diff --git a/backend/app/api/v1/reviews.py b/backend/app/api/v1/reviews.py
new file mode 100644
index 0000000..eb6c8a5
--- /dev/null
+++ b/backend/app/api/v1/reviews.py
@@ -0,0 +1,59 @@
+"""Review gate endpoints."""
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy.orm import Session
+from typing import List, Optional
+from app.database import get_db
+from app.schemas.review import ReviewResponse, ReviewDecision, ReviewCreate
+from app.services.review_service import ReviewService
+from app.api.deps import get_current_user, require_roles
+from app.core.permissions import Role
+from app.models.user import User
+
+router = APIRouter(prefix="/reviews")
+
+
+@router.get("", response_model=List[ReviewResponse])
+def list_reviews(
+    status: Optional[str] = None,
+    project_id: Optional[int] = None,
+    skip: int = 0, limit: int = 100,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    return ReviewService.list_reviews(db, user.tenant_id, status, project_id, skip, limit)
+
+
+@router.post("", response_model=ReviewResponse, status_code=201)
+def create_review(
+    req: ReviewCreate,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    return ReviewService.create_review(db, user.tenant_id, req)
+
+
+@router.get("/{review_id}", response_model=ReviewResponse)
+def get_review(
+    review_id: int,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    r = ReviewService.get_review(db, user.tenant_id, review_id)
+    if not r:
+        raise HTTPException(status_code=404, detail="Review not found")
+    return r
+
+
+@router.post("/{review_id}/decision", response_model=ReviewResponse)
+def make_decision(
+    review_id: int,
+    req: ReviewDecision,
+    user: User = Depends(require_roles(Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER, Role.REVIEWER)),
+    db: Session = Depends(get_db),
+):
+    try:
+        return ReviewService.make_decision(
+            db, user.tenant_id, review_id, user.id, user.role, req
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))