diff --git a/appinfo/routes.php b/appinfo/routes.php
index 20b2974..b47b072 100644
--- a/appinfo/routes.php
+++ b/appinfo/routes.php
@@ -6,5 +6,7 @@ return [
 	'routes' => [
 		/* Resources */
 		['name' => 'resource#show', 'url' => '/resources/{resourceId}', 'verb' => 'GET'],
-	]
+		['name' => 'resource#create', 'url' => '/resources/{resourceId}', 'verb' => 'POST'],
+		['name' => 'resource#update', 'url' => '/resources/{resourceId}', 'verb' => 'PUT'],
+	],
 ];
\ No newline at end of file
diff --git a/lib/Controller/ResourceController.php b/lib/Controller/ResourceController.php
index 5c09b2b..2b68dea 100644
--- a/lib/Controller/ResourceController.php
+++ b/lib/Controller/ResourceController.php
@@ -5,26 +5,49 @@ namespace OCA\OrganizationFolders\Controller;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 
+use OCA\OrganizationFolders\Db\Resource;
 use OCA\OrganizationFolders\Service\ResourceService;
+use OCA\OrganizationFolders\Service\ResourceMemberService;
+use OCA\OrganizationFolders\Traits\ApiObjectController;
 
 class ResourceController extends BaseController {
 	use Errors;
+	use ApiObjectController;
+
+	public const MEMBERS_INCLUDE = 'members';
 
 	public function __construct(
 		private ResourceService $service,
+		private ResourceMemberService $memberService,
 		private string $userId,
     ) {
 		parent::__construct();
 	}
 
+	private function getApiObjectFromEntity(Resource $resource, ?string $include): array {
+		$includes = $this->parseIncludesString($include);
+
+		$result = [];
+
+		if ($this->shouldInclude(self::MODEL_INCLUDE, $includes)) {
+			$result = $resource->jsonSerialize();
+		}
+
+		if ($this->shouldInclude(self::MEMBERS_INCLUDE, $includes)) {
+			$result["members"] = $this->memberService->findAll($resource->getId());
+		}
+
+		return $result;
+	}
+
     #[NoAdminRequired]
-	public function show(int $resourceId): JSONResponse {
-		return $this->handleNotFound(function () use ($resourceId) {
+	public function show(int $resourceId, ?string $include): JSONResponse {
+		return $this->handleNotFound(function () use ($resourceId, $include) {
             $resource = $this->service->find($resourceId);
 
             $this->denyAccessUnlessGranted(['READ'], $resource);
 
-			return $resource;
+			return $this->getApiObjectFromEntity($resource, $include);
 		});
 	}
 
@@ -41,11 +64,19 @@ class ResourceController extends BaseController {
 		?int $membersAclPermission = null,
 		?int $managersAclPermission = null,
 		?int $inheritedAclPermission = null,
-	): JSONResponse {
-		return $this->handleErrors(function () use ($organizationFolderId, $type, $name, $parentResourceId, $active, $inheritManagers, $membersAclPermission, $managersAclPermission, $inheritedAclPermission) {
-			// TODO: check permissions
 
-			return $this->service->create(
+		?string $include,
+	): JSONResponse {
+		return $this->handleErrors(function () use ($organizationFolderId, $type, $name, $parentResourceId, $active, $inheritManagers, $membersAclPermission, $managersAclPermission, $inheritedAclPermission, $include) {
+			if(!is_null($parentResourceId)) {
+				$parentResource = $this->service->find($parentResourceId);
+
+				$this->denyAccessUnlessGranted(['CREATE_SUBRESOURCE'], $parentResource);
+			} else {
+				// TODO: ask future organization folder voter
+			}
+
+			$resource = $this->service->create(
 				organizationFolderId: $organizationFolderId,
 				type: $type,
 				name: $name,
@@ -57,6 +88,42 @@ class ResourceController extends BaseController {
 				managersAclPermission: $managersAclPermission,
 				inheritedAclPermission: $inheritedAclPermission,
 			);
+
+			return $this->getApiObjectFromEntity($resource, $include);
+		});
+	}
+
+	#[NoAdminRequired]
+	public function update(
+		int $resourceId,
+		?string $name = null,
+		?bool $active = null,
+		?bool $inheritManagers = null,
+
+		// for type folder
+		?int $membersAclPermission = null,
+		?int $managersAclPermission = null,
+		?int $inheritedAclPermission = null,
+
+		?string $include,
+	): JSONResponse {
+		return $this->handleErrors(function () use ($resourceId, $name, $active, $inheritManagers, $membersAclPermission, $managersAclPermission, $inheritedAclPermission, $include) {
+			$resource = $this->service->find($resourceId);
+			
+			$this->denyAccessUnlessGranted(['UPDATE'], $resource);
+
+			$resource = $this->service->update(
+				id: $resourceId,
+				name: $name,
+				active: $active,
+				inheritManagers: $inheritManagers,
+
+				membersAclPermission: $membersAclPermission,
+				managersAclPermission: $managersAclPermission,
+				inheritedAclPermission: $inheritedAclPermission,
+			);
+
+			return $this->getApiObjectFromEntity($resource, $include);
 		});
 	}
 }
\ No newline at end of file
diff --git a/lib/Traits/ApiObjectController.php b/lib/Traits/ApiObjectController.php
new file mode 100644
index 0000000..a02daf8
--- /dev/null
+++ b/lib/Traits/ApiObjectController.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace OCA\OrganizationFolders\Traits;
+
+trait ApiObjectController {
+	public const MODEL_INCLUDE = 'model';
+
+	/**
+	 * @param string $include
+	 *
+	 * @return array
+	 */
+	public function parseIncludesString(?string $include): array {
+		if (isset($include)) {
+			$includes = array_filter(explode('+', $include));
+
+			if (!!$includes) {
+				return $includes;
+			}
+		}
+
+		return [self::MODEL_INCLUDE];
+	}
+
+    /**
+	 * @param string $test
+	 * @param array $includes
+	 *
+	 * @return boolean
+	 */
+	public function shouldInclude(string $test, array $includes): bool {
+		return in_array($test, $includes);
+	}
+}
\ No newline at end of file