diff --git a/modoboa/admin/api.py b/modoboa/admin/api.py
index b3295152f..3ca68504b 100644
--- a/modoboa/admin/api.py
+++ b/modoboa/admin/api.py
@@ -61,7 +61,6 @@ class AccountViewSet(viewsets.ModelViewSet):
     """ViewSet for User/Mailbox."""
 
     filter_backends = [filters.SearchFilter]
-    http_method_names = ["get", "post", "put", "delete"]
     permission_classes = [IsAuthenticated, DjangoModelPermissions, ]
     search_fields = ("^first_name", "^last_name", "^email")
 
diff --git a/modoboa/admin/models/mailbox.py b/modoboa/admin/models/mailbox.py
index 610157536..696d63d2f 100644
--- a/modoboa/admin/models/mailbox.py
+++ b/modoboa/admin/models/mailbox.py
@@ -318,12 +318,13 @@ class Mailbox(AdminObject):
                 raise lib_exceptions.PermDeniedException
         if "use_domain_quota" in values:
             self.use_domain_quota = values["use_domain_quota"]
-        override_rules = (
-            not self.quota or user.is_superuser or
-            user.has_perm("admin.add_domain") and
-            not user.userobjectlimit_set.get(name="quota").max_value
-        )
-        self.set_quota(values["quota"], override_rules)
+        if "use_domain_quota" in values or "quota" in values:
+            override_rules = (
+                not self.quota or user.is_superuser or
+                user.has_perm("admin.add_domain") and
+                not user.userobjectlimit_set.get(name="quota").max_value
+            )
+            self.set_quota(values["quota"], override_rules)
         if newaddress:
             self.rename(local_part, domain)
         self.save()
diff --git a/modoboa/admin/serializers.py b/modoboa/admin/serializers.py
index ccddf4e58..8deeccae2 100644
--- a/modoboa/admin/serializers.py
+++ b/modoboa/admin/serializers.py
@@ -227,14 +227,16 @@ class WritableAccountSerializer(AccountSerializer):
         if role == "SimpleUsers":
             mailbox = data.get("mailbox")
             if mailbox is None:
-                data["mailbox"] = {
-                    "full_address": data["username"], "use_domain_quota": True
-                }
+                if not self.instance:
+                    data["mailbox"] = {
+                        "full_address": data["username"],
+                        "use_domain_quota": True
+                    }
             elif mailbox["full_address"] != data["username"]:
                 raise serializers.ValidationError({
                     "username": _("Must be equal to mailbox full_address")
                 })
-        if not data["random_password"]:
+        if not data.get("random_password"):
             password = data.get("password")
             if password:
                 try:
@@ -333,15 +335,17 @@ class WritableAccountSerializer(AccountSerializer):
             setattr(instance, key, value)
         if password:
             instance.set_password(password)
-        instance.save()
         if mailbox_data:
             creator = self.context["request"].user
             if instance.mailbox:
-                # FIXME: compat, to remove ASAP.
-                mailbox_data["email"] = mailbox_data["full_address"]
+                if "full_address" in mailbox_data:
+                    # FIXME: compat, to remove ASAP.
+                    mailbox_data["email"] = mailbox_data["full_address"]
+                    instance.email = mailbox_data["full_address"]
                 instance.mailbox.update_from_dict(creator, mailbox_data)
             else:
                 self._create_mailbox(creator, instance, mailbox_data)
+        instance.save()
         self.set_permissions(instance, domains)
         return instance
 
diff --git a/modoboa/admin/tests/test_api.py b/modoboa/admin/tests/test_api.py
index 51d82b6c0..235d6461c 100644
--- a/modoboa/admin/tests/test_api.py
+++ b/modoboa/admin/tests/test_api.py
@@ -444,6 +444,7 @@ class AccountAPITestCase(ModoAPITestCase):
         response = self.client.put(url, data, format="json")
         self.assertEqual(response.status_code, 200)
         account.refresh_from_db()
+        account.mailbox.refresh_from_db()
         self.assertEqual(account.email, account.mailbox.full_address)
         self.assertTrue(account.check_password("Toto1234"))
 
@@ -469,6 +470,7 @@ class AccountAPITestCase(ModoAPITestCase):
     def test_patch_account(self):
         """Try to patch an account."""
         account = core_models.User.objects.get(username="user@test.com")
+        old_quota = account.mailbox.quota
         url = reverse("api:account-detail", args=[account.pk])
         data = {
             "username": "fromapi@test.com",
@@ -477,7 +479,10 @@ class AccountAPITestCase(ModoAPITestCase):
             }
         }
         response = self.client.patch(url, data, format="json")
-        self.assertEqual(response.status_code, 405)
+        self.assertEqual(response.status_code, 200)
+        account.refresh_from_db()
+        self.assertEqual(account.email, data["username"])
+        self.assertEqual(account.mailbox.quota, old_quota)
 
     def test_update_domain_admin_account(self):
         """Try to change administered domains."""