diff --git a/src/goals/goals.controller.ts b/src/goals/goals.controller.ts
new file mode 100644
index 0000000..5dd2c7f
--- /dev/null
+++ b/src/goals/goals.controller.ts
@@ -0,0 +1,42 @@
+import { BadRequestException, Body, Controller, Delete, Get, Param, ParseUUIDPipe, Patch, Post, Query } from '@nestjs/common';
+import { CurrentSession } from '../auth/session.decorator';
+import type { AuthenticatedSession } from '../auth/tenant.guard';
+import { CreateGoalDto, GOAL_STATUSES, UpdateGoalDto, type GoalStatusValue } from './dto';
+import { GoalsService } from './goals.service';
+
+@Controller('goals')
+export class GoalsController {
+  constructor(private readonly goalsService: GoalsService) {}
+
+  @Get()
+  list(@CurrentSession() session: AuthenticatedSession, @Query('status') status?: string) {
+    if (status && !GOAL_STATUSES.includes(status as GoalStatusValue)) {
+      throw new BadRequestException(`status must be one of: ${GOAL_STATUSES.join(', ')}`);
+    }
+    return this.goalsService.list(session, status as GoalStatusValue | undefined);
+  }
+
+  @Get(':id')
+  getById(@CurrentSession() session: AuthenticatedSession, @Param('id', ParseUUIDPipe) id: string) {
+    return this.goalsService.getById(session, id);
+  }
+
+  @Post()
+  create(@CurrentSession() session: AuthenticatedSession, @Body() dto: CreateGoalDto) {
+    return this.goalsService.create(session, dto);
+  }
+
+  @Patch(':id')
+  update(
+    @CurrentSession() session: AuthenticatedSession,
+    @Param('id', ParseUUIDPipe) id: string,
+    @Body() dto: UpdateGoalDto,
+  ) {
+    return this.goalsService.update(session, id, dto);
+  }
+
+  @Delete(':id')
+  softDelete(@CurrentSession() session: AuthenticatedSession, @Param('id', ParseUUIDPipe) id: string) {
+    return this.goalsService.softDelete(session, id);
+  }
+}