diff --git a/packages/strapi-plugin-users-permissions/config/routes.json b/packages/strapi-plugin-users-permissions/config/routes.json
index 4d376a246e..7348c12678 100644
--- a/packages/strapi-plugin-users-permissions/config/routes.json
+++ b/packages/strapi-plugin-users-permissions/config/routes.json
@@ -7,6 +7,51 @@
       "config": {
         "policies": []
       }
+    },
+    {
+      "method": "GET",
+      "path": "/user",
+      "handler": "User.find",
+      "config": {
+        "policies": [],
+        "prefix": ""
+      }
+    },
+    {
+      "method": "GET",
+      "path": "/user/:_id",
+      "handler": "User.findOne",
+      "config": {
+        "policies": [],
+        "prefix": ""
+      }
+    },
+    {
+      "method": "POST",
+      "path": "/user",
+      "handler": "User.create",
+      "config": {
+        "policies": [],
+        "prefix": ""
+      }
+    },
+    {
+      "method": "PUT",
+      "path": "/user/:_id",
+      "handler": "User.update",
+      "config": {
+        "policies": [],
+        "prefix": ""
+      }
+    },
+    {
+      "method": "DELETE",
+      "path": "/user/:_id",
+      "handler": "User.destroy",
+      "config": {
+        "policies": [],
+        "prefix": ""
+      }
     }
   ]
 }
diff --git a/packages/strapi-plugin-users-permissions/controllers/User.js b/packages/strapi-plugin-users-permissions/controllers/User.js
new file mode 100644
index 0000000000..504de54291
--- /dev/null
+++ b/packages/strapi-plugin-users-permissions/controllers/User.js
@@ -0,0 +1,75 @@
+'use strict';
+
+/**
+ * User.js controller
+ *
+ * @description: A set of functions called "actions" for managing `User`.
+ */
+
+module.exports = {
+
+  /**
+   * Retrieve user records.
+   *
+   * @return {Object|Array}
+   */
+
+  find: async (ctx) => {
+    const data = await strapi.plugins['users-permissions'].services.user.fetchAll(ctx.query);
+
+    // Send 200 `ok`
+    ctx.send(data);
+  },
+
+  /**
+   * Retrieve a user record.
+   *
+   * @return {Object}
+   */
+
+  findOne: async (ctx) => {
+    const data = await strapi.plugins['users-permissions'].services.user.fetch(ctx.params);
+
+    // Send 200 `ok`
+    ctx.send(data);
+  },
+
+  /**
+   * Create a/an user record.
+   *
+   * @return {Object}
+   */
+
+  create: async (ctx) => {
+    const data = await strapi.plugins['users-permissions'].services.user.add(ctx.request.body);
+
+    // Send 201 `created`
+    ctx.created(data);
+  },
+
+  /**
+   * Update a/an user record.
+   *
+   * @return {Object}
+   */
+
+  update: async (ctx, next) => {
+    const data = await strapi.plugins['users-permissions'].services.user.edit(ctx.params, ctx.request.body) ;
+
+    // Send 200 `ok`
+    ctx.send(data);
+  },
+
+  /**
+   * Destroy a/an user record.
+   *
+   * @return {Object}
+   */
+
+  destroy: async (ctx, next) => {
+    const data = await strapi.plugins['users-permissions'].services.user.remove(ctx.params);
+
+    // Send 200 `ok`
+    ctx.send(data);
+  }
+};
diff --git a/packages/strapi-plugin-users-permissions/models/User.js b/packages/strapi-plugin-users-permissions/models/User.js
new file mode 100644
index 0000000000..e308fd2fc2
--- /dev/null
+++ b/packages/strapi-plugin-users-permissions/models/User.js
@@ -0,0 +1,85 @@
+'use strict';
+
+/**
+ * Lifecycle callbacks for the `User` model.
+ */
+
+module.exports = {
+
+  // Before saving a value.
+  // Fired before an `insert` or `update` query.
+  // beforeSave: function (next) {
+  //   // Use `this` to get your current object
+  //   next();
+  // },
+
+  // After saving a value.
+  // Fired after an `insert` or `update` query.
+  // afterSave: function (doc, next) {
+  //   next();
+  // },
+
+  // Before fetching all values.
+  // Fired before a `fetchAll` operation.
+  // beforeFetchAll: function (next) {
+  //   // Use `this` to get your current object
+  //   next();
+  // },
+
+  // After fetching all values.
+  // Fired after a `fetchAll` operation.
+  // afterFetchAll: function (doc, next) {
+  //   next();
+  // },
+
+  // Fired before a `fetch` operation.
+  // beforeFetch: function (next) {
+  //   // Use `this` to get your current object
+  //   next();
+  // },
+
+  // After fetching a value.
+  // Fired after a `fetch` operation.
+  // afterFetch: function (doc, next) {
+  //   next();
+  // },
+
+  // Before creating a value.
+  // Fired before `insert` query.
+  // beforeCreate: function (next) {
+  //   // Use `this` to get your current object
+  //   next();
+  // },
+
+  // After creating a value.
+  // Fired after `insert` query.
+  // afterCreate: function (doc, next) {
+  //   next();
+  // },
+
+  // Before updating a value.
+  // Fired before an `update` query.
+  // beforeUpdate: function (next) {
+  //   // Use `this` to get your current object
+  //   next();
+  // },
+
+  // After updating a value.
+  // Fired after an `update` query.
+  // afterUpdate: function (doc, next) {
+  //   next();
+  // },
+
+  // Before destroying a value.
+  // Fired before a `delete` query.
+  // beforeDestroy: function (next) {
+  //   // Use `this` to get your current object
+  //   next();
+  // },
+
+  // After destroying a value.
+  // Fired after a `delete` query.
+  // afterDestroy: function (doc, next) {
+  //   next();
+  // }
+};
diff --git a/packages/strapi-plugin-users-permissions/models/User.settings.json b/packages/strapi-plugin-users-permissions/models/User.settings.json
new file mode 100644
index 0000000000..540825298e
--- /dev/null
+++ b/packages/strapi-plugin-users-permissions/models/User.settings.json
@@ -0,0 +1,11 @@
+{
+  "connection": "default",
+  "collectionName": "",
+  "info": {
+    "name": "user",
+    "description": ""
+  },
+  "attributes": {
+    
+  }
+}
diff --git a/packages/strapi-plugin-users-permissions/package.json b/packages/strapi-plugin-users-permissions/package.json
index d0937e3d42..20095361c1 100644
--- a/packages/strapi-plugin-users-permissions/package.json
+++ b/packages/strapi-plugin-users-permissions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-users-permissions",
-  "version": "3.0.0-alpha.6.4",
+  "version": "3.0.0-alpha.6.7",
   "description": "This is the description of the plugin.",
   "strapi": {
     "name": "Auth & Permissions",
@@ -39,7 +39,7 @@
     "plop": "^1.9.0",
     "prettier": "^1.7.4",
     "rimraf": "^2.6.2",
-    "strapi-helper-plugin": "3.0.0-alpha.6.4",
+    "strapi-helper-plugin": "3.0.0-alpha.6.7",
     "webpack": "^3.8.1"
   },
   "author": {
diff --git a/packages/strapi-plugin-users-permissions/services/User.js b/packages/strapi-plugin-users-permissions/services/User.js
new file mode 100644
index 0000000000..4585542af7
--- /dev/null
+++ b/packages/strapi-plugin-users-permissions/services/User.js
@@ -0,0 +1,94 @@
+'use strict';
+
+/**
+ * User.js service
+ *
+ * @description: A set of functions similar to controller's actions to avoid code duplication.
+ */
+
+// Public dependencies.
+const _ = require('lodash');
+
+module.exports = {
+
+  /**
+   * Promise to fetch all users.
+   *
+   * @return {Promise}
+   */
+
+  fetchAll: (params) => {
+    const convertedParams = strapi.utils.models.convertParams('user', params);
+
+    return User
+      .find()
+      .where(convertedParams.where)
+      .sort(convertedParams.sort)
+      .skip(convertedParams.start)
+      .limit(convertedParams.limit)
+      .populate(_.keys(_.groupBy(_.reject(strapi.models.user.associations, {autoPopulate: false}), 'alias')).join(' '));
+  },
+
+  /**
+   * Promise to fetch a/an user.
+   *
+   * @return {Promise}
+   */
+
+  fetch: (params) => {
+    return User
+      .findOne(params)
+      .populate(_.keys(_.groupBy(_.reject(strapi.models.user.associations, {autoPopulate: false}), 'alias')).join(' '));
+  },
+
+  /**
+   * Promise to add a/an user.
+   *
+   * @return {Promise}
+   */
+
+  add: async (values) => {
+    const data = await User.create(_.omit(values, _.keys(_.groupBy(strapi.models.user.associations, 'alias'))));
+    await strapi.hook.mongoose.manageRelations('user', _.merge(_.clone(data), { values }));
+    return data;
+  },
+
+  /**
+   * Promise to edit a/an user.
+   *
+   * @return {Promise}
+   */
+
+  edit: async (params, values) => {
+    // Note: The current method will return the full response of Mongo.
+    // To get the updated object, you have to execute the `findOne()` method
+    // or use the `findOneOrUpdate()` method with `{ new:true }` option.
+    await strapi.hook.mongoose.manageRelations('user', _.merge(_.clone(params), { values }));
+    return User.update(params, values, { multi: true });
+  },
+
+  /**
+   * Promise to remove a/an user.
+   *
+   * @return {Promise}
+   */
+
+  remove: async params => {
+    // Note: To get the full response of Mongo, use the `remove()` method
+    // or add spent the parameter `{ passRawResult: true }` as second argument.
+    const data = await User.findOneAndRemove(params, {})
+      .populate(_.keys(_.groupBy(_.reject(strapi.models.user.associations, {autoPopulate: false}), 'alias')).join(' '));
+
+    _.forEach(User.associations, async association => {
+      const search = (_.endsWith(association.nature, 'One')) ? { [association.via]: data._id } : { [association.via]: { $in: [data._id] } };
+      const update = (_.endsWith(association.nature, 'One')) ? { [association.via]: null } : { $pull: { [association.via]: data._id } };
+
+      await strapi.models[association.model || association.collection].update(
+        search,
+        update,
+        { multi: true });
+    });
+
+    return data;
+  }
+};
diff --git a/packages/strapi/lib/middlewares/router/index.js b/packages/strapi/lib/middlewares/router/index.js
index 3e342aa867..4d13212d02 100755
--- a/packages/strapi/lib/middlewares/router/index.js
+++ b/packages/strapi/lib/middlewares/router/index.js
@@ -64,7 +64,7 @@ module.exports = strapi => {
           const router = strapi.koaMiddlewares.routerJoi();
 
           // Exclude routes with prefix.
-          const excludedRoutes = _.omitBy(plugin.config.routes, o => !o.hasOwnProperty('prefix'));
+          const excludedRoutes = _.omitBy(plugin.config.routes, o => !o.config.hasOwnProperty('prefix'));
 
           _.forEach(_.omit(plugin.config.routes, _.keys(excludedRoutes)), value => {
             composeEndpoint(value, name, router)(cb);