diff --git a/server/api/event/[id].post.ts b/server/api/event/[id].post.ts
index c734b92..7b5314d 100644
--- a/server/api/event/[id].post.ts
+++ b/server/api/event/[id].post.ts
@@ -36,7 +36,7 @@ export default defineProtectedEventHandler(async (event) => {
     .where(eq(events.id, eventId))
     .returning()
 
-  if (updatedEvent.length > 1) {
+  if (updatedEvent.length !== 1) {
     throw createError({
       statusCode: 500,
       statusMessage: 'Internal server error',
diff --git a/server/api/event/index.post.ts b/server/api/event/index.post.ts
index b70ea3e..a15348a 100644
--- a/server/api/event/index.post.ts
+++ b/server/api/event/index.post.ts
@@ -32,7 +32,7 @@ export default defineProtectedEventHandler(async (event) => {
     })
     .returning()
 
-  if (createdEvent.length > 1) {
+  if (createdEvent.length !== 1) {
     throw createError({
       statusCode: 500,
       statusMessage: 'Internal server error',
diff --git a/server/api/user/[id].post.ts b/server/api/user/[id].post.ts
index a4a1f3c..f4a35bf 100644
--- a/server/api/user/[id].post.ts
+++ b/server/api/user/[id].post.ts
@@ -26,7 +26,7 @@ export default defineProtectedEventHandler(async (event) => {
     )
     .returning()
 
-  if (updatedUsers.length > 1) {
+  if (updatedUsers.length !== 1) {
     throw createError({
       statusCode: 500,
       statusMessage: 'Internal server error',
diff --git a/server/api/user/bulk.post.ts b/server/api/user/bulk.post.ts
new file mode 100644
index 0000000..441db63
--- /dev/null
+++ b/server/api/user/bulk.post.ts
@@ -0,0 +1,53 @@
+import { z } from 'zod'
+import { users } from '~/server/db/schema'
+
+const bulkCreateUserRequestBody = z.array(
+  z.object({
+    memberId: z.string().nonempty(),
+    name: z.string().nonempty(),
+    email: z.string().email(),
+    graduationYear: z.number().int().min(2011),
+    memberType: z.enum([
+      'exco',
+      'associate',
+      'affiliate',
+      'ordinary',
+      'revoked',
+    ]),
+  }),
+)
+
+export default defineProtectedEventHandler(async (event) => {
+  const result = await bulkCreateUserRequestBody.safeParseAsync(await readBody(event))
+  if (!result.success) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Bad request',
+    })
+  }
+
+  const { data } = result
+
+  const createdUsers = await event.context.database.insert(users)
+    .values(
+      data.map(user => ({
+        memberId: user.memberId,
+        name: user.name,
+        email: user.email,
+        graduationYear: user.graduationYear,
+        memberType: user.memberType,
+      })),
+    )
+    .returning()
+
+  if (createdUsers.length !== data.length) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: 'Internal server error',
+    })
+  }
+
+  return createdUsers
+}, {
+  restrictTo: ['exco'],
+})
diff --git a/server/api/user/index.get.ts b/server/api/user/index.get.ts
new file mode 100644
index 0000000..6a3a2b1
--- /dev/null
+++ b/server/api/user/index.get.ts
@@ -0,0 +1,8 @@
+export default defineProtectedEventHandler((event) => {
+  return event.context.database.query.users.findMany()
+}, {
+  cache: {
+    maxAge: 60,
+  },
+  restrictTo: ['exco'],
+})
diff --git a/server/api/user/index.post.ts b/server/api/user/index.post.ts
new file mode 100644
index 0000000..b2acc4d
--- /dev/null
+++ b/server/api/user/index.post.ts
@@ -0,0 +1,49 @@
+import { z } from 'zod'
+import { users } from '~/server/db/schema'
+
+const createUserRequestBody = z.object({
+  memberId: z.string().nonempty(),
+  name: z.string().nonempty(),
+  email: z.string().email(),
+  graduationYear: z.number().int().min(2011),
+  memberType: z.enum([
+    'exco',
+    'associate',
+    'affiliate',
+    'ordinary',
+    'revoked',
+  ]),
+})
+
+export default defineProtectedEventHandler(async (event) => {
+  const result = await createUserRequestBody.safeParseAsync(await readBody(event))
+  if (!result.success) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Bad request',
+    })
+  }
+
+  const { data } = result
+
+  const createdUser = await event.context.database.insert(users)
+    .values({
+      memberId: data.memberId,
+      name: data.name,
+      email: data.email,
+      graduationYear: data.graduationYear,
+      memberType: data.memberType,
+    })
+    .returning()
+
+  if (createdUser.length !== 1) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: 'Internal server error',
+    })
+  }
+
+  return createdUser[0]
+}, {
+  restrictTo: ['exco'],
+})