diff --git a/src/modules/dmenu/dmenu.controller.ts b/src/modules/dmenu/dmenu.controller.ts
index 514f4e7..73ddeb6 100644
--- a/src/modules/dmenu/dmenu.controller.ts
+++ b/src/modules/dmenu/dmenu.controller.ts
@@ -16,9 +16,9 @@ import { PermissionEnum } from "../users/enums/permission.enum";
 import { UserDec } from "../../common/decorators/user.decorator";
 
 @ApiTags("d-menu")
-@Controller("admin/dmenu")
+@Controller()
 @AuthGuards()
-@PermissionsDec(PermissionEnum.DMENU)
+
 @ApiBearerAuth()
 export class DmenuController {
   constructor(
@@ -28,96 +28,109 @@ export class DmenuController {
   ) { }
 
   // Icon endpoints
-  @Post('icons')
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Post('admin/dmenu/icons')
   @ApiOperation({ summary: "Create icon" })
   createIcon(@Body() dto: CreateIconDto) {
     return this.iconsService.createIcon(dto);
   }
 
-  @Get('icons')
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Get('admin/dmenu/icons')
   @ApiOperation({ summary: "Get all icons" })
   findAllIcons() {
     return this.iconsService.findAllIcons();
   }
   // Group endpoints: place BEFORE `icons/:id` routes to avoid route conflicts
-  @Post("icons/groups")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Post("admin/dmenu/icons/groups")
   @ApiOperation({ summary: "Create icon group" })
   createGroup(@Body() dto: CreateGroupDto) {
     return this.iconsService.createGroup(dto);
   }
 
-  @Get("icons/groups")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Get("admin/dmenu/icons/groups")
   @ApiOperation({ summary: "Get all icon groups" })
   findAllGroups() {
     return this.iconsService.findAllGroups();
   }
 
-  @Get("icons/groups/:id")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Get("admin/dmenu/icons/groups/:id")
   @ApiOperation({ summary: "Get icon group by id" })
   @ApiParam({ name: "id", required: true, type: String })
   findOneGroup(@Param("id") id: string) {
     return this.iconsService.findOneGroup(id);
   }
 
-  @Patch("icons/groups/:id")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Patch("admin/dmenu/icons/groups/:id")
   @ApiOperation({ summary: "Update icon group" })
   @ApiParam({ name: "id" })
   updateGroup(@Param("id") id: string, @Body() dto: UpdateGroupDto) {
     return this.iconsService.updateGroup(id, dto);
   }
 
-  @Delete("icons/groups/:id")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Delete("admin/dmenu/icons/groups/:id")
   @ApiOperation({ summary: "Delete icon group" })
   @ApiParam({ name: "id" })
   removeGroup(@Param("id") id: string) {
     return this.iconsService.removeGroup(id);
   }
 
-  @Get("icons/:id")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Get("admin/dmenu/icons/:id")
   @ApiOperation({ summary: "Get icon by id" })
   @ApiParam({ name: "id", required: true, type: String })
   findOneIcon(@Param("id") id: string) {
     return this.iconsService.findOneIcon(id);
   }
 
-  @Patch("icons/:id")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Patch("admin/dmenu/icons/:id")
   @ApiOperation({ summary: "Update icon" })
   @ApiParam({ name: "id" })
   updateIcon(@Param("id") id: string, @Body() dto: UpdateIconDto) {
     return this.iconsService.updateIcon(id, dto);
   }
 
-  @Delete("icons/:id")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Delete("admin/dmenu/icons/:id")
   @ApiOperation({ summary: "Delete icon" })
   @ApiParam({ name: "id" })
   removeIcon(@Param("id") id: string) {
     return this.iconsService.removeIcon(id);
   }
   // contacts
-  @Get('contacts')
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Get('admin/dmenu/contacts')
   findAll() {
     return this.contactService.findAll();
   }
 
-  @Get("contacts/:id")
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Get("admin/dmenu/contacts/:id")
   findOne(@Param("id") id: string) {
     return this.contactService.findOne(+id);
   }
 
   //  restaurant
-  @Get('restaurants')
+  @PermissionsDec(PermissionEnum.DMENU)
+  @Get('admin/dmenu/restaurants')
   @ApiOperation({ summary: "Get all restaurants" })
   findAllRestaurant(@Query() queryDto: FindRestaurantsDto) {
     return this.restaurantService.findAll(queryDto);
   }
-
-  @Post('restaurants')
+  //User Endpoints
+  @Post('dmenu/restaurants')
   @ApiOperation({ summary: "Create restaurant" })
   createRestaurant(@Body() dto: SetupRestaurantDto, @UserDec("id") userId: string) {
     return this.restaurantService.createRestaurant(dto, userId);
   }
 
-  @Get('/super-admin/restaurants/subscription/:subscriptionId')
+  @Get('dmenu/restaurants/subscription/:subscriptionId')
   @ApiOperation({ summary: "Get restaurant subscription by subscription ID" })
   @ApiParam({ name: "subscriptionId", required: true, type: String })
   getRestaurantSubscription(@Param("subscriptionId") subscriptionId: string) {