diff --git a/app/Http/Controllers/Api/UsersController.php b/app/Http/Controllers/Api/UsersController.php
index ce9a390..c4c97f1 100644
--- a/app/Http/Controllers/Api/UsersController.php
+++ b/app/Http/Controllers/Api/UsersController.php
@@ -38,20 +38,20 @@ class UsersController extends Controller
         return response()->json(['message' => 'logged out successfully']);
     }
     public function store(UsersRequest $request){
-                $validate_data = $request->validated();
+        $validate_data = $request->validated();
 
         DB::beginTransaction();
         try{
             $user = User::create([
-                'name' => $validate_data->name,
-                'email' => $validate_data->email,
-                'password' => Hash::make($validate_data->password),
-                'firstname' => $validate_data->firstname,
-                'lastname' => $validate_data->lastname,
-                'position' => $validate_data->position
+                'name' => $validate_data['name'],
+                'email' => $validate_data['email'],
+                'password' => Hash::make($validate_data['password']),
+                'firstname' => $validate_data['firstname'],
+                'lastname' => $validate_data['lastname'],
+                'position' => $validate_data['position'],
             ]);
 
-            $user->roles()->attach($request->role_id);
+            $user->roles()->attach((int) $validate_data['role_id']);
 
             DB::commit();
             return response()->json(['message' => 'Successfully created'],201);
@@ -60,4 +60,27 @@ class UsersController extends Controller
             return response()->json(['message' => $e->getMessage()],500);
         };
     }
+    public function update(UsersRequest $request, $id){
+        try{
+            $validate_data = $request->validated();
+            $user = User::findOrFail($id);
+
+            DB::beginTransaction();
+            $user->update([
+                'name' => $validate_data['name'],
+                'email' => $validate_data['email'],
+                'firstname' => $validate_data['firstname'],
+                'lastname' => $validate_data['lastname'],
+                'position' => $validate_data['position']
+            ]);
+
+            $user->roles()->sync($request->role_id);
+
+            DB::commit();
+            return response()->json(['message' => 'Successfully updated'], 200);
+        }catch(\Exception $e){
+            DB::rollBack();
+            return response()->json(['message' => $e->getMessage()],500);
+        }
+    }
 }
diff --git a/app/Http/Requests/UsersRequest.php b/app/Http/Requests/UsersRequest.php
index 95ffd95..cabe4ca 100644
--- a/app/Http/Requests/UsersRequest.php
+++ b/app/Http/Requests/UsersRequest.php
@@ -22,7 +22,7 @@ class UsersRequest extends FormRequest
      */
     public function rules(): array
     {
-        $userId = $this->route('user'); // Get user ID from route (used in update)
+        $userId = $this->route('users'); // Get user ID from route (used in update)
 
         return [
             'name' => ['required', 'string', 'max:255'],
@@ -31,7 +31,7 @@ class UsersRequest extends FormRequest
                 'string',
                 'email',
                 'max:255',
-                Rule::unique('users')->ignore($userId), // Ignore the user's own email when updating
+                Rule::unique('users')->ignore($userId)
             ],
             'password' => [$this->isMethod('post') ? 'required' : 'nullable', 'confirmed', 'max:255'],
             'firstname' => ['required', 'string', 'max:255'],
diff --git a/resources/js/master/users/create.js b/resources/js/master/users/create.js
index c684479..143e913 100644
--- a/resources/js/master/users/create.js
+++ b/resources/js/master/users/create.js
@@ -19,15 +19,24 @@ document.addEventListener("DOMContentLoaded", function (e) {
             submitButton.disabled = true;
             spinner.classList.remove("d-none");
 
+            let jsonData = {};
+            formData.forEach((value, key) => {
+                jsonData[key] = value;
+            });
+
+            console.log(jsonData);
+
             try {
                 let response = await fetch(form.action, {
                     method: "POST",
                     headers: {
-                        "X-CSRF-TOKEN": document
-                            .querySelector('meta[name="csrf-token"]')
-                            .getAttribute("content"),
+                        "Content-Type": "application/json",
+                        Accept: "application/json",
+                        Authorization: `Bearer ${document
+                            .querySelector('meta[name="api-token"]')
+                            .getAttribute("content")}`,
                     },
-                    body: formData,
+                    body: JSON.stringify(jsonData),
                 });
 
                 if (response.ok) {
diff --git a/resources/views/master/users/create.blade.php b/resources/views/master/users/create.blade.php
index b8f7af6..767ce8b 100644
--- a/resources/views/master/users/create.blade.php
+++ b/resources/views/master/users/create.blade.php
@@ -8,8 +8,13 @@
 <div class="row d-flex justify-content-center">
     <div class="col-lg-6">
         <div class="card">
+            <div class="card-header">
+                <div class="d-flex justify-content-end">
+                    <a href="{{ route('users.index') }}" class="btn btn-sm btn-secondary me-2">Back</a>
+                </div>
+            </div>
             <div class="card-body">
-                <form id="formCreateUsers" action="{{route('users.store')}}" method="POST">
+                <form id="formCreateUsers" action="{{route('api.users.store')}}" method="POST">
                     @csrf
                     <div class="mb-3">
                         <label class="form-label" for="name">Name</label>
diff --git a/resources/views/master/users/edit.blade.php b/resources/views/master/users/edit.blade.php
index ac0becd..955e628 100644
--- a/resources/views/master/users/edit.blade.php
+++ b/resources/views/master/users/edit.blade.php
@@ -8,6 +8,11 @@
 <div class="row d-flex justify-content-center">
     <div class="col-lg-6">
         <div class="card">
+            <div class="card-header">
+                <div class="d-flex justify-content-end">
+                    <a href="{{ route('users.index') }}" class="btn btn-sm btn-secondary me-2">Back</a>
+                </div>
+            </div>
             <div class="card-body">
                 <form id="formUpdateUsers" action="{{ route('users.update', $user->id)}}" method="post">
                     @csrf
diff --git a/routes/api.php b/routes/api.php
index 5af44ee..54bff93 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -21,8 +21,12 @@ use Illuminate\Support\Facades\Route;
 Route::post('/login', [UsersController::class, 'login'])->name('api.user.login');
 Route::group(['middleware' => 'auth:sanctum'], function (){
     // users
-    Route::get('/users', [UsersController::class, 'index'])->name('users');
-    Route::post('/logout', [UsersController::class, 'logout'])->name('api.user.logout');
+    Route::controller(UsersController::class)->group(function(){
+        Route::get('/users', 'index')->name('api.users');
+        Route::post('/users', 'store')->name('api.users.store');
+        Route::put('/users/{id}', 'update')->name('api.users.update');
+        Route::post('/logout','logout')->name('api.users.logout');
+    });
     
     // global settings
     Route::apiResource('global-settings', GlobalSettingsController::class);