diff --git a/src/api/private/private-api.module.ts b/src/api/private/private-api.module.ts
index 9b8b2cb9d..3c8c83db5 100644
--- a/src/api/private/private-api.module.ts
+++ b/src/api/private/private-api.module.ts
@@ -23,6 +23,7 @@ import { MeController } from './me/me.controller';
 import { MediaController } from './media/media.controller';
 import { NotesController } from './notes/notes.controller';
 import { TokensController } from './tokens/tokens.controller';
+import { UsersController } from './users/users.controller';
 
 @Module({
   imports: [
@@ -46,6 +47,8 @@ import { TokensController } from './tokens/tokens.controller';
     NotesController,
     AliasController,
     AuthController,
+    UsersController,
+    GroupController,
   ],
 })
 export class PrivateApiModule {}
diff --git a/src/api/private/users/users.controller.ts b/src/api/private/users/users.controller.ts
new file mode 100644
index 000000000..b03798d1b
--- /dev/null
+++ b/src/api/private/users/users.controller.ts
@@ -0,0 +1,31 @@
+/*
+ * SPDX-FileCopyrightText: 2022 The HedgeDoc developers (see AUTHORS file)
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+import { Controller, Get, Param } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+
+import { ConsoleLoggerService } from '../../../logger/console-logger.service';
+import { UserInfoDto } from '../../../users/user-info.dto';
+import { UsersService } from '../../../users/users.service';
+import { OpenApi } from '../../utils/openapi.decorator';
+
+@ApiTags('users')
+@Controller('users')
+export class UsersController {
+  constructor(
+    private readonly logger: ConsoleLoggerService,
+    private userService: UsersService,
+  ) {
+    this.logger.setContext(UsersController.name);
+  }
+
+  @Get(':username')
+  @OpenApi(200)
+  async getUser(@Param('username') username: string): Promise<UserInfoDto> {
+    return this.userService.toUserDto(
+      await this.userService.getUserByUsername(username),
+    );
+  }
+}
diff --git a/test/private-api/users.e2e-spec.ts b/test/private-api/users.e2e-spec.ts
new file mode 100644
index 000000000..c61b7ea86
--- /dev/null
+++ b/test/private-api/users.e2e-spec.ts
@@ -0,0 +1,42 @@
+/*
+ * SPDX-FileCopyrightText: 2022 The HedgeDoc developers (see AUTHORS file)
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+import request from 'supertest';
+
+import { TestSetup, TestSetupBuilder } from '../test-setup';
+
+describe('Users', () => {
+  let testSetup: TestSetup;
+
+  beforeEach(async () => {
+    testSetup = await TestSetupBuilder.create().withUsers().build();
+    await testSetup.app.init();
+  });
+
+  afterEach(async () => {
+    await testSetup.app.close();
+  });
+
+  test('details for existing users can be retrieved', async () => {
+    let response = await request
+      .agent(testSetup.app.getHttpServer())
+      .get('/api/private/users/testuser1');
+    expect(response.status).toBe(200);
+    expect(response.body.username).toBe('testuser1');
+
+    response = await request
+      .agent(testSetup.app.getHttpServer())
+      .get('/api/private/users/testuser2');
+    expect(response.status).toBe(200);
+    expect(response.body.username).toBe('testuser2');
+  });
+
+  test('details for non-existing users cannot be retrieved', async () => {
+    const response = await request
+      .agent(testSetup.app.getHttpServer())
+      .get('/api/private/users/i_dont_exist');
+    expect(response.status).toBe(404);
+  });
+});