diff --git a/app/Http/Controllers/AP/APInboxController.php b/app/Http/Controllers/AP/APInboxController.php
index ce9ee36..d1d693f 100644
--- a/app/Http/Controllers/AP/APInboxController.php
+++ b/app/Http/Controllers/AP/APInboxController.php
@@ -14,5 +14,6 @@ class APInboxController extends Controller
     public function inbox (User $user)
     {
         Log::info ("APInboxController@index");
+        Log::info (json_encode (request ()->all ()));
     }
 }
diff --git a/app/Http/Controllers/AP/APInstanceInboxController.php b/app/Http/Controllers/AP/APInstanceInboxController.php
new file mode 100644
index 0000000..287cac8
--- /dev/null
+++ b/app/Http/Controllers/AP/APInstanceInboxController.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Controllers\AP;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+
+use App\Http\Controllers\Controller;
+
+class APInstanceInboxController extends Controller
+{
+    public function inbox ()
+    {
+        Log::info ("APInstanceInboxController:inbox");
+        Log::info (json_encode (request ()->all ()));
+    }
+}
diff --git a/app/Http/Controllers/AP/APOutboxController.php b/app/Http/Controllers/AP/APOutboxController.php
index 93e0f24..339f980 100644
--- a/app/Http/Controllers/AP/APOutboxController.php
+++ b/app/Http/Controllers/AP/APOutboxController.php
@@ -14,5 +14,6 @@ class APOutboxController extends Controller
     public function outbox (User $user)
     {
         Log::info ("APOutboxController@index");
+        Log::info (json_encode (request ()->all ()));
     }
 }
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 7b162da..88c523d 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -11,7 +11,9 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware) {
-        //
+        $middleware->validateCsrfTokens (except: [
+            "ap/v1/*",
+        ]);
     })
     ->withExceptions(function (Exceptions $exceptions) {
         //
diff --git a/routes/api.php b/routes/api.php
index ad39861..08aa043 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -3,15 +3,19 @@
 use Illuminate\Support\Facades\Route;
 
 use App\Http\Controllers\AP\APActorController;
-use App\Http\Controllers\AP\APWebfingerController;
-
 use App\Http\Controllers\AP\APInboxController;
+
+use App\Http\Controllers\AP\APInstanceInboxController;
+
 use App\Http\Controllers\AP\APOutboxController;
+use App\Http\Controllers\AP\APWebfingerController;
 
 Route::get ("/.well-known/webfinger", [ APWebfingerController::class, "webfinger" ])->name ("ap.webfinger");
 
 Route::prefix ("/ap/v1")->group (function () {
-    Route::get ("/user/{user:name}", [ APActorController::class, "user" ])->name ("ap.user");
     Route::post ("/user/{user:name}/inbox", [ APInboxController::class, "inbox" ])->name ("ap.inbox");
     Route::post ("/user/{user:name}/outbox", [ APOutboxController::class, "outbox" ])->name ("ap.outbox");
+    Route::get ("/user/{user:name}", [ APActorController::class, "user" ])->name ("ap.user");
+
+    Route::post ("/inbox", [ APInstanceInboxController::class, "inbox" ])->name ("ap.inbox");
 });