diff --git a/api/http/test.http b/api/http/test.http
new file mode 100644
index 0000000..c75f3f6
--- /dev/null
+++ b/api/http/test.http
@@ -0,0 +1,14 @@
+# Register a new user
+POST http://localhost:8081/login
+Content-Type: application/json
+
+{
+  "username": "hubert",
+  "password": "test"
+}
+
+> {% client.global.set("token", response.body.token); %}
+
+### Get notes
+GET http://localhost:8081/notes
+Authorization: Bearer {{token}}
\ No newline at end of file
diff --git a/api/src/controllers/AuthCrudController.kt b/api/src/controllers/AuthCrudController.kt
index 794057c..ba57567 100644
--- a/api/src/controllers/AuthCrudController.kt
+++ b/api/src/controllers/AuthCrudController.kt
@@ -2,6 +2,7 @@ package be.vandewalleh.controllers
 
 import io.ktor.application.ApplicationCall
 import io.ktor.auth.UserIdPrincipal
+import io.ktor.auth.authenticate
 import io.ktor.auth.principal
 import io.ktor.routing.Route
 import io.ktor.routing.Routing
@@ -20,8 +21,10 @@ abstract class AuthCrudController(
         this.principal<UserIdPrincipal>()!!.name
 
     override fun Routing.registerRoutes() {
-        route(path) {
-            route()
+        authenticate {
+            route(path) {
+                route()
+            }
         }
     }
 }
diff --git a/api/src/controllers/NotesController.kt b/api/src/controllers/NotesController.kt
index d51f83a..99dc7ec 100644
--- a/api/src/controllers/NotesController.kt
+++ b/api/src/controllers/NotesController.kt
@@ -1,25 +1,59 @@
 package be.vandewalleh.controllers
 
+import be.vandewalleh.tables.Notes
+import be.vandewalleh.tables.Tags
 import be.vandewalleh.tables.Users
 import io.ktor.application.call
 import io.ktor.response.respond
+import io.ktor.response.respondText
 import io.ktor.routing.Route
 import io.ktor.routing.get
 import me.liuwj.ktorm.database.Database
-import me.liuwj.ktorm.dsl.eq
-import me.liuwj.ktorm.entity.find
-import me.liuwj.ktorm.entity.sequenceOf
+import me.liuwj.ktorm.dsl.*
 import org.kodein.di.Kodein
 import org.kodein.di.generic.instance
+import java.time.LocalDateTime
+import java.time.format.DateTimeFormatter
 
 class NotesController(kodein: Kodein) : AuthCrudController("/notes", kodein) {
     private val db by kodein.instance<Database>()
 
+    private class ResponseItem(val title: String, val tags: List<String>, val updatedAt: String)
+
     override val route: Route.() -> Unit = {
         get {
             val email = call.userEmail()
-            val user = db.sequenceOf(Users).find { it.email eq email }!! // TODO
 
+            val list = db.from(Notes)
+                .leftJoin(Users, on = Users.id eq Notes.userId)
+                .select(Notes.id, Notes.title, Notes.updatedAt)
+                .where { Users.email eq email }
+                .orderBy(Notes.updatedAt.desc())
+                .map { row ->
+                    Notes.createEntity(row)
+                }
+                .toList()
+
+            val response = mutableListOf<ResponseItem>()
+
+            list.forEach { note ->
+                val tags = db.from(Tags)
+                    .select(Tags.name)
+                    .where { Tags.noteId eq note.id }
+                    .map { it[Tags.name]!! }
+                    .toList()
+
+                val updatedAt = DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(note.updatedAt)
+
+                val item = ResponseItem(
+                    title = note.title,
+                    tags = tags,
+                    updatedAt = updatedAt
+                )
+                response += item
+            }
+
+            call.respond(response)
         }
     }
 }
diff --git a/api/src/entities/Note.kt b/api/src/entities/Note.kt
index c91e421..877fff3 100644
--- a/api/src/entities/Note.kt
+++ b/api/src/entities/Note.kt
@@ -9,5 +9,5 @@ interface Note : Entity<Note> {
     val id: Int
     var title: String
     var user: User
-    var updatedAt: LocalDateTime?
+    var updatedAt: LocalDateTime
 }
\ No newline at end of file
diff --git a/api/src/tables/Chapters.kt b/api/src/tables/Chapters.kt
index d02dae0..a8d7c8f 100644
--- a/api/src/tables/Chapters.kt
+++ b/api/src/tables/Chapters.kt
@@ -12,4 +12,5 @@ object Chapters : Table<Chapter>("Chapters") {
     val number by int("number").bindTo { it.number }
     val content by text("content").bindTo { it.content }
     val noteId by int("note_id").references(Notes) { it.note }
+    val note get() = noteId.referenceTable as Notes
 }
\ No newline at end of file
diff --git a/api/src/tables/Notes.kt b/api/src/tables/Notes.kt
index 822faef..000dd9f 100644
--- a/api/src/tables/Notes.kt
+++ b/api/src/tables/Notes.kt
@@ -6,6 +6,7 @@ import me.liuwj.ktorm.schema.*
 object Notes : Table<Note>("Notes") {
     val id by int("id").primaryKey().bindTo { it.id }
     val title by varchar("title").bindTo { it.title }
-    val user by int("user_id").references(Users) { it.user }
-    val updatedAt by datetime("last_viewed").bindTo { it.updatedAt }
+    val userId by int("user_id").references(Users) { it.user }
+    val updatedAt by datetime("updated_at").bindTo { it.updatedAt }
+    val user get() = userId.referenceTable as Users
 }
\ No newline at end of file
diff --git a/api/src/tables/Tags.kt b/api/src/tables/Tags.kt
index 3cb4cf2..309291c 100644
--- a/api/src/tables/Tags.kt
+++ b/api/src/tables/Tags.kt
@@ -9,4 +9,5 @@ object Tags : Table<Tag>("Tags") {
     val id by int("id").primaryKey().bindTo { it.id }
     val name by varchar("name").bindTo { it.name }
     val noteId by int("note_id").references(Notes) { it.note }
+    val note get() = noteId.referenceTable as Notes
 }
\ No newline at end of file