diff --git a/internal/server/io_markers.go b/internal/server/io_markers.go
new file mode 100644
index 0000000..5568e0f
--- /dev/null
+++ b/internal/server/io_markers.go
@@ -0,0 +1,109 @@
+package server
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"mgit.msbls.de/m/mcables/internal/db"
+)
+
+type ioMarkerCreate struct {
+	FrameID *int64  `json:"frame_id,omitempty"`
+	Label   string  `json:"label,omitempty"`
+	X       float64 `json:"x"`
+	Y       float64 `json:"y"`
+}
+
+// ioMarkerPatch mirrors devicePatch's frame_id tri-state — see
+// devicePatch + parseFrameRef in frames_devices.go for the wire format.
+type ioMarkerPatch struct {
+	Label   *string         `json:"label,omitempty"`
+	FrameID json.RawMessage `json:"frame_id,omitempty"`
+	X       *float64        `json:"x,omitempty"`
+	Y       *float64        `json:"y,omitempty"`
+}
+
+func (h *handlers) listIOMarkers(w http.ResponseWriter, r *http.Request) {
+	pid, ok := parseInt64Path(r, "pid")
+	if !ok {
+		writeError(w, db.ErrInvalidInput, "pid must be a positive integer")
+		return
+	}
+	ms, err := h.store.ListIOMarkers(pid)
+	if err != nil {
+		writeError(w, err, nil)
+		return
+	}
+	writeJSON(w, http.StatusOK, ms)
+}
+
+func (h *handlers) createIOMarker(w http.ResponseWriter, r *http.Request) {
+	pid, ok := parseInt64Path(r, "pid")
+	if !ok {
+		writeError(w, db.ErrInvalidInput, "pid must be a positive integer")
+		return
+	}
+	var body ioMarkerCreate
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, errors.Join(db.ErrInvalidInput, err), nil)
+		return
+	}
+	m, err := h.store.CreateIOMarker(pid, db.IOMarkerCreate{
+		FrameID: body.FrameID, Label: body.Label, X: body.X, Y: body.Y,
+	})
+	if err != nil {
+		writeError(w, err, nil)
+		return
+	}
+	writeJSON(w, http.StatusCreated, m)
+}
+
+func (h *handlers) patchIOMarker(w http.ResponseWriter, r *http.Request) {
+	pid, ok := parseInt64Path(r, "pid")
+	if !ok {
+		writeError(w, db.ErrInvalidInput, "pid must be a positive integer")
+		return
+	}
+	id, ok := parseInt64Path(r, "id")
+	if !ok {
+		writeError(w, db.ErrInvalidInput, "id must be a positive integer")
+		return
+	}
+	var body ioMarkerPatch
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, errors.Join(db.ErrInvalidInput, err), nil)
+		return
+	}
+	ref, err := parseFrameRef(body.FrameID)
+	if err != nil {
+		writeError(w, errors.Join(db.ErrInvalidInput, err), "frame_id must be an integer or null")
+		return
+	}
+	m, err := h.store.UpdateIOMarker(pid, id, db.IOMarkerUpdate{
+		Label: body.Label, FrameID: ref, X: body.X, Y: body.Y,
+	})
+	if err != nil {
+		writeError(w, err, nil)
+		return
+	}
+	writeJSON(w, http.StatusOK, m)
+}
+
+func (h *handlers) deleteIOMarker(w http.ResponseWriter, r *http.Request) {
+	pid, ok := parseInt64Path(r, "pid")
+	if !ok {
+		writeError(w, db.ErrInvalidInput, "pid must be a positive integer")
+		return
+	}
+	id, ok := parseInt64Path(r, "id")
+	if !ok {
+		writeError(w, db.ErrInvalidInput, "id must be a positive integer")
+		return
+	}
+	if err := h.store.DeleteIOMarker(pid, id); err != nil {
+		writeError(w, err, nil)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
diff --git a/internal/server/server.go b/internal/server/server.go
index e28c0e9..2f3817d 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -45,6 +45,12 @@ func New(store *db.Store, frontend fs.FS) http.Handler {
 	mux.HandleFunc("PATCH /api/projects/{pid}/devices/{id}", h.patchDevice)
 	mux.HandleFunc("DELETE /api/projects/{pid}/devices/{id}", h.deleteDevice)
 
+	// IO markers (project-scoped) — wall-outlet terminators
+	mux.HandleFunc("GET /api/projects/{pid}/io-markers", h.listIOMarkers)
+	mux.HandleFunc("POST /api/projects/{pid}/io-markers", h.createIOMarker)
+	mux.HandleFunc("PATCH /api/projects/{pid}/io-markers/{id}", h.patchIOMarker)
+	mux.HandleFunc("DELETE /api/projects/{pid}/io-markers/{id}", h.deleteIOMarker)
+
 	// Frontend (embedded). Serve "/" → index.html via http.FileServerFS.
 	// Wrap in noCache so the browser revalidates with the ETag/Last-Modified
 	// the file server already emits — without this, browsers cache aggressively