         else
           resp.send 200, success: 'ok'
 
-app.get '/api/:user/sshkeys/?', (req, resp) ->
+listSSHKeys = (req, resp) ->
   User.findByShortName req.user.effective.shortName, (err, user) ->
     resp.send 200, user.sshKeys
 
+app.all '*', ensureAuthenticated
+
+app.get '/logout', logout
+
+# API!
+app.get '/api/tools/?', listTools
+app.post '/api/tools/?', postTool
+
+app.put '/api/user/?', updateUser
+
+app.get '/api/:user/datasets/?', checkThisIsMyDataHub, listDatasets
+# :todo: should :user be part of the dataset URL?
+app.get '/api/:user/datasets/:id/?', checkThisIsMyDataHub, getDataset
+app.get '/api/:user/datasets/:id/views/?', checkThisIsMyDataHub, listViews
+app.put '/api/:user/datasets/:id/?', checkThisIsMyDataHub, updateDataset
+app.post '/api/:user/datasets/?', checkThisIsMyDataHub, addDataset
+app.post '/api/:user/datasets/:dataset/views/?', checkThisIsMyDataHub, addView
+
+# Search for user api is staff-only for now.
+app.get '/api/user/?', checkStaff, listUsers
+
+app.post '/api/:user/sshkeys/?', addSSHKey
+app.get '/api/:user/sshkeys/?', listSSHKeys
+
 # Catch all other routes, send to client app
 app.get '*', renderClientApp
 
-# Define Port
 port = process.env.CU_PORT or 3001
 
 if existsSync(port)

        getSessionUser u
      return resp.send 200, result

app.post '/api/:user/sshkeys/?', (req, resp) ->
  User.findByShortName req.user.effective.shortName, (err, user) ->
    if not req.body.key?
      return resp.send 400, error: 'Specify key'

    else
      return resp.json 201, user

postStatus = (req, resp) ->
  console.log "POST /api/status/ from ident #{req.ident}"
  Dataset.findOneById req.ident, (err, dataset) ->
    if err?
