diff --git a/jupyterhub/apihandlers/users.py b/jupyterhub/apihandlers/users.py
index 50c37965..2e65bb75 100644
--- a/jupyterhub/apihandlers/users.py
+++ b/jupyterhub/apihandlers/users.py
@@ -88,8 +88,10 @@ class UserAPIHandler(BaseUserHandler):
         try:
             self.authenticator.add_user(user)
         except Exception:
+            self.log.error("Failed to create user: %s" % name, exc_info=True)
             self.db.delete(user)
             self.db.commit()
+            raise web.HTTPError(400, "Failed to create user: %s" % name)
         
         self.write(json.dumps(self.user_model(user)))
         self.set_status(201)
diff --git a/jupyterhub/tests/mocking.py b/jupyterhub/tests/mocking.py
index d576481b..7f844a51 100644
--- a/jupyterhub/tests/mocking.py
+++ b/jupyterhub/tests/mocking.py
@@ -48,7 +48,7 @@ class MockSpawner(LocalProcessSpawner):
 class MockPAMAuthenticator(PAMAuthenticator):
     def system_user_exists(self, user):
         # skip the add-system-user bit
-        return True
+        return not user.name.startswith('dne')
     
     def authenticate(self, *args, **kwargs):
         with mock.patch('simplepam.authenticate', mock_authenticate):
diff --git a/jupyterhub/tests/test_api.py b/jupyterhub/tests/test_api.py
index be0cd98b..b4c18404 100644
--- a/jupyterhub/tests/test_api.py
+++ b/jupyterhub/tests/test_api.py
@@ -102,6 +102,14 @@ def test_add_user(app):
     assert user.name == name
     assert not user.admin
 
+def test_add_user_bad(app):
+    db = app.db
+    name = 'dne_newuser'
+    r = api_request(app, 'users', name, method='post')
+    assert r.status_code == 400
+    user = find_user(db, name)
+    assert user is None
+
 def test_add_admin(app):
     db = app.db
     name = 'newadmin'