diff --git a/src/core.rs b/src/core.rs
index a0fa1a3..c4ec6f9 100644
--- a/src/core.rs
+++ b/src/core.rs
@@ -61,6 +61,11 @@ impl Core {
         }
     }
 
+    pub async fn get_reviews(&self, app_name_id: &String) -> Vec<Document> {
+        self.get_collection_with_params(&self.reviews, doc! {"app_name_id":app_name_id})
+            .await
+    }
+
     pub async fn write_review(&self, name: &String, info: &Json<ReviewData>) -> serde_json::Value {
         let options = FindOneOptions::builder()
             .projection(doc! {"_id" : 1})
@@ -313,6 +318,21 @@ impl Core {
         let hash = hasher.finalize();
         format!("{:x}", hash)
     }
+
+    async fn get_collection_with_params(
+        &self,
+        collection: &Collection<Document>,
+        params: Document,
+    ) -> Vec<Document> {
+        let options = FindOptions::builder().projection(doc! {"_id" : 0}).build();
+        let cursor = match collection.find(params, options).await {
+            Ok(cursor) => cursor,
+            Err(_) => return vec![],
+        };
+
+        cursor.try_collect().await.unwrap_or_else(|_| vec![])
+    }
+
     async fn get_collection(&self, collection: &Collection<Document>) -> Vec<Document> {
         let options = FindOptions::builder().projection(doc! {"_id" : 0}).build();
         let cursor = match collection.find(None, options).await {
diff --git a/src/main.rs b/src/main.rs
index 35527c2..253e4bd 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -82,6 +82,7 @@ async fn main() -> std::io::Result<()> {
                     .wrap(HttpAuthentication::bearer(jwt_validator))
                     .service(routes::apps)
                     .service(routes::app)
+                    .service(routes::reviews)
                     .service(routes::update)
                     .service(routes::change_password)
                     .service(routes::write_review),
diff --git a/src/routes.rs b/src/routes.rs
index a78b6bf..50d9945 100644
--- a/src/routes.rs
+++ b/src/routes.rs
@@ -65,6 +65,22 @@ pub async fn update(
             .await,
     )
 }
+
+#[post("/write_review")]
+#[has_any_permission("user", "admin")]
+pub async fn write_review(
+    app_data: web::Data<crate::AppState>,
+    review_data: web::Json<ReviewData>,
+    req: HttpRequest,
+) -> impl Responder {
+    response(
+        app_data
+            .core
+            .write_review(&username(req), &review_data)
+            .await,
+    )
+}
+
 fn username(req: HttpRequest) -> String {
     req.headers()
         .get("osma-username")