diff --git a/app/Http/Controllers/Admin/PermissionManagementController.php b/app/Http/Controllers/Admin/PermissionManagementController.php
index 8b0bc62..a96c3a4 100644
--- a/app/Http/Controllers/Admin/PermissionManagementController.php
+++ b/app/Http/Controllers/Admin/PermissionManagementController.php
@@ -3,6 +3,8 @@
 namespace App\Http\Controllers\Admin;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\PermissionManagement\StoreRequest;
+use App\Http\Requests\Admin\PermissionManagement\UpdateRequest;
 use App\Http\Resources\Admin\PermissionResource;
 use app\Http\Traits\ApiResponse;
 use App\Models\Permission;
@@ -12,12 +14,10 @@ use Illuminate\Http\Request;
 class PermissionManagementController extends Controller
 {
     use ApiResponse;
-    /**
-     * Display a listing of the resource.
-     */
-    public function index()
+
+    public function index(): JsonResponse
     {
-        //
+        return $this->successResponse(Permission::all());
     }
 
     public function list(): JsonResponse
@@ -25,35 +25,37 @@ class PermissionManagementController extends Controller
         return $this->successResponse(PermissionResource::collection(Permission::all()));
     }
 
-    /**
-     * Store a newly created resource in storage.
-     */
-    public function store(Request $request)
+    public function store(StoreRequest $request): JsonResponse
     {
-        //
+        Permission::query()->create([
+            'name' => $request->name,
+            'name_fa' => $request->name_fa,
+            'guard_name' => 'web'
+        ]);
+        return $this->successResponse();
     }
 
-    /**
-     * Display the specified resource.
-     */
-    public function show(string $id)
+    public function show(Permission $permission): JsonResponse
     {
-        //
+        return $this->successResponse($permission);
     }
 
-    /**
-     * Update the specified resource in storage.
-     */
-    public function update(Request $request, string $id)
+    public function update(UpdateRequest $request, Permission $permission): JsonResponse
     {
-        //
+        $permission->update([
+            'name' => $request->name,
+            'name_fa' => $request->name_fa,
+            'guard_name' => 'web',
+        ]);
+        return $this->successResponse();
     }
 
     /**
      * Remove the specified resource from storage.
      */
-    public function destroy(string $id)
+    public function destroy(Permission $permission): JsonResponse
     {
-        //
+        $permission->delete();
+        return $this->successResponse();
     }
 }
diff --git a/app/Http/Controllers/Admin/RoleManagementController.php b/app/Http/Controllers/Admin/RoleManagementController.php
index 4ad96cb..8f9fec0 100644
--- a/app/Http/Controllers/Admin/RoleManagementController.php
+++ b/app/Http/Controllers/Admin/RoleManagementController.php
@@ -4,6 +4,8 @@ namespace App\Http\Controllers\Admin;
 
 use App\Facades\DataTable\DataTableFacade;
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\RoleManagement\StoreRequest;
+use App\Http\Requests\Admin\RoleManagement\UpdateRequest;
 use App\Http\Resources\Admin\RoleResource;
 use app\Http\Traits\ApiResponse;
 use App\Models\Role;
@@ -23,12 +25,10 @@ class RoleManagementController extends Controller
 
         $allowedFilters = $columns;
         $allowedSortings = $columns;
-        $allowedRelations = array('permissions');
-
-        $query = Role::query();
+        $allowedRelations = array('permissions:id,name_fa');
 
         $data = DataTableFacade::run(
-            $query,
+            Role::query(),
             $request,
             allowedFilters: $allowedFilters,
             allowedSortings: $allowedSortings,
@@ -41,12 +41,13 @@ class RoleManagementController extends Controller
     /**
      * Store a newly created resource in storage.
      */
-    public function store(Request $request): JsonResponse
+    public function store(StoreRequest $request): JsonResponse
     {
         DB::transaction(function () use ($request) {
             $role = Role::create([
                 'name' => $request->name,
                 'name_fa' => $request->name_fa,
+                'guard_name' => 'web'
             ]);
 
             $role->syncPermissions($request->permissions);
@@ -66,12 +67,13 @@ class RoleManagementController extends Controller
     /**
      * Update the specified resource in storage.
      */
-    public function update(Request $request, Role $role): JsonResponse
+    public function update(UpdateRequest $request, Role $role): JsonResponse
     {
         DB::transaction(function () use ($request, $role) {
             $role->update([
                 'name' => $request->name,
                 'name_fa' => $request->name_fa,
+                'guard_name' => 'web'
             ]);
 
             $role->syncPermissions($request->permissions);
diff --git a/app/Http/Controllers/Admin/UserManagementController.php b/app/Http/Controllers/Admin/UserManagementController.php
index 0ea644d..e5b4e48 100644
--- a/app/Http/Controllers/Admin/UserManagementController.php
+++ b/app/Http/Controllers/Admin/UserManagementController.php
@@ -10,6 +10,7 @@ use App\Http\Requests\Admin\UserManagement\UpdateRequest;
 use App\Http\Resources\Admin\UserResource;
 use App\Http\Traits\ApiResponse;
 use App\Models\Province;
+use App\Models\Role;
 use App\Models\User;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -28,11 +29,10 @@ class UserManagementController extends Controller
 
         $allowedSortings = $columns;
 
-        $allowedRelations = array('roles');
+        $allowedRelations = array('roles:id,name_fa');
 
         $query = User::query()->where('username', "<>", "witel");
 
-
         $data = DataTableFacade::run(
             $query,
             $request,
@@ -67,7 +67,7 @@ class UserManagementController extends Controller
                 'telephone_id' => $request->telephone_id,
             ]);
 
-            $user->assignRole($request->role);
+            $user->assignRole(Role::query()->find($request->role_id));
         });
 
         return $this->successResponse();
@@ -98,10 +98,9 @@ class UserManagementController extends Controller
                 'province_fa' =>  $province->name,
                 'avatar' => $avatar,
                 'email' => $request->email,
-                'telephone_id' => $request->telephone_id
             ]);
 
-            $user->syncRoles($request->role);
+            $user->syncRoles(Role::query()->find($request->role_id));
         });
 
         return $this->successResponse();
diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php
index a74055c..f052b03 100644
--- a/app/Http/Controllers/ProfileController.php
+++ b/app/Http/Controllers/ProfileController.php
@@ -46,4 +46,9 @@ class ProfileController extends Controller
         ]);
         return $this->successResponse();
     }
+
+    public function permissions(): JsonResponse
+    {
+        return $this->successResponse(auth()->user()->getAllPermissions()->pluck('name'));
+    }
 }
diff --git a/app/Http/Controllers/ProvinceController.php b/app/Http/Controllers/ProvinceController.php
new file mode 100644
index 0000000..6ab542f
--- /dev/null
+++ b/app/Http/Controllers/ProvinceController.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use app\Http\Traits\ApiResponse;
+use App\Models\Province;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class ProvinceController extends Controller
+{
+    use ApiResponse;
+
+    public function list(): JsonResponse
+    {
+        return $this->successResponse(Province::all('id', 'name'));
+    }
+}
diff --git a/app/Http/Requests/Admin/PermissionManagement/StoreRequest.php b/app/Http/Requests/Admin/PermissionManagement/StoreRequest.php
new file mode 100644
index 0000000..e3dab74
--- /dev/null
+++ b/app/Http/Requests/Admin/PermissionManagement/StoreRequest.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Requests\Admin\PermissionManagement;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => 'required|unique:permissions,name|string|max:255',
+            'name_fa' => 'required|unique:permissions,name_fa|string|max:255',
+        ];
+    }
+}
diff --git a/app/Http/Requests/Admin/PermissionManagement/UpdateRequest.php b/app/Http/Requests/Admin/PermissionManagement/UpdateRequest.php
new file mode 100644
index 0000000..e9735eb
--- /dev/null
+++ b/app/Http/Requests/Admin/PermissionManagement/UpdateRequest.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Requests\Admin\PermissionManagement;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => [
+                'required','string', 'max:255',
+                Rule::unique('permissions', 'name')->ignore($this->permission->id)
+            ],
+            'name_fa' => [
+                'required','string', 'max:255',
+                Rule::unique('permissions', 'name_fa')->ignore($this->permission->id)
+            ],
+        ];
+    }
+}
diff --git a/app/Http/Requests/Admin/RoleManagement/StoreRequest.php b/app/Http/Requests/Admin/RoleManagement/StoreRequest.php
new file mode 100644
index 0000000..55f778f
--- /dev/null
+++ b/app/Http/Requests/Admin/RoleManagement/StoreRequest.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests\Admin\RoleManagement;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => 'required|unique:roles,name|string|max:255',
+            'name_fa' => 'required|unique:roles,name_fa|string|max:255',
+            'permissions' => 'required|exists:permissions,id|array',
+        ];
+    }
+}
diff --git a/app/Http/Requests/Admin/RoleManagement/UpdateRequest.php b/app/Http/Requests/Admin/RoleManagement/UpdateRequest.php
new file mode 100644
index 0000000..f7a0de7
--- /dev/null
+++ b/app/Http/Requests/Admin/RoleManagement/UpdateRequest.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Requests\Admin\RoleManagement;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => [
+                'required','string', 'max:255',
+                Rule::unique('roles', 'name')->ignore($this->role->id)
+            ],
+            'permissions' => 'required|exists:permissions,id|array',
+            'name_fa' => [
+                'required','string', 'max:255',
+                Rule::unique('roles', 'name_fa')->ignore($this->role->id)
+            ],
+        ];
+    }
+}
diff --git a/app/Http/Requests/Admin/UserManagement/StoreRequest.php b/app/Http/Requests/Admin/UserManagement/StoreRequest.php
index 616f5c8..f828f54 100644
--- a/app/Http/Requests/Admin/UserManagement/StoreRequest.php
+++ b/app/Http/Requests/Admin/UserManagement/StoreRequest.php
@@ -31,10 +31,9 @@ class StoreRequest extends FormRequest
             'phone_number' => 'required|numeric|digits:11|unique:users,phone_number|regex:/^09\d{9}$/',
             'province_id' => 'required|exists:provinces,id',
             'password' => 'required|regex:/^(?=.*[a-zA-Z])(?=.*\d).+$/|min:8',
-            'role' => 'required|exists:roles,id',
+            'role_id' => 'required|exists:roles,id',
             'avatar' => 'mimes:png,jpg,pdf|max:2048',
             'email' => 'email|unique:users,email',
-            'telephone_id' => 'required|string|unique:users,telephone_id'
         ];
     }
 }
diff --git a/app/Http/Requests/Admin/UserManagement/UpdateRequest.php b/app/Http/Requests/Admin/UserManagement/UpdateRequest.php
index c953eb3..436995c 100644
--- a/app/Http/Requests/Admin/UserManagement/UpdateRequest.php
+++ b/app/Http/Requests/Admin/UserManagement/UpdateRequest.php
@@ -36,10 +36,9 @@ class UpdateRequest extends FormRequest
                 'regex:/^09\d{9}$/'
             ],
             'province_id' => 'required|exists:provinces,id',
-            'role' => 'required|exists:roles,id',
+            'role_id' => 'required|exists:roles,id',
             'avatar' => 'mimes:png,jpg,pdf|max:2048',
             'email' => ['email', Rule::unique('users', 'email')->ignore($this->user->id)],
-            'telephone_id' => ['required', 'string', Rule::unique('users', 'telephone_id')->ignore($this->user->id)]
         ];
     }
 }
diff --git a/app/Http/Resources/Admin/UserResource.php b/app/Http/Resources/Admin/UserResource.php
index c53f084..7f81196 100644
--- a/app/Http/Resources/Admin/UserResource.php
+++ b/app/Http/Resources/Admin/UserResource.php
@@ -25,7 +25,7 @@ class UserResource extends JsonResource
             'position' => $this->position,
             'province_id' => $this->province_id,
             'province_name' => $this->province_name,
-            'role' => $this->getRoleNames()->first(),
+            'role' => $this->roles->pluck('id', 'name_fa'),
             'telephone_id' => $this->telephone_id
         ];
     }
diff --git a/app/Models/CallHistory.php b/app/Models/CallHistory.php
index 4f5f01e..3ee9361 100644
--- a/app/Models/CallHistory.php
+++ b/app/Models/CallHistory.php
@@ -7,15 +7,14 @@ use Illuminate\Database\Eloquent\Model;
 
 class CallHistory extends Model
 {
-    /** @use HasFactory<\Database\Factories\CallHistoryFactory> */
     use HasFactory;
-    protected $guarded = ['id'];
+    protected $guarded = [];
 
     public static function recordHistory(Call $call, $event_id): void
     {
         $event = Event::query()->where('id', $event_id)->first();
 
-        self::create([
+        self::query()->create([
             'call_id' => $call->id,
             'telephone_id' => $call->telephone_id,
             'caller_phone_number' => $call->caller_phone_number,
diff --git a/app/Models/Category.php b/app/Models/Category.php
index b57bcab..a1b2350 100644
--- a/app/Models/Category.php
+++ b/app/Models/Category.php
@@ -7,7 +7,6 @@ use Illuminate\Database\Eloquent\Model;
 
 class Category extends Model
 {
-    /** @use HasFactory<\Database\Factories\CategoryFactory> */
     use HasFactory;
-    protected $guarded = ['id'];
+    protected $guarded = [];
 }
diff --git a/app/Models/City.php b/app/Models/City.php
index 3f3ec29..05fc89f 100644
--- a/app/Models/City.php
+++ b/app/Models/City.php
@@ -7,6 +7,6 @@ use Illuminate\Database\Eloquent\Model;
 
 class City extends Model
 {
-    /** @use HasFactory<\Database\Factories\CityFactory> */
     use HasFactory;
+    protected $guarded = [];
 }
diff --git a/app/Models/Event.php b/app/Models/Event.php
index 9dce7e8..e687502 100644
--- a/app/Models/Event.php
+++ b/app/Models/Event.php
@@ -7,6 +7,6 @@ use Illuminate\Database\Eloquent\Model;
 
 class Event extends Model
 {
-    /** @use HasFactory<\Database\Factories\EventFactory> */
     use HasFactory;
+    protected $guarded = [];
 }
diff --git a/app/Models/Permission.php b/app/Models/Permission.php
index e559c90..87455f1 100644
--- a/app/Models/Permission.php
+++ b/app/Models/Permission.php
@@ -9,4 +9,5 @@ use Spatie\Permission\Models\Permission as SpatiePermission;
 class Permission extends SpatiePermission
 {
     use HasFactory;
+    protected $guarded = [];
 }
diff --git a/app/Models/Province.php b/app/Models/Province.php
index 115498c..9ae60b9 100644
--- a/app/Models/Province.php
+++ b/app/Models/Province.php
@@ -7,6 +7,6 @@ use Illuminate\Database\Eloquent\Model;
 
 class Province extends Model
 {
-    /** @use HasFactory<\Database\Factories\ProvinceFactory> */
     use HasFactory;
+    protected $guarded = [];
 }
diff --git a/app/Models/Role.php b/app/Models/Role.php
index a129360..1371e16 100644
--- a/app/Models/Role.php
+++ b/app/Models/Role.php
@@ -9,4 +9,5 @@ use Spatie\Permission\Models\Role as SpatieRole;
 class Role extends SpatieRole
 {
     use HasFactory;
+    protected $guarded = [];
 }
diff --git a/app/Models/User.php b/app/Models/User.php
index 94702a7..f3f3154 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -15,7 +15,7 @@ class User extends Authenticatable
 
     protected $guarded = [];
 
-    protected $hidden = ['password'];
+    protected $hidden = ['password', 'pivot'];
     public string $guard_name = 'web';
 
     public function storeFile($file, $name)
diff --git a/database/migrations/2025_04_28_110000_create_users_table.php b/database/migrations/2025_04_28_110000_create_users_table.php
index 55e3dda..ddf1cb2 100644
--- a/database/migrations/2025_04_28_110000_create_users_table.php
+++ b/database/migrations/2025_04_28_110000_create_users_table.php
@@ -26,7 +26,7 @@ return new class extends Migration
             $table->string('email')->unique()->nullable();
             $table->dateTime('last_login')->nullable();
             $table->string('telephone_id')->unique()->nullable();
-            $table->boolean('is_online');
+            $table->boolean('is_online')->default(false);
             $table->rememberToken()->nullable();
             $table->timestamps();
         });
diff --git a/resources/lang/en/messages.php b/resources/lang/en/messages.php
index c726755..d56d29b 100644
--- a/resources/lang/en/messages.php
+++ b/resources/lang/en/messages.php
@@ -8,4 +8,6 @@ return [
     'notification_server_is_down' => 'Notification Server Is Down',
     'the_operator_is_offline' => 'The Operator Is Offline',
     'operator_could_not_connect' => 'Operator Could Not Connect',
+    'combination_of_category_and_subcategory_does_not_exist' => 'Combination of Category and Subcategory Does Not Exist',
+    'telephone_id_is_in_use' => 'Telephone ID Is In Use',
 ];
diff --git a/resources/lang/fa/messages.php b/resources/lang/fa/messages.php
index 6cdc4a1..c45de66 100644
--- a/resources/lang/fa/messages.php
+++ b/resources/lang/fa/messages.php
@@ -9,4 +9,5 @@ return [
     'the_operator_is_offline' => 'اپراتور آفلاین است.',
     'operator_could_not_connect' => 'عدم اتصال اپراتور',
     'combination_of_category_and_subcategory_does_not_exist' => 'ترکیب موضوع و زیر موضوع نا معتبر می باشد',
+    'telephone_id_is_in_use' => 'این تلفن درحال استفاده است',
 ];
diff --git a/routes/web.php b/routes/web.php
index 332bbfb..5714891 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,10 +1,13 @@
 <?php
 
+use App\Http\Controllers\Admin\PermissionManagementController;
+use App\Http\Controllers\Admin\RoleManagementController;
 use App\Http\Controllers\Admin\UserManagementController;
 use App\Http\Controllers\AuthController;
 use App\Http\Controllers\CallController;
 use App\Http\Controllers\CategoryController;
 use App\Http\Controllers\ProfileController;
+use App\Http\Controllers\ProvinceController;
 use App\Http\Middleware\SuperAdminCheck;
 use Illuminate\Support\Facades\Route;
 
@@ -19,15 +22,17 @@ Route::prefix('server')->group(function () {
 
     Route::prefix('profile')
         ->name('profile.')
+        ->middleware('auth')
         ->controller(ProfileController::class)
         ->group(function () {
-            Route::get('/info', 'info')->middleware('auth:sanctum')->name('info');
-            Route::post('/change_password', 'changePassword')->middleware('auth:sanctum')->name('changePassword');
+            Route::get('/info', 'info')->name('info');
+            Route::post('/change_password', 'changePassword')->name('changePassword');
+            Route::get('/permissions', 'permissions')->name('permissions');
         });
 
     Route::prefix('users')
         ->name('users.')
-        ->middleware(['auth:sanctum', 'permission:manage_users'])
+        ->middleware(['auth', 'permission:manage_users'])
         ->controller(UserManagementController::class)
         ->group(function () {
             Route::get('/', 'index')->name('index');
@@ -46,9 +51,40 @@ Route::prefix('server')->group(function () {
             Route::post('/{call}', 'update')->name('update')->middleware(['auth', 'permission:manage_calls']);
         });
 
-    Route::middleware('auth')
+    Route::prefix('categories')
+        ->middleware('auth')
         ->controller(CategoryController::class)
         ->group(function () {
-            Route::get('/categories', 'list');
+            Route::get('/list', 'list');
+        });
+
+    Route::middleware('auth')
+        ->prefix('permissions')
+        ->controller(PermissionManagementController::class)
+        ->group(function () {
+            Route::get('/', 'index')->name('index');
+            Route::get('list', 'list')->name('list');
+            Route::post('/', 'store')->name('store');
+            Route::get('/{permission}', 'show')->name('show');
+            Route::post('/{permission}', 'update')->name('update');
+            Route::delete('/{permission}', 'destroy')->name('destroy');
+    });
+
+    Route::prefix('provinces')
+        ->controller(ProvinceController::class)
+        ->group(function () {
+            Route::get('/list', 'list')->name('list');
+        });
+
+    Route::middleware('auth')
+        ->prefix('roles')
+        ->controller(RoleManagementController::class)
+        ->group(function () {
+            Route::get('/', 'index')->name('index');
+            Route::get('list', 'list')->name('list');
+            Route::post('/', 'store')->name('store');
+            Route::get('/{roll}', 'show')->name('show');
+            Route::post('/{roll}', 'update')->name('update');
+            Route::delete('/{roll}', 'destroy')->name('destroy');
         });
 });