diff --git a/authorizer-app-backend/src/main/java/org/radarbase/authorizer/resources/RestSourceUserResource.kt b/authorizer-app-backend/src/main/java/org/radarbase/authorizer/resources/RestSourceUserResource.kt
index b12cf59..d3d6d63 100644
--- a/authorizer-app-backend/src/main/java/org/radarbase/authorizer/resources/RestSourceUserResource.kt
+++ b/authorizer-app-backend/src/main/java/org/radarbase/authorizer/resources/RestSourceUserResource.kt
@@ -157,7 +157,7 @@ class RestSourceUserResource(
     }
 
     @POST
-    @NeedsPermission(Permission.SUBJECT_CREATE)
+    @NeedsPermission(Permission.SUBJECT_UPDATE)
     fun create(
         userDto: RestSourceUserDTO,
         @Suspended asyncResponse: AsyncResponse,