diff --git a/package-lock.json b/package-lock.json
index d3f2b5f..8bf0c21 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -35,6 +35,7 @@
         "express-query-boolean": "^2.0.0",
         "express-session": "^1.18.0",
         "floating-vue": "^5.2.2",
+        "graphql": "^16.9.0",
         "ip-cidr": "^4.0.0",
         "js-cookie": "^3.0.5",
         "knex": "^3.1.0",
@@ -6310,6 +6311,14 @@
       "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
       "dev": true
     },
+    "node_modules/graphql": {
+      "version": "16.9.0",
+      "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.9.0.tgz",
+      "integrity": "sha512-GGTKBX4SD7Wdb8mqeDLni2oaRGYQWjWHGKPQ24ZMnUtKfcsVoiv4uX8+LJr1K6U5VW2Lu1BwJnj7uiori0YtRw==",
+      "engines": {
+        "node": "^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0"
+      }
+    },
     "node_modules/has-bigints": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.0.2.tgz",
@@ -14877,6 +14886,11 @@
       "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
       "dev": true
     },
+    "graphql": {
+      "version": "16.9.0",
+      "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.9.0.tgz",
+      "integrity": "sha512-GGTKBX4SD7Wdb8mqeDLni2oaRGYQWjWHGKPQ24ZMnUtKfcsVoiv4uX8+LJr1K6U5VW2Lu1BwJnj7uiori0YtRw=="
+    },
     "has-bigints": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.0.2.tgz",
diff --git a/package.json b/package.json
index 5e71341..47faee3 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "express-query-boolean": "^2.0.0",
     "express-session": "^1.18.0",
     "floating-vue": "^5.2.2",
+    "graphql": "^16.9.0",
     "ip-cidr": "^4.0.0",
     "js-cookie": "^3.0.5",
     "knex": "^3.1.0",
diff --git a/src/web/consent.js b/src/web/consent.js
index 86f6546..fc6b48b 100644
--- a/src/web/consent.js
+++ b/src/web/consent.js
@@ -1,11 +1,6 @@
 export default function consentHandler(req, res, next) {
 	const redirect = req.headers.referer && new URL(req.headers.referer).searchParams.get('redirect');
 
-	if (req.path.includes('/api')) {
-		next();
-		return;
-	}
-
 	if (Object.hasOwn(req.query, 'lgbt')) {
 		const lgbtFilters = (req.tagFilter || []).filter((tag) => !['gay', 'bisexual', 'transsexual'].includes(tag));
 
diff --git a/src/web/scenes.js b/src/web/scenes.js
index fc11dbd..5b3e22a 100644
--- a/src/web/scenes.js
+++ b/src/web/scenes.js
@@ -41,8 +41,6 @@ export async function curateScenesQuery(query) {
 }
 
 export async function fetchScenesApi(req, res) {
-	console.log('REQUEST', req.query);
-
 	const {
 		scenes,
 		aggActors,
@@ -58,8 +56,6 @@ export async function fetchScenesApi(req, res) {
 		limit: Number(req.query.limit) || 30,
 	}, req.user);
 
-	console.log('OUTPUT', scenes.length);
-
 	res.send(stringify({
 		scenes,
 		aggActors,
@@ -69,3 +65,33 @@ export async function fetchScenesApi(req, res) {
 		total,
 	}));
 }
+
+export const scenesSchema = `
+	type Scene {
+		id: Int!
+		title: String
+	}
+`;
+
+export async function fetchScenesGraphql(query, req) {
+	const {
+		scenes,
+		aggActors,
+		aggTags,
+		aggChannels,
+		limit,
+		total,
+	} = await fetchScenes({}, {
+		page: 1,
+		limit: 30,
+	}, req.user);
+
+	return {
+		scenes,
+		aggActors,
+		aggTags,
+		aggChannels,
+		limit,
+		total,
+	};
+}
diff --git a/src/web/server.js b/src/web/server.js
index edb5729..96dede1 100644
--- a/src/web/server.js
+++ b/src/web/server.js
@@ -9,8 +9,6 @@ import compression from 'compression';
 import cookie from 'cookie';
 import { renderPage } from 'vike/server'; // eslint-disable-line import/extensions
 
-// import root from './root.js';
-
 import redis from '../redis.js';
 
 import errorHandler from './error.js';
@@ -22,6 +20,8 @@ import { fetchMoviesApi } from './movies.js';
 import { fetchEntitiesApi } from './entities.js';
 import { fetchTagsApi } from './tags.js';
 
+import { graphqlApi } from './graphql.js';
+
 import {
 	setUserApi,
 	loginApi,
@@ -124,8 +124,6 @@ export default async function initServer() {
 		router.use(viteDevMiddleware);
 	}
 
-	router.use(consentHandler);
-
 	router.get('/consent', (req, res) => {
 		res.sendFile(path.join(import.meta.dirname, '../../assets/consent.html'));
 	});
@@ -175,6 +173,9 @@ export default async function initServer() {
 	// TAGS
 	router.get('/api/tags', fetchTagsApi);
 
+	router.post('/graphql', graphqlApi);
+	router.use(consentHandler);
+
 	router.use((req, res, next) => {
 		/* eslint-disable no-param-reassign */
 		res.set('Accept-CH', 'Sec-CH-Prefers-Color-Scheme');