diff --git a/src/Tgstation.Server.Host/Authority/ILoginAuthority.cs b/src/Tgstation.Server.Host/Authority/ILoginAuthority.cs
index 911cc7033e..de0258db40 100644
--- a/src/Tgstation.Server.Host/Authority/ILoginAuthority.cs
+++ b/src/Tgstation.Server.Host/Authority/ILoginAuthority.cs
@@ -2,7 +2,7 @@
 using System.Threading.Tasks;
 
 using Tgstation.Server.Host.Authority.Core;
-using Tgstation.Server.Host.GraphQL.Mutations;
+using Tgstation.Server.Host.GraphQL.Mutations.Payloads;
 
 namespace Tgstation.Server.Host.Authority
 {
diff --git a/src/Tgstation.Server.Host/Authority/LoginAuthority.cs b/src/Tgstation.Server.Host/Authority/LoginAuthority.cs
index 8dbd4827a7..4c5d2d6a77 100644
--- a/src/Tgstation.Server.Host/Authority/LoginAuthority.cs
+++ b/src/Tgstation.Server.Host/Authority/LoginAuthority.cs
@@ -11,7 +11,7 @@ using Tgstation.Server.Api.Models;
 using Tgstation.Server.Api.Models.Response;
 using Tgstation.Server.Host.Authority.Core;
 using Tgstation.Server.Host.Database;
-using Tgstation.Server.Host.GraphQL.Mutations;
+using Tgstation.Server.Host.GraphQL.Mutations.Payloads;
 using Tgstation.Server.Host.Models;
 using Tgstation.Server.Host.Models.Transformers;
 using Tgstation.Server.Host.Security;
diff --git a/src/Tgstation.Server.Host/Controllers/ApiRootController.cs b/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
index 7a90d23f17..08e499f233 100644
--- a/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
@@ -19,7 +19,7 @@ using Tgstation.Server.Host.Components.Interop;
 using Tgstation.Server.Host.Configuration;
 using Tgstation.Server.Host.Core;
 using Tgstation.Server.Host.Database;
-using Tgstation.Server.Host.GraphQL.Mutations;
+using Tgstation.Server.Host.GraphQL.Mutations.Payloads;
 using Tgstation.Server.Host.Models;
 using Tgstation.Server.Host.Security;
 using Tgstation.Server.Host.Security.OAuth;
diff --git a/src/Tgstation.Server.Host/GraphQL/Mutation.cs b/src/Tgstation.Server.Host/GraphQL/Mutation.cs
index f9b8d29d52..ff178262a5 100644
--- a/src/Tgstation.Server.Host/GraphQL/Mutation.cs
+++ b/src/Tgstation.Server.Host/GraphQL/Mutation.cs
@@ -6,7 +6,7 @@ using HotChocolate;
 using HotChocolate.Types;
 
 using Tgstation.Server.Host.Authority;
-using Tgstation.Server.Host.GraphQL.Mutations;
+using Tgstation.Server.Host.GraphQL.Mutations.Payloads;
 
 namespace Tgstation.Server.Host.GraphQL
 {
@@ -17,7 +17,7 @@ namespace Tgstation.Server.Host.GraphQL
 	public sealed class Mutation
 	{
 		/// <summary>
-		/// Generate JWT for authenticating with server.
+		/// Generate a JWT for authenticating with server. This is the only operation that accepts and required basic authentication.
 		/// </summary>
 		/// <param name="loginAuthority">The <see cref="IGraphQLAuthorityInvoker{TAuthority}"/> <see cref="ILoginAuthority"/>.</param>
 		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation.</param>
diff --git a/src/Tgstation.Server.Host/GraphQL/Mutations/LoginPayload.cs b/src/Tgstation.Server.Host/GraphQL/Mutations/Payloads/LoginPayload.cs
similarity index 92%
rename from src/Tgstation.Server.Host/GraphQL/Mutations/LoginPayload.cs
rename to src/Tgstation.Server.Host/GraphQL/Mutations/Payloads/LoginPayload.cs
index 31b9b2e0b3..5a055b6fcb 100644
--- a/src/Tgstation.Server.Host/GraphQL/Mutations/LoginPayload.cs
+++ b/src/Tgstation.Server.Host/GraphQL/Mutations/Payloads/LoginPayload.cs
@@ -1,9 +1,8 @@
 using HotChocolate;
-
 using Tgstation.Server.Api.Models.Response;
 using Tgstation.Server.Host.Models;
 
-namespace Tgstation.Server.Host.GraphQL.Mutations
+namespace Tgstation.Server.Host.GraphQL.Mutations.Payloads
 {
 	/// <summary>
 	/// Success response for a login attempt.
diff --git a/src/Tgstation.Server.Host/GraphQL/Mutations/UserMutations.cs b/src/Tgstation.Server.Host/GraphQL/Mutations/UserMutations.cs
new file mode 100644
index 0000000000..1c9f0707e5
--- /dev/null
+++ b/src/Tgstation.Server.Host/GraphQL/Mutations/UserMutations.cs
@@ -0,0 +1,120 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+using HotChocolate;
+using HotChocolate.Types;
+using HotChocolate.Types.Relay;
+
+using Tgstation.Server.Host.Authority;
+using Tgstation.Server.Host.GraphQL.Types;
+
+namespace Tgstation.Server.Host.GraphQL.Mutations
+{
+	/// <summary>
+	/// <see cref="IUserAuthority"/> related <see cref="Mutation"/>s.
+	/// </summary>
+	[ExtendObjectType(typeof(Mutation))]
+	public sealed class UserMutations
+	{
+		/// <summary>
+		/// Creates a TGS user specifying a personal <see cref="PermissionSet"/>.
+		/// </summary>
+		/// <param name="name">The <see cref="NamedEntity.Name"/> of the <see cref="User"/>.</param>
+		/// <param name="password">The password of the <see cref="User"/>.</param>
+		/// <param name="enabled">If the <see cref="User"/> is <see cref="User.Enabled"/>.</param>
+		/// <param name="permissionSet">The owned <see cref="PermissionSet"/> of the user.</param>
+		/// <param name="userAuthority">The <see cref="IGraphQLAuthorityInvoker{TAuthority}"/> <see cref="IUserAuthority"/>.</param>
+		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation.</param>
+		/// <returns>A <see cref="ValueTask"/> resulting in the created <see cref="User"/>.</returns>
+		[Error(typeof(ErrorMessageException))]
+		public ValueTask<User> CreateUserByPasswordAndPermissionSet(
+			string name,
+			string password,
+			bool enabled,
+			PermissionSet permissionSet,
+			[Service] IGraphQLAuthorityInvoker<IUserAuthority> userAuthority,
+			CancellationToken cancellationToken)
+		{
+			ArgumentException.ThrowIfNullOrWhiteSpace(name);
+			ArgumentException.ThrowIfNullOrEmpty(password);
+			ArgumentNullException.ThrowIfNull(permissionSet);
+			ArgumentNullException.ThrowIfNull(userAuthority);
+
+			throw new NotImplementedException();
+		}
+
+		/// <summary>
+		/// Creates a system user specifying a personal <see cref="PermissionSet"/>.
+		/// </summary>
+		/// <param name="systemIdentifier">The <see cref="User.SystemIdentifier"/> of the <see cref="User"/>.</param>
+		/// <param name="enabled">If the <see cref="User"/> is <see cref="User.Enabled"/>.</param>
+		/// <param name="permissionSet">The owned <see cref="PermissionSet"/> of the user.</param>
+		/// <param name="userAuthority">The <see cref="IGraphQLAuthorityInvoker{TAuthority}"/> <see cref="IUserAuthority"/>.</param>
+		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation.</param>
+		/// <returns>A <see cref="ValueTask"/> resulting in the created <see cref="User"/>.</returns>
+		[Error(typeof(ErrorMessageException))]
+		public ValueTask<User> CreateUserBySystemIDAndPermissionSet(
+			string systemIdentifier,
+			bool enabled,
+			PermissionSet permissionSet,
+			[Service] IGraphQLAuthorityInvoker<IUserAuthority> userAuthority,
+			CancellationToken cancellationToken)
+		{
+			ArgumentException.ThrowIfNullOrWhiteSpace(systemIdentifier);
+			ArgumentNullException.ThrowIfNull(permissionSet);
+			ArgumentNullException.ThrowIfNull(userAuthority);
+
+			throw new NotImplementedException();
+		}
+
+		/// <summary>
+		/// Creates a TGS user specifying the <see cref="UserGroup"/> they will belong to.
+		/// </summary>
+		/// <param name="name">The <see cref="NamedEntity.Name"/> of the <see cref="User"/>.</param>
+		/// <param name="password">The password of the <see cref="User"/>.</param>
+		/// <param name="enabled">If the <see cref="User"/> is <see cref="User.Enabled"/>.</param>
+		/// <param name="groupId">The <see cref="Entity.Id"/> of the <see cref="UserGroup"/> the <see cref="User"/> will belong to.</param>
+		/// <param name="userAuthority">The <see cref="IGraphQLAuthorityInvoker{TAuthority}"/> <see cref="IUserAuthority"/>.</param>
+		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation.</param>
+		/// <returns>A <see cref="ValueTask"/> resulting in the created <see cref="User"/>.</returns>
+		[Error(typeof(ErrorMessageException))]
+		public ValueTask<User> CreateUserByPasswordAndGroup(
+			string name,
+			string password,
+			bool enabled,
+			[ID(nameof(UserGroup))] long groupId,
+			[Service] IGraphQLAuthorityInvoker<IUserAuthority> userAuthority,
+			CancellationToken cancellationToken)
+		{
+			ArgumentException.ThrowIfNullOrWhiteSpace(name);
+			ArgumentException.ThrowIfNullOrEmpty(password);
+			ArgumentNullException.ThrowIfNull(userAuthority);
+
+			throw new NotImplementedException();
+		}
+
+		/// <summary>
+		/// Creates a system user specifying the <see cref="UserGroup"/> they will belong to.
+		/// </summary>
+		/// <param name="systemIdentifier">The <see cref="User.SystemIdentifier"/> of the <see cref="User"/>.</param>
+		/// <param name="enabled">If the <see cref="User"/> is <see cref="User.Enabled"/>.</param>
+		/// <param name="groupId">The <see cref="Entity.Id"/> of the <see cref="UserGroup"/> the <see cref="User"/> will belong to.</param>
+		/// <param name="userAuthority">The <see cref="IGraphQLAuthorityInvoker{TAuthority}"/> <see cref="IUserAuthority"/>.</param>
+		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation.</param>
+		/// <returns>A <see cref="ValueTask"/> resulting in the created <see cref="User"/>.</returns>
+		[Error(typeof(ErrorMessageException))]
+		public ValueTask<User> CreateUserBySystemIDAndGroup(
+			string systemIdentifier,
+			bool enabled,
+			[ID(nameof(UserGroup))] long groupId,
+			[Service] IGraphQLAuthorityInvoker<IUserAuthority> userAuthority,
+			CancellationToken cancellationToken)
+		{
+			ArgumentException.ThrowIfNullOrWhiteSpace(systemIdentifier);
+			ArgumentNullException.ThrowIfNull(userAuthority);
+
+			throw new NotImplementedException();
+		}
+	}
+}