diff --git a/BMA.EHR.Discipline.Service/Controllers/DisciplineComplaintController.cs b/BMA.EHR.Discipline.Service/Controllers/DisciplineComplaintController.cs
index e8b878f7..97f01299 100644
--- a/BMA.EHR.Discipline.Service/Controllers/DisciplineComplaintController.cs
+++ b/BMA.EHR.Discipline.Service/Controllers/DisciplineComplaintController.cs
@@ -14,6 +14,7 @@ using System.Runtime.Serialization;
 using System.Security.Claims;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
+using Microsoft.AspNetCore.Mvc.RazorPages;
 
 namespace BMA.EHR.DisciplineComplaint.Service.Controllers
 {
@@ -134,10 +135,32 @@ namespace BMA.EHR.DisciplineComplaint.Service.Controllers
         /// <response code="400">ค่าตัวแปรที่ส่งมาไม่ถูกต้อง</response>
         /// <response code="401">ไม่ได้ Login เข้าระบบ</response>
         /// <response code="500">เมื่อเกิดข้อผิดพลาดในการทำงาน</response>
-        [HttpGet("{id:guid}")]
-        public async Task<ActionResult<ResponseObject>> GetByDisciplineComplaint(Guid id)
+        [HttpGet("{page}/{id:guid}")]
+        public async Task<ActionResult<ResponseObject>> GetByDisciplineComplaint(string page,Guid id)
         {
-            var getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_COMPLAIN");
+            page = page.Trim().ToUpper();
+            string getPermission;
+            if (page == "MAIN")
+            {
+                 getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_COMPLAIN");
+            }
+            else if (page == "INVES")
+            {
+                 getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INVESTIGATE");
+            }
+            else if (page == "DISCIP")
+            {
+                 getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INTERROGATE");
+            }
+            else if (page == "RESULT")
+            {
+                 getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_RESULT");
+            }
+            else
+            {
+                 getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_COMPLAIN");
+            }
+            
             var jsonData = JsonConvert.DeserializeObject<JObject>(getPermission);
             if (jsonData["status"]?.ToString() != "200")
             {
diff --git a/BMA.EHR.Discipline.Service/Controllers/DisciplineDisciplinaryController.cs b/BMA.EHR.Discipline.Service/Controllers/DisciplineDisciplinaryController.cs
index a4adf867..e748b392 100644
--- a/BMA.EHR.Discipline.Service/Controllers/DisciplineDisciplinaryController.cs
+++ b/BMA.EHR.Discipline.Service/Controllers/DisciplineDisciplinaryController.cs
@@ -13,6 +13,7 @@ using Swashbuckle.AspNetCore.Annotations;
 using System.Security.Claims;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
+using Microsoft.AspNetCore.Mvc.RazorPages;
 
 namespace BMA.EHR.DisciplineDisciplinary.Service.Controllers
 {
@@ -407,10 +408,23 @@ namespace BMA.EHR.DisciplineDisciplinary.Service.Controllers
         /// <response code="400">ค่าตัวแปรที่ส่งมาไม่ถูกต้อง</response>
         /// <response code="401">ไม่ได้ Login เข้าระบบ</response>
         /// <response code="500">เมื่อเกิดข้อผิดพลาดในการทำงาน</response>
-        [HttpGet("{id:guid}")]
-        public async Task<ActionResult<ResponseObject>> GetByDisciplineDisciplinary(Guid id)
+        [HttpGet("{page}/{id:guid}")]
+        public async Task<ActionResult<ResponseObject>> GetByDisciplineDisciplinary(string page,Guid id)
         {
-            var getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INTERROGATE");
+            page = page.Trim().ToUpper();
+            string getPermission;
+            if (page == "MAIN")
+            {
+                getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INTERROGATE");
+            }
+            else if (page == "RESULT")
+            {
+                getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_RESULT");
+            }
+            else
+            {
+                getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INTERROGATE");
+            }
             var jsonData = JsonConvert.DeserializeObject<JObject>(getPermission);
             if (jsonData["status"]?.ToString() != "200")
             {
diff --git a/BMA.EHR.Discipline.Service/Controllers/DisciplineInvestigateController.cs b/BMA.EHR.Discipline.Service/Controllers/DisciplineInvestigateController.cs
index b3c89003..a6f338f0 100644
--- a/BMA.EHR.Discipline.Service/Controllers/DisciplineInvestigateController.cs
+++ b/BMA.EHR.Discipline.Service/Controllers/DisciplineInvestigateController.cs
@@ -13,6 +13,7 @@ using Swashbuckle.AspNetCore.Annotations;
 using System.Security.Claims;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
+using Microsoft.AspNetCore.Mvc.RazorPages;
 
 namespace BMA.EHR.DisciplineInvestigate.Service.Controllers
 {
@@ -246,10 +247,28 @@ namespace BMA.EHR.DisciplineInvestigate.Service.Controllers
         /// <response code="400">ค่าตัวแปรที่ส่งมาไม่ถูกต้อง</response>
         /// <response code="401">ไม่ได้ Login เข้าระบบ</response>
         /// <response code="500">เมื่อเกิดข้อผิดพลาดในการทำงาน</response>
-        [HttpGet("{id:guid}")]
-        public async Task<ActionResult<ResponseObject>> GetByDisciplineInvestigate(Guid id)
+        [HttpGet("{page}/{id:guid}")]
+        public async Task<ActionResult<ResponseObject>> GetByDisciplineInvestigate(string page,Guid id)
         {
-            var getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INVESTIGATE");
+            page = page.Trim().ToUpper();
+            string getPermission;
+            if (page == "MAIN")
+            {
+                getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INVESTIGATE");
+            }
+            else if (page == "DISCIP")
+            {
+                getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INTERROGATE");
+            }
+            else if (page == "RESULT")
+            {
+                getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_RESULT");
+            }
+            else
+            {
+                getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_DISCIPLINE_INVESTIGATE");
+            }
+            
             var jsonData = JsonConvert.DeserializeObject<JObject>(getPermission);
             if (jsonData["status"]?.ToString() != "200")
             {
diff --git a/BMA.EHR.Placement.Service/Controllers/PlacementController.cs b/BMA.EHR.Placement.Service/Controllers/PlacementController.cs
index 5bf3d7f4..203b1604 100644
--- a/BMA.EHR.Placement.Service/Controllers/PlacementController.cs
+++ b/BMA.EHR.Placement.Service/Controllers/PlacementController.cs
@@ -95,6 +95,12 @@ namespace BMA.EHR.Placement.Service.Controllers
         public async Task<ActionResult<ResponseObject>> GetExam(int year)
         // public async Task<ActionResult<ResponseObject>> GetExam(int year, int page = 1, int pageSize = 10, string keyword = "")
         {
+            var getPermission = await _permission.GetPermissionAPIAsync("GET", "SYS_PLACEMENT_PASS");
+            var jsonData = JsonConvert.DeserializeObject<JObject>(getPermission);
+            if (jsonData["status"]?.ToString() != "200")
+            {
+                return Error(jsonData["message"]?.ToString(), StatusCodes.Status403Forbidden);
+            }
             var data = await _context.Placements.Where(x => year > 0 ? (x.Year == year) : (x.Year > 0))
             .OrderByDescending(x => x.CreatedAt)
             .Select(x => new