diff --git a/src/pretix/plugins/pretixdroid/urls.py b/src/pretix/plugins/pretixdroid/urls.py
index 1036d468c..e8f005b56 100644
--- a/src/pretix/plugins/pretixdroid/urls.py
+++ b/src/pretix/plugins/pretixdroid/urls.py
@@ -7,4 +7,6 @@ urlpatterns = [
         name='config'),
     url(r'^pretixdroid/api/(?P<organizer>[^/]+)/(?P<event>[^/]+)/redeem/', views.ApiRedeemView.as_view(),
         name='api.redeem'),
+    url(r'^pretixdroid/api/(?P<organizer>[^/]+)/(?P<event>[^/]+)/search/', views.ApiSearchView.as_view(),
+        name='api.search'),
 ]
diff --git a/src/pretix/plugins/pretixdroid/views.py b/src/pretix/plugins/pretixdroid/views.py
index d510e5f39..5b3ab536d 100644
--- a/src/pretix/plugins/pretixdroid/views.py
+++ b/src/pretix/plugins/pretixdroid/views.py
@@ -3,6 +3,7 @@ import logging
 import string
 
 from django.db import transaction
+from django.db.models import Q
 from django.http import (
     HttpResponseForbidden, HttpResponseNotFound, JsonResponse,
 )
@@ -101,3 +102,35 @@ class ApiRedeemView(ApiView):
             response['reason'] = 'unknown_ticket'
 
         return JsonResponse(response)
+
+
+class ApiSearchView(ApiView):
+    def get(self, request, **kwargs):
+        query = request.GET.get('query', '!INVALID!')
+        response = {
+            'version': API_VERSION
+        }
+
+        if len(query) >= 4:
+            ops = OrderPosition.objects.select_related('item', 'variation', 'order').filter(
+                Q(order__event=self.event)
+                & Q(
+                    Q(secret__istartswith=query) | Q(attendee_name__icontains=query) | Q(order__code__istartswith=query)
+                )
+            ).prefetch_related('pretixdroid_checkins')[:25]
+
+            response['results'] = [
+                {
+                    'secret': op.secret,
+                    'order': op.order.code,
+                    'item': str(op.item),
+                    'variation': str(op.variation) if op.variation else None,
+                    'attendee_name': op.attendee_name,
+                    'redeemed': bool(op.pretixdroid_checkins.all()),
+                    'paid': op.order.status == Order.STATUS_PAID,
+                } for op in ops
+            ]
+        else:
+            response['results'] = []
+
+        return JsonResponse(response)
diff --git a/src/tests/plugins/test_pretixdroid.py b/src/tests/plugins/test_pretixdroid.py
index 7538039a7..9f32da001 100644
--- a/src/tests/plugins/test_pretixdroid.py
+++ b/src/tests/plugins/test_pretixdroid.py
@@ -34,7 +34,7 @@ def env():
     )
     op2 = OrderPosition.objects.create(
         order=o1, item=ticket,
-        price=23, attendee_name="Peter", secret='5678'
+        price=23, attendee_name="Peter", secret='5678910'
     )
     return event, user, o1, op1, op2
 
@@ -104,3 +104,14 @@ def test_unknown_event(client, env):
     resp = client.post('/pretixdroid/api/a/b/redeem/?key=c',
                        data={'secret': '4321'})
     assert resp.status_code == 404
+
+
+@pytest.mark.django_db
+def test_search(client, env):
+    env[0].settings.set('pretixdroid_key', 'abcdefg')
+    resp = client.get('/pretixdroid/api/%s/%s/search/?key=%s&query=%s' % (
+        env[0].organizer.slug, env[0].slug, 'abcdefg', '567891'))
+    print(resp.content)
+    jdata = json.loads(resp.content.decode("utf-8"))
+    assert len(jdata['results']) == 1
+    assert jdata['results'][0]['secret'] == '5678910'