diff --git a/http/bindapi.go b/http/bindapi.go
index f38c54a..c752122 100644
--- a/http/bindapi.go
+++ b/http/bindapi.go
@@ -4,6 +4,9 @@ package http
 import (
 	goji "goji.io"
 	"goji.io/pat"
+
+	"github.com/genofire/hs_master-kss-monolith/lib/http"
+	"github.com/genofire/hs_master-kss-monolith/runtime"
 )
 
 // bind all API routes to webserver
@@ -11,4 +14,5 @@ func BindAPI(router *goji.Mux) {
 	router.HandleFunc(pat.Get("/api/status"), status)
 	router.HandleFunc(pat.Get("/api/good/:productid"), listGoods)
 	router.HandleFunc(pat.Get("/api/good/availablity/:productid"), getGoodAvailablity)
+	router.HandleFunc(pat.Post("/api/good/:productid"), http.PermissionHandler(addGood, runtime.HasPermission, runtime.PermissionCreateGood))
 }
diff --git a/http/good.go b/http/good.go
index fda4c05..2fe6e1f 100644
--- a/http/good.go
+++ b/http/good.go
@@ -4,17 +4,15 @@ import (
 	"net/http"
 	"strconv"
 
-	logrus "github.com/Sirupsen/logrus"
 	"goji.io/pat"
 
 	"github.com/genofire/hs_master-kss-monolith/lib/database"
 	lib "github.com/genofire/hs_master-kss-monolith/lib/http"
 	logger "github.com/genofire/hs_master-kss-monolith/lib/log"
 	"github.com/genofire/hs_master-kss-monolith/models"
-	"github.com/genofire/hs_master-kss-monolith/runtime"
 )
 
-func listGoods(w http.ResponseWriter, r *http.Request) {
+func addGood(w http.ResponseWriter, r *http.Request) {
 	log := logger.HTTP(r)
 	id, err := strconv.ParseInt(pat.Param(r, "productid"), 10, 64)
 	if err != nil {
@@ -23,53 +21,17 @@ func listGoods(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	log = log.WithField("productid", id)
-	var list []*models.Good
-	result := database.Read.Where("product_id = ?", id).Find(&list)
-	if result.RowsAffected == 0 {
-		log.Warn("no goods found")
-		http.Error(w, "no goods found", http.StatusNotFound)
-		return
-	}
-	lib.Write(w, list)
-	log.Info("done")
-}
-
-func getGoodAvailablityCount(w http.ResponseWriter, r *http.Request) (int, *logrus.Entry) {
-	log := logger.HTTP(r)
-	id, err := strconv.ParseInt(pat.Param(r, "productid"), 10, 64)
-	if err != nil {
-		log.Warn("wrong productid format")
-		http.Error(w, "wrong productid", http.StatusNotAcceptable)
-		return -1, log
-	}
-	log = log.WithField("productid", id)
-	ok, err := runtime.ProductExists(id)
-	if err != nil {
-		log.Warn("product could not verified on other microservice")
-		http.Error(w, "product could not verified on other microservice", http.StatusGatewayTimeout)
-		return -1, log
-	}
-	if !ok {
-		log.Warn("product did not exists anymore")
-		http.Error(w, "product did not exists anymore", http.StatusNotFound)
-		return -1, log
-	}
-	var count float64
-	(&models.Good{}).FilterAvailable(database.Read.Where("product_id = ?", id)).Count(&count)
-	return int(count), log
-}
-
-func getGoodAvailablity(w http.ResponseWriter, r *http.Request) {
-	count, log := getGoodAvailablityCount(w, r)
-	if count < 0 {
-		return
-	}
-	log = log.WithField("type", r.Header.Get("Content-Type"))
-	switch r.Header.Get("Content-Type") {
-	case "application/json":
-		lib.Write(w, count)
-	default:
-		getGoodAvailablitySVG(w, count)
+	var obj *models.Good
+	lib.Read(r, obj)
+
+	obj.ProductID = id
+
+	db := database.Write.Create(obj)
+	if db.Error != nil {
+		log.Error("database could not write", db.Error)
+		http.Error(w, "was not possible to write", http.StatusInternalServerError)
 	}
+	lib.Write(w, obj)
+
 	log.Info("done")
 }
diff --git a/http/good_show.go b/http/good_show.go
new file mode 100644
index 0000000..fda4c05
--- /dev/null
+++ b/http/good_show.go
@@ -0,0 +1,75 @@
+package http
+
+import (
+	"net/http"
+	"strconv"
+
+	logrus "github.com/Sirupsen/logrus"
+	"goji.io/pat"
+
+	"github.com/genofire/hs_master-kss-monolith/lib/database"
+	lib "github.com/genofire/hs_master-kss-monolith/lib/http"
+	logger "github.com/genofire/hs_master-kss-monolith/lib/log"
+	"github.com/genofire/hs_master-kss-monolith/models"
+	"github.com/genofire/hs_master-kss-monolith/runtime"
+)
+
+func listGoods(w http.ResponseWriter, r *http.Request) {
+	log := logger.HTTP(r)
+	id, err := strconv.ParseInt(pat.Param(r, "productid"), 10, 64)
+	if err != nil {
+		log.Warn("wrong productid format")
+		http.Error(w, "wrong productid", http.StatusNotAcceptable)
+		return
+	}
+	log = log.WithField("productid", id)
+	var list []*models.Good
+	result := database.Read.Where("product_id = ?", id).Find(&list)
+	if result.RowsAffected == 0 {
+		log.Warn("no goods found")
+		http.Error(w, "no goods found", http.StatusNotFound)
+		return
+	}
+	lib.Write(w, list)
+	log.Info("done")
+}
+
+func getGoodAvailablityCount(w http.ResponseWriter, r *http.Request) (int, *logrus.Entry) {
+	log := logger.HTTP(r)
+	id, err := strconv.ParseInt(pat.Param(r, "productid"), 10, 64)
+	if err != nil {
+		log.Warn("wrong productid format")
+		http.Error(w, "wrong productid", http.StatusNotAcceptable)
+		return -1, log
+	}
+	log = log.WithField("productid", id)
+	ok, err := runtime.ProductExists(id)
+	if err != nil {
+		log.Warn("product could not verified on other microservice")
+		http.Error(w, "product could not verified on other microservice", http.StatusGatewayTimeout)
+		return -1, log
+	}
+	if !ok {
+		log.Warn("product did not exists anymore")
+		http.Error(w, "product did not exists anymore", http.StatusNotFound)
+		return -1, log
+	}
+	var count float64
+	(&models.Good{}).FilterAvailable(database.Read.Where("product_id = ?", id)).Count(&count)
+	return int(count), log
+}
+
+func getGoodAvailablity(w http.ResponseWriter, r *http.Request) {
+	count, log := getGoodAvailablityCount(w, r)
+	if count < 0 {
+		return
+	}
+	log = log.WithField("type", r.Header.Get("Content-Type"))
+	switch r.Header.Get("Content-Type") {
+	case "application/json":
+		lib.Write(w, count)
+	default:
+		getGoodAvailablitySVG(w, count)
+	}
+	log.Info("done")
+}
diff --git a/http/good_test.go b/http/good_show_test.go
similarity index 100%
rename from http/good_test.go
rename to http/good_show_test.go
diff --git a/runtime/auth.go b/runtime/auth.go
index 78f45a8..e151785 100644
--- a/runtime/auth.go
+++ b/runtime/auth.go
@@ -57,7 +57,7 @@ func init() {
 }
 
 // check if the client with the session string has a permissions (see Permission)
-func HasPermission(session string, p Permission) (bool, error) {
+func HasPermission(session string, p int) (bool, error) {
 	_, ok := permissionCache[session]
 	if !ok {
 		permissionCache[session] = &permissionMicroServiceCache{
@@ -66,5 +66,5 @@ func HasPermission(session string, p Permission) (bool, error) {
 			permissions: make(map[Permission]boolMicroServiceCache),
 		}
 	}
-	return permissionCache[session].HasPermission(p)
+	return permissionCache[session].HasPermission(Permission(p))
 }