diff --git a/api-v3/src/inspection-visits/field-findings.controller.ts b/api-v3/src/inspection-visits/field-findings.controller.ts
new file mode 100644
index 0000000..02f7c3d
--- /dev/null
+++ b/api-v3/src/inspection-visits/field-findings.controller.ts
@@ -0,0 +1,51 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  ParseUUIDPipe,
+  Post,
+  Req,
+} from '@nestjs/common';
+import { CurrentAuth } from '../auth/decorators/current-auth.decorator';
+import { RequirePermissions } from '../authorization/decorators/require-permissions.decorator';
+import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
+import type { CreateFieldFindingDto } from './dto/create-field-finding.dto';
+import { FieldFindingsService } from './field-findings.service';
+
+@Controller('inspection-visits/:visitId/field-findings')
+export class FieldFindingsController {
+  constructor(private readonly fieldFindings: FieldFindingsService) {}
+
+  @Get(':assetId/options')
+  @RequirePermissions('inspection_findings.create', 'inspections.execute')
+  options(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @CurrentAuth() principal: AuthPrincipal,
+  ) {
+    return this.fieldFindings.options(visitId, assetId, principal);
+  }
+
+  @Get(':assetId')
+  @RequirePermissions('inspection_findings.read', 'inspections.execute')
+  list(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @CurrentAuth() principal: AuthPrincipal,
+  ) {
+    return this.fieldFindings.list(visitId, assetId, principal);
+  }
+
+  @Post(':assetId')
+  @RequirePermissions('inspection_findings.create', 'inspections.execute')
+  create(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @Body() dto: CreateFieldFindingDto,
+    @CurrentAuth() principal: AuthPrincipal,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.fieldFindings.create(visitId, assetId, dto, principal, request);
+  }
+}