diff --git a/freak/__init__.py b/freak/__init__.py
index b48c2e8..eaa67c4 100644
--- a/freak/__init__.py
+++ b/freak/__init__.py
@@ -26,7 +26,7 @@ from suou import twocolon_list, WantsContentType
 
 from .colors import color_themes, theme_classes
 
-__version__ = '0.5.0-dev40'
+__version__ = '0.5.0-dev42'
 
 APP_BASE_DIR = os.path.dirname(os.path.dirname(__file__))
 
diff --git a/freak/rest/__init__.py b/freak/rest/__init__.py
index acf53e1..1f66eb5 100644
--- a/freak/rest/__init__.py
+++ b/freak/rest/__init__.py
@@ -1,9 +1,10 @@
 
 from __future__ import annotations
+from typing import Iterable
 
-from flask import abort
+from quart import session
+from quart import abort, Blueprint, redirect, request, url_for
 from pydantic import BaseModel
-from quart import Blueprint, redirect, request, url_for
 from quart_auth import AuthUser, current_user, login_required, login_user, logout_user
 from quart_schema import QuartSchema, validate_request, validate_response
 from sqlalchemy import select
@@ -14,6 +15,7 @@ from suou.quart import add_rest
 
 from freak.accounts import LoginStatus, check_login
 from freak.algorithms import public_timeline, top_guilds_query, topic_timeline, user_timeline
+from freak.search import SearchQuery
 
 from ..models import Guild, Post, User, db
 from .. import UserLoader, app, app_config,  __version__ as freak_version, csrf
@@ -55,9 +57,15 @@ async def health():
 
 @bp.get('/oath')
 async def oath():
+    try:
+        ## pull csrf token from session
+        csrf_tok = session['csrf_token']
+    except Exception as e:
+        print(e)
+        abort(503, "csrf_token is null")
     return dict(
         ## XXX might break any time!
-        csrf_token= await csrf._get_csrf_token()
+        csrf_token= csrf_tok
     )
 
 ## TODO coverage of REST is still partial, but it's planned
@@ -257,6 +265,36 @@ async def top_guilds():
             (await session.execute(top_guilds_query().limit(10))).scalars()]
 
         return dict(has=top_g)
+
+## SEARCH ##
+
+class QueryIn(BaseModel):
+    query: str
+
+@bp.post('/search/top')
+@validate_request(QueryIn)
+async def search_top(data: QueryIn):
+    async with db as session:
+        sq = SearchQuery(data.query)
+
+        result: Iterable[Post] = (await session.execute(sq.select(Post, [Post.title]).limit(20))).scalars()
         
+        return dict(has = [p.feed_info() for p in result])
     
 
+## SUGGEST
+
+
+@bp.post("/suggest/guild")
+@validate_request(QueryIn)
+async def suggest_guild(data: QueryIn):
+    if not data.query.isidentifier():
+        return dict(has=[])
+    async with db as session:
+        sq = select(Guild).where(Guild.name.like(data.query + "%"))
+
+        result: Iterable[Guild] = (await session.execute(sq.limit(10))).scalars()
+
+        return dict(has = [g.simple_info() for g in result])
+
+