diff --git a/package-lock.json b/package-lock.json
index 8a6413c..a59a913 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -33,8 +33,13 @@
         "@clack/prompts": "^1.7.0",
         "@hpcc-js/wasm-graphviz": "^1.28.0",
         "chalk": "^6.0.0",
-        "dotenv": "^17.4.2",
+        "dotenv": "^17.4.2"
+      },
+      "devDependencies": {
         "mssql": "^12.7.0"
+      },
+      "peerDependencies": {
+        "mssql": "^12.6.0"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
diff --git a/src/api/routes/article.js b/src/api/routes/article.js
new file mode 100644
index 0000000..94b8b4d
--- /dev/null
+++ b/src/api/routes/article.js
@@ -0,0 +1,104 @@
+import * as db from '../../db/article.js';
+
+function parsePositiveInt(value, field) {
+    const id = Number(value);
+    if (!Number.isInteger(id) || id <= 0) {
+        return { error: `${field} is required` };
+    }
+    return { id };
+}
+
+function articleErrorStatus(error) {
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Parent not found') return 404;
+    if (error.message === 'Article not found') return 404;
+    if (error.message === 'Name required') return 400;
+    return 500;
+}
+
+/**
+ * Registers article routes (requires auth middleware).
+ * @param {import('express').Application} app - Express app
+ * @param {string} [basePath=''] - Optional URL prefix for all routes in this module
+ */
+export function register(app, basePath = '') {
+    /**
+     * @route POST /article
+     * @description Creates an article under an authorized category (`parentId`).
+     * @body {number} parentId - Category id
+     * @body {string} name
+     * @returns {Object} 201 - `{ article: { id, parentId, name, sku } }`
+     */
+    app.post(`${basePath}/article`, async (req, res) => {
+        const parent = parsePositiveInt(req.body?.parentId, 'parentId');
+        if (parent.error) {
+            return res.status(400).json({ error: parent.error });
+        }
+
+        const name = typeof req.body?.name === 'string' ? req.body.name.trim() : '';
+        if (!name) {
+            return res.status(400).json({ error: 'name is required' });
+        }
+
+        try {
+            const article = await db.createUnderParent({
+                googleAuthId: req.user.id,
+                parentId: parent.id,
+                name,
+            });
+            res.status(201).json({ article });
+        } catch (error) {
+            const status = articleErrorStatus(error);
+            if (status === 500) console.error('Create article failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @route GET /article/:sku
+     * @description Returns an article by SKU if the user may access its category.
+     * @returns {Object} 200 - `{ article }`
+     */
+    app.get(`${basePath}/article/:sku`, async (req, res) => {
+        const sku = typeof req.params.sku === 'string' ? req.params.sku.trim() : '';
+        if (!sku) {
+            return res.status(400).json({ error: 'sku is required' });
+        }
+
+        try {
+            const article = await db.getBySku(req.user.id, decodeURIComponent(sku));
+            res.status(200).json({ article });
+        } catch (error) {
+            const status = articleErrorStatus(error);
+            if (status === 500) console.error('Get article by sku failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @route PATCH /article/:sku
+     * @description Updates an article name by SKU if the user may access its category.
+     * @body {string} name
+     * @returns {Object} 200 - `{ article }`
+     */
+    app.patch(`${basePath}/article/:sku`, async (req, res) => {
+        const sku = typeof req.params.sku === 'string' ? req.params.sku.trim() : '';
+        if (!sku) {
+            return res.status(400).json({ error: 'sku is required' });
+        }
+
+        const name = typeof req.body?.name === 'string' ? req.body.name.trim() : '';
+        if (!name) {
+            return res.status(400).json({ error: 'name is required' });
+        }
+
+        try {
+            const article = await db.updateBySku(req.user.id, decodeURIComponent(sku), { name });
+            res.status(200).json({ article });
+        } catch (error) {
+            const status = articleErrorStatus(error);
+            if (status === 500) console.error('Update article by sku failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+}
diff --git a/src/api/routes/category.js b/src/api/routes/category.js
index 8543e99..6422909 100644
--- a/src/api/routes/category.js
+++ b/src/api/routes/category.js
@@ -24,18 +24,17 @@ function categoryErrorStatus(error) {
 export function register(app, basePath = '') {
     /**
      * @route GET /category/tree
-     * @description Returns the category tree for a company the user belongs to.
-     * @query {number} companyId
+     * @description Returns the category tree for the authenticated user's selected company.
      * @returns {Object} 200 - `{ languageId, tree, articles }`
      */
     app.get(`${basePath}/category/tree`, async (req, res) => {
-        const parsed = parsePositiveInt(req.query.companyId, 'companyId');
-        if (parsed.error) {
-            return res.status(400).json({ error: parsed.error });
+        const companyId = req.user.selectedCompanyId;
+        if (companyId == null) {
+            return res.status(400).json({ error: 'No company selected' });
         }
 
         try {
-            const result = await db.getTreeForCompany(req.user.id, parsed.id);
+            const result = await db.getTreeForCompany(req.user.id, companyId);
             res.status(200).json(result);
         } catch (error) {
             const status = categoryErrorStatus(error);
@@ -76,6 +75,27 @@ export function register(app, basePath = '') {
         }
     });
 
+    /**
+     * @route GET /category/:id/articles
+     * @description Returns articles in a category the user is authorized for.
+     * @returns {Object} 200 - `{ articles }`
+     */
+    app.get(`${basePath}/category/:id/articles`, async (req, res) => {
+        const parsed = parsePositiveInt(req.params.id, 'id');
+        if (parsed.error) {
+            return res.status(400).json({ error: parsed.error });
+        }
+
+        try {
+            const articles = await db.getCategoryArticles(req.user.id, parsed.id);
+            res.status(200).json({ articles });
+        } catch (error) {
+            const status = categoryErrorStatus(error);
+            if (status === 500) console.error('Get category articles failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
     /**
      * @route DELETE /category/:id
      * @description Deletes a category the user is authorized for (not the company root).
diff --git a/src/db/article.js b/src/db/article.js
new file mode 100644
index 0000000..f38c2d8
--- /dev/null
+++ b/src/db/article.js
@@ -0,0 +1,16 @@
+import { getStore } from './store.js';
+
+export async function createUnderParent({ googleAuthId, parentId, name }) {
+    const store = await getStore();
+    return store.article.createUnderParent({ googleAuthId, parentId, name });
+}
+
+export async function getBySku(googleAuthId, sku) {
+    const store = await getStore();
+    return store.article.getBySku(googleAuthId, sku);
+}
+
+export async function updateBySku(googleAuthId, sku, data) {
+    const store = await getStore();
+    return store.article.updateBySku(googleAuthId, sku, data);
+}
diff --git a/src/db/category.js b/src/db/category.js
index 0624c75..f147c6e 100644
--- a/src/db/category.js
+++ b/src/db/category.js
@@ -14,3 +14,8 @@ export async function deleteCategory({ googleAuthId, id }) {
     const store = await getStore();
     await store.category.delete({ googleAuthId, id });
 }
+
+export async function getCategoryArticles(googleAuthId, categoryId) {
+    const store = await getStore();
+    return store.category.getCategoryArticles(googleAuthId, categoryId);
+}