diff --git a/app/controllers/api/osuny/root_controller.rb b/app/controllers/api/osuny/root_controller.rb
index e147ac6d384c74f4bcbaa54d7e1e0a5ca7a24053..109d38613b73c81dc0d0b1d63af09a3ecd93ecf0 100644
--- a/app/controllers/api/osuny/root_controller.rb
+++ b/app/controllers/api/osuny/root_controller.rb
@@ -4,7 +4,9 @@ class Api::Osuny::RootController < Api::ApplicationController
   end
 
   def theme_released
-    # TODO check security
-    # TODO autoupdate
+    render_forbidden unless params[:secret_key].present? && params[:secret_key] == ENV['OSUNY_API_AUTOUPDATE_THEME_KEY']
+    Communication::Website.with_automatic_update.find_each do |website|
+      website.update_theme_version
+    end
   end
 end
diff --git a/app/views/api/osuny/root/theme_released.json.jbuilder b/app/views/api/osuny/root/theme_released.json.jbuilder
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..9860c147a54cf386a98102c5fc54bfff6ce07801 100644
--- a/app/views/api/osuny/root/theme_released.json.jbuilder
+++ b/app/views/api/osuny/root/theme_released.json.jbuilder
@@ -0,0 +1 @@
+json.status 'ok'
\ No newline at end of file
diff --git a/config/application.sample.yml b/config/application.sample.yml
index 5e3269d246b7d2fdc8139cd4d3f24f1bced034be..2cd58ec221e6b9b33726f8293592326b466df439 100644
--- a/config/application.sample.yml
+++ b/config/application.sample.yml
@@ -15,6 +15,7 @@ OSUNY_DEVELOPMENT_DBNAME:
 
 OSUNY_STAGING_APP_NAME:
 OSUNY_STAGING_PG_ADDON_ID:
+OSUNY_API_AUTOUPDATE_THEME_KEY:
 
 OTP_SECRET_ENCRYPTION_KEY:
 
diff --git a/config/routes/api.rb b/config/routes/api.rb
index 2277ae19d9b44d5bef8ac8c85469ad1db3ee9e5f..f411be0e549a5d13d3e7611bf1e5e652aed0afbb 100644
--- a/config/routes/api.rb
+++ b/config/routes/api.rb
@@ -2,7 +2,7 @@ namespace :api do
   get 'lheo' => 'lheo#index', defaults: { format: :xml }
   namespace :osuny, defaults: { format: :json } do 
     get '/' => 'root#index'
-    get 'theme-released' => 'root#theme_released'
+    post 'theme-released' => 'root#theme_released'
   end
   root to: 'dashboard#index'
 end