diff --git a/docs/api.md b/docs/api.md
index f634066..3ac6a01 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -6,7 +6,7 @@
 通用返回JSON结构, 接口Response的数据结构说明只包含data部分
 ``` JSON
 {
-    "errcode": 0, //0:成功 4: 帐号被封, 100: 所有未定义的错误
+    "errcode": 0, //0:成功 2: 缺少必要参数(accountid, sessionid) 4: 帐号被封, 5: 帐号未找到 100: 所有未定义的错误
     "errmsg": "", //错误描述
     "data": {}, 	// 数据
 }
@@ -78,6 +78,9 @@
 ```
 
 ### 3. 可用英雄列表
+
+> 这个接口用户信息中的英雄列表最大的不同, 这里返回所有可用英雄, 用户信息中只返回永久免费和玩家拥有的英雄
+
 1. Method: POST
 2. URI:  /api/:accountid/heros
 
diff --git a/src/controllers/AccountController.ts b/src/controllers/AccountController.ts
index 2d8d75c..bbc06d4 100644
--- a/src/controllers/AccountController.ts
+++ b/src/controllers/AccountController.ts
@@ -3,6 +3,7 @@ import {role, router} from "../decorators/router";
 import {Account} from "../models/Account";
 import {ZError} from "../common/ZError";
 import {Hero} from "../models/subdoc/Hero";
+import {Card} from "../models/subdoc/Card";
 
 export default class AccountController extends BaseController {
     @role('anon')
@@ -27,7 +28,6 @@ export default class AccountController extends BaseController {
                 free_expire: 0
             });
         }
-        //TODO:: 添加限免英雄和免费英雄
         result.heros = heros;
         // let hero = new Hero();
         // hero.free = true;
@@ -44,4 +44,42 @@ export default class AccountController extends BaseController {
         return result;
     }
 
+    @router('post /api/:accountid/cards')
+    async cardlist(req: any) {
+        let account = req.user;
+        let result: Card[] = [];
+        for (let cardid of account.cards) {
+            let card = new Card();
+            card.cardid = cardid;
+            card.owned = true;
+            card.ban = false;
+            card.usetype = 0;
+            card.free = false;
+            result.push(card);
+        }
+        //TODO:: 添加限免英雄和免费英雄
+        return result;
+    }
+
+    @router('post /api/:accountid/heros')
+    async herolist(req: any) {
+        let account = req.user;
+        let heros: any[] = [];
+        for(let [key, hero] of account.heros) {
+            heros.push({
+                heroid: hero.heroid,
+                owned: true,
+                usetype: 0,
+                level: hero.level,
+                exp: hero.exp,
+                free: hero.free,
+                free_expire: 0
+            });
+        }
+        //TODO:: 添加限免英雄和免费英雄
+        return heros;
+    }
+
+
+
 }
diff --git a/src/plugins/apiauth.ts b/src/plugins/apiauth.ts
index 7118bd6..515f57e 100644
--- a/src/plugins/apiauth.ts
+++ b/src/plugins/apiauth.ts
@@ -5,6 +5,7 @@ import {
 } from 'fastify';
 import fastifyPlugin from 'fastify-plugin';
 import {Account} from '../models/Account';
+import {ZError} from "../common/ZError";
 
 declare module 'fastify' {
     interface FastifyInstance {
@@ -34,18 +35,20 @@ const apiAuthPlugin: FastifyPluginAsync = async function(
                 //     return reply.send({code: 11, msg: 'need accountid and sessionid'});
                 // }
                 if (!accountid) {
-                    return reply.send({code: 11, msg: 'need accountid and sessionid'});
+                    return reply.send({code: 2, msg: 'need accountid and sessionid'});
                 }
                 // const data = this.jwt.verify(request.token);
                 // if (!data || !data.id) {
                 //     return reply.send({code: 10, msg: 'need login'});
                 // }
-                // let account = await Account.findById(data.id);
-                // if (!account) {
-                //     return reply.send({code: 10, msg: 'need login'});
-                // }
-                // request.user = account;
-
+                let account = await Account.findById(accountid);
+                if (!account) {
+                    return reply.send({code: 5, msg: 'account not found'});
+                }
+                if (account.locked) {
+                    return reply.send({code: 4, msg: 'account locked'});
+                }
+                request.user = account;
             } catch (err) {
                 return reply.send({code: 401, msg: 'need auth'})
             }