diff --git a/backend/requests/blackjack.http b/backend/requests/blackjack.http
index fcff731..1ac2def 100644
--- a/backend/requests/blackjack.http
+++ b/backend/requests/blackjack.http
@@ -7,6 +7,6 @@ Content-Type: application/json
 }
 
 ###
-POST http://localhost:8080/blackjack/103/hit
+POST http://localhost:8080/blackjack/202/hit
 Authorization: Bearer {{token}}
 
diff --git a/backend/src/main/java/de/szut/casino/blackjack/BlackJackGameController.java b/backend/src/main/java/de/szut/casino/blackjack/BlackJackGameController.java
index 1319c10..58505eb 100644
--- a/backend/src/main/java/de/szut/casino/blackjack/BlackJackGameController.java
+++ b/backend/src/main/java/de/szut/casino/blackjack/BlackJackGameController.java
@@ -40,6 +40,12 @@ public class BlackJackGameController {
             return ResponseEntity.notFound().build();
         }
 
+        if (game.getState() != BlackJackState.IN_PROGRESS) {
+            Map<String, String> errorResponse = new HashMap<>();
+            errorResponse.put("error", "Invalid state");
+            return ResponseEntity.badRequest().body(errorResponse);
+        }
+
         return ResponseEntity.ok(blackJackService.hit(game));
     }
 
diff --git a/backend/src/main/java/de/szut/casino/blackjack/BlackJackService.java b/backend/src/main/java/de/szut/casino/blackjack/BlackJackService.java
index 05cf93c..9e507b5 100644
--- a/backend/src/main/java/de/szut/casino/blackjack/BlackJackService.java
+++ b/backend/src/main/java/de/szut/casino/blackjack/BlackJackService.java
@@ -94,7 +94,7 @@ public class BlackJackService {
         return BlackJackState.IN_PROGRESS;
     }
 
-    public int calculateHandValue(List<CardEntity> hand) {
+    private int calculateHandValue(List<CardEntity> hand) {
         int sum = 0;
         int aceCount = 0;
         for (CardEntity card : hand) {