diff --git a/src/main/java/net/hostsharing/hsadminng/config/WebSecurityConfig.java b/src/main/java/net/hostsharing/hsadminng/config/WebSecurityConfig.java
index 48ab8875..3585dd8c 100644
--- a/src/main/java/net/hostsharing/hsadminng/config/WebSecurityConfig.java
+++ b/src/main/java/net/hostsharing/hsadminng/config/WebSecurityConfig.java
@@ -16,6 +16,7 @@ public class WebSecurityConfig {
     public SecurityFilterChain securityFilterChain(final HttpSecurity http) throws Exception {
         return http
                 .authorizeHttpRequests(authorize -> authorize
+                        .requestMatchers("/api/**").permitAll() // TODO.impl: implement authentication
                         .requestMatchers("/actuator/**").permitAll()
                         .anyRequest().authenticated()
                 )
diff --git a/src/test/java/net/hostsharing/hsadminng/HsadminNgApplicationIntegrationTest.java b/src/test/java/net/hostsharing/hsadminng/config/WebSecurityConfigIntegrationTest.java
similarity index 72%
rename from src/test/java/net/hostsharing/hsadminng/HsadminNgApplicationIntegrationTest.java
rename to src/test/java/net/hostsharing/hsadminng/config/WebSecurityConfigIntegrationTest.java
index 0c8881f7..8b2bf3a0 100644
--- a/src/test/java/net/hostsharing/hsadminng/HsadminNgApplicationIntegrationTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/config/WebSecurityConfigIntegrationTest.java
@@ -1,4 +1,4 @@
-package net.hostsharing.hsadminng;
+package net.hostsharing.hsadminng.config;
 
 import java.util.Map;
 
@@ -14,8 +14,12 @@ import org.springframework.test.context.TestPropertySource;
 import static org.assertj.core.api.Assertions.assertThat;
 
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@TestPropertySource(properties = {"management.port=0"})
-class HsadminNgApplicationIntegrationTest {
+@TestPropertySource(properties = {"management.port=0", "server.port=0"})
+// IMPORTANT: To test prod config, do not use test profile!
+class WebSecurityConfigIntegrationTest {
+
+    @Value("${local.server.port}")
+    private int serverPort;
 
     @Value("${local.management.port}")
     private int managementPort;
@@ -23,6 +27,14 @@ class HsadminNgApplicationIntegrationTest {
     @Autowired
     private TestRestTemplate restTemplate;
 
+    @Test
+    public void shouldSupportPingEndpoint() {
+        final var result = this.restTemplate.getForEntity(
+                "http://localhost:" + this.serverPort + "/api/ping", String.class);
+        assertThat(result.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(result.getBody()).startsWith("pong");
+    }
+
     @Test
     public void shouldSupportActuatorEndpoint() {
         final var result = this.restTemplate.getForEntity(