diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUser.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUser.java
index 80ddf1b..9965edb 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUser.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUser.java
@@ -14,6 +14,8 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
+
 import com.google.common.base.Function;
 import com.google.common.base.Strings;
 import com.google.common.collect.Lists;
@@ -151,7 +153,12 @@
 
     input.email = Strings.emptyToNull(input.email);
     if (input.email != null) {
-      Boolean emailAllowed = getConfig.get().apply(new ConfigResource()).allowEmail;
+      Boolean emailAllowed;
+      try {
+        emailAllowed = getConfig.get().apply(new ConfigResource()).value().allowEmail;
+      } catch (Exception e) {
+        throw asRestApiException("Cannot get configuration", e);
+      }
       if (emailAllowed == null || !emailAllowed) {
         throw new ResourceConflictException("email not allowed");
       }
@@ -159,7 +166,13 @@
 
     AccountInput in = new ServiceUserInput(username, input.email, input.sshKey);
     in.groups = Arrays.asList(cfg.getStringList("group"));
-    Response<AccountInfo> response = createAccount.apply(IdString.fromDecoded(username), in);
+
+    AccountInfo response;
+    try {
+      response = createAccount.apply(IdString.fromDecoded(username), in).value();
+    } catch (Exception e) {
+      throw asRestApiException("Cannot create account", e);
+    }
 
     String creator = user.getUserName().get();
     Account.Id creatorId = ((IdentifiedUser) user).getAccountId();
@@ -175,8 +188,7 @@
     MetaDataUpdate md = metaDataUpdateFactory.create(allProjects);
     md.setMessage("Create service user '" + username + "'\n");
     storage.commit(md);
-
-    ServiceUserInfo info = new ServiceUserInfo(response.value());
+    ServiceUserInfo info = new ServiceUserInfo(response);
     AccountLoader al = accountLoader.create(true);
     info.createdBy = al.get(creatorId);
     al.fill();
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUserNotes.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUserNotes.java
index 63cb875..fd54a55 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUserNotes.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUserNotes.java
@@ -20,7 +20,6 @@
 import static org.eclipse.jgit.lib.Constants.OBJ_COMMIT;
 
 import com.google.gerrit.extensions.common.AccountInfo;
-import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.server.GerritPersonIdent;
@@ -154,13 +153,13 @@
   }
 
   private ObjectId createNoteContent(String branch, ServiceUserInfo serviceUser)
-      throws IOException, MethodNotAllowedException, PermissionBackendException {
+      throws IOException, PermissionBackendException, RestApiException, RuntimeException {
     return getInserter()
         .insert(Constants.OBJ_BLOB, createServiceUserNote(branch, serviceUser).getBytes(UTF_8));
   }
 
   private String createServiceUserNote(String branch, ServiceUserInfo serviceUser)
-      throws MethodNotAllowedException, PermissionBackendException {
+      throws PermissionBackendException, RestApiException, RuntimeException {
     HeaderFormatter fmt = new HeaderFormatter(gerritServerIdent.getTimeZone(), anonymousCowardName);
     fmt.appendDate();
     fmt.append("Project", project.get());
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetActive.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetActive.java
index 3939119..b6284b0 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetActive.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetActive.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -29,7 +30,7 @@
   }
 
   @Override
-  public Object apply(ServiceUserResource rsrc) {
-    return getActive.get().apply(rsrc);
+  public Response<Object> apply(ServiceUserResource rsrc) {
+    return Response.ok(getActive.get().apply(rsrc));
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetConfig.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetConfig.java
index 85da7b0..7a8c7e2 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetConfig.java
@@ -17,6 +17,7 @@
 import com.google.common.base.Strings;
 import com.google.gerrit.extensions.annotations.PluginName;
 import com.google.gerrit.extensions.common.GroupInfo;
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.server.account.GroupCache;
@@ -59,7 +60,7 @@
   }
 
   @Override
-  public ConfigInfo apply(ConfigResource rsrc) throws PermissionBackendException {
+  public Response<ConfigInfo> apply(ConfigResource rsrc) throws PermissionBackendException {
     PluginConfig cfg = cfgFactory.getFromGerritConfig(pluginName);
     ConfigInfo info = new ConfigInfo();
     info.info = Strings.emptyToNull(cfg.getString("infoMessage"));
@@ -77,7 +78,7 @@
     String[] groups = cfg.getStringList("group");
     info.groups = new TreeMap<>();
     for (String g : groups) {
-      Optional<InternalGroup> group = groupCache.get(new AccountGroup.NameKey(g));
+      Optional<InternalGroup> group = groupCache.get(AccountGroup.nameKey(g));
       if (group.isPresent()) {
         GroupInfo groupInfo = groupJson.format(new InternalGroupDescription(group.get()));
         groupInfo.name = null;
@@ -87,7 +88,7 @@
       }
     }
 
-    return info;
+    return Response.ok(info);
   }
 
   private static Boolean toBoolean(boolean v) {
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetEmail.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetEmail.java
index 0fd97da..440bcfa 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetEmail.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetEmail.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.inject.Singleton;
 
@@ -21,7 +22,7 @@
 class GetEmail implements RestReadView<ServiceUserResource> {
 
   @Override
-  public String apply(ServiceUserResource rsrc) {
-    return rsrc.getUser().getAccount().getPreferredEmail();
+  public Response<String> apply(ServiceUserResource rsrc) {
+    return Response.ok(rsrc.getUser().getAccount().preferredEmail());
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetName.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetName.java
index 6ed1af6..7294911 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetName.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetName.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -29,7 +30,7 @@
   }
 
   @Override
-  public String apply(ServiceUserResource rsrc) {
+  public Response<String> apply(ServiceUserResource rsrc) {
     return getName.get().apply(rsrc);
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetServiceUser.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetServiceUser.java
index 3a2460f..3363708 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetServiceUser.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetServiceUser.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.KEY_CREATED_AT;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.KEY_CREATOR_ID;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.USER;
@@ -60,7 +61,7 @@
   }
 
   @Override
-  public ServiceUserInfo apply(ServiceUserResource rsrc)
+  public Response<ServiceUserInfo> apply(ServiceUserResource rsrc)
       throws RestApiException, PermissionBackendException {
     ProjectLevelConfig storage = projectCache.getAllProjects().getConfig(pluginName + ".db");
     String username = rsrc.getUser().getUserName().get();
@@ -69,25 +70,35 @@
       throw new ResourceNotFoundException(username);
     }
 
-    ServiceUserInfo info = new ServiceUserInfo(getAccount.get().apply(rsrc));
+    ServiceUserInfo info;
+    try {
+      info = new ServiceUserInfo(getAccount.get().apply(rsrc).value());
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get service user", e);
+    }
+
     AccountLoader al = accountLoader.create(true);
-    info.createdBy = al.get(new Account.Id(db.getInt(USER, username, KEY_CREATOR_ID, -1)));
+    info.createdBy = al.get(Account.id(db.getInt(USER, username, KEY_CREATOR_ID, -1)));
     al.fill();
     info.createdAt = db.getString(USER, username, KEY_CREATED_AT);
     info.inactive = !rsrc.getUser().getAccount().isActive() ? true : null;
 
     Response<GroupInfo> response = getOwner.apply(rsrc);
+
     if (response.statusCode() == SC_OK) {
-      info.owner = response.value();
+      try {
+        info.owner = response.value();
+      } catch (Exception e) {
+        throw asRestApiException("Cannot get owner", e);
+      }
     }
 
-    return info;
+    return Response.ok(info);
   }
 
   public static class ServiceUserInfo extends AccountInfo {
     public AccountInfo createdBy;
     public String createdAt;
-    public Boolean inactive;
     public GroupInfo owner;
 
     public ServiceUserInfo(AccountInfo info) {
@@ -97,6 +108,7 @@
       email = info.email;
       username = info.username;
       avatars = info.avatars;
+      inactive = info.inactive;
     }
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKey.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKey.java
index 00a0968..6c8a008 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKey.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKey.java
@@ -15,6 +15,7 @@
 package com.googlesource.gerrit.plugins.serviceuser;
 
 import com.google.gerrit.extensions.common.SshKeyInfo;
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.gerrit.server.account.AccountResource;
 import com.google.inject.Inject;
@@ -31,7 +32,7 @@
   }
 
   @Override
-  public SshKeyInfo apply(ServiceUserResource.SshKey rsrc) {
+  public Response<SshKeyInfo> apply(ServiceUserResource.SshKey rsrc) {
     return getSshKey.get().apply(new AccountResource.SshKey(rsrc.getUser(), rsrc.getSshKey()));
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java
index 60dfc15..747190c 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java
@@ -16,6 +16,7 @@
 
 import com.google.gerrit.extensions.common.SshKeyInfo;
 import com.google.gerrit.extensions.restapi.AuthException;
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -35,8 +36,8 @@
   }
 
   @Override
-  public List<SshKeyInfo> apply(ServiceUserResource rsrc)
+  public Response<List<SshKeyInfo>> apply(ServiceUserResource rsrc)
       throws AuthException, RepositoryNotFoundException, IOException, ConfigInvalidException {
-    return getSshKeys.get().apply(rsrc.getUser());
+    return Response.ok(getSshKeys.get().apply(rsrc.getUser()));
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ListServiceUsers.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ListServiceUsers.java
index 0b93721..5e77ce2 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ListServiceUsers.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ListServiceUsers.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.USER;
 
 import com.google.common.collect.Maps;
@@ -21,6 +22,7 @@
 import com.google.gerrit.extensions.restapi.AuthException;
 import com.google.gerrit.extensions.restapi.IdString;
 import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.gerrit.server.CurrentUser;
@@ -66,7 +68,7 @@
   }
 
   @Override
-  public Map<String, ServiceUserInfo> apply(ConfigResource rscr)
+  public Response<Map<String, ServiceUserInfo>> apply(ConfigResource rscr)
       throws IOException, RestApiException, PermissionBackendException, ConfigInvalidException {
     ProjectLevelConfig storage = projectCache.getAllProjects().getConfig(pluginName + ".db");
     CurrentUser user = userProvider.get();
@@ -86,16 +88,17 @@
                   .get()
                   .parse(
                       new ConfigResource(),
-                      IdString.fromDecoded(
-                          String.valueOf(account.get().getAccount().getId().get())));
-          info = getServiceUser.get().apply(serviceUserResource);
+                      IdString.fromDecoded(String.valueOf(account.get().account().id().get())));
+          info = getServiceUser.get().apply(serviceUserResource).value();
           info.username = null;
           accounts.put(username, info);
         } catch (ResourceNotFoundException e) {
           // this service user is not visible to the caller -> ignore it
+        } catch (Exception e) {
+          throw asRestApiException("Cannot list service users", e);
         }
       }
     }
-    return accounts;
+    return Response.ok(accounts);
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutConfig.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutConfig.java
index 09a559e..29e7ea7 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutConfig.java
@@ -99,7 +99,7 @@
     }
     if (input.groups != null) {
       for (String g : input.groups) {
-        if (groupCache.get(new AccountGroup.NameKey(g)) == null) {
+        if (groupCache.get(AccountGroup.nameKey(g)) == null) {
           throw new UnprocessableEntityException(String.format("Group %s does not exist.", g));
         }
       }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutEmail.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutEmail.java
index 986b2bb..0fb9269 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutEmail.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutEmail.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
 
 import com.google.common.base.Strings;
@@ -74,12 +75,23 @@
   public Response<?> apply(ServiceUserResource rsrc, Input input)
       throws ConfigInvalidException, EmailException, IOException, PermissionBackendException,
           RestApiException {
-    Boolean emailAllowed = getConfig.get().apply(new ConfigResource()).allowEmail;
+    Boolean emailAllowed;
+    try {
+      emailAllowed = getConfig.get().apply(new ConfigResource()).value().allowEmail;
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get configuration", e);
+    }
     if ((emailAllowed == null || !emailAllowed)) {
       permissionBackend.user(self.get()).check(ADMINISTRATE_SERVER);
     }
 
-    String email = getEmail.get().apply(rsrc);
+    String email;
+    try {
+      email = getEmail.get().apply(rsrc).value();
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get email", e);
+    }
+
     if (Strings.emptyToNull(input.email) == null) {
       if (Strings.emptyToNull(email) == null) {
         return Response.none();
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutHttpPassword.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutHttpPassword.java
index 8d0110a..4ff0525 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutHttpPassword.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutHttpPassword.java
@@ -13,14 +13,13 @@
 // limitations under the License.
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
 import static com.google.gerrit.server.restapi.account.PutHttpPassword.generate;
 
 import com.google.common.base.Strings;
-import com.google.gerrit.extensions.restapi.AuthException;
-import com.google.gerrit.extensions.restapi.ResourceConflictException;
-import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
 import com.google.gerrit.extensions.restapi.Response;
+import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.RestModifyView;
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.config.ConfigResource;
@@ -59,14 +58,20 @@
 
   @Override
   public Response<String> apply(ServiceUserResource rsrc, Input input)
-      throws AuthException, ResourceConflictException, ConfigInvalidException,
-          ResourceNotFoundException, IOException, PermissionBackendException {
+      throws ConfigInvalidException, IOException, PermissionBackendException, RestApiException,
+          RuntimeException {
     if (input == null) {
       input = new Input();
     }
     input.httpPassword = Strings.emptyToNull(input.httpPassword);
 
-    Boolean httpPasswordAllowed = getConfig.get().apply(new ConfigResource()).allowHttpPassword;
+    Boolean httpPasswordAllowed;
+    try {
+      httpPasswordAllowed = getConfig.get().apply(new ConfigResource()).value().allowHttpPassword;
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get configuration", e);
+    }
+
     if (input.generate || input.httpPassword == null) {
       if ((httpPasswordAllowed == null || !httpPasswordAllowed)) {
         permissionBackend.user(self.get()).check(ADMINISTRATE_SERVER);
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutOwner.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutOwner.java
index f444380..7d6e10d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutOwner.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutOwner.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.KEY_OWNER;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.USER;
@@ -88,7 +89,12 @@
   public Response<GroupInfo> apply(ServiceUserResource rsrc, Input input)
       throws RestApiException, IOException, PermissionBackendException {
     ProjectLevelConfig storage = projectCache.getAllProjects().getConfig(pluginName + ".db");
-    Boolean ownerAllowed = getConfig.get().apply(new ConfigResource()).allowOwner;
+    Boolean ownerAllowed;
+    try {
+      ownerAllowed = getConfig.get().apply(new ConfigResource()).value().allowOwner;
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get configuration", e);
+    }
     if ((ownerAllowed == null || !ownerAllowed)) {
       permissionBackend.user(self.get()).check(ADMINISTRATE_SERVER);
     }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/RefUpdateListener.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/RefUpdateListener.java
index c4090ac..f56679d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/RefUpdateListener.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/RefUpdateListener.java
@@ -73,7 +73,7 @@
 
           @Override
           public Project.NameKey getProjectNameKey() {
-            return new Project.NameKey(event.getProjectName());
+            return Project.nameKey(event.getProjectName());
           }
 
           @Override
@@ -99,7 +99,7 @@
   }
 
   private void createServiceUserNotes(Event e) {
-    Project.NameKey projectName = new Project.NameKey(e.getProjectName());
+    Project.NameKey projectName = Project.nameKey(e.getProjectName());
     try (Repository git = repoManager.openRepository(projectName)) {
       CreateServiceUserNotes crn = serviceUserNotesFactory.create(projectName, git);
       crn.createNotes(
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserCollection.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserCollection.java
index 066898f..88bfbde 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserCollection.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserCollection.java
@@ -101,7 +101,7 @@
         }
       } else if (!((IdentifiedUser) user)
           .getAccountId()
-          .equals(new Account.Id(storage.get().getInt(USER, username, KEY_CREATOR_ID, -1)))) {
+          .equals(Account.id(storage.get().getInt(USER, username, KEY_CREATOR_ID, -1)))) {
         throw new ResourceNotFoundException(id);
       }
     }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResolver.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResolver.java
index e2f16a6..4158e82 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResolver.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResolver.java
@@ -14,9 +14,10 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
+
 import com.google.gerrit.common.data.GroupDescription;
 import com.google.gerrit.extensions.common.AccountInfo;
-import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
 import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.reviewdb.client.Account;
@@ -31,7 +32,6 @@
 import com.google.gerrit.server.account.GroupMembership;
 import com.google.gerrit.server.group.GroupResolver;
 import com.google.gerrit.server.group.GroupResource;
-import com.google.gerrit.server.permissions.PermissionBackendException;
 import com.google.gerrit.server.restapi.group.ListMembers;
 import com.google.gerrit.server.util.RequestContext;
 import com.google.gerrit.server.util.ThreadLocalRequestContext;
@@ -39,13 +39,11 @@
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
 import com.googlesource.gerrit.plugins.serviceuser.GetServiceUser.ServiceUserInfo;
-import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 import java.util.Set;
-import org.eclipse.jgit.errors.ConfigInvalidException;
 import org.eclipse.jgit.lib.PersonIdent;
 
 @Singleton
@@ -79,8 +77,7 @@
     this.groupResolver = groupResolver;
   }
 
-  ServiceUserInfo getAsServiceUser(PersonIdent committerIdent)
-      throws ConfigInvalidException, IOException, PermissionBackendException, RestApiException {
+  ServiceUserInfo getAsServiceUser(PersonIdent committerIdent) throws RestApiException {
     StringBuilder committer = new StringBuilder();
     committer.append(committerIdent.getName());
     committer.append(" <");
@@ -88,17 +85,20 @@
     committer.append("> ");
 
     try {
-      Account account = resolver.resolve(committer.toString()).asUnique().getAccount();
+      Account account = resolver.resolve(committer.toString()).asUnique().account();
       return getServiceUser
           .get()
-          .apply(new ServiceUserResource(genericUserFactory.create(account.getId())));
+          .apply(new ServiceUserResource(genericUserFactory.create(account.id())))
+          .value();
     } catch (ResourceNotFoundException | UnresolvableAccountException e) {
       return null;
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get service user", e);
     }
   }
 
   List<AccountInfo> listOwners(ServiceUserInfo serviceUser)
-      throws MethodNotAllowedException, PermissionBackendException {
+      throws RestApiException, RuntimeException {
     if (serviceUser.owner == null) {
       return Collections.emptyList();
     }
@@ -149,8 +149,12 @@
       GroupResource rsrc = new GroupResource(ctl);
       lm.setRecursive(true);
       List<AccountInfo> owners = new ArrayList<>();
-      for (AccountInfo a : lm.apply(rsrc)) {
-        owners.add(a);
+      try {
+        for (AccountInfo a : lm.apply(rsrc).value()) {
+          owners.add(a);
+        }
+      } catch (Exception e) {
+        throw asRestApiException("Cannot list group members", e);
       }
       return owners;
     } finally {
@@ -159,11 +163,11 @@
   }
 
   List<AccountInfo> listActiveOwners(ServiceUserInfo serviceUser)
-      throws MethodNotAllowedException, PermissionBackendException {
+      throws RestApiException, RuntimeException {
     List<AccountInfo> activeOwners = new ArrayList<>();
     for (AccountInfo owner : listOwners(serviceUser)) {
-      Optional<AccountState> accountState = accountCache.get(new Account.Id(owner._accountId));
-      if (accountState.isPresent() && accountState.get().getAccount().isActive()) {
+      Optional<AccountState> accountState = accountCache.get(Account.id(owner._accountId));
+      if (accountState.isPresent() && accountState.get().account().isActive()) {
         activeOwners.add(owner);
       }
     }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ValidateServiceUserCommits.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ValidateServiceUserCommits.java
index d8c2176..e4d031b 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ValidateServiceUserCommits.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ValidateServiceUserCommits.java
@@ -22,15 +22,12 @@
 import com.google.gerrit.server.git.validators.CommitValidationException;
 import com.google.gerrit.server.git.validators.CommitValidationListener;
 import com.google.gerrit.server.git.validators.CommitValidationMessage;
-import com.google.gerrit.server.permissions.PermissionBackendException;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import com.googlesource.gerrit.plugins.serviceuser.GetServiceUser.ServiceUserInfo;
-import java.io.IOException;
 import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
-import org.eclipse.jgit.errors.ConfigInvalidException;
 import org.eclipse.jgit.lib.PersonIdent;
 
 @Singleton
@@ -62,8 +59,8 @@
                   committer.getEmailAddress()));
         }
         Optional<AccountState> creator =
-            accountCache.get(new Account.Id(serviceUser.createdBy._accountId));
-        if (!creator.isPresent() || !creator.get().getAccount().isActive()) {
+            accountCache.get(Account.id(serviceUser.createdBy._accountId));
+        if (!creator.isPresent() || !creator.get().account().isActive()) {
           throw new CommitValidationException(
               String.format(
                   "Commit %s of service user %s (%s) is rejected because "
@@ -73,10 +70,7 @@
                   committer.getEmailAddress()));
         }
       }
-    } catch (IOException
-        | ConfigInvalidException
-        | PermissionBackendException
-        | RestApiException e) {
+    } catch (RestApiException e) {
       throw new CommitValidationException(
           "Internal error while checking for service user commits.", e);
     }