diff --git a/src/Tgstation.Server.Api/Models/ConfigurationFile.cs b/src/Tgstation.Server.Api/Models/ConfigurationFile.cs
index a7e7aad737..1c27df900c 100644
--- a/src/Tgstation.Server.Api/Models/ConfigurationFile.cs
+++ b/src/Tgstation.Server.Api/Models/ConfigurationFile.cs
@@ -16,25 +16,25 @@ namespace Tgstation.Server.Api.Models
 		public string Path { get; set; }
 
 		/// <summary>
-		/// If read access to the <see cref="ConfigurationFile"/> file was denied
+		/// If access to the <see cref="ConfigurationFile"/> file was denied for the operation
 		/// </summary>
 		[Permissions(DenyWrite = true)]
-		public bool? ReadDenied { get; set; }
+		public bool? AccessDenied { get; set; }
 
 		/// <summary>
-		/// If <see cref="Path"/> represents a directory. Will only be <see langword="true"/> if <see cref="ReadDenied"/> is <see langword="true"/>
+		/// If <see cref="Path"/> represents a directory
 		/// </summary>
 		[Permissions(DenyWrite = true)]
 		public bool? IsDirectory { get; set; }
 
 		/// <summary>
-		/// The MD5 hash of the file when last read by the user. Will be <see langword="null"/> if <see cref="ReadDenied"/> is <see langword="true"/>. If this doesn't match during update actions, the write will be denied with error code 409
+		/// The MD5 hash of the file when last read by the user. If this doesn't match during update actions, the write will be denied with <see cref="System.Net.HttpStatusCode.Conflict"/>
 		/// </summary>
 		[Permissions(DenyWrite = true)]
 		public string LastReadHash { get; set; }
 
 		/// <summary>
-		/// The content of the <see cref="ConfigurationFile"/>. Will be <see langword="null"/> if <see cref="ReadDenied"/> is <see langword="true"/> or during listing operations
+		/// The content of the <see cref="ConfigurationFile"/>. Will be <see langword="null"/> if <see cref="AccessDenied"/> is <see langword="true"/> or during listing and write operations
 		/// </summary>
 		public byte[] Content { get; set; }
 	}
diff --git a/src/Tgstation.Server.Host/Components/Configuration.cs b/src/Tgstation.Server.Host/Components/Configuration.cs
index 1ab7412e7d..d6de13df5c 100644
--- a/src/Tgstation.Server.Host/Components/Configuration.cs
+++ b/src/Tgstation.Server.Host/Components/Configuration.cs
@@ -2,7 +2,9 @@
 using System;
 using System.Collections.Generic;
 using System.Globalization;
+using System.IO;
 using System.Linq;
+using System.Security.Cryptography;
 using System.Threading;
 using System.Threading.Tasks;
 using Tgstation.Server.Api.Models;
@@ -82,13 +84,17 @@ namespace Tgstation.Server.Host.Components
 			return new ServerSideModifications(headFileExistsTask.Result ? IncludeLine(CodeModificationsHeadFile) : null, tailFileExistsTask.Result ? IncludeLine(CodeModificationsTailFile) : null, false);
 		}
 
-		/// <inheritdoc />
-		public async Task<IReadOnlyList<ConfigurationFile>> ListDirectory(string configurationRelativePath, ISystemIdentity systemIdentity, CancellationToken cancellationToken)
+		string ValidateConfigRelativePath(string configurationRelativePath)
 		{
 			if (String.IsNullOrEmpty(configurationRelativePath))
 				configurationRelativePath = ".";
+			return ioManager.ResolvePath(configurationRelativePath);
+		}
 
-			var path = ioManager.ResolvePath(configurationRelativePath);
+		/// <inheritdoc />
+		public async Task<IReadOnlyList<ConfigurationFile>> ListDirectory(string configurationRelativePath, ISystemIdentity systemIdentity, CancellationToken cancellationToken)
+		{
+			var path = ValidateConfigRelativePath(configurationRelativePath);
 
 			List<ConfigurationFile> result = new List<ConfigurationFile>();
 
@@ -98,13 +104,13 @@ namespace Tgstation.Server.Host.Components
 				result.AddRange(enumerator.Select(x => new ConfigurationFile
 				{
 					IsDirectory = true,
-					Path = ioManager.ConcatPath(path, x),
+					Path = ioManager.ConcatPath(configurationRelativePath, x),
 				}));
 				enumerator = synchronousIOManager.GetFiles(configurationRelativePath, cancellationToken);
 				result.AddRange(enumerator.Select(x => new ConfigurationFile
 				{
 					IsDirectory = false,
-					Path = ioManager.ConcatPath(path, x),
+					Path = ioManager.ConcatPath(configurationRelativePath, x),
 				}));
 			}
 
@@ -117,9 +123,49 @@ namespace Tgstation.Server.Host.Components
 		}
 
 		/// <inheritdoc />
-		public Task<ConfigurationFile> Read(string configurationRelativePath, ISystemIdentity systemIdentity, CancellationToken cancellationToken)
+		public async Task<ConfigurationFile> Read(string configurationRelativePath, ISystemIdentity systemIdentity, CancellationToken cancellationToken)
 		{
-			throw new NotImplementedException();
+			var path = ValidateConfigRelativePath(configurationRelativePath);
+
+			ConfigurationFile result = null;
+			
+			void ReadImpl()
+			{
+				try
+				{
+					var content = synchronousIOManager.ReadFile(path);
+					string sha1String;
+#pragma warning disable CA5350 // Do not use insecure cryptographic algorithm SHA1.
+					using (var sha1 = new SHA1Managed())
+#pragma warning restore CA5350 // Do not use insecure cryptographic algorithm SHA1.
+						sha1String = String.Join("", sha1.ComputeHash(content).Select(b => b.ToString("x2", CultureInfo.InvariantCulture)));
+					result = new ConfigurationFile
+					{
+						Content = content,
+						IsDirectory = false,
+						LastReadHash = sha1String,
+						AccessDenied = false,
+						Path = configurationRelativePath
+					};
+				}
+				catch (FileNotFoundException) { }
+				catch (DirectoryNotFoundException) { }
+				catch (UnauthorizedAccessException)
+				{
+					result = new ConfigurationFile
+					{
+						AccessDenied = true,
+						Path = configurationRelativePath
+					};
+				}
+			}
+
+			if (systemIdentity == null)
+				ReadImpl();
+			else
+				await systemIdentity.RunImpersonated(ReadImpl, cancellationToken).ConfigureAwait(false);
+
+			return result;
 		}
 
 		/// <inheritdoc />
diff --git a/src/Tgstation.Server.Host/Controllers/ConfigurationController.cs b/src/Tgstation.Server.Host/Controllers/ConfigurationController.cs
index eb9ed1ea7b..bbdfd048b7 100644
--- a/src/Tgstation.Server.Host/Controllers/ConfigurationController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ConfigurationController.cs
@@ -69,10 +69,6 @@ namespace Tgstation.Server.Host.Controllers
 			{
 				return StatusCode((int)HttpStatusCode.NotImplemented, new { message = e.Message });
 			}
-			catch (UnauthorizedAccessException)
-			{
-				return Forbid();
-			}
 		}
 
 		/// <summary>
@@ -126,6 +122,10 @@ namespace Tgstation.Server.Host.Controllers
 			{
 				return StatusCode((int)HttpStatusCode.NotImplemented, new { message = e.Message });
 			}
+			catch (UnauthorizedAccessException)
+			{
+				return Forbid();
+			}
 		}
 	}
 }