diff --git a/test/users.spec.js b/test/users.spec.js
index 2e86ab1..8f880ea 100644
--- a/test/users.spec.js
+++ b/test/users.spec.js
@@ -88,4 +88,72 @@ describe('Users', () => {
         .expect(200, done)
     })
   })
+
+  describe('PUT /users/:id', () => {
+    it('should not update user if token is invalid', (done) => {
+      request
+        .put('/users/1?token=1')
+        .set('Accept', 'application/json')
+        .expect(401, done)
+    })
+
+    it('should throw 404 if user doesn\'t exist', (done) => {
+      const { token } = context
+      request
+        .put(`/users/1?token=${token}`)
+        .set('Accept', 'application/json')
+        .expect(404, done)
+    })
+
+    it('should update user', (done) => {
+      const {
+        user: { _id },
+        token
+      } = context
+
+      request
+        .put(`/users/${_id}?token=${token}`)
+        .set('Accept', 'application/json')
+        .send({ user: { username: 'updatedcoolname' } })
+        .expect(200, (err, res) => {
+          if (err) { return done(err) }
+
+          res.body.user.should.have.property('username')
+          res.body.user.username.should.equal('updatedcoolname')
+          expect(res.body.user.password).to.not.exist
+          expect(res.body.user.salt).to.not.exist
+
+          done()
+        })
+    })
+  })
+
+  describe('DELETE /users/:id', () => {
+    it('should not delete user if token is invalid', (done) => {
+      request
+        .delete('/users/1?token=1')
+        .set('Accept', 'application/json')
+        .expect(401, done)
+    })
+
+    it('should throw 404 if user doesn\'t exist', (done) => {
+      const { token } = context
+      request
+        .delete(`/users/1?token=${token}`)
+        .set('Accept', 'application/json')
+        .expect(404, done)
+    })
+
+    it('should delete user', (done) => {
+      const {
+        user: { _id },
+        token
+      } = context
+
+      request
+        .delete(`/users/${_id}?token=${token}`)
+        .set('Accept', 'application/json')
+        .expect(200, done)
+    })
+  })
 })