diff --git a/packages/portal/nuxt.config.js b/packages/portal/nuxt.config.js
index 985f380a8f..06d024d628 100644
--- a/packages/portal/nuxt.config.js
+++ b/packages/portal/nuxt.config.js
@@ -43,7 +43,6 @@ const redisConfig = () => {
 const postgresConfig = () => {
   // see https://node-postgres.com/apis/pool
   const postgresOptions = {
-    enabled: featureIsEnabled('eventLogging'),
     connectionString: process.env.POSTGRES_URL,
     connectionTimeoutMillis: Number(process.env.POSTGRES_POOL_CONNECTION_TIMEOUT || 0),
     idleTimeoutMillis: Number(process.env.POSTGRES_POOL_IDLE_TIMEOUT || 10000),
diff --git a/packages/portal/src/components/generic/FeatureIdeas.vue b/packages/portal/src/components/generic/FeatureIdeas.vue
index 945797e03b..4ec7af6125 100644
--- a/packages/portal/src/components/generic/FeatureIdeas.vue
+++ b/packages/portal/src/components/generic/FeatureIdeas.vue
@@ -24,17 +24,18 @@
       >
         <template #footer>
           <b-button
+            v-if="!$fetchState.pending"
             class="vote-button d-inline-flex align-items-center text-uppercase mt-auto mr-auto"
-            :class="{ voted: hasVotedOnFeature(feature.sys.id) }"
+            :class="{ voted: hasVotedOnFeature(feature.identifier) }"
             variant="light-flat"
             :aria-label="$t('actions.vote')"
-            @click="voteOnFeature(feature.sys.id)"
+            @click="voteOnFeature(feature.identifier)"
           >
             <span
               class="mr-1"
               :class="feature.voted ? 'icon-thumbsup' : 'icon-thumbsup-outlined'"
             />
-            {{ $tc('likes.count', voteCountOnFeature(feature.sys.id)) }}
+            {{ $tc('likes.count', voteCountOnFeature(feature.identifier)) }}
           </b-button>
         </template>
       </ContentCard>
@@ -43,7 +44,9 @@
 </template>
 
 <script>
+  import axios from 'axios';
   import keycloakMixin from '@/mixins/keycloak';
+  import { keycloakResponseErrorHandler } from '@/plugins/europeana/auth';
   import ContentCard from '@/components/content/ContentCard';
 
   export default {
@@ -65,54 +68,71 @@
 
     data() {
       return {
+        axiosInstance: null,
         votesOnFeatures: {}
       };
     },
 
-    fetch() {
+    async fetch() {
+      this.axiosInstance = axios.create({
+        baseURL: this.$config.app.baseUrl
+      });
+      this.axiosInstance.interceptors.response.use(
+        (response) => response,
+        (error) => keycloakResponseErrorHandler(this.$nuxt.context, error)
+      );
+
       if (this.features.length < 1) {
         const error = new Error('No feature ideas');
         error.code = 'noFeatureIdeas';
         this.$error(error);
+        return;
       }
 
-      // TODO: fetch the votes for each feature and remove mock functionality
-      // const featureIds = this.features.map((feature) => feature.sys.id).join(',');
-      // this.votesOnFeatures = await this.$axios.$get(`/api/votes/${featureIds}`);
-      for (const feature of this.features) {
-        const featureVotes = { count: Math.floor(Math.random() * 99), currentlyVotedOn: false };
-        this.votesOnFeatures[feature.sys.id] = featureVotes;
-      }
-    },
+      const params = { candidate: this.features.map((feature) => feature.identifier).join(',') };
+      const votesResponse = await this.axiosInstance({
+        url: '/_api/votes',
+        method: 'get',
+        headers: this.headersForAuthorization(),
+        params
+      });
 
-    computed: {
-      userId() {
-        return this.$auth.user?.sub;
-      }
+      this.votesOnFeatures = votesResponse.data;
     },
 
+    // client-side only for oAuth authorization
+    fetchOnServer: false,
+
     methods: {
-      voteOnFeature(featureId) {
-        // TODO: Implement voting on feature and remove mock functionality
-        // await this.$axios.$post(`/api/vote/${featureId}`);
-        console.log('Voting on feature', featureId);
+      headersForAuthorization() {
         if (this.$auth.loggedIn) {
-          if (this.hasVotedOnFeature(featureId)) {
-            this.votesOnFeatures[featureId].count = (this.votesOnFeatures[featureId]?.count || 0) - 1;
-            this.votesOnFeatures[featureId].currentlyVotedOn = false;
-          } else {
-            this.votesOnFeatures[featureId].count = (this.votesOnFeatures[featureId]?.count || 0) + 1;
-            this.votesOnFeatures[featureId].currentlyVotedOn = true;
-          }
+          return {
+            authorization: this.$auth.getToken(this.$auth.strategy?.name)
+          };
+        } else {
+          return {};
+        }
+      },
+      async voteOnFeature(featureId) {
+        if (this.$auth.loggedIn) {
+          const method = this.hasVotedOnFeature(featureId) ? 'delete' : 'put';
+
+          await this.axiosInstance({
+            url: `/_api/votes/${featureId}`,
+            method,
+            headers: this.headersForAuthorization()
+          });
+
+          this.$fetch();
         } else {
           this.keycloakLogin();
         }
       },
       voteCountOnFeature(featureId) {
-        return this.votesOnFeatures[featureId]?.count;
+        return this.votesOnFeatures[featureId]?.total || 0;
       },
       hasVotedOnFeature(featureId) {
-        return this.votesOnFeatures[featureId]?.currentlyVotedOn;
+        return this.votesOnFeatures[featureId]?.votedByCurrentVoter || false;
       }
     }
   };
diff --git a/packages/portal/src/i18n/lang/en.js b/packages/portal/src/i18n/lang/en.js
index ded41d97d5..8895cb5fa8 100644
--- a/packages/portal/src/i18n/lang/en.js
+++ b/packages/portal/src/i18n/lang/en.js
@@ -76,7 +76,8 @@ export default {
     "transcribeNow": "Transcribe now",
     "unlike": "Unlike",
     "viewAt": "View at {link}",
-    "viewDocument": "View document"
+    "viewDocument": "View document",
+    "vote": "Vote"
   },
   "attribution": {
     "country": "Country:",
diff --git a/packages/portal/src/modules/contentful/queries/feature-ideas-page.graphql b/packages/portal/src/modules/contentful/queries/feature-ideas-page.graphql
index ef48eeb2e9..7fa66e9b9d 100644
--- a/packages/portal/src/modules/contentful/queries/feature-ideas-page.graphql
+++ b/packages/portal/src/modules/contentful/queries/feature-ideas-page.graphql
@@ -11,10 +11,8 @@ query featureIdeasPage($locale: String!, $preview: Boolean = false) {
       hasPartCollection {
         items {
           ... on VoteableFeature {
-            sys {
-              id
-            }
             name
+            identifier
             text
             image {
               ... on Illustration {
diff --git a/packages/portal/src/plugins/europeana/auth.js b/packages/portal/src/plugins/europeana/auth.js
index 9931138c6a..84b6d98c0a 100644
--- a/packages/portal/src/plugins/europeana/auth.js
+++ b/packages/portal/src/plugins/europeana/auth.js
@@ -7,6 +7,7 @@ const refreshAccessToken = async({ $auth, $axios, redirect, route }, requestConf
     // Refresh token is no longer valid; clear tokens and try again
     $auth.logout();
     delete requestConfig.headers['Authorization'];
+    delete requestConfig.headers['authorization'];
     return $axios.request(requestConfig);
   }
 
@@ -18,6 +19,7 @@ const refreshAccessToken = async({ $auth, $axios, redirect, route }, requestConf
   updateRefreshToken($auth, refreshAccessTokenResponse);
 
   // Retry request with new access token
+  console.log('retrying request with new access token', requestConfig);
   return $axios.request(requestConfig);
 };
 
@@ -58,6 +60,9 @@ const updateAccessToken = ($auth, requestConfig, refreshAccessTokenResponse) =>
   $auth.strategy._setToken(newAccessToken); // eslint-disable-line no-underscore-dangle
 
   delete requestConfig.headers['Authorization'];
+  delete requestConfig.headers['authorization'];
+  // TODO: use axios instead of $axios, and set new Authorization header here
+  //       from newAccessToken?
 
   return newAccessToken;
 };
diff --git a/packages/portal/src/server-middleware/api/cache/index.js b/packages/portal/src/server-middleware/api/cache/index.js
index e12ac7046d..fee41d6916 100644
--- a/packages/portal/src/server-middleware/api/cache/index.js
+++ b/packages/portal/src/server-middleware/api/cache/index.js
@@ -1,5 +1,4 @@
 import { createClient } from 'redis';
-import { errorHandler } from '../utils.js';
 
 const cacheKey = (id) => `@europeana:portal.js:${id.replace(/\//g, ':')}`;
 
@@ -30,7 +29,7 @@ export const cached = async(ids, config = {}) => {
   return values;
 };
 
-export default (config = {}) => (req, res) => {
+export default (config = {}) => (req, res, next) => {
   const ids = req.params[0] ? req.params[0] : req.query.id;
 
   return cached(ids, config)
@@ -38,5 +37,5 @@ export default (config = {}) => (req, res) => {
       res.set('Content-Type', 'application/json');
       res.send(data);
     })
-    .catch(error => errorHandler(res, error));
+    .catch(next);
 };
diff --git a/packages/portal/src/server-middleware/api/events/index.js b/packages/portal/src/server-middleware/api/events/index.js
new file mode 100644
index 0000000000..2929ab1545
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/events/index.js
@@ -0,0 +1,17 @@
+// TODO: move to a standalone express micro-service, so the portal.js app does
+//       not have a direct dependency on postgres, indeed need not know what
+//       back-end storage is used.
+
+import express from 'express';
+
+import logEvent from './log.js';
+import eventTrending from './trending.js';
+import eventViews from './views.js';
+
+const router = express.Router();
+
+router.post('/', logEvent);
+router.get('/trending', eventTrending);
+router.get('/views', eventViews);
+
+export default router;
diff --git a/packages/portal/src/server-middleware/api/events/log.js b/packages/portal/src/server-middleware/api/events/log.js
index b2598b211c..a2522d0412 100644
--- a/packages/portal/src/server-middleware/api/events/log.js
+++ b/packages/portal/src/server-middleware/api/events/log.js
@@ -1,83 +1,78 @@
 import isbot from 'isbot';
-import pg from './pg.js';
+import pg from '../pg.js';
 
-// TODO: use `next` for error handling
 // TODO: accept multiple uris for the same action
 // TODO: log user agent?
 // TODO: validate action_types
-export default (config = {}) => {
-  pg.config = config;
+export default async(req, res, next) => {
+  try {
+    // Respond early as clients don't need to wait for the results of this logging
+    res.sendStatus(204);
 
-  return async(req, res) => {
-    try {
-      // Respond early as clients don't need to wait for the results of this logging
-      res.sendStatus(204);
+    if (isbot(req.get('user-agent'))) {
+      return;
+    }
 
-      if (!pg.enabled || isbot(req.get('user-agent'))) {
-        return;
-      }
+    const { actionType, objectUri, sessionId } = req.body;
+    const url = new URL(objectUri);
+    // Ignore any search query or hash
+    const uri = `${url.origin}${url.pathname}`;
 
-      const { actionType, objectUri, sessionId } = req.body;
-      const url = new URL(objectUri);
-      // Ignore any search query or hash
-      const uri = `${url.origin}${url.pathname}`;
+    let objectRow;
+    const selectObjectResult = await pg.query(
+      'SELECT id FROM events.objects WHERE uri=$1',
+      [uri]
+    );
 
-      let objectRow;
-      const selectObjectResult = await pg.query(
-        'SELECT id FROM events.objects WHERE uri=$1',
+    if (selectObjectResult.rowCount > 0) {
+      objectRow = selectObjectResult.rows[0];
+    } else {
+      const insertObjectResult = await pg.query(
+        'INSERT INTO events.objects (uri) VALUES($1) RETURNING id',
         [uri]
       );
+      objectRow = insertObjectResult.rows[0];
+    }
 
-      if (selectObjectResult.rowCount > 0) {
-        objectRow = selectObjectResult.rows[0];
-      } else {
-        const insertObjectResult = await pg.query(
-          'INSERT INTO events.objects (uri) VALUES($1) RETURNING id',
-          [uri]
-        );
-        objectRow = insertObjectResult.rows[0];
-      }
+    let sessionRow;
+    const selectSessionResult = await pg.query(
+      'SELECT id FROM events.sessions WHERE uuid=$1',
+      [sessionId]
+    );
 
-      let sessionRow;
-      const selectSessionResult = await pg.query(
-        'SELECT id FROM events.sessions WHERE uuid=$1',
+    if (selectSessionResult.rowCount > 0) {
+      sessionRow = selectSessionResult.rows[0];
+    } else {
+      const insertSessionResult = await pg.query(
+        'INSERT INTO events.sessions (uuid) VALUES($1) RETURNING id',
         [sessionId]
       );
+      sessionRow = insertSessionResult.rows[0];
+    }
 
-      if (selectSessionResult.rowCount > 0) {
-        sessionRow = selectSessionResult.rows[0];
-      } else {
-        const insertSessionResult = await pg.query(
-          'INSERT INTO events.sessions (uuid) VALUES($1) RETURNING id',
-          [sessionId]
-        );
-        sessionRow = insertSessionResult.rows[0];
-      }
-
-      const selectActionResult = await pg.query(`
-        SELECT a.id FROM events.actions a LEFT JOIN events.action_types at
-          ON a.action_type_id=at.id
-        WHERE a.object_id=$1
-          AND at.name=$2
-          AND a.session_id=$3
-        `,
-      [objectRow.id, actionType, sessionRow.id]
-      );
-      if (selectActionResult.rowCount > 0) {
-        // this session has already logged this action type for this object; don't log it again
-        return;
-      }
-
-      await pg.query(`
-        INSERT INTO events.actions (object_id, action_type_id, session_id, occurred_at)
-        SELECT $1, at.id, $2, CURRENT_TIMESTAMP
-        FROM events.action_types at
-        WHERE at.name=$3
-        `,
-      [objectRow.id, sessionRow.id, actionType]
-      );
-    } catch (err) {
-      console.error(err);
+    const selectActionResult = await pg.query(`
+      SELECT a.id FROM events.actions a LEFT JOIN events.action_types at
+        ON a.action_type_id=at.id
+      WHERE a.object_id=$1
+        AND at.name=$2
+        AND a.session_id=$3
+      `,
+    [objectRow.id, actionType, sessionRow.id]
+    );
+    if (selectActionResult.rowCount > 0) {
+      // this session has already logged this action type for this object; don't log it again
+      return;
     }
-  };
+
+    await pg.query(`
+      INSERT INTO events.actions (object_id, action_type_id, session_id, occurred_at)
+      SELECT $1, at.id, $2, CURRENT_TIMESTAMP
+      FROM events.action_types at
+      WHERE at.name=$3
+      `,
+    [objectRow.id, sessionRow.id, actionType]
+    );
+  } catch (err) {
+    next(err);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/events/trending.js b/packages/portal/src/server-middleware/api/events/trending.js
index f46d49f136..9b4d289801 100644
--- a/packages/portal/src/server-middleware/api/events/trending.js
+++ b/packages/portal/src/server-middleware/api/events/trending.js
@@ -1,86 +1,75 @@
-import pg from './pg.js';
+import pg from '../pg.js';
 
-// TODO: use `next` for error handling
-export default (config = {}) => {
-  pg.config = config;
+export default async(req, res, next) => {
+  try {
+    const selectObjectResult = await pg.query(`
+      SELECT uri,
+             previous_score,
+             current_score,
+             CEIL(current_score ^ ((current_score - previous_score) / current_score)) trending_score,
+             last_occurred_at
+      FROM
+        (SELECT current_scores.uri,
+                COALESCE(SUM(current_scores.action_score), 0) current_score,
+                COALESCE(SUM(previous_scores.action_score), 0) previous_score,
+                GREATEST(MAX(current_scores.last_occurred_at), MAX(previous_scores.last_occurred_at)) last_occurred_at
+         FROM
+           (SELECT uri,
+                   num * action_weight AS action_score,
+                   last_occurred_at
+            FROM
+              (SELECT o.uri,
+                      at.name,
+                      COUNT(a.id) AS num,
+                      MAX(a.occurred_at) AS last_occurred_at,
+                      CASE
+                          WHEN at.name = 'view' THEN 1
+                          WHEN at.name = 'download' THEN 2
+                          WHEN at.name = 'like' THEN 4
+                          WHEN at.name = 'add' THEN 6
+                          ELSE 0
+                      END AS action_weight
+               FROM events.actions a
+               LEFT JOIN events.objects o ON a.object_id=o.id
+               LEFT JOIN events.action_types AT ON a.action_type_id=at.id
+               WHERE a.occurred_at > (CURRENT_TIMESTAMP - INTERVAL '1 day')
+                 AND o.uri LIKE '%/item/%'
+               GROUP BY o.uri,
+                        at.name) AS action_counts) AS current_scores
+         LEFT JOIN
+           (SELECT uri,
+                   num * action_weight AS action_score,
+                   last_occurred_at
+            FROM
+              (SELECT o.uri,
+                      at.name,
+                      COUNT(a.id) AS num,
+                      MAX(a.occurred_at) AS last_occurred_at,
+                      CASE
+                          WHEN at.name = 'view' THEN 1
+                          WHEN at.name = 'download' THEN 2
+                          WHEN at.name = 'like' THEN 4
+                          WHEN at.name = 'add' THEN 6
+                          ELSE 0
+                      END AS action_weight
+               FROM events.actions a
+               LEFT JOIN events.objects o ON a.object_id=o.id
+               LEFT JOIN events.action_types AT ON a.action_type_id=at.id
+               WHERE a.occurred_at > (CURRENT_TIMESTAMP - INTERVAL '2 day')
+                 AND a.occurred_at < (CURRENT_TIMESTAMP - INTERVAL '1 day')
+                 AND o.uri LIKE '%/item/%'
+               GROUP BY o.uri,
+                        at.name) AS action_counts) AS previous_scores ON current_scores.uri=previous_scores.uri
+         GROUP BY current_scores.uri) AS scores
+      WHERE current_score > previous_score
+      ORDER BY trending_score DESC,
+               last_occurred_at DESC
+      LIMIT 24
+      `
+    );
 
-  return async(req, res) => {
-    try {
-      if (!pg.enabled) {
-        res.json({ items: [] });
-        return;
-      }
-
-      const selectObjectResult = await pg.query(`
-        SELECT uri,
-               previous_score,
-               current_score,
-               CEIL(current_score ^ ((current_score - previous_score) / current_score)) trending_score,
-               last_occurred_at
-        FROM
-          (SELECT current_scores.uri,
-                  COALESCE(SUM(current_scores.action_score), 0) current_score,
-                  COALESCE(SUM(previous_scores.action_score), 0) previous_score,
-                  GREATEST(MAX(current_scores.last_occurred_at), MAX(previous_scores.last_occurred_at)) last_occurred_at
-           FROM
-             (SELECT uri,
-                     num * action_weight AS action_score,
-                     last_occurred_at
-              FROM
-                (SELECT o.uri,
-                        at.name,
-                        COUNT(a.id) AS num,
-                        MAX(a.occurred_at) AS last_occurred_at,
-                        CASE
-                            WHEN at.name = 'view' THEN 1
-                            WHEN at.name = 'download' THEN 2
-                            WHEN at.name = 'like' THEN 4
-                            WHEN at.name = 'add' THEN 6
-                            ELSE 0
-                        END AS action_weight
-                 FROM events.actions a
-                 LEFT JOIN events.objects o ON a.object_id=o.id
-                 LEFT JOIN events.action_types AT ON a.action_type_id=at.id
-                 WHERE a.occurred_at > (CURRENT_TIMESTAMP - INTERVAL '1 day')
-                   AND o.uri LIKE '%/item/%'
-                 GROUP BY o.uri,
-                          at.name) AS action_counts) AS current_scores
-           LEFT JOIN
-             (SELECT uri,
-                     num * action_weight AS action_score,
-                     last_occurred_at
-              FROM
-                (SELECT o.uri,
-                        at.name,
-                        COUNT(a.id) AS num,
-                        MAX(a.occurred_at) AS last_occurred_at,
-                        CASE
-                            WHEN at.name = 'view' THEN 1
-                            WHEN at.name = 'download' THEN 2
-                            WHEN at.name = 'like' THEN 4
-                            WHEN at.name = 'add' THEN 6
-                            ELSE 0
-                        END AS action_weight
-                 FROM events.actions a
-                 LEFT JOIN events.objects o ON a.object_id=o.id
-                 LEFT JOIN events.action_types AT ON a.action_type_id=at.id
-                 WHERE a.occurred_at > (CURRENT_TIMESTAMP - INTERVAL '2 day')
-                   AND a.occurred_at < (CURRENT_TIMESTAMP - INTERVAL '1 day')
-                   AND o.uri LIKE '%/item/%'
-                 GROUP BY o.uri,
-                          at.name) AS action_counts) AS previous_scores ON current_scores.uri=previous_scores.uri
-           GROUP BY current_scores.uri) AS scores
-        WHERE current_score > previous_score
-        ORDER BY trending_score DESC,
-                 last_occurred_at DESC
-        LIMIT 24
-        `
-      );
-
-      res.json({ items: selectObjectResult.rows });
-    } catch (e) {
-      console.error(e);
-      res.sendStatus(500);
-    }
-  };
+    res.json({ items: selectObjectResult.rows });
+  } catch (err) {
+    next(err);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/events/views.js b/packages/portal/src/server-middleware/api/events/views.js
index 39b7703ab2..9ea8629358 100644
--- a/packages/portal/src/server-middleware/api/events/views.js
+++ b/packages/portal/src/server-middleware/api/events/views.js
@@ -1,55 +1,45 @@
-import pg from './pg.js';
+import pg from '../pg.js';
 
-// TODO: use `next` for error handling
-export default (config = {}) => {
-  pg.config = config;
+export default async(req, res, next) => {
+  try {
+    const url = new URL(req.query?.url);
+    // Ignore any search query or hash
+    const uri = `${url.origin}${url.pathname}`;
 
-  return async(req, res) => {
-    try {
-      if (!pg.enabled) {
-        res.json({ viewCount: 0 });
-        return;
-      }
-      const url = new URL(req.query?.url);
-      // Ignore any search query or hash
-      const uri = `${url.origin}${url.pathname}`;
+    // TODO: update old objects, then stop using legacy uris
+    // @/docker/compose/postgres/model/07-clean-up-blog-objects.psql
+    // TODO: or, stop hard-coding for blog posts/stories, and add redirects/
+    //       aliases to db to support other paths too
+    const legacyUri = url.pathname.startsWith('/stories') ? `${url.origin}${url.pathname.replace('/stories', '/blog')}` : uri;
 
-      // TODO: update old objects, then stop using legacy uris
-      // @/docker/compose/postgres/model/07-clean-up-blog-objects.psql
-      // TODO: or, stop hard-coding for blog posts/stories, and add redirects/
-      //       aliases to db to support other paths too
-      const legacyUri = url.pathname.startsWith('/stories') ? `${url.origin}${url.pathname.replace('/stories', '/blog')}` : uri;
+    const result = await pg.query(`
+      SELECT SUM(views) AS views
+      FROM
+        (SELECT o.uri,
+                at.name AS action_type_name,
+                sum(h.occurrences) AS views
+         FROM events.history h
+         LEFT JOIN events.objects o ON h.object_id=o.id
+         LEFT JOIN events.action_types AT ON h.action_type_id=at.id
+         GROUP BY at.name,
+                  o.uri
+         UNION ALL SELECT o.uri,
+                          at.name AS action_type_name,
+                          count(a.id) AS views
+         FROM events.actions a
+         LEFT JOIN events.objects o ON a.object_id=o.id
+         LEFT JOIN events.action_types AT ON a.action_type_id=at.id
+         GROUP BY at.name,
+                  o.uri) actions_and_history
+      WHERE action_type_name='view' AND (uri=$1 OR uri=$2)
+      `,
+    [uri, legacyUri]
+    );
 
-      const result = await pg.query(`
-        SELECT SUM(views) AS views
-        FROM
-          (SELECT o.uri,
-                  at.name AS action_type_name,
-                  sum(h.occurrences) AS views
-           FROM events.history h
-           LEFT JOIN events.objects o ON h.object_id=o.id
-           LEFT JOIN events.action_types AT ON h.action_type_id=at.id
-           GROUP BY at.name,
-                    o.uri
-           UNION ALL SELECT o.uri,
-                            at.name AS action_type_name,
-                            count(a.id) AS views
-           FROM events.actions a
-           LEFT JOIN events.objects o ON a.object_id=o.id
-           LEFT JOIN events.action_types AT ON a.action_type_id=at.id
-           GROUP BY at.name,
-                    o.uri) actions_and_history
-        WHERE action_type_name='view' AND (uri=$1 OR uri=$2)
-        `,
-      [uri, legacyUri]
-      );
+    const viewCount = Number(result.rows[0]?.views);
 
-      const viewCount = Number(result.rows[0]?.views);
-
-      res.json({ viewCount });
-    } catch (e) {
-      console.error(e);
-      res.sendStatus(500);
-    }
-  };
+    res.json({ viewCount });
+  } catch (err) {
+    next(err);
+  }
 };
diff --git a/packages/portal/src/server-middleware/api/index.js b/packages/portal/src/server-middleware/api/index.js
index 3597077f0a..5cfca2cbdd 100644
--- a/packages/portal/src/server-middleware/api/index.js
+++ b/packages/portal/src/server-middleware/api/index.js
@@ -3,7 +3,9 @@ import cors from 'cors';
 import apm from 'elastic-apm-node';
 
 import logging from '../logging.js';
-import { forbiddenUnlessOriginAllowed, nuxtRuntimeConfig } from './utils.js';
+import pg from './pg.js';
+import keycloak from './keycloak.js';
+import { errorHandler, forbiddenUnlessOriginAllowed, nuxtRuntimeConfig } from './utils.js';
 
 const app = express();
 app.disable('x-powered-by'); // Security: do not disclose technology fingerprints
@@ -11,6 +13,8 @@ app.use(express.json());
 app.use(logging);
 
 const runtimeConfig = nuxtRuntimeConfig();
+pg.config = runtimeConfig.postgres;
+keycloak.config = runtimeConfig.auth.strategies.keycloak;
 
 app.use((req, res, next) => {
   if (apm.isStarted())  {
@@ -30,15 +34,8 @@ const cacheHandler = cache(runtimeConfig.redis);
 app.get('/cache', cacheHandler);
 app.get('/cache/*', cacheHandler);
 
-// TODO: move to a standalone express micro-service, so the portal.js app does
-//       not have a direct dependency on postgres, indeed need not know what
-//       back-end storage is used.
-import logEvent from './events/log.js';
-app.post('/events', logEvent(runtimeConfig.postgres));
-import eventTrending from './events/trending.js';
-app.get('/events/trending', eventTrending(runtimeConfig.postgres));
-import eventViews from './events/views.js';
-app.get('/events/views', eventViews(runtimeConfig.postgres));
+import events from './events/index.js';
+app.use('/events', events);
 
 import jiraServiceDeskFeedback from './jira-service-desk/feedback.js';
 const feedbackCorsOptions = {
@@ -59,6 +56,10 @@ app.post('/jira-service-desk/galleries', jiraServiceDeskGalleries(runtimeConfig.
 import version from './version.js';
 app.get('/version', version);
 
+import polls from './polls/index.js';
+app.use('/votes', polls);
+
 app.all('/*', (req, res) => res.sendStatus(404));
+app.use(errorHandler);
 
 export default app;
diff --git a/packages/portal/src/server-middleware/api/jira-service-desk/feedback.js b/packages/portal/src/server-middleware/api/jira-service-desk/feedback.js
index dbff8bc0fb..7ceefdb949 100644
--- a/packages/portal/src/server-middleware/api/jira-service-desk/feedback.js
+++ b/packages/portal/src/server-middleware/api/jira-service-desk/feedback.js
@@ -1,7 +1,6 @@
 import axios from 'axios';
 import createHttpError from 'http-errors';
 
-import { errorHandler } from '../utils.js';
 import { truncate } from '../../../mixins/truncate.js';
 
 const JIRA_SERVICE_DESK_API_PATH = '/rest/servicedeskapi/request';
@@ -60,12 +59,12 @@ const jiraOptions = (options) => ({
 });
 
 // Docs: https://developer.atlassian.com/cloud/jira/service-desk/rest/api-group-request/#api-rest-servicedeskapi-request-post
-export default (options = {}) => (req, res) => {
+export default (options = {}) => (req, res, next) => {
   return validateFeedback(req.body.feedback)
     .then(() => (axios
       .create({ baseURL: options.origin })
       .post(JIRA_SERVICE_DESK_API_PATH, jiraData(options, req), jiraOptions(options))
-      .then(jiraRes => res.sendStatus(jiraRes.status))
+      .then((jiraRes) => res.sendStatus(jiraRes.status))
     ))
-    .catch(error => errorHandler(res, error));
+    .catch(next);
 };
diff --git a/packages/portal/src/server-middleware/api/jira-service-desk/galleries.js b/packages/portal/src/server-middleware/api/jira-service-desk/galleries.js
index f9f0a30945..dfbc26507f 100644
--- a/packages/portal/src/server-middleware/api/jira-service-desk/galleries.js
+++ b/packages/portal/src/server-middleware/api/jira-service-desk/galleries.js
@@ -1,6 +1,5 @@
 import axios from 'axios';
 
-import { errorHandler } from '../utils.js';
 import { truncate } from '../../../mixins/truncate.js';
 
 const JIRA_SERVICE_DESK_API_PATH = '/rest/servicedeskapi/request';
@@ -45,9 +44,9 @@ const jiraOptions = options => ({
 });
 
 // Docs: https://developer.atlassian.com/cloud/jira/service-desk/rest/api-group-request/#api-rest-servicedeskapi-request-post
-export default (options = {}) => (req, res) => {
+export default (options = {}) => (req, res, next) => {
   return axios.create({ baseURL: options.origin })
     .post(JIRA_SERVICE_DESK_API_PATH, jiraData(options, req), jiraOptions(options))
-    .then(jiraRes => res.sendStatus(jiraRes.status))
-    .catch(error => errorHandler(res, error));
+    .then((jiraRes) => res.sendStatus(jiraRes.status))
+    .catch(next);
 };
diff --git a/packages/portal/src/server-middleware/api/keycloak.js b/packages/portal/src/server-middleware/api/keycloak.js
new file mode 100644
index 0000000000..77c193089e
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/keycloak.js
@@ -0,0 +1,24 @@
+import axios from 'axios';
+
+export default {
+  config: {},
+
+  async userInfo(authorization) {
+    const keycloakUserinfoResponse = await axios({
+      baseURL: this.config.origin,
+      url: `/auth/realms/${this.config.realm}/protocol/openid-connect/userinfo`,
+      method: 'get',
+      headers: { authorization }
+    });
+    return keycloakUserinfoResponse.data;
+  },
+
+  async userId(authorization) {
+    let id = null;
+    if (authorization) {
+      const userInfo = await this.userInfo(authorization);
+      id = userInfo?.sub || null;
+    }
+    return id;
+  }
+};
diff --git a/packages/portal/src/server-middleware/api/events/pg.js b/packages/portal/src/server-middleware/api/pg.js
similarity index 100%
rename from packages/portal/src/server-middleware/api/events/pg.js
rename to packages/portal/src/server-middleware/api/pg.js
diff --git a/packages/portal/src/server-middleware/api/polls/index.js b/packages/portal/src/server-middleware/api/polls/index.js
new file mode 100644
index 0000000000..07819e963b
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/index.js
@@ -0,0 +1,13 @@
+import express from 'express';
+
+import getVotes from './votes.js';
+import putPollVote from './vote.js';
+import deletePollVote from './remove-vote.js';
+
+const router = express.Router();
+
+router.get('/', getVotes);
+router.put('/:candidateExternalId', putPollVote);
+router.delete('/:candidateExternalId', deletePollVote);
+
+export default router;
diff --git a/packages/portal/src/server-middleware/api/polls/model.js b/packages/portal/src/server-middleware/api/polls/model.js
new file mode 100644
index 0000000000..352a2e9df7
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/model.js
@@ -0,0 +1,82 @@
+import pg from '../pg.js';
+
+const findVoter = async(voterExternalId) => {
+  const selectVoterResult = await pg.query(
+    'SELECT id FROM polls.voters WHERE external_id=$1',
+    [voterExternalId]
+  );
+  return (selectVoterResult.rowCount > 0) ? selectVoterResult.rows[0] : null;
+};
+
+const createVoter = async(voterExternalId) => {
+  const insertVoterResult = await pg.query(
+    'INSERT INTO polls.voters (external_id) VALUES($1) RETURNING id',
+    [voterExternalId]
+  );
+  return insertVoterResult.rows[0];
+};
+
+const findCandidate = async(candidateExternalId) => {
+  const selectCandidateResult = await pg.query(
+    'SELECT id FROM polls.candidates WHERE external_id=$1',
+    [candidateExternalId]
+  );
+  return (selectCandidateResult.rowCount > 0) ? selectCandidateResult.rows[0] : null;
+};
+
+// TODO: sanity check this against external data sources?
+const createCandidate = async(candidateExternalId) => {
+  const insertCandidateResult = await pg.query(
+    'INSERT INTO polls.candidates (external_id) VALUES($1) RETURNING id',
+    [candidateExternalId]
+  );
+  return insertCandidateResult.rows[0];
+};
+
+const findVote = async(voterId, candidateId) => {
+  const selectVoteResult = await pg.query(
+    'SELECT id FROM polls.votes WHERE voter_id=$1 AND candidate_id=$2',
+    [voterId, candidateId]
+  );
+  return (selectVoteResult.rowCount > 0) ? selectVoteResult.rows[0] : null;
+};
+
+const findVotes = async(voterId, candidateExternalIds) => {
+  const selectVotesResult = await pg.query(
+    `
+      SELECT c.external_id, COUNT(*) AS total, (SELECT COUNT(*) FROM polls.votes WHERE voter_id=$2 AND candidate_id=c.id) AS voted_by_current_voter
+        FROM polls.votes v LEFT JOIN polls.candidates c
+        ON v.candidate_id=c.id
+        WHERE c.external_id LIKE ANY($1)
+        GROUP BY (c.id)
+    `,
+    [candidateExternalIds, voterId]
+  );
+  return selectVotesResult.rows || [];
+};
+
+const createVote = async(voterId, candidateId) => {
+  const insertVoteResult = await pg.query(
+    'INSERT INTO polls.votes (voter_id, candidate_id, occurred_at) VALUES($1, $2, CURRENT_TIMESTAMP)',
+    [voterId, candidateId]
+  );
+  return insertVoteResult.rows[0];
+};
+
+const deleteVote = async(voteId) => {
+  return await pg.query(
+    'DELETE FROM polls.votes WHERE id=$1',
+    [voteId]
+  );
+};
+
+export default {
+  createCandidate,
+  createVote,
+  createVoter,
+  deleteVote,
+  findCandidate,
+  findVote,
+  findVotes,
+  findVoter
+};
diff --git a/packages/portal/src/server-middleware/api/polls/remove-vote.js b/packages/portal/src/server-middleware/api/polls/remove-vote.js
new file mode 100644
index 0000000000..0db96dc03d
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/remove-vote.js
@@ -0,0 +1,37 @@
+import createHttpError from 'http-errors';
+
+import db from './model.js';
+import keycloak from '../keycloak.js';
+
+export default async(req, res, next) => {
+  try {
+    const voterExternalId = await keycloak.userId(req.headers.authorization);
+    if (voterExternalId === null) {
+      throw createHttpError(401);
+    }
+
+    const voterRow = await db.findVoter(voterExternalId);
+    if (!voterRow) {
+      // voter doesn't exist, can't have voted on anything
+      throw createHttpError(403);
+    }
+
+    const { candidateExternalId } = req.params;
+    const candidateRow = await db.findCandidate(candidateExternalId);
+    if (!candidateRow) {
+      // candidate doesn't exist, can't have been voted on
+      throw createHttpError(404);
+    }
+
+    const voteRow = await db.findVote(voterRow.id, candidateRow.id);
+    if (!voteRow) {
+      // vote doesn't exist, no need to remove
+      throw createHttpError(404);
+    }
+
+    await db.deleteVote(voteRow.id);
+    res.sendStatus(204);
+  } catch (err) {
+    next(err);
+  }
+};
diff --git a/packages/portal/src/server-middleware/api/polls/vote.js b/packages/portal/src/server-middleware/api/polls/vote.js
new file mode 100644
index 0000000000..569cb0f3dd
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/vote.js
@@ -0,0 +1,27 @@
+import createHttpError from 'http-errors';
+
+import db from './model.js';
+import keycloak from '../keycloak.js';
+
+export default async(req, res, next) => {
+  try {
+    const voterExternalId = await keycloak.userId(req.headers.authorization);
+    if (voterExternalId === null) {
+      throw createHttpError(401);
+    }
+
+    const { candidateExternalId } = req.params;
+
+    const voterRow = await db.findVoter(voterExternalId) || await db.createVoter(voterExternalId);
+    const candidateRow = await db.findCandidate(candidateExternalId) || await db.createCandidate(candidateExternalId);
+    if (await db.findVote(voterRow.id, candidateRow.id)) {
+      // Voter has already voted for this candidate
+      throw createHttpError(409);
+    }
+
+    await db.createVote(voterRow.id, candidateRow.id);
+    res.sendStatus(204);
+  } catch (err) {
+    next(err);
+  }
+};
diff --git a/packages/portal/src/server-middleware/api/polls/votes.js b/packages/portal/src/server-middleware/api/polls/votes.js
new file mode 100644
index 0000000000..22d5779e6c
--- /dev/null
+++ b/packages/portal/src/server-middleware/api/polls/votes.js
@@ -0,0 +1,22 @@
+import db from './model.js';
+import keycloak from '../keycloak.js';
+
+export default async(req, res, next) => {
+  try {
+    const voterExternalId = await keycloak.userId(req.headers.authorization);
+    const candidateExternalIds = req.query?.candidate?.split(',') || [];
+
+    const voter = await db.findVoter(voterExternalId);
+    const votes = await db.findVotes(voter?.id, candidateExternalIds);
+
+    res.json(votes.reduce((memo, row) => {
+      memo[row.external_id] = {
+        total: row.total,
+        votedByCurrentVoter: row.voted_by_current_voter === '1'
+      };
+      return memo;
+    }, {}));
+  } catch (err) {
+    next(err);
+  }
+};
diff --git a/packages/portal/src/server-middleware/api/utils.js b/packages/portal/src/server-middleware/api/utils.js
index 3ecf9d0bc3..14e9577e00 100644
--- a/packages/portal/src/server-middleware/api/utils.js
+++ b/packages/portal/src/server-middleware/api/utils.js
@@ -1,18 +1,26 @@
+import apm from 'elastic-apm-node';
 import defu  from 'defu';
 import createHttpError from 'http-errors';
 
 import nuxtConfig from '../../../nuxt.config.js';
 
-export const errorHandler = (res, error) => {
-  let status = error.status || 500;
-  let message = error.message;
+export const errorHandler = (err, req, res, next) => {
+  if (err) {
+    console.error(process.NODE_ENV === 'production' ? err.message : err.stack);
 
-  if (error.response) {
-    status = error.response.status;
-    message = error.response.data.errorMessage;
-  }
+    const errorStatus = err.response?.status || err.status || err.statusCode || 500;
+    const message = err.response?.data?.error || err.response?.data?.errorMessage || err.message;
+
+    if (apm.isStarted()) {
+      apm.captureError(err, { message, request: req, response: res });
+    }
 
-  res.status(status).set('Content-Type', 'text/plain').send(message);
+    if (!res.writableEnded) {
+      res.status(errorStatus).send(message);
+    }
+  } else {
+    next();
+  }
 };
 
 let runtimeConfig;
diff --git a/packages/portal/tests/unit/components/generic/FeatureIdeas.spec.js b/packages/portal/tests/unit/components/generic/FeatureIdeas.spec.js
index 8c2aa30384..4db84a9170 100644
--- a/packages/portal/tests/unit/components/generic/FeatureIdeas.spec.js
+++ b/packages/portal/tests/unit/components/generic/FeatureIdeas.spec.js
@@ -1,5 +1,6 @@
 import { createLocalVue } from '@vue/test-utils';
 import { shallowMountNuxt } from '../../utils';
+import nock from 'nock';
 import sinon from 'sinon';
 
 import BootstrapVue from 'bootstrap-vue';
@@ -8,24 +9,38 @@ import FeatureIdeas from '@/components/generic/FeatureIdeas.vue';
 const localVue = createLocalVue();
 localVue.use(BootstrapVue);
 
-const factory = ({ propsData = {}, $fetchState = {} }) => {
+const factory = ({ propsData = {}, mocks = {} } = {}) => {
   return shallowMountNuxt(FeatureIdeas, {
     localVue,
     propsData,
     mocks: {
+      $auth: {
+        loggedIn: false
+      },
+      $config: {
+        app: {
+          baseUrl: 'https://www.example.org'
+        }
+      },
       $error: sinon.spy(),
-      $fetchState,
-      $t: (key) => key
+      $fetchState: {},
+      $nuxt: { context: {} },
+      $t: (key) => key,
+      $tc: (key) => key,
+      ...mocks
     },
     stubs: ['ErrorMessage']
   });
 };
 
 describe('components/generic/FeatureIdeas', () => {
+  beforeAll(() => nock.disableNetConnect());
+  afterAll(() => nock.enableNetConnect());
+
   describe('fetch', () => {
     describe('when there are no features', () => {
       it('renders a message', async() => {
-        const wrapper = factory({ $fetchState: { error: { code: 'noFeatureIdeas' } } });
+        const wrapper = factory({ mocks: { $fetchState: { error: { code: 'noFeatureIdeas' } } } });
 
         await wrapper.vm.fetch();
 
diff --git a/packages/portal/tests/unit/server-middleware/api/events/log.spec.js b/packages/portal/tests/unit/server-middleware/api/events/log.spec.js
index 0faeda78c8..39778a39b2 100644
--- a/packages/portal/tests/unit/server-middleware/api/events/log.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/events/log.spec.js
@@ -48,14 +48,11 @@ pgPoolQuery.withArgs(
 )
   .resolves({});
 
-const expressReqStub = {
-  body: fixtures.reqBody,
-  get: sinon.spy()
-};
 const expressResStub = {
   json: sinon.spy(),
   sendStatus: sinon.spy()
 };
+const expressNextStub = sinon.spy();
 
 describe('@/server-middleware/api/events/log', () => {
   beforeAll(() => {
@@ -64,60 +61,40 @@ describe('@/server-middleware/api/events/log', () => {
   afterEach(sinon.resetHistory);
   afterAll(sinon.resetBehavior);
 
-  describe('when not explicitly enabled', () => {
-    const options = {};
+  describe('when user agent is a known bot', () => {
+    const expressReqStub = {
+      get: sinon.stub().withArgs('user-agent').returns('search engine bot')
+    };
 
     it('does not query postgres', async() => {
-      await logEventsHandler(options)(expressReqStub, expressResStub);
+      await logEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
       expect(pgPoolQuery.called).toBe(false);
     });
 
     it('responds with 204 status', async() => {
-      await logEventsHandler(options)(expressReqStub, expressResStub);
+      await logEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
       expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
     });
   });
 
-  describe('when explicitly enabled', () => {
-    const options = { enabled: true };
-
-    describe('and user agent is a known bot', () => {
-      const expressReqStub = {
-        get: sinon.stub().withArgs('user-agent').returns('search engine bot')
-      };
-
-      it('does not query postgres', async() => {
-        await logEventsHandler(options)(expressReqStub, expressResStub);
+  describe('when user agent is not a known bot', () => {
+    const expressReqStub = {
+      body: fixtures.reqBody,
+      get: sinon.spy()
+    };
 
-        expect(pgPoolQuery.called).toBe(false);
-      });
+    it('runs all postgres queries to log event', async() => {
+      await logEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-      it('responds with 204 status', async() => {
-        await logEventsHandler(options)(expressReqStub, expressResStub);
-
-        expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
-      });
+      expect(pgPoolQuery.getCalls().length).toBe(6);
     });
 
-    describe('and user agent is not a known bot', () => {
-      const expressReqStub = {
-        body: fixtures.reqBody,
-        get: sinon.spy()
-      };
-
-      it('runs all postgres queries to log event', async() => {
-        await logEventsHandler(options)(expressReqStub, expressResStub);
-
-        expect(pgPoolQuery.getCalls().length).toBe(6);
-      });
-
-      it('responds with 204 status', async() => {
-        await logEventsHandler(options)(expressReqStub, expressResStub);
+    it('responds with 204 status', async() => {
+      await logEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-        expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
-      });
+      expect(expressResStub.sendStatus.calledWith(204)).toBe(true);
     });
   });
 });
diff --git a/packages/portal/tests/unit/server-middleware/api/events/trending.spec.js b/packages/portal/tests/unit/server-middleware/api/events/trending.spec.js
index 6b70160785..49e01861bf 100644
--- a/packages/portal/tests/unit/server-middleware/api/events/trending.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/events/trending.spec.js
@@ -14,6 +14,7 @@ const expressResStub = {
   json: sinon.spy(),
   sendStatus: sinon.spy()
 };
+const expressNextStub = sinon.spy();
 
 describe('@/server-middleware/api/events/trending', () => {
   beforeAll(() => {
@@ -22,35 +23,15 @@ describe('@/server-middleware/api/events/trending', () => {
   afterEach(sinon.resetHistory);
   afterAll(sinon.resetBehavior);
 
-  describe('when not explicitly enabled', () => {
-    const options = {};
+  it('queries postgres for trending items', async() => {
+    await trendingEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-    it('does not query postgres', async() => {
-      await trendingEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(pgPoolQuery.called).toBe(false);
-    });
-
-    it('responds with empty items array as json', async() => {
-      await trendingEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(expressResStub.json.calledWith({ items: [] })).toBe(true);
-    });
+    expect(pgPoolQuery.called).toBe(true);
   });
 
-  describe('when explicitly enabled', () => {
-    const options = { enabled: true };
-
-    it('queries postgres for trending items', async() => {
-      await trendingEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(pgPoolQuery.called).toBe(true);
-    });
-
-    it('responds with items as json', async() => {
-      await trendingEventsHandler(options)(expressReqStub, expressResStub);
+  it('responds with items as json', async() => {
+    await trendingEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-      expect(expressResStub.json.calledWith({ items: fixtures.rows })).toBe(true);
-    });
+    expect(expressResStub.json.calledWith({ items: fixtures.rows })).toBe(true);
   });
 });
diff --git a/packages/portal/tests/unit/server-middleware/api/events/views.spec.js b/packages/portal/tests/unit/server-middleware/api/events/views.spec.js
index d4b0021a5d..993aadeacf 100644
--- a/packages/portal/tests/unit/server-middleware/api/events/views.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/events/views.spec.js
@@ -16,6 +16,7 @@ const expressResStub = {
   json: sinon.spy(),
   sendStatus: sinon.spy()
 };
+const expressNextStub = sinon.spy();
 
 describe('@/server-middleware/api/events/views', () => {
   beforeAll(() => {
@@ -24,38 +25,18 @@ describe('@/server-middleware/api/events/views', () => {
   afterEach(sinon.resetHistory);
   afterAll(sinon.resetBehavior);
 
-  describe('when not explicitly enabled', () => {
-    const options = {};
+  it('queries postgres for the views', async() => {
+    await viewsEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-    it('does not query postgres', async() => {
-      await viewsEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(pgPoolQuery.called).toBe(false);
-    });
-
-    it('responds with viewCount 0 as json', async() => {
-      await viewsEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(expressResStub.json.calledWith({ viewCount: 0 })).toBe(true);
-    });
+    expect(pgPoolQuery.calledWith(
+      sinon.match((sql) => sql.trim().startsWith('SELECT ')),
+      ['https://example.com/example', 'https://example.com/example']
+    )).toBe(true);
   });
 
-  describe('when explicitly enabled', () => {
-    const options = { enabled: true };
-
-    it('queries postgres for the views', async() => {
-      await viewsEventsHandler(options)(expressReqStub, expressResStub);
-
-      expect(pgPoolQuery.calledWith(
-        sinon.match((sql) => sql.trim().startsWith('SELECT ')),
-        ['https://example.com/example', 'https://example.com/example']
-      )).toBe(true);
-    });
-
-    it('responds with the view count as json', async() => {
-      await viewsEventsHandler(options)(expressReqStub, expressResStub);
+  it('responds with the view count as json', async() => {
+    await viewsEventsHandler(expressReqStub, expressResStub, expressNextStub);
 
-      expect(expressResStub.json.calledWith({ viewCount: 128 })).toBe(true);
-    });
+    expect(expressResStub.json.calledWith({ viewCount: 128 })).toBe(true);
   });
 });
diff --git a/packages/portal/tests/unit/server-middleware/api/jira-service-desk/feedback.spec.js b/packages/portal/tests/unit/server-middleware/api/jira-service-desk/feedback.spec.js
index b96bb799ad..91e0686916 100644
--- a/packages/portal/tests/unit/server-middleware/api/jira-service-desk/feedback.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/jira-service-desk/feedback.spec.js
@@ -1,7 +1,6 @@
 import serviceDesk from '@/server-middleware/api/jira-service-desk/feedback';
 
 import nock from 'nock';
-nock.disableNetConnect();
 import sinon from 'sinon';
 
 const options = {
@@ -31,12 +30,20 @@ const mockResponse = () => {
   res.send = sinon.stub().returns(res);
   return res;
 };
-const mockJiraApiRequest = body => nock(options.origin).post('/rest/servicedeskapi/request', body);
+const mockJiraApiRequest = (body) => nock(options.origin).post('/rest/servicedeskapi/request', body);
+const expressNextStub = sinon.spy();
 
 describe('server-middleware/api/jira-service-desk/feedback', () => {
+  beforeAll(() => {
+    nock.disableNetConnect();
+  });
   afterEach(() => {
+    sinon.resetHistory();
     nock.cleanAll();
   });
+  afterAll(() => {
+    nock.enableNetConnect();
+  });
 
   describe('middleware', () => {
     describe('request handling', () => {
@@ -45,7 +52,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
         const res = mockResponse();
         mockJiraApiRequest().reply(201);
 
-        await middleware(req, res);
+        await middleware(req, res, expressNextStub);
 
         expect(nock.isDone()).toBe(true);
       });
@@ -59,7 +66,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
             (body.requestTypeId === options.serviceDesk.feedback.requestTypeId)
           )).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -72,7 +79,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => body.requestFieldValues.description === reqBody.feedback).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -84,9 +91,9 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const req = mockRequest(reqBody);
           const res = mockResponse();
 
-          await middleware(req, res);
-          expect(res.status.calledWith(400)).toBe(true);
-          expect(res.send.calledWith('Invalid feedback.')).toBe(true);
+          await middleware(req, res, expressNextStub);
+          expect(expressNextStub.calledWith(sinon.match.has('message', 'Invalid feedback.'))).toBe(true);
+          expect(expressNextStub.calledWith(sinon.match.has('status', 400))).toBe(true);
         });
 
         it('responds with an error when the feedback is less than five words', async() => {
@@ -96,9 +103,9 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const req = mockRequest(reqBody);
           const res = mockResponse();
 
-          await middleware(req, res);
-          expect(res.status.calledWith(400)).toBe(true);
-          expect(res.send.calledWith('Invalid feedback.')).toBe(true);
+          await middleware(req, res, expressNextStub);
+          expect(expressNextStub.calledWith(sinon.match.has('message', 'Invalid feedback.'))).toBe(true);
+          expect(expressNextStub.calledWith(sinon.match.has('status', 400))).toBe(true);
         });
 
         it('truncates feedback to 50 characters in summary field, removing newlines', async() => {
@@ -111,7 +118,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => body.requestFieldValues.summary === summary).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -127,7 +134,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => body.requestFieldValues[options.serviceDesk.feedback.customFields.pageUrl] === reqBody.pageUrl).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -140,7 +147,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => !Object.keys(body).includes('raiseOnBehalfOf')).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -154,7 +161,7 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
           const res = mockResponse();
           mockJiraApiRequest(body => body.raiseOnBehalfOf === reqBody.email).reply(201);
 
-          await middleware(req, res);
+          await middleware(req, res, expressNextStub);
 
           expect(nock.isDone()).toBe(true);
         });
@@ -168,35 +175,31 @@ describe('server-middleware/api/jira-service-desk/feedback', () => {
         const res = mockResponse();
         mockJiraApiRequest().reply(status);
 
-        await middleware(req, res);
+        await middleware(req, res, expressNextStub);
 
         expect(res.sendStatus.calledWith(status)).toBe(true);
       });
 
       it('responds with upstream error on failure', async() => {
         const status = 400;
-        const errorMessage = 'Summary is required.';
         const req = mockRequest();
         const res = mockResponse();
-        mockJiraApiRequest().reply(status, { errorMessage });
+        mockJiraApiRequest().reply(status);
 
-        await middleware(req, res);
+        await middleware(req, res, expressNextStub);
 
-        expect(res.status.calledWith(status)).toBe(true);
-        expect(res.send.calledWith(errorMessage)).toBe(true);
+        expect(expressNextStub.calledWith(sinon.match.has('message', 'Request failed with status code 400'))).toBe(true);
       });
 
-      it('responds with 500 status on request failure', async() => {
-        const status = 500;
+      it('responds with error on request failure', async() => {
         const errorMessage = 'Unknown error';
         const req = mockRequest();
         const res = mockResponse();
         mockJiraApiRequest().replyWithError(errorMessage);
 
-        await middleware(req, res);
+        await middleware(req, res, expressNextStub);
 
-        expect(res.status.calledWith(status)).toBe(true);
-        expect(res.send.calledWith(errorMessage)).toBe(true);
+        expect(expressNextStub.calledWith(sinon.match.has('message', errorMessage))).toBe(true);
       });
     });
   });
diff --git a/packages/portal/tests/unit/server-middleware/api/jira-service-desk/galleries.spec.js b/packages/portal/tests/unit/server-middleware/api/jira-service-desk/galleries.spec.js
index ee8c2d779d..9b6b96fef9 100644
--- a/packages/portal/tests/unit/server-middleware/api/jira-service-desk/galleries.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/jira-service-desk/galleries.spec.js
@@ -1,7 +1,6 @@
 import galleryPublicationServiceDesk from '@/server-middleware/api/jira-service-desk/galleries';
 
 import nock from 'nock';
-nock.disableNetConnect();
 import sinon from 'sinon';
 
 const options = {
@@ -35,12 +34,13 @@ describe('server-middleware/api/jira-service-desk/galleries', () => {
   beforeAll(() => {
     nock.disableNetConnect();
   });
-  afterAll(() => {
-    nock.enableNetConnect();
-  });
   afterEach(() => {
+    sinon.resetHistory();
     nock.cleanAll();
   });
+  afterAll(() => {
+    nock.enableNetConnect();
+  });
 
   describe('middleware', () => {
     describe('request handling', () => {
diff --git a/packages/portal/tests/unit/server-middleware/api/events/pg.spec.js b/packages/portal/tests/unit/server-middleware/api/pg.spec.js
similarity index 88%
rename from packages/portal/tests/unit/server-middleware/api/events/pg.spec.js
rename to packages/portal/tests/unit/server-middleware/api/pg.spec.js
index 17c2af88b5..13ddad7954 100644
--- a/packages/portal/tests/unit/server-middleware/api/events/pg.spec.js
+++ b/packages/portal/tests/unit/server-middleware/api/pg.spec.js
@@ -1,12 +1,12 @@
 import pg from 'pg';
 import sinon from 'sinon';
 
-import pgEvents from '@/server-middleware/api/events/pg';
+import pgEvents from '@/server-middleware/api/pg.js';
 
 const pgPoolOn = sinon.stub();
 const pgPoolQuery = sinon.stub();
 
-describe('@/server-middleware/api/events/pg', () => {
+describe('@/server-middleware/api/pg', () => {
   beforeAll(() => {
     sinon.replace(pg.Pool.prototype, 'on', pgPoolOn);
     sinon.replace(pg.Pool.prototype, 'query', pgPoolQuery);
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/model.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/model.spec.js
new file mode 100644
index 0000000000..44a2b7dddb
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/polls/model.spec.js
@@ -0,0 +1,215 @@
+import pg from 'pg';
+import sinon from 'sinon';
+
+import pollsModel from '@/server-middleware/api/polls/model.js';
+
+describe('@/server-middleware/api/polls/model', () => {
+  beforeEach(() => {
+    const pgPoolQueryStub = sinon.stub().rejects(new Error('Unstubbed query'));
+    sinon.replace(pg.Pool.prototype, 'query', pgPoolQueryStub);
+  });
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  describe('findVoter', () => {
+    const voterExternalId = 'keycloak-uuid';
+    const voterRow = { id: 7 };
+    const sqlMatcher = 'SELECT id FROM polls.voters WHERE external_id=$1';
+    const argsMatcher = [voterExternalId];
+
+    it('selects from voters table', async() => {
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.findVoter(voterExternalId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+
+    describe('when voter row is found', () => {
+      it('is returned', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 1, rows: [voterRow] });
+
+        const voter = await pollsModel.findVoter(voterExternalId);
+
+        expect(voter).toEqual(voterRow);
+      });
+    });
+
+    describe('when voter row is not found', () => {
+      it('returns null', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 0 });
+
+        const voter = await pollsModel.findVoter(voterExternalId);
+
+        expect(voter).toBeNull();
+      });
+    });
+  });
+
+  describe('createVoter', () => {
+    it('inserts row into voters table and returns it', async() => {
+      const voterExternalId = 'keycloak-uuid';
+      const voterRow = { id: 7 };
+      const sqlMatcher = 'INSERT INTO polls.voters (external_id) VALUES($1) RETURNING id';
+      const argsMatcher = [voterExternalId];
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rows: [voterRow] });
+
+      const voter = await pollsModel.createVoter(voterExternalId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+      expect(voter).toEqual(voterRow);
+    });
+  });
+
+  describe('findCandidate', () => {
+    const candidateExternalId = 'new-feature';
+    const candidateRow = { id: 7 };
+    const sqlMatcher = 'SELECT id FROM polls.candidates WHERE external_id=$1';
+    const argsMatcher = [candidateExternalId];
+
+    it('selects from candidates table', async() => {
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.findCandidate(candidateExternalId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+
+    describe('when candidate row is found', () => {
+      it('is returned', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 1, rows: [candidateRow] });
+
+        const voter = await pollsModel.findCandidate(candidateExternalId);
+
+        expect(voter).toEqual(candidateRow);
+      });
+    });
+
+    describe('when candidate row is not found', () => {
+      it('returns null', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 0 });
+
+        const voter = await pollsModel.findCandidate(candidateExternalId);
+
+        expect(voter).toBeNull();
+      });
+    });
+  });
+
+  describe('createCandidate', () => {
+    it('inserts row into candidates table and returns it', async() => {
+      const candidateExternalId = 'new-feature';
+      const candidateRow = { id: 7 };
+      const sqlMatcher = 'INSERT INTO polls.candidates (external_id) VALUES($1) RETURNING id';
+      const argsMatcher = [candidateExternalId];
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rows: [candidateRow] });
+
+      const candidate = await pollsModel.createCandidate(candidateExternalId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+      expect(candidate).toEqual(candidateRow);
+    });
+  });
+
+  describe('findVote', () => {
+    const voterId = 5;
+    const candidateId = 6;
+    const voteRow = { id: 7 };
+    const sqlMatcher = 'SELECT id FROM polls.votes WHERE voter_id=$1 AND candidate_id=$2';
+    const argsMatcher = [voterId, candidateId];
+
+    it('selects from votes table', async() => {
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.findVote(voterId, candidateId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+
+    describe('when candidate row is found', () => {
+      it('is returned', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 1, rows: [voteRow] });
+
+        const vote = await pollsModel.findVote(voterId, candidateId);
+
+        expect(vote).toEqual(voteRow);
+      });
+    });
+
+    describe('when candidate row is not found', () => {
+      it('returns null', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rowCount: 0 });
+
+        const vote = await pollsModel.findVote(voterId, candidateId);
+
+        expect(vote).toBeNull();
+      });
+    });
+  });
+
+  describe('findVotes', () => {
+    const voterId = 5;
+    const candidateExternalIds = ['new-feature'];
+    const voteRows = [{ id: 6 }];
+    const sqlMatcher = sinon.match((sqlMatcher) => sqlMatcher.includes('FROM polls.votes v LEFT JOIN polls.candidates c'));
+    const argsMatcher = sinon.match.array.contains([voterId, candidateExternalIds]);
+
+    it('selects from votes table', async() => {
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.findVotes(voterId, candidateExternalIds);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+
+    describe('when votes are found', () => {
+      it('returns them', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rows: voteRows });
+
+        const votes = await pollsModel.findVotes(voterId, candidateExternalIds);
+
+        expect(votes).toEqual(voteRows);
+      });
+    });
+
+    describe('when votes are not found', () => {
+      it('returns []', async() => {
+        pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+        const votes = await pollsModel.findVotes(voterId, candidateExternalIds);
+
+        expect(votes).toEqual([]);
+      });
+    });
+  });
+
+  describe('createVote', () => {
+    it('inserts row into votes table and returns it', async() => {
+      const voterId = 5;
+      const candidateId = 6;
+      const voteRow = { id: 7 };
+      const sqlMatcher = 'INSERT INTO polls.votes (voter_id, candidate_id, occurred_at) VALUES($1, $2, CURRENT_TIMESTAMP)';
+      const argsMatcher = [voterId, candidateId];
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({ rows: [voteRow] });
+
+      const vote = await pollsModel.createVote(voterId, candidateId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+      expect(vote).toEqual(voteRow);
+    });
+  });
+
+  describe('deleteVote', () => {
+    it('deletes row from votes table', async() => {
+      const voteId = 8;
+      const sqlMatcher = 'DELETE FROM polls.votes WHERE id=$1';
+      const argsMatcher = [voteId];
+      pg.Pool.prototype.query.withArgs(sqlMatcher, argsMatcher).resolves({});
+
+      await pollsModel.deleteVote(voteId);
+
+      expect(pg.Pool.prototype.query.calledWith(sqlMatcher, argsMatcher)).toBe(true);
+    });
+  });
+});
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
new file mode 100644
index 0000000000..767f128562
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/polls/remove-vote.spec.js
@@ -0,0 +1,123 @@
+import sinon from 'sinon';
+
+import { expressReqStub, expressResStub, expressNextStub } from '../../utils.js';
+import removeVoteHandler from '@/server-middleware/api/polls/remove-vote.js';
+import pollsModel from '@/server-middleware/api/polls/model.js';
+import keycloak from '@/server-middleware/api/keycloak.js';
+
+describe('@/server-middleware/api/polls/remove-vote', () => {
+  beforeEach(() => {
+    sinon.stub(keycloak, 'userId').resolves(null);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'findCandidate').resolves(null);
+    sinon.stub(pollsModel, 'findVote').resolves(null);
+    sinon.stub(pollsModel, 'deleteVote').resolves({});
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  it('authorizes request via keycloak', async() => {
+    const authorization = 'Bearer token';
+    const headers = { authorization };
+
+    await removeVoteHandler(expressReqStub({ headers }), expressResStub(), expressNextStub());
+
+    expect(keycloak.userId.calledWith(authorization)).toBe(true);
+  });
+
+  describe('when unauthorized', () => {
+    it('calls next with 401 error', async() => {
+      const next = expressNextStub();
+
+      await removeVoteHandler(expressReqStub(), expressResStub(), next);
+
+      expect(next.calledWith(sinon.match.has('status', 401))).toBe(true);
+    });
+  });
+
+  describe('when authorized', () => {
+    const keycloakUserId = 'keycloak-uuid';
+    beforeEach(() => keycloak.userId.resolves(keycloakUserId));
+
+    it('queries db model to find voter row for keycloak user id', async() => {
+      await removeVoteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+      expect(pollsModel.findVoter.calledWith(keycloakUserId)).toBe(true);
+    });
+
+    describe('when voter row is not found', () => {
+      it('calls next with 403 error', async() => {
+        const next = expressNextStub();
+
+        await removeVoteHandler(expressReqStub(), expressResStub(), next);
+
+        expect(next.calledWith(sinon.match.has('status', 403))).toBe(true);
+      });
+    });
+
+    describe('when voter row is found', () => {
+      const voterId = 17;
+      beforeEach(() => pollsModel.findVoter.resolves({ id: voterId }));
+
+      it('queries db model to find candidate row from req params', async() => {
+        const candidateExternalId = 'new-feature';
+        const params = { candidateExternalId };
+        await removeVoteHandler(expressReqStub({ params }), expressResStub(), expressNextStub());
+
+        expect(pollsModel.findCandidate.calledWith(candidateExternalId)).toBe(true);
+      });
+
+      describe('when candidate row is not found', () => {
+        it('calls next with 404 error', async() => {
+          const next = expressNextStub();
+
+          await removeVoteHandler(expressReqStub(), expressResStub(), next);
+
+          expect(next.calledWith(sinon.match.has('status', 404))).toBe(true);
+        });
+      });
+
+      describe('when candidate row is found', () => {
+        const candidateId = 10;
+        beforeEach(() => pollsModel.findCandidate.resolves({ id: candidateId }));
+
+        it('queries db model to check for an existing vote', async() => {
+          await removeVoteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+          expect(pollsModel.findVote.calledWith(voterId, candidateId)).toBe(true);
+        });
+
+        describe('when vote row does not exist', () => {
+          it('calls next with 404 error', async() => {
+            const next = expressNextStub();
+
+            await removeVoteHandler(expressReqStub(), expressResStub(), next);
+
+            expect(next.calledWith(sinon.match.has('status', 404))).toBe(true);
+          });
+        });
+
+        describe('when vote row exists', () => {
+          const voteId = 22;
+          beforeEach(() => pollsModel.findVote.resolves({ id: voteId }));
+
+          it('deletes vote from db', async() => {
+            await removeVoteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+            expect(pollsModel.deleteVote.calledWith(voteId)).toBe(true);
+          });
+
+          it('calls res.sendStatus with 204 status', async() => {
+            const res = expressResStub();
+
+            await removeVoteHandler(expressReqStub(), res, expressNextStub());
+
+            expect(res.sendStatus.calledWith(204)).toBe(true);
+          });
+        });
+      });
+    });
+  });
+});
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
new file mode 100644
index 0000000000..9e421814f8
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/polls/vote.spec.js
@@ -0,0 +1,144 @@
+import sinon from 'sinon';
+
+import { expressReqStub, expressResStub, expressNextStub } from '../../utils.js';
+import voteHandler from '@/server-middleware/api/polls/vote.js';
+import pollsModel from '@/server-middleware/api/polls/model.js';
+import keycloak from '@/server-middleware/api/keycloak.js';
+
+describe('@/server-middleware/api/polls/vote', () => {
+  beforeEach(() => {
+    sinon.stub(keycloak, 'userId').resolves(null);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'createVoter').resolves({});
+    sinon.stub(pollsModel, 'findCandidate').resolves(null);
+    sinon.stub(pollsModel, 'createCandidate').resolves({});
+    sinon.stub(pollsModel, 'findVote').resolves(null);
+    sinon.stub(pollsModel, 'createVote').resolves({});
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  it('authorizes request via keycloak', async() => {
+    const authorization = 'Bearer token';
+    const headers = { authorization };
+
+    await voteHandler(expressReqStub({ headers }), expressResStub(), expressNextStub());
+
+    expect(keycloak.userId.calledWith(authorization)).toBe(true);
+  });
+
+  describe('when unauthorized', () => {
+    it('calls next with 401 error', async() => {
+      const next = expressNextStub();
+
+      await voteHandler(expressReqStub(), expressResStub(), next);
+
+      expect(next.calledWith(sinon.match.has('status', 401))).toBe(true);
+    });
+  });
+
+  describe('when authorized', () => {
+    const keycloakUserId = 'keycloak-uuid';
+    beforeEach(() => keycloak.userId.resolves(keycloakUserId));
+
+    it('queries db model to find voter row for keycloak user id', async() => {
+      await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+      expect(pollsModel.findVoter.calledWith(keycloakUserId)).toBe(true);
+    });
+
+    describe('when voter row is found', () => {
+      const voterId = 17;
+      beforeEach(() => pollsModel.findVoter.resolves({ id: voterId }));
+
+      it('does not create new voter row', async() => {
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createVoter.called).toBe(false);
+      });
+    });
+
+    describe('when voter row is not found', () => {
+      it('creates new voter row', async() => {
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createVoter.calledWith(keycloakUserId)).toBe(true);
+      });
+    });
+
+    it('queries db model to find candidate row from req params', async() => {
+      const candidateExternalId = 'new-feature';
+      const params = { candidateExternalId };
+      await voteHandler(expressReqStub({ params }), expressResStub(), expressNextStub());
+
+      expect(pollsModel.findCandidate.calledWith(candidateExternalId)).toBe(true);
+    });
+
+    describe('when candidate row is found', () => {
+      const candidateId = 10;
+      beforeEach(() => pollsModel.findCandidate.resolves({ id: candidateId }));
+
+      it('does not create new candidate row', async() => {
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createCandidate.called).toBe(false);
+      });
+    });
+
+    describe('when candidate row is not found', () => {
+      const candidateExternalId = 'new-feature';
+
+      it('creates new candidate row', async() => {
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createCandidate.calledWith(candidateExternalId)).toBe(false);
+      });
+    });
+
+    it('queries db model to check for an existing vote', async() => {
+      const voterId = 17;
+      pollsModel.findVoter.resolves({ id: voterId });
+      const candidateId = 10;
+      pollsModel.findCandidate.resolves({ id: candidateId });
+
+      await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+      expect(pollsModel.findVote.calledWith(voterId, candidateId)).toBe(true);
+    });
+
+    describe('when vote row already exists', () => {
+      beforeEach(() => pollsModel.findVote.resolves({}));
+
+      it('calls next with 409 error', async() => {
+        const next = expressNextStub();
+
+        await voteHandler(expressReqStub(), expressResStub(), next);
+
+        expect(next.calledWith(sinon.match.has('status', 409))).toBe(true);
+      });
+    });
+
+    describe('when vote row does not already exist', () => {
+      it('creates vote in db', async() => {
+        const voterId = 17;
+        pollsModel.findVoter.resolves({ id: voterId });
+        const candidateId = 10;
+        pollsModel.findCandidate.resolves({ id: candidateId });
+
+        await voteHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+        expect(pollsModel.createVote.calledWith(voterId, candidateId)).toBe(true);
+      });
+
+      it('calls res.sendStatus with 204 status', async() => {
+        const res = expressResStub();
+
+        await voteHandler(expressReqStub(), res, expressNextStub());
+
+        expect(res.sendStatus.calledWith(204)).toBe(true);
+      });
+    });
+  });
+});
diff --git a/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
new file mode 100644
index 0000000000..ad6f71abad
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/api/polls/votes.spec.js
@@ -0,0 +1,68 @@
+import sinon from 'sinon';
+
+import { expressReqStub, expressResStub, expressNextStub } from '../../utils.js';
+import votesHandler from '@/server-middleware/api/polls/votes.js';
+import pollsModel from '@/server-middleware/api/polls/model.js';
+import keycloak from '@/server-middleware/api/keycloak.js';
+
+describe('@/server-middleware/api/polls/votes', () => {
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  it('authorizes request via keycloak', async() => {
+    const authorization = 'Bearer token';
+    const headers = { authorization };
+    sinon.stub(keycloak, 'userId').resolves(null);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'findVotes').resolves([]);
+
+    await votesHandler(expressReqStub({ headers }), expressResStub(), expressNextStub());
+
+    expect(keycloak.userId.calledWith(authorization)).toBe(true);
+  });
+
+  it('queries db model for authorized voter', async() => {
+    const voterExternalId = 'keycloak uuid';
+    sinon.stub(keycloak, 'userId').resolves(voterExternalId);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'findVotes').resolves([]);
+
+    await votesHandler(expressReqStub(), expressResStub(), expressNextStub());
+
+    expect(pollsModel.findVoter.calledWith(voterExternalId)).toBe(true);
+  });
+
+  it('queries db model for votes on candidates (by voter)', async() => {
+    const candidates = ['new-thing', 'improve-that'];
+    const query = { candidate: 'new-thing,improve-that' };
+    const voterExternalId = 'keycloak uuid';
+    const voterId = 17;
+    sinon.stub(keycloak, 'userId').resolves(voterExternalId);
+    sinon.stub(pollsModel, 'findVoter').resolves({ id: voterId });
+    sinon.stub(pollsModel, 'findVotes').resolves([]);
+
+    await votesHandler(expressReqStub({ query }), expressResStub(), expressNextStub());
+
+    expect(pollsModel.findVotes.calledWith(voterId, candidates)).toBe(true);
+  });
+
+  it('responds with votes data as json', async() => {
+    const votes = [
+      { 'external_id': 'new-thing', total: '10', 'voted_by_current_voter': '0' },
+      { 'external_id': 'improve-that', total: '5', 'voted_by_current_voter': '1' }
+    ];
+    const votesResponse = {
+      'new-thing': { total: '10', votedByCurrentVoter: false },
+      'improve-that': { total: '5', votedByCurrentVoter: true }
+    };
+    sinon.stub(keycloak, 'userId').resolves(null);
+    sinon.stub(pollsModel, 'findVoter').resolves(null);
+    sinon.stub(pollsModel, 'findVotes').resolves(votes);
+    const res = expressResStub();
+
+    await votesHandler(expressReqStub(), res, expressNextStub());
+
+    expect(res.json.calledWith(votesResponse)).toBe(true);
+  });
+});
diff --git a/packages/portal/tests/unit/server-middleware/utils.js b/packages/portal/tests/unit/server-middleware/utils.js
new file mode 100644
index 0000000000..cca2d3e4c7
--- /dev/null
+++ b/packages/portal/tests/unit/server-middleware/utils.js
@@ -0,0 +1,17 @@
+import sinon from 'sinon';
+
+export const expressReqStub = (mocks = {}) => ({
+  query: {},
+  headers: {},
+  params: {},
+  get: sinon.spy(),
+  ...mocks
+});
+
+export const expressResStub = (mocks = {}) => ({
+  json: sinon.spy(),
+  sendStatus: sinon.spy(),
+  ...mocks
+});
+
+export const expressNextStub = () => sinon.spy();