diff --git a/app/Http/Controllers/Admin/PermissionManagementController.php b/app/Http/Controllers/Admin/PermissionManagementController.php
index 8b0bc62..a96c3a4 100644
--- a/app/Http/Controllers/Admin/PermissionManagementController.php
+++ b/app/Http/Controllers/Admin/PermissionManagementController.php
@@ -3,6 +3,8 @@
 namespace App\Http\Controllers\Admin;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\PermissionManagement\StoreRequest;
+use App\Http\Requests\Admin\PermissionManagement\UpdateRequest;
 use App\Http\Resources\Admin\PermissionResource;
 use app\Http\Traits\ApiResponse;
 use App\Models\Permission;
@@ -12,12 +14,10 @@ use Illuminate\Http\Request;
 class PermissionManagementController extends Controller
 {
     use ApiResponse;
-    /**
-     * Display a listing of the resource.
-     */
-    public function index()
+
+    public function index(): JsonResponse
     {
-        //
+        return $this->successResponse(Permission::all());
     }
 
     public function list(): JsonResponse
@@ -25,35 +25,37 @@ class PermissionManagementController extends Controller
         return $this->successResponse(PermissionResource::collection(Permission::all()));
     }
 
-    /**
-     * Store a newly created resource in storage.
-     */
-    public function store(Request $request)
+    public function store(StoreRequest $request): JsonResponse
     {
-        //
+        Permission::query()->create([
+            'name' => $request->name,
+            'name_fa' => $request->name_fa,
+            'guard_name' => 'web'
+        ]);
+        return $this->successResponse();
     }
 
-    /**
-     * Display the specified resource.
-     */
-    public function show(string $id)
+    public function show(Permission $permission): JsonResponse
     {
-        //
+        return $this->successResponse($permission);
     }
 
-    /**
-     * Update the specified resource in storage.
-     */
-    public function update(Request $request, string $id)
+    public function update(UpdateRequest $request, Permission $permission): JsonResponse
     {
-        //
+        $permission->update([
+            'name' => $request->name,
+            'name_fa' => $request->name_fa,
+            'guard_name' => 'web',
+        ]);
+        return $this->successResponse();
     }
 
     /**
      * Remove the specified resource from storage.
      */
-    public function destroy(string $id)
+    public function destroy(Permission $permission): JsonResponse
     {
-        //
+        $permission->delete();
+        return $this->successResponse();
     }
 }
diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php
index a74055c..f052b03 100644
--- a/app/Http/Controllers/ProfileController.php
+++ b/app/Http/Controllers/ProfileController.php
@@ -46,4 +46,9 @@ class ProfileController extends Controller
         ]);
         return $this->successResponse();
     }
+
+    public function permissions(): JsonResponse
+    {
+        return $this->successResponse(auth()->user()->getAllPermissions()->pluck('name'));
+    }
 }
diff --git a/app/Http/Requests/Admin/PermissionManagement/StoreRequest.php b/app/Http/Requests/Admin/PermissionManagement/StoreRequest.php
new file mode 100644
index 0000000..25c9c1a
--- /dev/null
+++ b/app/Http/Requests/Admin/PermissionManagement/StoreRequest.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Requests\Admin\PermissionManagement;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => 'required|unique:permissions,name|string|max:255',
+            'name_fa' => 'required|unique:permissions,name|string|max:255',
+        ];
+    }
+}
diff --git a/app/Http/Requests/Admin/PermissionManagement/UpdateRequest.php b/app/Http/Requests/Admin/PermissionManagement/UpdateRequest.php
new file mode 100644
index 0000000..e9735eb
--- /dev/null
+++ b/app/Http/Requests/Admin/PermissionManagement/UpdateRequest.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Requests\Admin\PermissionManagement;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => [
+                'required','string', 'max:255',
+                Rule::unique('permissions', 'name')->ignore($this->permission->id)
+            ],
+            'name_fa' => [
+                'required','string', 'max:255',
+                Rule::unique('permissions', 'name_fa')->ignore($this->permission->id)
+            ],
+        ];
+    }
+}
diff --git a/routes/web.php b/routes/web.php
index 332bbfb..3c21171 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Controllers\Admin\PermissionManagementController;
 use App\Http\Controllers\Admin\UserManagementController;
 use App\Http\Controllers\AuthController;
 use App\Http\Controllers\CallController;
@@ -19,10 +20,12 @@ Route::prefix('server')->group(function () {
 
     Route::prefix('profile')
         ->name('profile.')
+        ->middleware('auth:sanctum')
         ->controller(ProfileController::class)
         ->group(function () {
-            Route::get('/info', 'info')->middleware('auth:sanctum')->name('info');
-            Route::post('/change_password', 'changePassword')->middleware('auth:sanctum')->name('changePassword');
+            Route::get('/info', 'info')->name('info');
+            Route::post('/change_password', 'changePassword')->name('changePassword');
+            Route::post('/permissions', 'permissions')->name('permissions');
         });
 
     Route::prefix('users')
@@ -42,13 +45,26 @@ Route::prefix('server')->group(function () {
         ->controller(CallController::class)
         ->group(function () {
             Route::post('/', 'store')->name('store');
-            Route::get('/list', 'list')->name('list')->middleware(['auth', 'permission:manage_calls']);
-            Route::post('/{call}', 'update')->name('update')->middleware(['auth', 'permission:manage_calls']);
+            Route::get('/list', 'list')->name('list')->middleware(['auth:sanctum', 'permission:manage_calls']);
+            Route::post('/{call}', 'update')->name('update')->middleware(['auth:sanctum', 'permission:manage_calls']);
         });
 
-    Route::middleware('auth')
+    Route::prefix('categories')
+        ->middleware('auth:sanctum')
         ->controller(CategoryController::class)
         ->group(function () {
             Route::get('/categories', 'list');
         });
+
+    Route::middleware('auth:sanctum')
+        ->prefix('permissions')
+        ->controller(PermissionManagementController::class)
+        ->group(function () {
+            Route::get('/', 'index')->name('index');
+            Route::get('list', 'list')->name('list');
+            Route::post('/', 'store')->name('store');
+            Route::get('/{permission}', 'show')->name('show');
+            Route::post('/{permission}', 'update')->name('update');
+            Route::delete('/{permission}', 'destroy')->name('destroy');
+    });
 });