.Sprint(i)})
 	}
 
-	expected[0], apiErr, err = org.CreateUser(ctx, expected[0])
+	expected[0], apiErr, err = userClient.Create(tc.Context(), users.WithName(expected[0].Name))
 	assert.NoError(err)
 	assert.Nil(apiErr)
 
-	ul, apiErr, err = org.ListUsers(ctx)
+	ul, apiErr, err = userClient.List(tc.Context())
 	assert.NoError(err)
 	assert.Nil(apiErr)
 	assert.ElementsMatch(comparableSlice(expected[:1]), comparableSlice(ul))
 
 	for i := 1; i < 10; i++ {
-		expected[i], apiErr, err = org.CreateUser(ctx, expected[i])
+		expected[i], apiErr, err = userClient.Create(tc.Context(), users.WithName(expected[i].Name))
 		assert.NoError(err)
 		assert.Nil(apiErr)
 	}
-	ul, apiErr, err = org.ListUsers(ctx)
-	require.NoError(t, err)
+	ul, apiErr, err = userClient.List(tc.Context())
+	require.NoError(err)
 	assert.Nil(apiErr)
 	assert.ElementsMatch(comparableSlice(expected), comparableSlice(ul))
 }
@@ -59,89 +76,96 @@ func comparableSlice(in []*users.User) []users.User {
 }
 
 func TestUser_Crud(t *testing.T) {
-	tc := controller.NewTestController(t, &controller.TestControllerOpts{DisableAuthorizationFailures: true})
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultUsername:              "user",
+		DefaultPassword:              "passpass",
+	})
 	defer tc.Shutdown()
 
 	client := tc.Client()
-	org := &scopes.Org{
-		Client: client,
-	}
+	userClient := users.NewUsersClient(client)
 
-	checkUser := func(step string, u *users.User, apiErr *api.Error, err error, wantedName string) {
-		assert := assert.New(t)
+	checkUser := func(step string, u *users.User, apiErr *api.Error, err error, wantedName string, wantedVersion uint32) {
 		assert.NoError(err, step)
 		if !assert.Nil(apiErr, step) && apiErr.Message != "" {
 			t.Errorf("ApiError message: %q", apiErr.Message)
 		}
 		assert.NotNil(u, "returned no resource", step)
 		gotName := ""
-		if u.Name != nil {
-			gotName = *u.Name
+		if u.Name != "" {
+			gotName = u.Name
 		}
 		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, u.Version)
 	}
 
-	u, apiErr, err := org.CreateUser(tc.Context(), &users.User{Name: api.String("foo")})
-	checkUser("create", u, apiErr, err, "foo")
+	u, apiErr, err := userClient.Create(tc.Context(), users.WithName("foo"))
+	checkUser("create", u, apiErr, err, "foo", 1)
 
-	u, apiErr, err = org.ReadUser(tc.Context(), &users.User{Id: u.Id})
-	checkUser("read", u, apiErr, err, "foo")
+	u, apiErr, err = userClient.Read(tc.Context(), u.Id)
+	checkUser("read", u, apiErr, err, "foo", 1)
 
-	u = &users.User{Id: u.Id}
-	u.Name = api.String("bar")
-	u, apiErr, err = org.UpdateUser(tc.Context(), u)
-	checkUser("update", u, apiErr, err, "bar")
+	u, apiErr, err = userClient.Update(tc.Context(), u.Id, u.Version, users.WithName("bar"))
+	checkUser("update", u, apiErr, err, "bar", 2)
 
-	u = &users.User{Id: u.Id}
-	u.SetDefault("name")
-	u, apiErr, err = org.UpdateUser(tc.Context(), u)
-	checkUser("update", u, apiErr, err, "")
+	u, apiErr, err = userClient.Update(tc.Context(), u.Id, u.Version, users.DefaultName())
+	checkUser("update", u, apiErr, err, "", 3)
 
-	existed, _, err := org.DeleteUser(tc.Context(), u)
-	require.NoError(t, err)
-	assert.Nil(t, apiErr)
-	assert.True(t, existed, "Expected existing user when deleted, but it wasn't.")
+	existed, _, err := userClient.Delete(tc.Context(), u.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.True(existed, "Expected existing user when deleted, but it wasn't.")
 
-	existed, apiErr, err = org.DeleteUser(tc.Context(), u)
-	require.NoError(t, err)
-	assert.Nil(t, apiErr)
-	assert.False(t, existed, "Expected user to not exist when deleted, but it did.")
+	existed, apiErr, err = userClient.Delete(tc.Context(), u.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.False(existed, "Expected user to not exist when deleted, but it did.")
 }
 
 func TestUser_Errors(t *testing.T) {
-	assert := assert.New(t)
-	tc := controller.NewTestController(t, &controller.TestControllerOpts{DisableAuthorizationFailures: true})
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultUsername:              "user",
+		DefaultPassword:              "passpass",
+	})
 	defer tc.Shutdown()
-	ctx := tc.Context()
 
 	client := tc.Client()
-	org := &scopes.Org{
-		Client: client,
-	}
+	userClient := users.NewUsersClient(client)
 
-	u, apiErr, err := org.CreateUser(ctx, &users.User{Name: api.String("first")})
-	assert.NoError(err)
+	u, apiErr, err := userClient.Create(tc.Context(), users.WithName("first"))
+	require.NoError(err)
 	assert.Nil(apiErr)
 	assert.NotNil(u)
 
 	// Create another resource with the same name.
-	_, apiErr, err = org.CreateUser(ctx, &users.User{Name: api.String("first")})
-	assert.NoError(err)
+	_, apiErr, err = userClient.Create(tc.Context(), users.WithName("first"))
+	require.NoError(err)
 	assert.NotNil(apiErr)
 
-	_, apiErr, err = org.ReadUser(ctx, &users.User{Id: iam.UserPrefix + "_doesntexis"})
-	assert.NoError(err)
+	_, apiErr, err = userClient.Read(tc.Context(), iam.UserPrefix+"_doesntexis")
+	require.NoError(err)
 	assert.NotNil(apiErr)
-	assert.EqualValues(apiErr.Status, http.StatusNotFound)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
 
-	_, apiErr, err = org.ReadUser(ctx, &users.User{Id: "invalid id"})
-	assert.NoError(err)
+	_, apiErr, err = userClient.Read(tc.Context(), "invalid id")
+	require.NoError(err)
 	assert.NotNil(apiErr)
-	assert.EqualValues(apiErr.Status, http.StatusBadRequest)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
 
-	_, apiErr, err = org.UpdateUser(ctx, &users.User{Id: u.Id})
-	assert.NoError(err)
+	_, apiErr, err = userClient.Update(tc.Context(), u.Id, u.Version)
+	require.NoError(err)
 	assert.NotNil(apiErr)
-	assert.EqualValues(apiErr.Status, http.StatusBadRequest)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
 }
-*/