diff --git a/src/db_delete_user.c b/src/db_delete_user.c
index 35513af..5781098 100644
--- a/src/db_delete_user.c
+++ b/src/db_delete_user.c
@@ -36,6 +36,7 @@ bool db_delete_user(const int id) {
     printf("User deleted successfully. ID: %d\n", id);
   } else {
     printf("No user found with ID: %d\n", id);
+    pthread_mutex_unlock(&db_mutex);
     return false;
   }
 
diff --git a/src/delete_user.c b/src/delete_user.c
index 9ad4db6..e1dba35 100644
--- a/src/delete_user.c
+++ b/src/delete_user.c
@@ -3,7 +3,16 @@
 #include "utils.h"
 
 void delete_user(struct mg_connection *c, struct mg_http_message *hm) {
+  if (hm->body.len == 0) {
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
+                  MG_ESC("must have token"));
+    return;
+  }
   request_with_token *requestdata = check_body(hm);
+  if (requestdata->error != NULL) {
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"), MG_ESC(requestdata->error));
+    return;
+  }
   const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
   if (!valid) {
     mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
@@ -18,4 +27,5 @@ void delete_user(struct mg_connection *c, struct mg_http_message *hm) {
            user_deleted ? "true" : "false");
 
   mg_http_reply(c, 200, "Content-Type: application/json\r\n", responsedata);
+  cJSON_Delete(payload);
 }
diff --git a/src/get_user.c b/src/get_user.c
index 3449b7e..c970f15 100644
--- a/src/get_user.c
+++ b/src/get_user.c
@@ -3,7 +3,16 @@
 #include "utils.h"
 
 void get_user(struct mg_connection *c, struct mg_http_message *hm) {
+  if (hm->body.len == 0) {
+    mg_http_reply(c, 400, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
+                  MG_ESC("must have token"));
+    return;
+  }
   request_with_token *requestdata = check_body(hm);
+  if (requestdata->error != NULL) {
+    mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"), MG_ESC(requestdata->error));
+    return;
+  }
   if (!jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET)) {
     free_request_with_token(requestdata);
     mg_http_reply(c, 403, "Content-Type: application/json\r\n", "{%m:%m}", MG_ESC("error"),
diff --git a/tests.sh b/tests.sh
index cce7ea1..176b277 100755
--- a/tests.sh
+++ b/tests.sh
@@ -183,6 +183,57 @@ else
     errors=$(($errors+1))
 fi
 
+# test POST /api/users with wrong token
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users with wrong token${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '{"token":"asdf"}' \
+    localhost:8222/api/users &> api_users_wrong_token_test.log
+sleep 0.1
+res=$(cat api_users_wrong_token_test.log)
+if [[ "$res" == *'{"error":"invalid token"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/users without post data
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users without post data${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '' \
+    localhost:8222/api/users &> api_users_no_data_test.log
+sleep 0.1
+res=$(cat api_users_no_data_test.log)
+if [[ "$res" == *'{"error":"must have token"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/users with wrong json
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users with wrong json${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d 'ahsdlfhjalighafina[a[][apofj OFFW[Efflja]]]' \
+    localhost:8222/api/users &> api_users_wrong_json_test.log
+sleep 0.1
+res=$(cat api_users_wrong_json_test.log)
+if [[ "$res" == *'error'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
 # test POST /api/users/user
 printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users/user${RESET} "
 curl \
@@ -200,6 +251,57 @@ else
     errors=$(($errors+1))
 fi
 
+# test POST /api/users/user with wrong token
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users/user with wrong token${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '{"token":"asdf"}' \
+    localhost:8222/api/users/user &> api_users_user_wrong_token_test.log
+sleep 0.1
+res=$(cat api_users_user_wrong_token_test.log)
+if [[ "$res" == *'{"error":"invalid token"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/users/user without post data
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users/user without post data${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '' \
+    localhost:8222/api/users/user &> api_users_user_no_data_test.log
+sleep 0.1
+res=$(cat api_users_user_no_data_test.log)
+if [[ "$res" == *'{"error":"must have token"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/users/user with wrong json
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users/user with wrong json${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d 'alskodjfqjvoq3vn[q90\audv0q j89fvn  2vp]' \
+    localhost:8222/api/users/user &> api_users_user_wrong_json_test.log
+sleep 0.1
+res=$(cat api_users_user_wrong_json_test.log)
+if [[ "$res" == *'error'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
 # test POST /api/users/add
 printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users/add${RESET} "
 curl \
@@ -231,6 +333,7 @@ reqdata=$(curl \
     -X POST \
     -d '{"username":"asdff","password":"asdf"}' \
     localhost:8222/api/token)
+sleep 0.1
 curl \
     --silent \
     -X DELETE \
@@ -246,6 +349,74 @@ else
     errors=$(($errors+1))
 fi
 
+# test DELETE /api/users second delete
+printf "==> ${BLUE}Testing${RED} DELETE${BWHITE} /api/users second delete${RESET} "
+curl \
+    --silent \
+    -X DELETE \
+    -d $reqdata \
+    localhost:8222/api/users &> delete_api_users_second_delete_test.log
+sleep 0.1
+res=$(cat delete_api_users_second_delete_test.log)
+if [[ "$res" == *'{"success": false}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test DELETE /api/users with wrong json
+printf "==> ${BLUE}Testing${RED} DELETE${BWHITE} /api/users with wrong json${RESET} "
+curl \
+    --silent \
+    -X DELETE \
+    -d '$reqdata' \
+    localhost:8222/api/users &> delete_api_users_wrong_json_test.log
+sleep 0.1
+res=$(cat delete_api_users_wrong_json_test.log)
+if [[ "$res" == *'error'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test DELETE /api/users with wrong token
+printf "==> ${BLUE}Testing${RED} DELETE${BWHITE} /api/users with wrong token${RESET} "
+curl \
+    --silent \
+    -X DELETE \
+    -d '{"token":"asdf"}' \
+    localhost:8222/api/users &> delete_api_users_wrong_token_test.log
+sleep 0.1
+res=$(cat delete_api_users_wrong_token_test.log)
+if [[ "$res" == *'{"error":"invalid token"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test DELETE /api/users without post data
+printf "==> ${BLUE}Testing${RED} DELETE${BWHITE} /api/users without post data${RESET} "
+curl \
+    --silent \
+    -X DELETE \
+    -d '' \
+    localhost:8222/api/users &> delete_api_users_no_data_test.log
+sleep 0.1
+res=$(cat delete_api_users_no_data_test.log)
+if [[ "$res" == *'{"error":"must have token"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
 # test POST /api/users/password
 printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/users/password${RESET} "
 reqtoken=$(cat api_token_test.log | sed -e "s/{//g" | sed -e "s/}//g")
@@ -310,6 +481,172 @@ else
     errors=$(($errors+1))
 fi
 
+# test POST /api/register without username
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/register without username${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '{
+        "email":"asdf@asdf.com",
+        "password":"asdf",
+        "group":"users",
+        "is_superuser":false
+}' \
+    localhost:8222/api/register &> api_register_without_username_test.log
+sleep 0.1
+res=$(cat api_register_without_username_test.log)
+if [[ "$res" == *'{"error":"must have <username>, <password>, <email>, <group, optional>, <is_superuser, optional>"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/register without email
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/register without email${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '{
+        "username":"asdf",
+        "password":"asdf",
+        "group":"users",
+        "is_superuser":false
+}' \
+    localhost:8222/api/register &> api_register_without_email_test.log
+sleep 0.1
+res=$(cat api_register_without_email_test.log)
+if [[ "$res" == *'{"error":"must have <username>, <password>, <email>, <group, optional>, <is_superuser, optional>"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/register without password
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/register without password${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '{
+        "username":"asdf",
+        "email":"asdf@asdf.com",
+        "group":"users",
+        "is_superuser":false
+}' \
+    localhost:8222/api/register &> api_register_without_password_test.log
+sleep 0.1
+res=$(cat api_register_without_password_test.log)
+if [[ "$res" == *'{"error":"must have <username>, <password>, <email>, <group, optional>, <is_superuser, optional>"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/register without group
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/register without group${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '{
+        "username":"qwer",
+        "email":"qwer@qwer.com",
+        "password":"qwer",
+        "is_superuser":false
+}' \
+    localhost:8222/api/register &> api_register_without_group_test.log
+sleep 0.1
+res=$(cat api_register_without_group_test.log)
+if [[ "$res" == *'username'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/register without is_superuser
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/register without is_superuser${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '{
+        "username":"zxcv",
+        "email":"zxcv@zxcv.com",
+        "password":"zxcv",
+        "group":"users"
+}' \
+    localhost:8222/api/register &> api_register_without_is_superuser_test.log
+sleep 0.1
+res=$(cat api_register_without_is_superuser_test.log)
+if [[ "$res" == *'username'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/register second register
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/register second register${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '{
+        "username":"zxcv",
+        "email":"zxcv@zxcv.com",
+        "password":"zxcv",
+        "group":"users"
+}' \
+    localhost:8222/api/register &> api_register_second_register_test.log
+sleep 0.1
+res=$(cat api_register_second_register_test.log)
+if [[ "$res" == *'{"error":"failed to create user"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/register with wrong json
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/register with wrong json${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d 'najsnvpnvq234890vn9qq234vqui3v' \
+    localhost:8222/api/register &> api_register_wrong_json_test.log
+sleep 0.1
+res=$(cat api_register_wrong_json_test.log)
+if [[ "$res" == *'error'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
+# test POST /api/register without post data
+printf "==> ${BLUE}Testing${CYAN} POST${BWHITE} /api/register without post data${RESET} "
+curl \
+    --silent \
+    -X POST \
+    -d '' \
+    localhost:8222/api/register &> api_register_no_data_test.log
+sleep 0.1
+res=$(cat api_register_no_data_test.log)
+if [[ "$res" == *'{"error":"must have <username>, <password>, <email>, <group, optional>, <is_superuser, optional>"}'* ]]; then
+    printf "[$GREEN OK $RESET]\n"
+    success=$(($success+1))
+else
+    printf "[$RED ERR $RESET]\n==> ${BLUE}Response: $RESET$(echo $res)\n"
+    errors=$(($errors+1))
+fi
+
 killall auth_service
 printf "==> ${GREEN}Success: ${RESET}${success}\n==>${RED} Errors: ${RESET}${errors}\n"
 if [ ! $errors -eq 0 ]; then