diff --git a/modules/restapi/src/main/resources/docspell-openapi.yml b/modules/restapi/src/main/resources/docspell-openapi.yml
index da318274..a9dd01a7 100644
--- a/modules/restapi/src/main/resources/docspell-openapi.yml
+++ b/modules/restapi/src/main/resources/docspell-openapi.yml
@@ -3360,11 +3360,15 @@ components:
       description: |
         A user of a collective.
       required:
+        - id
         - login
         - state
         - loginCount
         - created
       properties:
+        id:
+          type: string
+          format: ident
         login:
           type: string
           format: ident
diff --git a/modules/restserver/src/main/scala/docspell/restserver/conv/Conversions.scala b/modules/restserver/src/main/scala/docspell/restserver/conv/Conversions.scala
index caf92d9d..8f180531 100644
--- a/modules/restserver/src/main/scala/docspell/restserver/conv/Conversions.scala
+++ b/modules/restserver/src/main/scala/docspell/restserver/conv/Conversions.scala
@@ -431,7 +431,16 @@ trait Conversions {
 
   // users
   def mkUser(ru: RUser): User =
-    User(ru.login, ru.state, None, ru.email, ru.lastLogin, ru.loginCount, ru.created)
+    User(
+      ru.uid,
+      ru.login,
+      ru.state,
+      None,
+      ru.email,
+      ru.lastLogin,
+      ru.loginCount,
+      ru.created
+    )
 
   def newUser[F[_]: Sync](u: User, cid: Ident): F[RUser] =
     timeId.map {
@@ -451,7 +460,7 @@ trait Conversions {
 
   def changeUser(u: User, cid: Ident): RUser =
     RUser(
-      Ident.unsafe(""),
+      u.id,
       u.login,
       cid,
       u.password.getOrElse(Password.empty),