diff --git a/app/Http/Controllers/Api/CardOrder/CardOrderController.php b/app/Http/Controllers/Api/CardOrder/CardOrderController.php
index ee6d82b..c021c47 100644
--- a/app/Http/Controllers/Api/CardOrder/CardOrderController.php
+++ b/app/Http/Controllers/Api/CardOrder/CardOrderController.php
@@ -2,12 +2,118 @@
 
 namespace App\Http\Controllers\Api\CardOrder;
 
+use App\Http\Controllers\Api\CardOrder\Requests\CardOrderStoreRequest;
+use App\Http\Controllers\Api\CardOrder\Requests\CardOrderUpdateRequest;
+use App\Http\Controllers\Api\CardOrder\Resources\CardOrderIndexResource;
 use App\Http\Controllers\Controller;
+use App\Models\Order\Card\CardOrder;
+use App\Repos\Order\OrderRepo;
 use Dedoc\Scramble\Attributes\Group;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Str;
 
 #[Group('Sargytlar - Kart - Täze kart')]
 class CardOrderController extends Controller
 {
-    //
+    /**
+     * LIST*
+     */
+    public function index(): JsonResponse
+    {
+        return response()->json(CardOrderIndexResource::collection(
+            CardOrder::query()
+                ->with(['branch', 'cardState', 'cardType'])
+                ->where('user_id', auth()->id())
+                ->get()
+        ));
+    }
+
+    /**
+     * SAVE*
+     */
+    public function store(CardOrderStoreRequest $request): JsonResponse
+    {
+        $data = $request->validated();
+        CardOrder::forceCreate([
+            ...$data,
+            ...[
+                'user_id' => auth()->id(),
+                'citizenship' => 'TM',
+                'status' => OrderRepo::PENDING,
+            ],
+            ...$this->uploadedFiles($request),
+        ]);
+
+        return response()->json([
+            'message' => __('Successfully created'),
+        ], 201);
+    }
+
+    /**
+     * Upload files
+     *
+     * @return array<string, string>
+     */
+    public function uploadedFiles(Request $request): array
+    {
+        $files = [];
+
+        foreach (['passport_one', 'passport_two', 'passport_three', 'passport_four'] as $field) {
+            if ($request->hasFile($field)) {
+                $files[$field] = Str::after($request->file($field)->store('public'), 'public/');
+            }
+        }
+
+        return $files;
+    }
+
+    /**
+     * SHOW*
+     *
+     * ID ugradyp alyan route -da.
+     */
+    public function show(CardOrder $cardOrder)
+    {
+        if ($cardOrder->user_id != auth()->id()) {
+            return response()->json(status: 403);
+        }
+
+        return response()->json(new CardOrderIndexResource($cardOrder));
+    }
+
+    /**
+     * UPDATE*
+     *
+     * ID ugradyp `route`-da update edip bilyan. Base App Enum-lardan peydalan. Panelkadan gor.
+     */
+    public function update(CardOrderUpdateRequest $request, CardOrder $cardOrder): JsonResponse
+    {
+        $data = array_merge($request->validated(), $this->uploadedFiles($request));
+
+        Model::unguarded(function () use ($cardOrder, $data) {
+            $cardOrder->update($data);
+        });
+
+        return response()->json([
+            'message' => __('Successfully updated'),
+        ]);
+    }
+
+    /**
+     * DELETE*
+     */
+    public function destroy(CardOrder $cardOrder): JsonResponse
+    {
+        if ($cardOrder->user_id !== auth()->id()) {
+            return response()->json(status: 403);
+        }
+
+        $cardOrder->delete();
+
+        return response()->json([
+            'message' => __('Successfully deleted'),
+        ]);
+    }
 }
diff --git a/app/Http/Controllers/Api/CardOrder/Requests/CardOrderStoreRequest.php b/app/Http/Controllers/Api/CardOrder/Requests/CardOrderStoreRequest.php
new file mode 100644
index 0000000..d8a926f
--- /dev/null
+++ b/app/Http/Controllers/Api/CardOrder/Requests/CardOrderStoreRequest.php
@@ -0,0 +1,166 @@
+<?php
+
+namespace App\Http\Controllers\Api\CardOrder\Requests;
+
+use App\Repos\System\Settings\Legal\PassportRepo;
+use App\Repos\System\Settings\Location\RegionRepo;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class CardOrderStoreRequest extends FormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<int, string>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            /**
+             * Card state id (https://online.tbbank.gov.tm/api/base-app-enums)
+             */
+            'card_state_id' => ['required', 'integer', Rule::exists('card_states', 'id')],
+
+            /**
+             * Card type id (https://online.tbbank.gov.tm/api/base-app-enums)
+             */
+            'card_type_id' => ['required', 'integer', Rule::exists('card_types', 'id')],
+
+            /**
+             * Region (https://online.tbbank.gov.tm/api/base-app-enums)
+             *
+             * @example ag
+             */
+            'region' => ['required', 'string', Rule::in(array_keys(RegionRepo::values()))],
+
+            /**
+             * Branch id (https://online.tbbank.gov.tm/api/branches)
+             */
+            'branch_id' => ['required', 'integer', Rule::exists('branches', 'id')],
+
+            /**
+             * Customer name
+             *
+             * @example Mahmyt
+             */
+            'customer_name' => ['required', 'string', 'max:255'],
+
+            /**
+             * Customer surname
+             *
+             * @example Allaberdiyev
+             */
+            'customer_surname' => ['required', 'string', 'max:255'],
+
+            /**
+             * Customer patronic name
+             *
+             * @example Öwezowiç
+             */
+            'customer_patronic_name' => ['nullable', 'string', 'max:255'],
+
+            /**
+             * Date of birth
+             *
+             * @example 10.10.2000
+             */
+            'born_at' => ['required', 'before_or_equal:today'],
+
+            /**
+             * Old surname
+             */
+            'old_surname' => ['nullable', 'string', 'max:255'],
+
+            /**
+             * Passport serie
+             *
+             * @example I-AS
+             */
+            'passport_serie' => ['required', 'string', Rule::in(PassportRepo::values())],
+
+            /**
+             * Passport number
+             *
+             * @example 100999
+             */
+            'passport_id' => ['required', 'numeric', 'digits:6'],
+
+            /**
+             * Passport date of issue
+             *
+             * @example 10.10.2020
+             */
+            'passport_given_at' => ['required', 'date', 'before_or_equal:today'],
+
+            /**
+             * Passport given by
+             *
+             * @example Ashgabat shaher polisiya tarapyndan
+             */
+            'passport_given_by' => ['required', 'string', 'max:255'],
+
+            /**
+             * Born place
+             *
+             * @example Ashgabat shaher
+             */
+            'born_place' => ['required', 'string', 'max:255'],
+
+            /**
+             * Işleýän ýeriňiz we wezipäňiz
+             *
+             * @example Aşgabat şäheriniň "TÜRKMENBAŞY" PAÝDARLAR TÄJIRÇILIK bankynyň Baş bugalteri
+             */
+            'job_location' => ['required', 'string', 'max:255'],
+
+            /**
+             * Passport address
+             *
+             * @example Kemine 100/190
+             */
+            'passport_address' => ['required', 'string', 'max:255'],
+
+            /**
+             * Real address
+             *
+             * @example Kemine 100/190
+             */
+            'real_address' => ['required', 'string', 'max:255'],
+
+            /**
+             * Phone number
+             *
+             * @example 65999990
+             */
+            'phone' => ['required', 'integer', 'between:61000000, 71999999'],
+
+            /**
+             * Phone number (additional)
+             *
+             * @example 65999990
+             */
+            'phone_additional' => ['nullable', 'integer', 'between:61000000, 71999999'],
+
+            /**
+             * Passport (sahypa 1)
+             */
+            'passport_one' => ['required', 'file', 'max:2048', 'mimes:jpg,png,jpeg'],
+
+            /**
+             * Pasport (2-3-nji sahypa)
+             */
+            'passport_two' => ['required', 'file', 'max:2048', 'mimes:jpg,png,jpeg'],
+
+            /**
+             * Pasport (8-9 sahypa)
+             */
+            'passport_three' => ['required', 'file', 'max:2048', 'mimes:jpg,png,jpeg'],
+
+            /**
+             * Pasport (32-nji sahypa)
+             */
+            'passport_four' => ['required', 'file', 'max:2048', 'mimes:jpg,png,jpeg'],
+        ];
+    }
+}
diff --git a/app/Http/Controllers/Api/CardOrder/Requests/CardOrderUpdateRequest.php b/app/Http/Controllers/Api/CardOrder/Requests/CardOrderUpdateRequest.php
new file mode 100644
index 0000000..f2f2b0c
--- /dev/null
+++ b/app/Http/Controllers/Api/CardOrder/Requests/CardOrderUpdateRequest.php
@@ -0,0 +1,166 @@
+<?php
+
+namespace App\Http\Controllers\Api\CardOrder\Requests;
+
+use App\Repos\System\Settings\Legal\PassportRepo;
+use App\Repos\System\Settings\Location\RegionRepo;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class CardOrderUpdateRequest extends FormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<int, string>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            /**
+             * Card state id (https://online.tbbank.gov.tm/api/base-app-enums)
+             */
+            'card_state_id' => ['sometimes', 'integer', Rule::exists('card_states', 'id')],
+
+            /**
+             * Card type id (https://online.tbbank.gov.tm/api/base-app-enums)
+             */
+            'card_type_id' => ['sometimes', 'integer', Rule::exists('card_types', 'id')],
+
+            /**
+             * Region (https://online.tbbank.gov.tm/api/base-app-enums)
+             *
+             * @example ag
+             */
+            'region' => ['sometimes', 'string', Rule::in(array_keys(RegionRepo::values()))],
+
+            /**
+             * Branch id (https://online.tbbank.gov.tm/api/branches)
+             */
+            'branch_id' => ['sometimes', 'integer', Rule::exists('branches', 'id')],
+
+            /**
+             * Customer name
+             *
+             * @example Mahmyt
+             */
+            'customer_name' => ['sometimes', 'string', 'max:255'],
+
+            /**
+             * Customer surname
+             *
+             * @example Allaberdiyev
+             */
+            'customer_surname' => ['sometimes', 'string', 'max:255'],
+
+            /**
+             * Customer patronic name
+             *
+             * @example Öwezowiç
+             */
+            'customer_patronic_name' => ['nullable', 'string', 'max:255'],
+
+            /**
+             * Date of birth
+             *
+             * @example 10.10.2000
+             */
+            'born_at' => ['sometimes', 'before_or_equal:today'],
+
+            /**
+             * Old surname
+             */
+            'old_surname' => ['nullable', 'string', 'max:255'],
+
+            /**
+             * Passport serie
+             *
+             * @example I-AS
+             */
+            'passport_serie' => ['sometimes', 'string', Rule::in(PassportRepo::values())],
+
+            /**
+             * Passport number
+             *
+             * @example 100999
+             */
+            'passport_id' => ['sometimes', 'numeric', 'digits:6'],
+
+            /**
+             * Passport date of issue
+             *
+             * @example 10.10.2020
+             */
+            'passport_given_at' => ['sometimes', 'date', 'before_or_equal:today'],
+
+            /**
+             * Passport given by
+             *
+             * @example Ashgabat shaher polisiya tarapyndan
+             */
+            'passport_given_by' => ['sometimes', 'string', 'max:255'],
+
+            /**
+             * Born place
+             *
+             * @example Ashgabat shaher
+             */
+            'born_place' => ['sometimes', 'string', 'max:255'],
+
+            /**
+             * Işleýän ýeriňiz we wezipäňiz
+             *
+             * @example Aşgabat şäheriniň "TÜRKMENBAŞY" PAÝDARLAR TÄJIRÇILIK bankynyň Baş bugalteri
+             */
+            'job_location' => ['sometimes', 'string', 'max:255'],
+
+            /**
+             * Passport address
+             *
+             * @example Kemine 100/190
+             */
+            'passport_address' => ['sometimes', 'string', 'max:255'],
+
+            /**
+             * Real address
+             *
+             * @example Kemine 100/190
+             */
+            'real_address' => ['sometimes', 'string', 'max:255'],
+
+            /**
+             * Phone number
+             *
+             * @example 65999990
+             */
+            'phone' => ['sometimes', 'integer', 'between:61000000, 71999999'],
+
+            /**
+             * Phone number (additional)
+             *
+             * @example 65999990
+             */
+            'phone_additional' => ['nullable', 'integer', 'between:61000000, 71999999'],
+
+            /**
+             * Passport (sahypa 1)
+             */
+            'passport_one' => ['sometimes', 'file', 'max:2048', 'mimes:jpg,png,jpeg'],
+
+            /**
+             * Pasport (2-3-nji sahypa)
+             */
+            'passport_two' => ['sometimes', 'file', 'max:2048', 'mimes:jpg,png,jpeg'],
+
+            /**
+             * Pasport (8-9 sahypa)
+             */
+            'passport_three' => ['sometimes', 'file', 'max:2048', 'mimes:jpg,png,jpeg'],
+
+            /**
+             * Pasport (32-nji sahypa)
+             */
+            'passport_four' => ['sometimes', 'file', 'max:2048', 'mimes:jpg,png,jpeg'],
+        ];
+    }
+}
diff --git a/app/Http/Controllers/Api/CardOrder/Resources/CardOrderIndexResource.php b/app/Http/Controllers/Api/CardOrder/Resources/CardOrderIndexResource.php
new file mode 100644
index 0000000..53f9e77
--- /dev/null
+++ b/app/Http/Controllers/Api/CardOrder/Resources/CardOrderIndexResource.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Http\Controllers\Api\CardOrder\Resources;
+
+use App\Repos\Order\OrderRepo;
+use App\Repos\System\Settings\Location\RegionRepo;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/**
+ * @mixin \App\Models\Order\Card\CardOrder
+ */
+class CardOrderIndexResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'unique_id' => $this->unique_id,
+
+            'paid' => $this->paid,
+
+            'card_state_id' => $this->cardState?->name,
+
+            'card_type_id' => $this->cardType?->name,
+
+            'region' => RegionRepo::label($this->region),
+            'branch_id' => $this->branch?->name,
+
+            'customer_name' => $this->customer_name,
+            'customer_surname' => $this->customer_surname,
+            'customer_patronic_name' => $this->customer_patronic_name,
+            'old_surname' => $this->old_surname,
+            'born_at' => $this->born_at,
+
+            'passport_serie' => $this->passport_serie,
+            'passport_id' => $this->passport_id,
+            'passport_given_at' => $this->passport_given_at,
+            'passport_given_by' => $this->passport_given_by,
+            'born_place' => $this->born_place,
+            'passport_address' => $this->passport_address,
+            'real_address' => $this->real_address,
+
+            'job_location' => $this->job_location,
+
+            'phone' => $this->phone,
+            'phone_additional' => $this->phone_additional,
+
+            'status' => OrderRepo::statusFormatted($this->status),
+
+            'passport_one' => url('/storage/'.$this->passport_one),
+            'passport_two' => url('/storage/'.$this->passport_two),
+            'passport_three' => url('/storage/'.$this->passport_three),
+            'passport_four' => url('/storage/'.$this->passport_four),
+
+            'notes' => $this->notes,
+
+            'user_id' => $this->user_id,
+
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+            'deleted_at' => $this->deleted_at,
+        ];
+    }
+}
diff --git a/app/Http/Controllers/Api/LoanOrder/Remaining/LoanOrderRemainingOrderController.php b/app/Http/Controllers/Api/LoanOrder/Remaining/LoanOrderRemainingOrderController.php
index 28af632..1077324 100644
--- a/app/Http/Controllers/Api/LoanOrder/Remaining/LoanOrderRemainingOrderController.php
+++ b/app/Http/Controllers/Api/LoanOrder/Remaining/LoanOrderRemainingOrderController.php
@@ -119,7 +119,7 @@ class LoanOrderRemainingOrderController extends Controller
         $order->delete();
 
         return response()->json([
-            'message' => __('Successfully deleted')
+            'message' => __('Successfully deleted'),
         ]);
     }
 }
diff --git a/app/Http/Controllers/Api/LoanPaidOffLetterOrderController.php b/app/Http/Controllers/Api/LoanPaidOffLetterOrderController.php
index 24b57cc..e223936 100644
--- a/app/Http/Controllers/Api/LoanPaidOffLetterOrderController.php
+++ b/app/Http/Controllers/Api/LoanPaidOffLetterOrderController.php
@@ -6,7 +6,6 @@ use App\Http\Controllers\Api\LoanPaidOffLetterOrder\Requests\LoanPaidOffLetterOr
 use App\Http\Controllers\Api\LoanPaidOffLetterOrder\Resources\LoanPaidOffLetterOrderIndexResource;
 use App\Http\Controllers\Controller;
 use App\Models\Order\Loan\LoanPaidOffLetterOrder;
-use App\Repos\Order\OrderRepo;
 use App\Repos\System\Settings\Legal\PassportRepo;
 use App\Repos\System\Settings\Location\RegionRepo;
 use Dedoc\Scramble\Attributes\Group;
@@ -161,7 +160,6 @@ class LoanPaidOffLetterOrderController extends Controller
         ]);
 
         Model::unguarded(function () use ($order, $data) {
-            info([$data]);
             $order->update($data);
         });
 
diff --git a/app/Modules/BaseAppEnum/Controllers/BaseAppEnumController.php b/app/Modules/BaseAppEnum/Controllers/BaseAppEnumController.php
index c38f8e5..550a7de 100644
--- a/app/Modules/BaseAppEnum/Controllers/BaseAppEnumController.php
+++ b/app/Modules/BaseAppEnum/Controllers/BaseAppEnumController.php
@@ -3,12 +3,16 @@
 namespace App\Modules\BaseAppEnum\Controllers;
 
 use App\Http\Controllers\Controller;
+use App\Repos\Order\Card\CardStateRepo;
+use App\Repos\Order\Card\CardTypeRepo;
 use App\Repos\Order\Loan\LoanTypeRepo;
 use App\Repos\System\Settings\Legal\EducationRepo;
 use App\Repos\System\Settings\Legal\MarriageRepo;
 use App\Repos\System\Settings\Legal\PassportRepo;
 use App\Repos\System\Settings\Location\RegionRepo;
+use Dedoc\Scramble\Attributes\Group;
 
+#[Group('1. App enums')]
 class BaseAppEnumController extends Controller
 {
     /**
@@ -26,6 +30,8 @@ class BaseAppEnumController extends Controller
             'educations' => $this->educationValues(),
             'marriage_statuses' => MarriageRepo::values(),
             'passport_series' => PassportRepo::values(),
+            'card_types' => CardTypeRepo::values(),
+            'card_states' => CardStateRepo::values(),
         ];
     }
 
diff --git a/app/Modules/LoanOrder/Controllers/LoanOrderController.php b/app/Modules/LoanOrder/Controllers/LoanOrderController.php
index 7037205..e95d7a6 100644
--- a/app/Modules/LoanOrder/Controllers/LoanOrderController.php
+++ b/app/Modules/LoanOrder/Controllers/LoanOrderController.php
@@ -143,7 +143,7 @@ class LoanOrderController extends Controller
             $data['guarantor_2_card_year'] = indexByValue($request->guarantor_2_card_year, $years);
         }
 
-        $data += $this->uploadedFiles($request);
+        $data = array_merge($request->all(), $this->uploadedFiles($request));
 
         Model::unguarded(function () use ($loanOrder, $data) {
             $loanOrder->update($data);
diff --git a/app/Modules/LoanOrder/Controllers/Resources/LoanOrderIndexResource.php b/app/Modules/LoanOrder/Controllers/Resources/LoanOrderIndexResource.php
index ab58094..cc9d912 100644
--- a/app/Modules/LoanOrder/Controllers/Resources/LoanOrderIndexResource.php
+++ b/app/Modules/LoanOrder/Controllers/Resources/LoanOrderIndexResource.php
@@ -48,10 +48,10 @@ class LoanOrderIndexResource extends JsonResource
             'work_position' => $this->work_position,
             'education' => $this->education,
             'marriage_status' => $this->marriage_status,
-            'passport_one' => url('/storage/' . $this->passport_one),
-            'passport_two' => url('/storage/' . $this->passport_two),
-            'passport_three' => url('/storage/' . $this->passport_three),
-            'passport_four' => url('/storage/' . $this->passport_four),
+            'passport_one' => url('/storage/'.$this->passport_one),
+            'passport_two' => url('/storage/'.$this->passport_two),
+            'passport_three' => url('/storage/'.$this->passport_three),
+            'passport_four' => url('/storage/'.$this->passport_four),
             'user_id' => $this->user_id,
             'status' => $this->status,
             'notes' => $this->notes,
diff --git a/routes/api.php b/routes/api.php
index 620ccf1..c6b3ede 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -91,7 +91,7 @@ Route::middleware(['auth:sanctum', 'not_banned'])->group(function () {
     // Alerts...
     Route::get('alerts', [AlertController::class, 'index']);
 
-    // Card order...
+    // Card order... [tested fully]
     Route::get('card-order', [CardOrderController::class, 'index']);
     Route::get('card-order/{cardOrder}', [CardOrderController::class, 'show']);
     Route::post('card-order', [CardOrderController::class, 'store']);