diff --git a/config/packages/nelmio_api_doc.yaml b/config/packages/nelmio_api_doc.yaml
index 49771041..24c0be7e 100644
--- a/config/packages/nelmio_api_doc.yaml
+++ b/config/packages/nelmio_api_doc.yaml
@@ -39,7 +39,7 @@ nelmio_api_doc:
             description: |
                 JSON API for the Kimai 2 time-tracking software. Read more about its usage in the [API documentation](https://www.kimai.org/documentation/rest-api.html) and then download a [Swagger file](doc.json) for import e.g. in Postman.
                 Be aware: it is not yet considered stable and BC breaks might happen, but we try to avoid them.
-            version: '0.3'
+            version: '0.4'
         securityDefinitions:
             apiUser:
                 type: apiKey
diff --git a/src/API/ActivityController.php b/src/API/ActivityController.php
index badf15ba..8217099e 100644
--- a/src/API/ActivityController.php
+++ b/src/API/ActivityController.php
@@ -22,6 +22,7 @@ use FOS\RestBundle\Controller\Annotations\RouteResource;
 use FOS\RestBundle\Request\ParamFetcherInterface;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 use Swagger\Annotations as SWG;
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
@@ -75,10 +76,10 @@ class ActivityController extends BaseApiController
      * @Rest\QueryParam(name="order", requirements="ASC|DESC", strict=true, nullable=true, description="The result order. Allowed values: ASC, DESC (default: ASC)")
      * @Rest\QueryParam(name="term", requirements="[a-zA-Z0-9 \-,:]+", strict=true, nullable=true, description="Free search term")
      *
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function cgetAction(ParamFetcherInterface $paramFetcher)
+    public function cgetAction(ParamFetcherInterface $paramFetcher): Response
     {
         $query = new ActivityQuery();
 
@@ -133,10 +134,10 @@ class ActivityController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function getAction($id)
+    public function getAction(int $id): Response
     {
         $data = $this->repository->find($id);
 
@@ -168,13 +169,10 @@ class ActivityController extends BaseApiController
      *      @SWG\Schema(ref="#/definitions/ActivityEditForm")
      * )
      *
-     * @param Request $request
-     * @return Response
-     * @throws \App\Repository\RepositoryException
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function postAction(Request $request)
+    public function postAction(Request $request): Response
     {
         if (!$this->isGranted('create_activity')) {
             throw new AccessDeniedHttpException('User cannot create activities');
@@ -229,13 +227,10 @@ class ActivityController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param Request $request
-     * @param string $id
-     * @return Response
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function patchAction(Request $request, string $id)
+    public function patchAction(Request $request, int $id): Response
     {
         $activity = $this->repository->find($id);
 
@@ -288,13 +283,10 @@ class ActivityController extends BaseApiController
      * @Rest\RequestParam(name="name", strict=true, nullable=false, description="The meta-field name")
      * @Rest\RequestParam(name="value", strict=true, nullable=false, description="The meta-field value")
      *
-     * @param int $id
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function metaAction($id, ParamFetcherInterface $paramFetcher)
+    public function metaAction(int $id, ParamFetcherInterface $paramFetcher): Response
     {
         $activity = $this->repository->find($id);
 
diff --git a/src/API/ConfigurationController.php b/src/API/ConfigurationController.php
index dad3c0d9..efcdf8a1 100644
--- a/src/API/ConfigurationController.php
+++ b/src/API/ConfigurationController.php
@@ -17,8 +17,10 @@ use App\Entity\User;
 use FOS\RestBundle\Controller\Annotations as Rest;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 use Swagger\Annotations as SWG;
+use Symfony\Component\HttpFoundation\Response;
 
 /**
  * @Security("is_granted('IS_AUTHENTICATED_REMEMBERED')")
@@ -54,8 +56,11 @@ class ConfigurationController extends BaseApiController
      * )
      *
      * @Rest\Get(path="/config/i18n")
+     *
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function i18nAction()
+    public function i18nAction(): Response
     {
         /** @var User $user */
         $user = $this->getUser();
diff --git a/src/API/CustomerController.php b/src/API/CustomerController.php
index 62821d65..afb70774 100644
--- a/src/API/CustomerController.php
+++ b/src/API/CustomerController.php
@@ -22,6 +22,7 @@ use FOS\RestBundle\Controller\Annotations\RouteResource;
 use FOS\RestBundle\Request\ParamFetcherInterface;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 use Swagger\Annotations as SWG;
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
@@ -72,10 +73,10 @@ class CustomerController extends BaseApiController
      * @Rest\QueryParam(name="orderBy", requirements="id|name", strict=true, nullable=true, description="The field by which results will be ordered. Allowed values: id, name (default: name)")
      * @Rest\QueryParam(name="term", requirements="[a-zA-Z0-9 \-,:]+", strict=true, nullable=true, description="Free search term")
      *
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function cgetAction(ParamFetcherInterface $paramFetcher)
+    public function cgetAction(ParamFetcherInterface $paramFetcher): Response
     {
         $query = new CustomerQuery();
         $query->setCurrentUser($this->getUser());
@@ -112,10 +113,10 @@ class CustomerController extends BaseApiController
      *      @SWG\Schema(ref="#/definitions/CustomerEntity"),
      * )
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function getAction($id)
+    public function getAction(int $id): Response
     {
         $data = $this->repository->find($id);
 
@@ -147,13 +148,10 @@ class CustomerController extends BaseApiController
      *      @SWG\Schema(ref="#/definitions/CustomerEditForm")
      * )
      *
-     * @param Request $request
-     * @return Response
-     * @throws \App\Repository\RepositoryException
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function postAction(Request $request)
+    public function postAction(Request $request): Response
     {
         if (!$this->isGranted('create_customer')) {
             throw new AccessDeniedHttpException('User cannot create customers');
@@ -208,13 +206,10 @@ class CustomerController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param Request $request
-     * @param string $id
-     * @return Response
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function patchAction(Request $request, string $id)
+    public function patchAction(Request $request, int $id): Response
     {
         $customer = $this->repository->find($id);
 
@@ -267,13 +262,10 @@ class CustomerController extends BaseApiController
      * @Rest\RequestParam(name="name", strict=true, nullable=false, description="The meta-field name")
      * @Rest\RequestParam(name="value", strict=true, nullable=false, description="The meta-field value")
      *
-     * @param int $id
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function metaAction($id, ParamFetcherInterface $paramFetcher)
+    public function metaAction(int $id, ParamFetcherInterface $paramFetcher): Response
     {
         $customer = $this->repository->find($id);
 
diff --git a/src/API/ProjectController.php b/src/API/ProjectController.php
index 34ed6ac7..7b6f20df 100644
--- a/src/API/ProjectController.php
+++ b/src/API/ProjectController.php
@@ -22,6 +22,7 @@ use FOS\RestBundle\Controller\Annotations\RouteResource;
 use FOS\RestBundle\Request\ParamFetcherInterface;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 use Swagger\Annotations as SWG;
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
@@ -73,10 +74,10 @@ class ProjectController extends BaseApiController
      * @Rest\QueryParam(name="orderBy", requirements="id|name|customer", strict=true, nullable=true, description="The field by which results will be ordered. Allowed values: id, name, customer (default: name)")
      * @Rest\QueryParam(name="term", requirements="[a-zA-Z0-9 \-,:]+", strict=true, nullable=true, description="Free search term")
      *
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function cgetAction(ParamFetcherInterface $paramFetcher)
+    public function cgetAction(ParamFetcherInterface $paramFetcher): Response
     {
         $query = new ProjectQuery();
         $query->setCurrentUser($this->getUser());
@@ -117,10 +118,10 @@ class ProjectController extends BaseApiController
      *      @SWG\Schema(ref="#/definitions/ProjectEntity"),
      * )
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function getAction($id)
+    public function getAction(int $id): Response
     {
         $data = $this->repository->find($id);
 
@@ -152,13 +153,10 @@ class ProjectController extends BaseApiController
      *      @SWG\Schema(ref="#/definitions/ProjectEditForm")
      * )
      *
-     * @param Request $request
-     * @return Response
-     * @throws \App\Repository\RepositoryException
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function postAction(Request $request)
+    public function postAction(Request $request): Response
     {
         if (!$this->isGranted('create_project')) {
             throw new AccessDeniedHttpException('User cannot create projects');
@@ -213,13 +211,10 @@ class ProjectController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param Request $request
-     * @param string $id
-     * @return Response
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function patchAction(Request $request, string $id)
+    public function patchAction(Request $request, int $id): Response
     {
         $project = $this->repository->find($id);
 
@@ -272,13 +267,10 @@ class ProjectController extends BaseApiController
      * @Rest\RequestParam(name="name", strict=true, nullable=false, description="The meta-field name")
      * @Rest\RequestParam(name="value", strict=true, nullable=false, description="The meta-field value")
      *
-     * @param int $id
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function metaAction($id, ParamFetcherInterface $paramFetcher)
+    public function metaAction(int $id, ParamFetcherInterface $paramFetcher): Response
     {
         $project = $this->repository->find($id);
 
diff --git a/src/API/StatusController.php b/src/API/StatusController.php
index 59e8c27f..f92558e9 100644
--- a/src/API/StatusController.php
+++ b/src/API/StatusController.php
@@ -16,7 +16,9 @@ use FOS\RestBundle\Controller\Annotations as Rest;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
 use Nelmio\ApiDocBundle\Annotation\Model;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Swagger\Annotations as SWG;
+use Symfony\Component\HttpFoundation\Response;
 
 class StatusController extends BaseApiController
 {
@@ -43,8 +45,11 @@ class StatusController extends BaseApiController
      * )
      *
      * @Rest\Get(path="/ping")
+     *
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function pingAction()
+    public function pingAction(): Response
     {
         $view = new View(['message' => 'pong'], 200);
 
@@ -61,8 +66,11 @@ class StatusController extends BaseApiController
      * )
      *
      * @Rest\Get(path="/version")
+     *
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function versionAction()
+    public function versionAction(): Response
     {
         return $this->viewHandler->handle(new View(new Version(), 200));
     }
diff --git a/src/API/TagController.php b/src/API/TagController.php
index 120ac4b2..16a7323d 100644
--- a/src/API/TagController.php
+++ b/src/API/TagController.php
@@ -13,13 +13,13 @@ namespace App\API;
 
 use App\Entity\Tag;
 use App\Form\API\TagApiEditForm;
-use App\Form\TagEditForm;
 use App\Repository\TagRepository;
 use FOS\RestBundle\Controller\Annotations as Rest;
 use FOS\RestBundle\Controller\Annotations\RouteResource;
 use FOS\RestBundle\Request\ParamFetcherInterface;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 use Swagger\Annotations as SWG;
 use Symfony\Component\HttpFoundation\Request;
@@ -65,10 +65,10 @@ class TagController extends BaseApiController
      *
      * @Rest\QueryParam(name="name", strict=true, nullable=true, description="Search term to filter tag list")
      *
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function cgetAction(ParamFetcherInterface $paramFetcher)
+    public function cgetAction(ParamFetcherInterface $paramFetcher): Response
     {
         $filter = $paramFetcher->get('name');
 
@@ -98,13 +98,10 @@ class TagController extends BaseApiController
      *      @SWG\Schema(ref="#/definitions/TagEditForm")
      * )
      *
-     * @param Request $request
-     * @return Response
-     * @throws \App\Repository\RepositoryException
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function postAction(Request $request)
+    public function postAction(Request $request): Response
     {
         if (!$this->isGranted('manage_tag')) {
             throw new AccessDeniedHttpException('User cannot create tags');
@@ -150,10 +147,10 @@ class TagController extends BaseApiController
      *
      * @Security("is_granted('delete_tag')")
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function deleteAction($id)
+    public function deleteAction(int $id): Response
     {
         $tag = $this->repository->find($id);
 
diff --git a/src/API/TeamController.php b/src/API/TeamController.php
index 48738efb..3d0cd02b 100644
--- a/src/API/TeamController.php
+++ b/src/API/TeamController.php
@@ -17,6 +17,7 @@ use FOS\RestBundle\Controller\Annotations\RouteResource;
 use FOS\RestBundle\Request\ParamFetcherInterface;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 use Swagger\Annotations as SWG;
 use Symfony\Component\HttpFoundation\Response;
@@ -55,9 +56,10 @@ class TeamController extends BaseApiController
      *
      * @Security("is_granted('view_team')")
      *
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function cgetAction(ParamFetcherInterface $paramFetcher)
+    public function cgetAction(ParamFetcherInterface $paramFetcher): Response
     {
         $data = $this->repository->findAll();
 
@@ -76,10 +78,10 @@ class TeamController extends BaseApiController
      *      @SWG\Schema(ref="#/definitions/TeamEntity"),
      * )
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function getAction($id)
+    public function getAction(int $id): Response
     {
         $data = $this->repository->find($id);
 
@@ -112,10 +114,10 @@ class TeamController extends BaseApiController
      *
      * @Security("is_granted('delete_team')")
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function deleteAction($id)
+    public function deleteAction(int $id): Response
     {
         $team = $this->repository->find($id);
 
diff --git a/src/API/TimesheetController.php b/src/API/TimesheetController.php
index c3631bb6..c5aaa75b 100644
--- a/src/API/TimesheetController.php
+++ b/src/API/TimesheetController.php
@@ -30,6 +30,7 @@ use FOS\RestBundle\Controller\Annotations\RouteResource;
 use FOS\RestBundle\Request\ParamFetcherInterface;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Pagerfanta\Pagerfanta;
 use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 use Swagger\Annotations as SWG;
@@ -136,11 +137,10 @@ class TimesheetController extends BaseApiController
      *
      * @Security("is_granted('view_own_timesheet') or is_granted('view_other_timesheet')")
      *
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
-     * @throws \Exception
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function cgetAction(ParamFetcherInterface $paramFetcher)
+    public function cgetAction(ParamFetcherInterface $paramFetcher): Response
     {
         $query = new TimesheetQuery();
         $query->setUser($this->getUser());
@@ -249,10 +249,10 @@ class TimesheetController extends BaseApiController
      *
      * @Security("is_granted('view_own_timesheet') or is_granted('view_other_timesheet')")
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function getAction($id)
+    public function getAction(int $id): Response
     {
         $data = $this->repository->find($id);
 
@@ -290,13 +290,10 @@ class TimesheetController extends BaseApiController
      *
      * @Security("is_granted('create_own_timesheet')")
      *
-     * @param Request $request
-     * @return Response
-     * @throws \App\Repository\RepositoryException
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function postAction(Request $request)
+    public function postAction(Request $request): Response
     {
         $timesheet = new Timesheet();
         $timesheet->setUser($this->getUser());
@@ -367,11 +364,10 @@ class TimesheetController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param Request $request
-     * @param int $id the timesheet to update
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function patchAction(Request $request, int $id)
+    public function patchAction(Request $request, int $id): Response
     {
         $timesheet = $this->repository->find($id);
 
@@ -431,10 +427,10 @@ class TimesheetController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function deleteAction($id)
+    public function deleteAction(int $id): Response
     {
         $timesheet = $this->repository->find($id);
 
@@ -470,10 +466,11 @@ class TimesheetController extends BaseApiController
      * @Rest\QueryParam(name="size", requirements="\d+", strict=true, nullable=true, description="The amount of entries (default: 10)")
      *
      * @Security("is_granted('view_own_timesheet') or is_granted('view_other_timesheet')")
-     * @return Response
-     * @throws \Doctrine\ORM\Query\QueryException
+     *
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function recentAction(ParamFetcherInterface $paramFetcher)
+    public function recentAction(ParamFetcherInterface $paramFetcher): Response
     {
         $user = $this->getUser();
         $begin = $this->dateTime->createDateTime('-1 year');
@@ -515,9 +512,11 @@ class TimesheetController extends BaseApiController
      * )
      *
      * @Security("is_granted('view_own_timesheet')")
-     * @return Response
+     *
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function activeAction()
+    public function activeAction(): Response
     {
         $data = $this->repository->getActiveEntries($this->getUser());
 
@@ -543,13 +542,10 @@ class TimesheetController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param int $id
-     * @return Response
-     * @throws \App\Repository\RepositoryException
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function stopAction($id)
+    public function stopAction(int $id): Response
     {
         $timesheet = $this->repository->find($id);
 
@@ -587,13 +583,10 @@ class TimesheetController extends BaseApiController
      *
      * @Rest\RequestParam(name="copy", requirements="all|tags|rates|meta|description", strict=true, nullable=true, description="Whether data should be copied to the new entry. Allowed values: all, tags, rates, description, meta (default: nothing is copied)")
      *
-     * @param int $id
-     * @return Response
-     * @throws \App\Repository\RepositoryException
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function restartAction($id, ParamFetcherInterface $paramFetcher, ValidatorInterface $validator)
+    public function restartAction(int $id, ParamFetcherInterface $paramFetcher, ValidatorInterface $validator): Response
     {
         $timesheet = $this->repository->find($id);
 
@@ -676,12 +669,10 @@ class TimesheetController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param int $id
-     * @return Response
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function exportAction($id)
+    public function exportAction(int $id): Response
     {
         $timesheet = $this->repository->find($id);
 
@@ -723,13 +714,10 @@ class TimesheetController extends BaseApiController
      * @Rest\RequestParam(name="name", strict=true, nullable=false, description="The meta-field name")
      * @Rest\RequestParam(name="value", strict=true, nullable=false, description="The meta-field value")
      *
-     * @param int $id
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
-     * @throws \Doctrine\ORM\ORMException
-     * @throws \Doctrine\ORM\OptimisticLockException
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function metaAction($id, ParamFetcherInterface $paramFetcher)
+    public function metaAction(int $id, ParamFetcherInterface $paramFetcher): Response
     {
         $timesheet = $this->repository->find($id);
 
diff --git a/src/API/UserController.php b/src/API/UserController.php
index b3b185ec..a6e0fa0d 100644
--- a/src/API/UserController.php
+++ b/src/API/UserController.php
@@ -19,6 +19,7 @@ use FOS\RestBundle\Controller\Annotations\RouteResource;
 use FOS\RestBundle\Request\ParamFetcherInterface;
 use FOS\RestBundle\View\View;
 use FOS\RestBundle\View\ViewHandlerInterface;
+use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
 use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 use Swagger\Annotations as SWG;
 use Symfony\Component\HttpFoundation\Response;
@@ -70,10 +71,10 @@ class UserController extends BaseApiController
      *
      * @Security("is_granted('view_user')")
      *
-     * @param ParamFetcherInterface $paramFetcher
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function cgetAction(ParamFetcherInterface $paramFetcher)
+    public function cgetAction(ParamFetcherInterface $paramFetcher): Response
     {
         $query = new UserQuery();
 
@@ -105,7 +106,7 @@ class UserController extends BaseApiController
      *
      * @SWG\Response(
      *      response=200,
-     *      description="Return one user entity. Required permission: view_user",
+     *      description="Return one user entity.",
      *      @SWG\Schema(ref="#/definitions/UserEntity"),
      * )
      * @SWG\Parameter(
@@ -116,10 +117,10 @@ class UserController extends BaseApiController
      *      required=true,
      * )
      *
-     * @param int $id
-     * @return Response
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
      */
-    public function getAction($id)
+    public function getAction(int $id): Response
     {
         $user = $this->repository->find($id);
 
@@ -136,4 +137,26 @@ class UserController extends BaseApiController
 
         return $this->viewHandler->handle($view);
     }
+
+    /**
+     * Return the current user entity
+     *
+     * @SWG\Response(
+     *      response=200,
+     *      description="Return the current user entity.",
+     *      @SWG\Schema(ref="#/definitions/UserEntity"),
+     * )
+     *
+     * @Rest\Get(path="/users/me")
+     *
+     * @ApiSecurity(name="apiUser")
+     * @ApiSecurity(name="apiToken")
+     */
+    public function meAction(): Response
+    {
+        $view = new View($this->getUser(), 200);
+        $view->getContext()->setGroups(['Default', 'Entity', 'User']);
+
+        return $this->viewHandler->handle($view);
+    }
 }
diff --git a/tests/API/UserControllerTest.php b/tests/API/UserControllerTest.php
index 30b9868e..09a808aa 100644
--- a/tests/API/UserControllerTest.php
+++ b/tests/API/UserControllerTest.php
@@ -72,6 +72,22 @@ class UserControllerTest extends APIControllerBaseTest
 
         $this->assertIsArray($result);
         $this->assertStructure($result);
+        self::assertEquals('1', $result['id']);
+        self::assertEquals('CFO', $result['title']);
+        self::assertEquals('Clara Haynes', $result['alias']);
+    }
+
+    public function testGetMyProfile()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_SUPER_ADMIN);
+        $this->assertAccessIsGranted($client, '/api/users/me');
+        $result = json_decode($client->getResponse()->getContent(), true);
+
+        $this->assertIsArray($result);
+        $this->assertStructure($result);
+        self::assertEquals('6', $result['id']);
+        self::assertEquals('Super Administrator', $result['title']);
+        self::assertEquals('', $result['alias']);
     }
 
     public function testNotFound()