diff --git a/hideout-activitypub/build.gradle.kts b/hideout-activitypub/build.gradle.kts
index 60a18a8f..33dd538f 100644
--- a/hideout-activitypub/build.gradle.kts
+++ b/hideout-activitypub/build.gradle.kts
@@ -4,6 +4,12 @@ plugins {
     alias(libs.plugins.kotlin.jvm)
     alias(libs.plugins.detekt)
     alias(libs.plugins.kover)
+    alias(libs.plugins.spring.boot)
+    alias(libs.plugins.kotlin.spring)
+}
+
+apply {
+    plugin("io.spring.dependency-management")
 }
 
 group = "dev.usbharu"
@@ -17,6 +23,8 @@ dependencies {
     testImplementation(kotlin("test"))
     detektPlugins(libs.detekt.formatting)
     implementation("dev.usbharu:hideout-core:0.0.1")
+    implementation("org.springframework.boot:spring-boot-starter-web")
+    implementation("org.springframework.boot:spring-boot-starter-security")
     implementation(libs.bundles.jackson)
 }
 
diff --git a/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/application/actor/GetActorApplicationService.kt b/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/application/actor/GetActorApplicationService.kt
new file mode 100644
index 00000000..1f2711f7
--- /dev/null
+++ b/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/application/actor/GetActorApplicationService.kt
@@ -0,0 +1,22 @@
+package dev.usbharu.hideout.activitypub.application.actor
+
+import dev.usbharu.hideout.core.application.shared.AbstractApplicationService
+import dev.usbharu.hideout.core.application.shared.Transaction
+import dev.usbharu.hideout.core.domain.model.actor.Actor
+import dev.usbharu.hideout.core.domain.model.support.principal.Principal
+import org.slf4j.LoggerFactory
+import org.springframework.stereotype.Service
+
+@Service
+class GetActorApplicationService(transaction: Transaction) : AbstractApplicationService<String, Actor>(
+    transaction,
+    logger
+) {
+    override suspend fun internalExecute(command: String, principal: Principal): Actor {
+        TODO()
+    }
+
+    companion object {
+        private val logger = LoggerFactory.getLogger(GetActorApplicationService::class.java)
+    }
+}
\ No newline at end of file
diff --git a/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/config/ActivityPubSecurityConfig.kt b/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/config/ActivityPubSecurityConfig.kt
new file mode 100644
index 00000000..9676aa01
--- /dev/null
+++ b/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/config/ActivityPubSecurityConfig.kt
@@ -0,0 +1,27 @@
+package dev.usbharu.hideout.activitypub.config
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.core.annotation.Order
+import org.springframework.http.HttpMethod.GET
+import org.springframework.http.HttpMethod.POST
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.config.annotation.web.invoke
+import org.springframework.security.web.SecurityFilterChain
+
+@Configuration
+class ActivityPubSecurityConfig {
+    @Bean
+    @Order(4)
+    fun activityPubSecurityFilterChain(http: HttpSecurity): SecurityFilterChain {
+        http {
+            authorizeHttpRequests {
+                authorize(POST, "/inbox", permitAll)
+                authorize(POST, "/users/{username}/inbox", permitAll)
+                authorize(GET, "/outbox", permitAll)
+                authorize(GET, "/users/{username}/outbox", permitAll)
+            }
+        }
+        return http.build()
+    }
+}
\ No newline at end of file
diff --git a/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/interface/api/APActorController.kt b/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/interface/api/APActorController.kt
new file mode 100644
index 00000000..36b4e170
--- /dev/null
+++ b/hideout-activitypub/src/main/kotlin/dev/usbharu/hideout/activitypub/interface/api/APActorController.kt
@@ -0,0 +1,20 @@
+package dev.usbharu.hideout.activitypub.`interface`.api
+
+import dev.usbharu.hideout.activitypub.application.actor.GetActorApplicationService
+import dev.usbharu.hideout.core.domain.model.actor.Actor
+import dev.usbharu.hideout.core.domain.model.support.principal.Anonymous
+import org.springframework.stereotype.Controller
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
+
+@Controller
+class APActorController(private val getActorApplicationService: GetActorApplicationService) {
+    @GetMapping(
+        "/users/{username}",
+        consumes = ["application/activity+json"],
+        produces = ["application/activity+json"]
+    )
+    suspend fun user(@PathVariable username: String): Actor {
+        return getActorApplicationService.execute(username, Anonymous)
+    }
+}
\ No newline at end of file
diff --git a/hideout-core/src/main/kotlin/dev/usbharu/hideout/core/config/SecurityConfig.kt b/hideout-core/src/main/kotlin/dev/usbharu/hideout/core/config/SecurityConfig.kt
index d0b071ca..fab7f0e4 100644
--- a/hideout-core/src/main/kotlin/dev/usbharu/hideout/core/config/SecurityConfig.kt
+++ b/hideout-core/src/main/kotlin/dev/usbharu/hideout/core/config/SecurityConfig.kt
@@ -75,7 +75,7 @@ class SecurityConfig {
     }
 
     @Bean
-    @Order(3)
+    @Order(6)
     fun httpSecurityFilterChain(http: HttpSecurity): SecurityFilterChain {
         http {
             authorizeHttpRequests {