diff --git a/jams-common/src/main/java/net/jami/jams/common/servlets/ScopedServlet.java b/jams-common/src/main/java/net/jami/jams/common/servlets/ScopedServlet.java
index ac50808f6f4e6bfb2f95e793f5b3dbfe3d193a1d..7a31733f6323e7b8846f0d170b0a93db934e8b56 100644
--- a/jams-common/src/main/java/net/jami/jams/common/servlets/ScopedServlet.java
+++ b/jams-common/src/main/java/net/jami/jams/common/servlets/ScopedServlet.java
@@ -23,11 +23,11 @@ public abstract class ScopedServlet extends HttpServlet {
 
     @Override
     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        if(req.getAttribute("accessLevel") instanceof AccessLevel){
+        if(!(req.getAttribute("accessLevel") instanceof AccessLevel)){
             resp.sendError(403,"No valid access level found!");
             return;
         }
-        if(!GET_accessLevels.contains(req.getAttribute("accessLevel"))){
+        if(!GET_accessLevels.contains((AccessLevel) req.getAttribute("accessLevel"))){
             resp.sendError(403,"You do not have enough rights to access this endpoint!");
             return;
         }
@@ -35,11 +35,11 @@ public abstract class ScopedServlet extends HttpServlet {
 
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        if(req.getAttribute("accessLevel") instanceof AccessLevel){
+        if(!(req.getAttribute("accessLevel") instanceof AccessLevel)){
             resp.sendError(403,"No valid access level found!");
             return;
         }
-        if(!POST_accessLevels.contains(req.getAttribute("accessLevel"))){
+        if(!POST_accessLevels.contains((AccessLevel) req.getAttribute("accessLevel"))){
             resp.sendError(403,"You do not have enough rights to access this endpoint!");
             return;
         }
@@ -47,11 +47,11 @@ public abstract class ScopedServlet extends HttpServlet {
 
     @Override
     protected void doPut(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        if(req.getAttribute("accessLevel") instanceof AccessLevel){
+        if(!(req.getAttribute("accessLevel") instanceof AccessLevel)){
             resp.sendError(403,"No valid access level found!");
             return;
         }
-        if(!PUT_accessLevels.contains(req.getAttribute("accessLevel"))){
+        if(!PUT_accessLevels.contains((AccessLevel) req.getAttribute("accessLevel"))){
             resp.sendError(403,"You do not have enough rights to access this endpoint!");
             return;
         }
@@ -59,11 +59,11 @@ public abstract class ScopedServlet extends HttpServlet {
 
     @Override
     protected void doDelete(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        if(req.getAttribute("accessLevel") instanceof AccessLevel){
+        if(!(req.getAttribute("accessLevel") instanceof AccessLevel)){
             resp.sendError(403,"No valid access level found!");
             return;
         }
-        if(!DELETE_accessLevels.contains(req.getAttribute("accessLevel"))){
+        if(!DELETE_accessLevels.contains((AccessLevel) req.getAttribute("accessLevel"))){
             resp.sendError(403,"You do not have enough rights to access this endpoint!");
             return;
         }
diff --git a/jams-server/src/main/java/net/jami/jams/server/servlets/api/admin/update/SubscriptionServlet.java b/jams-server/src/main/java/net/jami/jams/server/servlets/api/admin/update/SubscriptionServlet.java
index f2b48ab0c4394be7ef09dfa449596b3adbf244ab..e30132d3b03d645949ad62aaedda3d2d43962b02 100644
--- a/jams-server/src/main/java/net/jami/jams/server/servlets/api/admin/update/SubscriptionServlet.java
+++ b/jams-server/src/main/java/net/jami/jams/server/servlets/api/admin/update/SubscriptionServlet.java
@@ -34,7 +34,7 @@ import net.jami.jams.server.Server;
 
 import java.io.IOException;
 
-@WebServlet("/api/subscription")
+@WebServlet("/api/admin/subscription")
 public class SubscriptionServlet extends HttpServlet {
 
     //Get the subscription status (see: SubscriptionStatusResponse.class)
diff --git a/jams-server/src/main/java/net/jami/jams/server/servlets/api/admin/update/UpdateServlet.java b/jams-server/src/main/java/net/jami/jams/server/servlets/api/admin/update/UpdateServlet.java
index 08785810da8620c18b10afc7416f1a65a2c5ee92..1b3a5e45bd899e92b83c3187b68bb335b61e163f 100644
--- a/jams-server/src/main/java/net/jami/jams/server/servlets/api/admin/update/UpdateServlet.java
+++ b/jams-server/src/main/java/net/jami/jams/server/servlets/api/admin/update/UpdateServlet.java
@@ -34,7 +34,7 @@ import java.io.IOException;
 
 import static net.jami.jams.server.Server.appUpdater;
 
-@WebServlet("/api/update")
+@WebServlet("/api/admin/update")
 public class UpdateServlet extends HttpServlet {
 
     //Return the current version number and the available version number.
diff --git a/jams-server/src/main/java/net/jami/jams/server/servlets/filters/ApiFilter.java b/jams-server/src/main/java/net/jami/jams/server/servlets/filters/ApiFilter.java
index 519aa48f0656e3f321bda5b140b4af211f7f6604..8bbee8f2acd046487f346c2616ec994566ea4b8e 100644
--- a/jams-server/src/main/java/net/jami/jams/server/servlets/filters/ApiFilter.java
+++ b/jams-server/src/main/java/net/jami/jams/server/servlets/filters/ApiFilter.java
@@ -75,7 +75,7 @@ public class ApiFilter implements Filter {
                         if ((Boolean) signedJWT.getJWTClaimsSet().getClaim("oneTimePassword")) {
                             //TODO: use redirect to enforce the /changepassword url or something.
                         }
-                        request.setAttribute("accessLevel", AccessLevel.valueOf(signedJWT.getJWTClaimsSet().getClaim("accessLevel").toString()));
+                        request.setAttribute("accessLevel", AccessLevel.valueOf(signedJWT.getJWTClaimsSet().getClaim("scope").toString()));
                     }
                 } catch (Exception e) {
                     log.info("Received an invalid token, declining access...");