diff --git a/backend/backend/api.py b/backend/backend/api.py
index 3239ffc..70a43fe 100644
--- a/backend/backend/api.py
+++ b/backend/backend/api.py
@@ -1,20 +1,50 @@
 from rest_framework import viewsets, serializers, permissions
 from rest_framework import routers
+from django_filters.rest_framework import DjangoFilterBackend
 
-from .models import ToDoList
+from .models import ToDoList, ToDoItem
+
+
+class ToDoItemSerializer(serializers.HyperlinkedModelSerializer):
+    parent = serializers.PrimaryKeyRelatedField(many=False, read_only=True)
+
+    class Meta:
+        model = ToDoItem
+        fields = ["id", "text", "finished", "created_at", "parent"]
+
+
+class ToDoItemViewSet(viewsets.ModelViewSet):
+    serializer_class = ToDoItemSerializer
+    permission_classes = [permissions.IsAuthenticated]
+    filter_backends = [DjangoFilterBackend]
+    filterset_fields = ["parent", "finished"]
+
+    def get_queryset(self):
+        user = self.request.user
+        if not user.is_authenticated:
+            # ветка только для генерации схемы
+            return ToDoItem.objects.all()
+        return ToDoItem.objects.filter(parent__user=user)
 
 
 class ToDoListSerializer(serializers.HyperlinkedModelSerializer):
     class Meta:
         model = ToDoList
-        fields = ["title", "created_at"]
+        fields = ["id", "title", "created_at"]
 
 
 class ToDoListViewSet(viewsets.ModelViewSet):
-    queryset = ToDoList.objects.all()
     serializer_class = ToDoListSerializer
     permission_classes = [permissions.IsAuthenticated]
 
+    def get_queryset(self):
+        user = self.request.user
+        if not user.is_authenticated:
+            # ветка только для генерации схемы
+            return ToDoList.objects.all()
+        return ToDoList.objects.filter(user=user)
+
 
 router = routers.DefaultRouter()
-router.register(r"lists", ToDoListViewSet)
+router.register(r"lists", ToDoListViewSet, basename="ToDoLists")
+router.register(r"todo_items", ToDoItemViewSet, basename="ToDoItems")