diff --git a/src/main/kotlin/dev/usbharu/hideout/application/config/SecurityConfig.kt b/src/main/kotlin/dev/usbharu/hideout/application/config/SecurityConfig.kt
index 59caf58d..fd129a61 100644
--- a/src/main/kotlin/dev/usbharu/hideout/application/config/SecurityConfig.kt
+++ b/src/main/kotlin/dev/usbharu/hideout/application/config/SecurityConfig.kt
@@ -186,11 +186,13 @@ class SecurityConfig {
                 authorize(POST, "/api/v1/accounts", permitAll)
 
                 authorize("/auth/sign_up", hasRole("ANONYMOUS"))
-                authorize(GET, "/files", permitAll)
+                authorize(GET, "/files/*", permitAll)
                 authorize(GET, "/users/*/icon.jpg", permitAll)
                 authorize(GET, "/users/*/header.jpg", permitAll)
 
                 authorize(GET, "/api/v1/accounts/verify_credentials", hasAnyScope("read", "read:accounts"))
+                authorize(GET, "/api/v1/accounts/*", permitAll)
+                authorize(GET, "/api/v1/accounts/*/statuses", permitAll)
 
                 authorize(POST, "/api/v1/media", hasAnyScope("write", "write:media"))
                 authorize(POST, "/api/v1/statuses", hasAnyScope("write", "write:statuses"))
diff --git a/src/main/kotlin/dev/usbharu/hideout/mastodon/service/account/AccountApiService.kt b/src/main/kotlin/dev/usbharu/hideout/mastodon/service/account/AccountApiService.kt
index 7a3a6820..946a6710 100644
--- a/src/main/kotlin/dev/usbharu/hideout/mastodon/service/account/AccountApiService.kt
+++ b/src/main/kotlin/dev/usbharu/hideout/mastodon/service/account/AccountApiService.kt
@@ -9,6 +9,7 @@ import dev.usbharu.hideout.domain.mastodon.model.generated.*
 import dev.usbharu.hideout.mastodon.query.StatusQueryService
 import org.slf4j.LoggerFactory
 import org.springframework.stereotype.Service
+import kotlin.math.min
 
 @Service
 interface AccountApiService {
@@ -126,17 +127,18 @@ class AccountApiServiceImpl(
         return@transaction accountService.findById(id)
     }
 
-    override suspend fun relationships(userid: Long, id: List<Long>, withSuspended: Boolean): List<Relationship> {
+    override suspend fun relationships(userid: Long, id: List<Long>, withSuspended: Boolean): List<Relationship> =
+        transaction.transaction {
         if (id.isEmpty()) {
-            return emptyList()
+            return@transaction emptyList()
         }
 
 
         logger.warn("id is too long! ({}) truncate to 20", id.size)
 
-        val subList = id.subList(0, 20)
+            val subList = id.subList(0, min(id.size, 20))
 
-        return subList.map {
+            return@transaction subList.map {
 
             val alreadyFollow = followerQueryService.alreadyFollow(userid, it)
 
diff --git a/src/main/kotlin/dev/usbharu/hideout/mastodon/service/account/AccountService.kt b/src/main/kotlin/dev/usbharu/hideout/mastodon/service/account/AccountService.kt
index a7f5f766..72050167 100644
--- a/src/main/kotlin/dev/usbharu/hideout/mastodon/service/account/AccountService.kt
+++ b/src/main/kotlin/dev/usbharu/hideout/mastodon/service/account/AccountService.kt
@@ -1,5 +1,6 @@
 package dev.usbharu.hideout.mastodon.service.account
 
+import dev.usbharu.hideout.application.config.ApplicationConfig
 import dev.usbharu.hideout.core.query.UserQueryService
 import dev.usbharu.hideout.domain.mastodon.model.generated.Account
 import org.springframework.stereotype.Service
@@ -10,9 +11,14 @@ interface AccountService {
 }
 
 @Service
-class AccountServiceImpl(private val userQueryService: UserQueryService) : AccountService {
+class AccountServiceImpl(
+    private val userQueryService: UserQueryService,
+    private val applicationConfig: ApplicationConfig
+) : AccountService {
     override suspend fun findById(id: Long): Account {
         val findById = userQueryService.findById(id)
+        val userUrl = applicationConfig.url.toString() + "/users/" + findById.id.toString()
+
         return Account(
             id = findById.id.toString(),
             username = findById.name,
@@ -20,10 +26,10 @@ class AccountServiceImpl(private val userQueryService: UserQueryService) : Accou
             url = findById.url,
             displayName = findById.screenName,
             note = findById.description,
-            avatar = findById.url + "/icon.jpg",
-            avatarStatic = findById.url + "/icon.jpg",
-            header = findById.url + "/header.jpg",
-            headerStatic = findById.url + "/header.jpg",
+            avatar = "$userUrl/icon.jpg",
+            avatarStatic = "$userUrl/icon.jpg",
+            header = "$userUrl/header.jpg",
+            headerStatic = "$userUrl/header.jpg",
             locked = false,
             fields = emptyList(),
             emojis = emptyList(),
diff --git a/src/main/resources/openapi/mastodon.yaml b/src/main/resources/openapi/mastodon.yaml
index 5d39ad40..3049c1d9 100644
--- a/src/main/resources/openapi/mastodon.yaml
+++ b/src/main/resources/openapi/mastodon.yaml
@@ -215,7 +215,7 @@ paths:
             - "read:follows"
       parameters:
         - in: query
-          name: id
+          name: id[]
           required: false
           schema:
             type: array