diff --git a/README.md b/README.md
index d964514..d21d2ca 100644
--- a/README.md
+++ b/README.md
@@ -286,6 +286,27 @@
 
 </details>
 
+<details>
+<summary><code>GET</code> <code>/api/whitelist</code> (UUIDs aller Whitelist-Spieler)</summary>
+
+##### Response Codes
+
+| http code | beschreibung                               |
+| --------- | ------------------------------------------ |
+| 200       | /                                          |
+| 401       | Es wurde ein falsches API Secret angegeben |
+
+##### Response Body
+
+```
+{
+  // UUIDs aller Spieler auf der Whitelist
+  "uuid": string[]
+}
+```
+
+</details>
+
 ## Webhook
 
 > Die env variable `WEBHOOK_ENDPOINT` muss gesetzt und eine valide HTTP URL sein.
diff --git a/src/db/database.sql b/src/db/database.sql
index ef489b5..7138d0d 100644
--- a/src/db/database.sql
+++ b/src/db/database.sql
@@ -32,6 +32,14 @@ CREATE TABLE IF NOT EXISTS direct_signup (
     FOREIGN KEY (user_id) REFERENCES user(id) ON DELETE CASCADE
 );
 
+-- whitelist user
+CREATE TABLE IF NOT EXISTS whitelist_user (
+    uuid VARCHAR(36) NOT NULL PRIMARY KEY,
+    comment TINYTEXT,
+    user_id INT UNIQUE,
+    FOREIGN KEY (user_id) REFERENCES user(id) ON DELETE SET NULL
+);
+
 -- report
 CREATE TABLE IF NOT EXISTS report (
     id INT AUTO_INCREMENT PRIMARY KEY,
diff --git a/src/db/database.ts b/src/db/database.ts
index 32804ab..cc3c953 100644
--- a/src/db/database.ts
+++ b/src/db/database.ts
@@ -132,6 +132,17 @@ import {
   setDirectSignupUser,
   type SetDirectSignupUserReq
 } from '@db/schema/directSignup.ts';
+import {
+  addWhitelistUser,
+  type AddWhitelistUserReq,
+  deleteWhitelistUser,
+  type DeleteWhitelistUserReq,
+  editWhitelistUser,
+  type EditWhitelistUserReq,
+  getWhitelistUsers,
+  type GetWhitelistUsersReq,
+  whitelistUser
+} from '@db/schema/whitelistUser.ts';
 
 export class Database {
   protected readonly db: MySql2Database<{
@@ -139,6 +150,7 @@ export class Database {
     user: typeof user;
     blockedUser: typeof blockedUser;
     directSignup: typeof directSignup;
+    whitelistUser: typeof whitelistUser;
     report: typeof report;
     reportAttachment: typeof reportAttachment;
     reportStatus: typeof reportStatus;
@@ -164,6 +176,7 @@ export class Database {
         user,
         blockedUser,
         directSignup,
+        whitelistUser,
         report,
         reportAttachment,
         reportStatus,
@@ -213,6 +226,12 @@ export class Database {
   getDirectSignups = (values: GetDirectSignupsReq) => getDirectSignups(this.db, values);
   getDirectSignupByCode = (values: GetDirectSignupByCodeReq) => getDirectSignupByCode(this.db, values);
 
+  /* whitelist */
+  addWhitelistUser = (values: AddWhitelistUserReq) => addWhitelistUser(this.db, values);
+  editWhitelistUser = (values: EditWhitelistUserReq) => editWhitelistUser(this.db, values);
+  deleteWhitelistUser = (values: DeleteWhitelistUserReq) => deleteWhitelistUser(this.db, values);
+  getWhitelistUsers = (values: GetWhitelistUsersReq) => getWhitelistUsers(this.db, values);
+
   /* report */
   addReport = (values: AddReportReq) => addReport(this.db, values);
   editReport = (values: EditReportReq) => editReport(this.db, values);
diff --git a/src/db/schema/whitelistUser.ts b/src/db/schema/whitelistUser.ts
new file mode 100644
index 0000000..cfdad01
--- /dev/null
+++ b/src/db/schema/whitelistUser.ts
@@ -0,0 +1,66 @@
+import { int, mysqlTable, text, varchar } from 'drizzle-orm/mysql-core';
+import type { MySql2Database } from 'drizzle-orm/mysql2';
+import { eq } from 'drizzle-orm';
+import { user } from '@db/schema/user.ts';
+
+type Database = MySql2Database<{ whitelistUser: typeof whitelistUser }>;
+
+export const whitelistUser = mysqlTable('whitelist_user', {
+  uuid: varchar('uuid', { length: 36 }).primaryKey(),
+  comment: text('comment'),
+  userId: int('user_id')
+    .unique()
+    .references(() => user.id, { onDelete: 'set null' })
+});
+
+export type AddWhitelistUserReq = {
+  uuid: string;
+  comment?: string | null;
+  userId?: number | null;
+};
+
+export type EditWhitelistUserReq = {
+  uuid: string;
+  comment?: string | null;
+  userId?: number | null;
+};
+
+export type DeleteWhitelistUserReq = {
+  uuid: string;
+};
+
+export type GetWhitelistUsersReq = {};
+
+export async function addWhitelistUser(db: Database, values: AddWhitelistUserReq) {
+  await db.insert(whitelistUser).values(values);
+
+  return { uuid: values.uuid };
+}
+
+export async function editWhitelistUser(db: Database, values: EditWhitelistUserReq) {
+  await db
+    .update(whitelistUser)
+    .set({
+      comment: values.comment,
+      userId: values.userId
+    })
+    .where(eq(whitelistUser.uuid, values.uuid));
+}
+
+export async function deleteWhitelistUser(db: Database, values: DeleteWhitelistUserReq) {
+  return db.delete(whitelistUser).where(eq(whitelistUser.uuid, values.uuid));
+}
+
+export async function getWhitelistUsers(db: Database, _values: GetWhitelistUsersReq) {
+  return db
+    .select({
+      uuid: whitelistUser.uuid,
+      comment: whitelistUser.comment,
+      user: {
+        id: user.id,
+        uuid: user.uuid
+      }
+    })
+    .from(whitelistUser)
+    .leftJoin(user, eq(whitelistUser.userId, user.id));
+}
diff --git a/src/pages/api/whitelist/index.ts b/src/pages/api/whitelist/index.ts
new file mode 100644
index 0000000..fc4e937
--- /dev/null
+++ b/src/pages/api/whitelist/index.ts
@@ -0,0 +1,16 @@
+import { externalApi } from '../_api.ts';
+import { db } from '@db/database.ts';
+
+export const GET = externalApi({
+  auth: true,
+  handler: async () => {
+    const whitelist = await db.getWhitelistUsers({});
+
+    return new Response(
+      JSON.stringify({
+        uuid: whitelist.map((entry) => entry.user?.uuid ?? entry.uuid)
+      }),
+      { status: 200 }
+    );
+  }
+});