diff --git a/app/main/views.py b/app/main/views.py
index f46aef86d90c97a1456e40437c51104a61c162c1..fecefe0ddd656d750727048a9acb03c79c46eadd 100644
--- a/app/main/views.py
+++ b/app/main/views.py
@@ -41,12 +41,14 @@ def handle_inventory_error(error):
 def retrieve_items():
     items = Item.query.order_by(Item._created)
     data = [[item.id,
+             item.ics_id,
+             utils.format_field(item._created),
+             utils.format_field(item._updated),
              item.serial_number,
              utils.format_field(item.manufacturer),
              utils.format_field(item.model),
              utils.format_field(item.location),
              utils.format_field(item.status),
-             utils.format_field(item._updated),
              ] for item in items]
     return jsonify(data=data)
 
diff --git a/app/static/js/inventory.js b/app/static/js/inventory.js
index 1082bdc4a5578cf1e3cd8e4c78af6032eb9367db..de9f8d44fe91729af4c81a87275ea985c0910d57 100644
--- a/app/static/js/inventory.js
+++ b/app/static/js/inventory.js
@@ -8,7 +8,7 @@ $(document).ready(function() {
           callback(json);
         });
     },
-    "order": [[4, 'desc']],
+    "order": [[3, 'desc']],
     "pagingType": "full_numbers",
     "pageLength": 20,
     "lengthMenu": [[20, 50, 100, -1], [20, 50, 100, "All"]],
diff --git a/app/templates/index.html b/app/templates/index.html
index b70bb36a839e9e9f21aba9c73c5eab7d259e615e..f91e195d45466109a98613573ed535b124780e2e 100644
--- a/app/templates/index.html
+++ b/app/templates/index.html
@@ -9,12 +9,14 @@
     <thead>
       <tr>
         <th>Id</th>
+        <th>ICS id</th>
+        <th>Created</th>
+        <th>Updated</th>
         <th>Serial number</th>
         <th>Manufacturer</th>
         <th>Model</th>
         <th>Location</th>
         <th>Status</th>
-        <th>Last updated</th>
       </tr>
     </thead>
   </table>
diff --git a/tests/functional/test_web.py b/tests/functional/test_web.py
index d8e8527737982a3086b4942ee231b7cb1ed067f9..dfb119dcc4c587c09328fbbf6378cd4e044631fa 100644
--- a/tests/functional/test_web.py
+++ b/tests/functional/test_web.py
@@ -9,6 +9,16 @@ This module defines basic web tests.
 :license: BSD 2-Clause, see LICENSE for more details.
 
 """
+import json
+import pytest
+from app import models
+
+
+def get(client, url):
+    response = client.get(url)
+    if response.headers['Content-Type'] == 'application/json':
+        response.json = json.loads(response.data)
+    return response
 
 
 def login(client, username, password):
@@ -23,6 +33,13 @@ def logout(client):
     return client.get('/logout', follow_redirects=True)
 
 
+@pytest.fixture
+def logged_client(request, app):
+    client_ = app.test_client()
+    login(client_, 'user_ro', 'userro')
+    return client_
+
+
 def test_login_logout(client):
     response = login(client, 'unknown', 'invalid')
     assert b'<title>Login</title>' in response.data
@@ -35,11 +52,34 @@ def test_login_logout(client):
     assert b'<title>Login</title>' in response.data
 
 
-def test_index(client):
-    response = client.get('/')
+def test_index(logged_client):
+    response = logged_client.get('/')
+    assert b'Welcome to the ICS Inventory!' in response.data
+    assert b'User RO' in response.data
+
+
+@pytest.mark.parametrize('url', [
+    '/',
+    '/qrcodes',
+    '_retrieve_items',
+])
+def test_protected_url(url, client):
+    response = client.get(url)
     assert response.status_code == 302
     assert '/login' in response.headers['Location']
     login(client, 'user_ro', 'userro')
-    response = client.get('/')
-    assert b'Welcome to the ICS Inventory!' in response.data
-    assert b'User RO' in response.data
+    response = client.get(url)
+    assert response.status_code == 200
+
+
+def test_retrieve_items(logged_client, session):
+    response = get(logged_client, '/_retrieve_items')
+    assert response.json['data'] == []
+    serial_numbers = ('12345', '45678')
+    for sn in serial_numbers:
+        session.add(models.Item(serial_number=sn))
+    session.commit()
+    response = get(logged_client, '/_retrieve_items')
+    items = response.json['data']
+    assert set(serial_numbers) == set(item[4] for item in items)
+    assert len(items[0]) == 9