diff --git a/budgit/server/controllers/CategoriesController.js b/budgit/server/controllers/CategoriesController.js
index 8ccdfdc..fb4b60e 100644
--- a/budgit/server/controllers/CategoriesController.js
+++ b/budgit/server/controllers/CategoriesController.js
@@ -13,6 +13,7 @@ export class CategoriesController extends BaseController {
       .get('', this.getAll)
       .get('/:id', this.getById)
       .put('/:id', this.modify)
+      .delete('/:id', this.remove)
   }
 
   async create(req, res, next) {
@@ -43,15 +44,21 @@ export class CategoriesController extends BaseController {
     }
   }
 
-  // TODO modify()
   async modify(req, res, next) {
     try {
-      const data = await categoriesService.modify(res.data, req.params.id, req.userInfo.id)
+      const data = await categoriesService.modify(req.body, req.params.id, req.userInfo.id)
       return res.send(data)
     } catch (error) {
       next(error)
     }
   }
 
-  // TODO delete()
+  async remove(req, res, next) {
+    try {
+      const data = await categoriesService.remove(req.params.id, req.userInfo.id)
+      return res.send(data)
+    } catch (error) {
+      next(error)
+    }
+  }
 }
\ No newline at end of file
diff --git a/budgit/server/services/CategoriesService.js b/budgit/server/services/CategoriesService.js
index 7023710..ee86283 100644
--- a/budgit/server/services/CategoriesService.js
+++ b/budgit/server/services/CategoriesService.js
@@ -20,14 +20,11 @@ class CategoriesService {
   }
 
   async getById(categoryId, accountId) {
-    const category = await dbContext.Categories.find({accountId: accountId, _id: categoryId})
+    // needs to be findOne to not wrap object inside an object
+    const category = await dbContext.Categories.findOne({accountId: accountId, _id: categoryId})
     if (!category){
       throw new BadRequest('Invalid Id')
     }
-    // if (accountId != category.accountId) {
-    //   // TODO this still is a data leak, because it tells the attacker that the category exists
-    //   throw new BadRequest('das nacho category')
-    // }
     return category
   }
   
@@ -37,16 +34,26 @@ class CategoriesService {
     if (!original) {
       throw new BadRequest('category does not exist')
     }
+    // throw new BadRequest(original)
     original.name = update.name || original.name
     original.budgeted = update.budgeted || original.budgeted
     original.targetAmt = update.targetAmt || original.targetAmt
     original.targetStart = update.targetStart || original.targetStart
     original.targetFreq = update.targetFreq || original.targetFreq
     original.targetUnit = update.targetUnit || original.targetUnit
-    update = await dbContext.Categories.findByIdAndUpdate(categoryId, original)
+    await original.save()
+    // this works because original is a mongoose object - but it only works if it's findOne - not an object of object
+    return original
   }
   
-  // TODO delete()
+  async remove(categoryId, accountId) {
+    const category = await this.getById(categoryId, accountId)
+    if (!category) {
+      throw new BadRequest('category does not exist')
+    }
+    category.remove()
+    return category
+  }
 }
   
 export const categoriesService = new CategoriesService
\ No newline at end of file