diff --git a/README.md b/README.md
index 76d414d..292ed3c 100644
--- a/README.md
+++ b/README.md
@@ -9,3 +9,4 @@ Table:
 | 07.07.2023 | Brainstorming and initialize project | 2 |
 | 07.07.2023 | Setting up database | 2 |
 | 07.07.2023 | Authentication and authorization | 6 |
+| 10.07.2023 | User routes | 4 |
diff --git a/server/controllers/users.js b/server/controllers/users.js
new file mode 100644
index 0000000..e40e4c6
--- /dev/null
+++ b/server/controllers/users.js
@@ -0,0 +1,101 @@
+import User from "../models/User";
+
+/**
+ * Read - GET
+ */
+export const getUser = async (req, res) => {
+  try {
+    const { id } = req.params;
+    const user = await User.findById(id);
+
+    res.status(200).json(user);
+  } catch (error) {
+    res.status(404).json({ error: error.message });
+  }
+};
+
+export const getFriends = async (req, res) => {
+  try {
+    const { id } = req.params;
+    const user = await User.findById(id);
+    const friends = await Promise.all(
+      user.friends.map((id) => User.findById(id))
+    );
+    const friendList = friends.map(
+      ({
+        _id,
+        firstName,
+        lastName,
+        profilePicturePath,
+        location,
+        description,
+        admin,
+      }) => {
+        return {
+          _id,
+          firstName,
+          lastName,
+          profilePicturePath,
+          location,
+          description,
+          admin,
+        };
+      }
+    );
+
+    res.status(200).json(friendList);
+  } catch (error) {
+    res.status(404).json({ error: error.message });
+  }
+};
+
+/**
+ * Update - PATCH
+ */
+export const patchFriend = async (req, res) => {
+  try {
+    const { id, friendId } = req.params;
+    const user = await User.findById(id);
+    const friend = await User.findById(friendId);
+
+    if (user.friends.includes(friendId)) {
+      user.friends = user.friends.filter((id) => id !== friendId);
+      friend.friends = friend.friends.filter((id) => id !== id);
+    } else {
+      user.friends.push(friendId);
+      friend.friends.push(id);
+    }
+
+    await user.save();
+    await friend.save();
+
+    const friends = await Promise.all(
+      user.friends.map((id) => User.findById(id))
+    );
+    const friendList = friends.map(
+      ({
+        _id,
+        firstName,
+        lastName,
+        profilePicturePath,
+        location,
+        description,
+        admin,
+      }) => {
+        return {
+          _id,
+          firstName,
+          lastName,
+          profilePicturePath,
+          location,
+          description,
+          admin,
+        };
+      }
+    );
+
+    res.status(200).json(friendList);
+  } catch (error) {
+    res.status(404).json({ error: error.message });
+  }
+};
diff --git a/server/index.js b/server/index.js
index ff697c9..dac65bf 100644
--- a/server/index.js
+++ b/server/index.js
@@ -8,9 +8,15 @@ import helmet from "helmet";
 import morgan from "morgan";
 import path from "path";
 import { fileURLToPath } from "url";
+/* Routes */
 import authRoutes from "./routes/auth.js";
+import userRoutes from "./routes/user.js";
+import postRoutes from "./routes/post.js";
 /* Controllers */
 import { register } from "./controllers/auth.js";
+import { createPost } from "./controllers/post.js";
+/* Middlewares */
+import { verifyToken } from "./middlewares/auth.js";
 
 /**
  * Config
@@ -45,6 +51,10 @@ const upload = multer({ storage });
  * Routes
  * */
 app.post("/auth/register", upload.single("profilePicture"), register);
+app.post("/posts", verifyToken, upload.single("image"), createPost);
+app.use("/auth", authRoutes);
+app.use("/users", userRoutes);
+app.use("/posts", postRoutes);
 
 /**
  * Database
diff --git a/server/routes/users.js b/server/routes/users.js
new file mode 100644
index 0000000..a5d38ba
--- /dev/null
+++ b/server/routes/users.js
@@ -0,0 +1,18 @@
+import express from "express";
+import { getUser, getFriends, patchFriend } from "../controllers/users.js";
+import { verifyToken } from "../middlewares/auth.js";
+
+const router = express.Router();
+
+/**
+ * Read - GET
+ */
+router.get("/:id", verifyToken, getUser);
+router.get("/:id/friends", verifyToken, getFriends);
+
+/**
+ * Update - PATCH
+ */
+router.patch("/:id/:friendId", verifyToken, patchFriend);
+
+export default router;