diff --git a/lib/tunnel-manager.js b/lib/tunnel-manager.js
index 077c4d7..30330d8 100644
--- a/lib/tunnel-manager.js
+++ b/lib/tunnel-manager.js
@@ -130,5 +130,25 @@ module.exports.create = function (deps, config) {
         return removeToken(data);
       });
     }
+  , get: function (owner) {
+      return storage.all().then(function (tokens) {
+        var result = {};
+        tokens.forEach(function (data) {
+          if (!result[data.owner]) {
+            result[data.owner] = {};
+          }
+          if (!result[data.owner][data.tunnelUrl]) {
+            result[data.owner][data.tunnelUrl] = [];
+          }
+          data.decoded = JSON.parse(new Buffer(data.jwt.split('.')[0], 'base64'));
+          result[data.owner][data.tunnelUrl].push(data);
+        });
+
+        if (owner) {
+          return result[owner] || {};
+        }
+        return result;
+      });
+    }
   };
 };
diff --git a/packages/apis/com.daplie.goldilocks/index.js b/packages/apis/com.daplie.goldilocks/index.js
index 7134e05..d11faed 100644
--- a/packages/apis/com.daplie.goldilocks/index.js
+++ b/packages/apis/com.daplie.goldilocks/index.js
@@ -118,6 +118,15 @@ module.exports.create = function (deps, conf) {
     }
   , tunnel: function (req, res) {
       isAuthorized(req, res, function () {
+        if ('POST' !== req.method) {
+          res.setHeader('Content-Type', 'application/json');
+          return deps.tunneler.get(req.userId).then(function (result) {
+            res.end(JSON.stringify(result));
+          }, function (err) {
+            res.end(JSON.stringify({ error: { message: err.message, code: err.code, uri: err.uri } }));
+          });
+        }
+
         jsonParser(req, res, function () {
 
           console.log('req.body', req.body);
@@ -153,8 +162,8 @@ module.exports.create = function (deps, conf) {
       });
     }
   , request: function (req, res) {
-      jsonParser(req, res, function () {
       isAuthorized(req, res, function () {
+      jsonParser(req, res, function () {
 
         deps.request({
           method: req.body.method || 'GET'