diff --git a/crates/app/src/routes/api/v1/journal/entries.rs b/crates/app/src/routes/api/v1/journal/entries.rs
new file mode 100644
index 0000000..2e87d0a
--- /dev/null
+++ b/crates/app/src/routes/api/v1/journal/entries.rs
@@ -0,0 +1,75 @@
+use axum::{Extension, Json, extract::Path, response::IntoResponse};
+use axum_extra::extract::CookieJar;
+use tetratto_core::model::{ApiReturn, Error, journal::JournalEntry};
+
+use crate::{
+    State, get_user_from_token,
+    routes::api::v1::{CreateJournalEntry, UpdateJournalEntryContent},
+};
+
+pub async fn create_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Json(req): Json<CreateJournalEntry>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data
+        .create_entry(JournalEntry::new(req.content, req.journal, user.id))
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Entry created".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
+
+pub async fn delete_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data.delete_entry(id, user).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Entry deleted".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
+
+pub async fn update_content_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(req): Json<UpdateJournalEntryContent>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data.update_entry_content(id, user, req.content).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Entry updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
diff --git a/crates/app/src/routes/api/v1/journal/mod.rs b/crates/app/src/routes/api/v1/journal/mod.rs
new file mode 100644
index 0000000..dd2f7f4
--- /dev/null
+++ b/crates/app/src/routes/api/v1/journal/mod.rs
@@ -0,0 +1,2 @@
+pub mod entries;
+pub mod pages;
diff --git a/crates/app/src/routes/api/v1/journal/pages.rs b/crates/app/src/routes/api/v1/journal/pages.rs
new file mode 100644
index 0000000..744a9de
--- /dev/null
+++ b/crates/app/src/routes/api/v1/journal/pages.rs
@@ -0,0 +1,144 @@
+use axum::{Extension, Json, extract::Path, response::IntoResponse};
+use axum_extra::extract::CookieJar;
+use tetratto_core::model::{ApiReturn, Error, journal::JournalPage};
+
+use crate::{
+    State, get_user_from_token,
+    routes::api::v1::{
+        CreateJournalPage, UpdateJournalPagePrompt, UpdateJournalPageReadAccess,
+        UpdateJournalPageTitle, UpdateJournalPageWriteAccess,
+    },
+};
+
+pub async fn create_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Json(req): Json<CreateJournalPage>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data
+        .create_page(JournalPage::new(req.title, req.prompt, user.id))
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Page created".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
+
+pub async fn delete_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data.delete_page(id, user).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Page deleted".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
+
+pub async fn update_title_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(req): Json<UpdateJournalPageTitle>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data.update_page_title(id, user, req.title).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Page updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
+
+pub async fn update_prompt_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(req): Json<UpdateJournalPagePrompt>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data.update_page_prompt(id, user, req.prompt).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Page updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
+
+pub async fn update_read_access_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(req): Json<UpdateJournalPageReadAccess>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data.update_page_read_access(id, user, req.access).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Page updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
+
+pub async fn update_write_access_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(req): Json<UpdateJournalPageWriteAccess>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data.update_page_write_access(id, user, req.access).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Page updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => return Json(e.into()),
+    }
+}
diff --git a/crates/app/src/routes/api/v1/mod.rs b/crates/app/src/routes/api/v1/mod.rs
index 1952bc0..977b013 100644
--- a/crates/app/src/routes/api/v1/mod.rs
+++ b/crates/app/src/routes/api/v1/mod.rs
@@ -1,12 +1,41 @@
 pub mod auth;
+pub mod journal;
+
 use axum::{
     Router,
-    routing::{get, post},
+    routing::{delete, get, post},
 };
 use serde::Deserialize;
+use tetratto_core::model::journal::{JournalPageReadAccess, JournalPageWriteAccess};
 
 pub fn routes() -> Router {
     Router::new()
+        // journal pages
+        .route("/pages", post(journal::pages::create_request))
+        .route("/pages/{id}", delete(journal::pages::delete_request))
+        .route(
+            "/pages/{id}/title",
+            post(journal::pages::update_title_request),
+        )
+        .route(
+            "/pages/{id}/prompt",
+            post(journal::pages::update_prompt_request),
+        )
+        .route(
+            "/pages/{id}/access/read",
+            post(journal::pages::update_read_access_request),
+        )
+        .route(
+            "/pages/{id}/access/write",
+            post(journal::pages::update_write_access_request),
+        )
+        // journal entries
+        .route("/entries", post(journal::entries::create_request))
+        .route("/entries/{id}", delete(journal::entries::delete_request))
+        .route(
+            "/entries/{id}/content",
+            post(journal::entries::update_content_request),
+        )
         // auth
         // global
         .route("/auth/register", post(auth::register_request))
@@ -36,3 +65,40 @@ pub struct AuthProps {
     pub username: String,
     pub password: String,
 }
+
+#[derive(Deserialize)]
+pub struct CreateJournalPage {
+    pub title: String,
+    pub prompt: String,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateJournalPageTitle {
+    pub title: String,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateJournalPagePrompt {
+    pub prompt: String,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateJournalPageReadAccess {
+    pub access: JournalPageReadAccess,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateJournalPageWriteAccess {
+    pub access: JournalPageWriteAccess,
+}
+
+#[derive(Deserialize)]
+pub struct CreateJournalEntry {
+    pub content: String,
+    pub journal: usize,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateJournalEntryContent {
+    pub content: String,
+}
diff --git a/crates/core/src/database/entries.rs b/crates/core/src/database/entries.rs
new file mode 100644
index 0000000..6b6807a
--- /dev/null
+++ b/crates/core/src/database/entries.rs
@@ -0,0 +1,69 @@
+use super::*;
+use crate::cache::Cache;
+use crate::model::auth::User;
+use crate::model::{Error, Result, journal::JournalEntry, permissions::FinePermission};
+use crate::{auto_method, execute, get, query_row};
+
+#[cfg(feature = "sqlite")]
+use rusqlite::Row;
+
+#[cfg(feature = "postgres")]
+use tokio_postgres::Row;
+
+impl DataManager {
+    /// Get a [`JournalEntry`] from an SQL row.
+    pub(crate) fn get_entry_from_row(
+        #[cfg(feature = "sqlite")] x: &Row<'_>,
+        #[cfg(feature = "postgres")] x: &Row,
+    ) -> JournalEntry {
+        JournalEntry {
+            id: get!(x->0(u64)) as usize,
+            created: get!(x->1(u64)) as usize,
+            content: get!(x->2(String)),
+            owner: get!(x->3(u64)) as usize,
+            journal: get!(x->4(u64)) as usize,
+        }
+    }
+
+    auto_method!(get_entry_by_id()@get_entry_from_row -> "SELECT * FROM entries WHERE id = $1" --name="journal entry" --returns=JournalEntry --cache-key-tmpl="atto.entry:{}");
+
+    /// Create a new journal entry in the database.
+    ///
+    /// # Arguments
+    /// * `data` - a mock [`JournalEntry`] object to insert
+    pub async fn create_entry(&self, data: JournalEntry) -> Result<()> {
+        // check values
+        if data.content.len() < 2 {
+            return Err(Error::DataTooShort("content".to_string()));
+        } else if data.content.len() > 4096 {
+            return Err(Error::DataTooLong("username".to_string()));
+        }
+
+        // ...
+        let conn = match self.connect().await {
+            Ok(c) => c,
+            Err(e) => return Err(Error::DatabaseConnection(e.to_string())),
+        };
+
+        let res = execute!(
+            &conn,
+            "INSERT INTO entries VALUES ($1, $2, $3, $4, $5",
+            &[
+                &data.id.to_string().as_str(),
+                &data.created.to_string().as_str(),
+                &data.content.as_str(),
+                &data.owner.to_string().as_str(),
+                &data.journal.to_string().as_str(),
+            ]
+        );
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        Ok(())
+    }
+
+    auto_method!(delete_entry()@get_entry_by_id:MANAGE_JOURNAL_ENTRIES -> "DELETE FROM entries WHERE id = $1" --cache-key-tmpl="atto.entry:{}");
+    auto_method!(update_entry_content(String)@get_entry_by_id:MANAGE_JOURNAL_ENTRIES -> "UPDATE entries SET content = $1 WHERE id = $2" --cache-key-tmpl="atto.entry:{}");
+}
diff --git a/crates/core/src/database/mod.rs b/crates/core/src/database/mod.rs
index eef7761..2b8552d 100644
--- a/crates/core/src/database/mod.rs
+++ b/crates/core/src/database/mod.rs
@@ -1,6 +1,7 @@
 mod auth;
 mod common;
 mod drivers;
+mod entries;
 mod pages;
 
 #[cfg(feature = "sqlite")]
diff --git a/crates/core/src/database/pages.rs b/crates/core/src/database/pages.rs
index d57023a..2c13830 100644
--- a/crates/core/src/database/pages.rs
+++ b/crates/core/src/database/pages.rs
@@ -1,6 +1,7 @@
 use super::*;
 use crate::cache::Cache;
 use crate::model::auth::User;
+use crate::model::journal::{JournalPageReadAccess, JournalPageWriteAccess};
 use crate::model::{Error, Result, journal::JournalPage, permissions::FinePermission};
 use crate::{auto_method, execute, get, query_row};
 
@@ -34,15 +35,11 @@ impl DataManager {
     /// # Arguments
     /// * `data` - a mock [`JournalPage`] object to insert
     pub async fn create_page(&self, data: JournalPage) -> Result<()> {
-        if self.0.security.registration_enabled == false {
-            return Err(Error::RegistrationDisabled);
-        }
-
         // check values
         if data.title.len() < 2 {
             return Err(Error::DataTooShort("title".to_string()));
         } else if data.title.len() > 32 {
-            return Err(Error::DataTooLong("username".to_string()));
+            return Err(Error::DataTooLong("title".to_string()));
         }
 
         if data.prompt.len() < 2 {
@@ -81,6 +78,6 @@ impl DataManager {
     auto_method!(delete_page()@get_page_by_id:MANAGE_JOURNAL_PAGES -> "DELETE FROM pages WHERE id = $1" --cache-key-tmpl="atto.page:{}");
     auto_method!(update_page_title(String)@get_page_by_id:MANAGE_JOURNAL_PAGES -> "UPDATE pages SET title = $1 WHERE id = $2" --cache-key-tmpl="atto.page:{}");
     auto_method!(update_page_prompt(String)@get_page_by_id:MANAGE_JOURNAL_PAGES -> "UPDATE pages SET prompt = $1 WHERE id = $2" --cache-key-tmpl="atto.page:{}");
-    auto_method!(update_page_read_access(String)@get_page_by_id:MANAGE_JOURNAL_PAGES -> "UPDATE pages SET read_access = $1 WHERE id = $2" --serde --cache-key-tmpl="atto.page:{}");
-    auto_method!(update_page_write_access(String)@get_page_by_id:MANAGE_JOURNAL_PAGES -> "UPDATE pages SET write_access = $1 WHERE id = $2" --serde --cache-key-tmpl="atto.page:{}");
+    auto_method!(update_page_read_access(JournalPageReadAccess)@get_page_by_id:MANAGE_JOURNAL_PAGES -> "UPDATE pages SET read_access = $1 WHERE id = $2" --serde --cache-key-tmpl="atto.page:{}");
+    auto_method!(update_page_write_access(JournalPageWriteAccess)@get_page_by_id:MANAGE_JOURNAL_PAGES -> "UPDATE pages SET write_access = $1 WHERE id = $2" --serde --cache-key-tmpl="atto.page:{}");
 }
diff --git a/crates/core/src/model/journal.rs b/crates/core/src/model/journal.rs
index 480aec8..ab67981 100644
--- a/crates/core/src/model/journal.rs
+++ b/crates/core/src/model/journal.rs
@@ -69,3 +69,30 @@ impl Default for JournalPageWriteAccess {
         Self::Authenticated
     }
 }
+
+#[derive(Serialize, Deserialize)]
+pub struct JournalEntry {
+    pub id: usize,
+    pub created: usize,
+    pub content: String,
+    /// The ID of the owner of this entry.
+    pub owner: usize,
+    /// The ID of the [`JournalPage`] this entry belongs to.
+    pub journal: usize,
+}
+
+impl JournalEntry {
+    /// Create a new [`JournalEntry`].
+    pub fn new(content: String, journal: usize, owner: usize) -> Self {
+        Self {
+            id: AlmostSnowflake::new(1234567890)
+                .to_string()
+                .parse::<usize>()
+                .unwrap(),
+            created: unix_epoch_timestamp() as usize,
+            content,
+            owner,
+            journal,
+        }
+    }
+}