diff --git a/MoneyMap/Controllers/AuditController.cs b/MoneyMap/Controllers/AuditController.cs
new file mode 100644
index 0000000..936afc8
--- /dev/null
+++ b/MoneyMap/Controllers/AuditController.cs
@@ -0,0 +1,26 @@
+using Microsoft.AspNetCore.Mvc;
+using MoneyMap.Services;
+
+namespace MoneyMap.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class AuditController : ControllerBase
+{
+    private readonly IFinancialAuditService _auditService;
+
+    public AuditController(IFinancialAuditService auditService) => _auditService = auditService;
+
+    [HttpGet]
+    public async Task<IActionResult> Get(
+        [FromQuery] DateTime? startDate,
+        [FromQuery] DateTime? endDate,
+        [FromQuery] bool includeTransactions = false)
+    {
+        var end = endDate ?? DateTime.Today;
+        var start = startDate ?? end.AddDays(-90);
+
+        var result = await _auditService.GenerateAuditAsync(start, end, includeTransactions);
+        return Ok(result);
+    }
+}
diff --git a/MoneyMap/Controllers/HealthController.cs b/MoneyMap/Controllers/HealthController.cs
new file mode 100644
index 0000000..f22b541
--- /dev/null
+++ b/MoneyMap/Controllers/HealthController.cs
@@ -0,0 +1,23 @@
+using Microsoft.AspNetCore.Mvc;
+using MoneyMap.Data;
+
+namespace MoneyMap.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class HealthController : ControllerBase
+{
+    private readonly MoneyMapContext _db;
+
+    public HealthController(MoneyMapContext db) => _db = db;
+
+    [HttpGet]
+    public async Task<IActionResult> Get()
+    {
+        var canConnect = await _db.Database.CanConnectAsync();
+        if (!canConnect)
+            return StatusCode(503, new { status = "unhealthy", reason = "database unreachable" });
+
+        return Ok(new { status = "healthy" });
+    }
+}