diff --git a/unwind/web.py b/unwind/web.py
index c1cd0db..67370dd 100644
--- a/unwind/web.py
+++ b/unwind/web.py
@@ -108,6 +108,22 @@ def as_ulid(s: str) -> ULID:
         raise HTTPException(422, "Not a valid ULID.")
 
 
+_routes = []
+
+
+def route(path: str, *, methods: list[str] = None, **kwds):
+    def decorator(func):
+        r = Route(path, func, methods=methods, **kwds)
+        _routes.append(r)
+        return func
+
+    return decorator
+
+
+route.registered = _routes
+
+
+@route("/groups/{group_id}/ratings")
 async def get_ratings_for_group(request):
     group_id = as_ulid(request.path_params["group_id"])
     group = await db.get(Group, id=str(group_id))
@@ -163,6 +179,8 @@ def not_found(reason: str = "Not Found"):
     return JSONResponse({"error": reason}, status_code=404)
 
 
+@route("/movies")
+@requires(["private"])
 async def get_movies(request):
     imdb_id = request.query_params.get("imdb_id")
 
@@ -172,31 +190,38 @@ async def get_movies(request):
     return JSONResponse(resp)
 
 
+@route("/movies", methods=["POST"])
 @requires(["authenticated", "admin"])
 async def add_movie(request):
     pass
 
 
+@route("/users")
 @requires(["authenticated", "admin"])
 async def list_users(request):
     users = await db.get_all(User)
     return JSONResponse([asplain(u) for u in users])
 
 
+@route("/users", methods=["POST"])
 @requires(["authenticated", "admin"])
 async def add_user(request):
     pass
 
 
+@route("/users/{user_id}/ratings")
+@requires(["private"])
 async def ratings_for_user(request):
     request.path_params["user_id"]
 
 
+@route("/users/{user_id}/ratings", methods=["PUT"])
 @requires("authenticated")
 async def set_rating_for_user(request):
     request.path_params["user_id"]
 
 
+@route("/groups", methods=["POST"])
 @requires(["authenticated", "admin"])
 async def add_group(request):
     if not await request.body():
@@ -227,6 +252,7 @@ async def add_group(request):
     )
 
 
+@route("/groups/{group_id}/users", methods=["POST"])
 @requires(["authenticated"])
 async def add_user_to_group(request):
     group_id = as_ulid(request.path_params["group_id"])
@@ -289,24 +315,7 @@ def create_app():
         on_startup=[open_connection_pool],
         on_shutdown=[close_connection_pool],
         routes=[
-            Mount(
-                "/api/v1",
-                routes=[
-                    Route("/movies", get_movies),
-                    Route("/movies", add_movie, methods=["POST"]),
-                    Route("/users", list_users),
-                    Route("/users", add_user, methods=["POST"]),
-                    Route("/users/{user_id}/ratings", ratings_for_user),
-                    Route(
-                        "/users/{user_id}/ratings", set_rating_for_user, methods=["PUT"]
-                    ),
-                    Route("/groups", add_group, methods=["POST"]),
-                    Route(
-                        "/groups/{group_id}/users", add_user_to_group, methods=["POST"]
-                    ),
-                    Route("/groups/{group_id}/ratings", get_ratings_for_group),
-                ],
-            ),
+            Mount("/api/v1", routes=route.registered),
         ],
         middleware=[
             Middleware(ResponseTimeMiddleware, header_name="Unwind-Elapsed"),