diff --git a/build/Doxyfile b/build/Doxyfile
index b4ec282ad2..e2876a616c 100644
--- a/build/Doxyfile
+++ b/build/Doxyfile
@@ -865,7 +865,7 @@ RECURSIVE              = YES
 # run.
 
 #We want the main .md
-EXCLUDE                = legacy packages
+EXCLUDE                =
 
 # The EXCLUDE_SYMLINKS tag can be used to select whether or not files or
 # directories that are symbolic links (a Unix file system feature) are excluded
diff --git a/docs/API.dox b/docs/API.dox
index 683fa11d29..03208d6fee 100644
--- a/docs/API.dox
+++ b/docs/API.dox
@@ -1,3 +1,4 @@
+/*!
 @page api API
 
 @tableofcontents
@@ -8,7 +9,7 @@ The TGS4 API is designed to be a fully realized RESTful service. Once hosted, fo
 
 Routes and their usages are defined as follows
 
-[I (If Instance is required)] <Http Method> "<Route>" => <Response Model>
+[I (If Instance is required)] <Http Method> "<Route>" [Request Model] => <Response Model>
 
 @section api_lib Official Libraries
 
@@ -68,7 +69,7 @@ Every request made to TGS requires authentication. It is provided in the form of
 
 The first request made to TGS must be to login the user
 
-POST "/" => Empty
+POST "/" => Token
 
 Headers:
 
@@ -102,5 +103,38 @@ Permissions are represented a a 32 bit integer in the form of bitflags. The two
 GET "/Users" => @ref Tgstation.Server.Api.Models.User
 I GET "/InstanceUser" => @ref Tgstation.Server.Api.Models.InstanceUser
 
-See individual permission documentation for their usage
+See individual documentation of each permission enum for their usage
 
+@section api_user User Management
+
+TGS start with one user action "Admin". The password is "ISolemlySwearToDeleteTheDataDirectory"
+
+There are two types of users that can be created: Database users and system users. Database users are your plain login/password style users. System users are based on either Windows or POSIX accounts depending on the host system. They cannot be created by TGS and have to be activated by adding them to the Database similarly to a normal user using the "SystemIdentifier" field which should generally be set to their username or DOMAIN\\Username in an active directory environment. These act the same as regular users with the only exception being @ref api_config. See that section for details.
+
+New users can be created with the following method.
+
+PUT "/User" @ref Tgstation.Server.Api.Models.UserUpdate => @ref Tgstation.Server.Api.Models.User
+
+To create a regular user, populate the name and password fields. To create a system user populate the SystemIdentifier field. Users rights and enabled status can also be specified in this call. To change them later use this API.
+
+POST "/User" @ref Tgstation.Server.Api.Models.UserUpdate => @ref Tgstation.Server.Api.Models.User
+
+Passowords for database users may be changed as well using this call. The capitalization of the display name of a user may also be changed
+
+@subsection Instance User Management
+
+Instance users must be created for a given instance before being manipulated. The creator of an instance starts with full permissions on it
+
+I PUT "/InstanceUser" @ref Tgstation.Server.Api.Models.InstanceUser => @ref Tgstation.Server.Api.Models.InstanceUser
+
+They can be updated with a similar POST
+
+I POST "/InstanceUser" @ref Tgstation.Server.Api.Models.InstanceUser => @ref Tgstation.Server.Api.Models.InstanceUser
+
+Unlike regular users, they can also be deleted, which prevents the user from discovering the instance
+
+I DELETE "/InstanceUser/{UserId}" => OK
+
+Users with the permission to modify @ref Tgstation.Server.Api.Models.Instance objects can also gain user editing rights for any Instance. See @ref api_instance
+
+*/
diff --git a/src/Tgstation.Server.Api/Models/InstanceUser.cs b/src/Tgstation.Server.Api/Models/InstanceUser.cs
index 2732ef66c3..68bd323b81 100644
--- a/src/Tgstation.Server.Api/Models/InstanceUser.cs
+++ b/src/Tgstation.Server.Api/Models/InstanceUser.cs
@@ -16,13 +16,6 @@ namespace Tgstation.Server.Api.Models
 		[Required]
 		public long? UserId { get; set; }
 
-		/// <summary>
-		/// The <see cref="Instance.Id"/> of the <see cref="Instance"/> the <see cref="InstanceUser"/> belongs to
-		/// </summary>
-		[Permissions(DenyWrite = true)]
-		[Required]
-		public long? InstanceId { get; set; }
-
 		/// <summary>
 		/// The <see cref="Rights.InstanceUserRights"/> of the <see cref="InstanceUser"/>
 		/// </summary>
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceUserController.cs b/src/Tgstation.Server.Host/Controllers/InstanceUserController.cs
index a76407212f..7d2deb2d37 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceUserController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceUserController.cs
@@ -40,9 +40,6 @@ namespace Tgstation.Server.Host.Controllers
 			if (model == null)
 				throw new ArgumentNullException(nameof(model));
 
-			if (model.InstanceId.HasValue && model.InstanceId != Instance.Id)
-				return BadRequest(new { message = "InstanceId does not match headers!" });
-
 			if (!model.UserId.HasValue)
 				return BadRequest(new { message = "Missing UserId!" });
 
diff --git a/src/Tgstation.Server.Host/Models/InstanceUser.cs b/src/Tgstation.Server.Host/Models/InstanceUser.cs
index 813bf40d0e..152738ef3a 100644
--- a/src/Tgstation.Server.Host/Models/InstanceUser.cs
+++ b/src/Tgstation.Server.Host/Models/InstanceUser.cs
@@ -11,6 +11,11 @@ namespace Tgstation.Server.Host.Models
 		/// </summary>
 		public long Id { get; set; }
 
+		/// <summary>
+		/// The <see cref="Api.Models.Instance.Id"/> of <see cref="Instance"/>
+		/// </summary>
+		public long InstanceId { get; set; }
+
 		/// <summary>
 		/// The <see cref="Models.Instance"/> the <see cref="InstanceUser"/> belongs to
 		/// </summary>
@@ -35,7 +40,6 @@ namespace Tgstation.Server.Host.Models
 			ConfigurationRights = ConfigurationRights,
 			DreamDaemonRights = DreamDaemonRights,
 			DreamMakerRights = DreamMakerRights,
-			InstanceId = InstanceId,
 			RepositoryRights = RepositoryRights,
 			InstanceUserRights = InstanceUserRights,
 			UserId = UserId