diff --git a/API.md b/API.md
index 57e3ae1..065d018 100644
--- a/API.md
+++ b/API.md
@@ -7,6 +7,26 @@ admin.invalid
 localhost.admin.daplie.me
 ```
 
+All requests require an OAuth3 token in the request headers.
+
+## Tunnel
+
+### Check Status
+  * **URL** `/api/goldillocks@daplie.com/tunnel`
+  * **Method** `POST`
+  * **Reponse**: An object whose keys are the URLs for the tunnels, and whose
+    properties are arrays of the tunnel tokens.
+
+  This route with return only the sessions started by the same user who is
+  checking the status.
+
+### Start Tunnel
+  * **URL** `/api/goldillocks@daplie.com/tunnel`
+  * **Method** `POST`
+
+  This route will use the stored token for the user matching the request
+  header to request a tunnel token from the audience of the stored token.
+
 ## Socks5 Proxy
 
 ### Check Status