diff --git a/app/delivery/web/api/restricted/orders.go b/app/delivery/web/api/restricted/orders.go
new file mode 100644
index 0000000..4cb054a
--- /dev/null
+++ b/app/delivery/web/api/restricted/orders.go
@@ -0,0 +1,148 @@
+package restricted
+
+import (
+	"strconv"
+
+	"git.ma-al.com/goc_daniel/b2b/app/model"
+	"git.ma-al.com/goc_daniel/b2b/app/utils/i18n"
+	"git.ma-al.com/goc_daniel/b2b/app/utils/localeExtractor"
+	"git.ma-al.com/goc_daniel/b2b/app/utils/nullable"
+	"git.ma-al.com/goc_daniel/b2b/app/utils/query/query_params"
+	"git.ma-al.com/goc_daniel/b2b/app/utils/response"
+	"git.ma-al.com/goc_daniel/b2b/app/utils/responseErrors"
+	"github.com/gofiber/fiber/v3"
+)
+
+type OrdersHandler struct{}
+
+func NewOrdersHandler() *OrdersHandler {
+	return &OrdersHandler{}
+}
+
+func OrdersHandlerRoutes(r fiber.Router) fiber.Router {
+	handler := NewOrdersHandler()
+
+	r.Get("/list", handler.ListOrders)
+	r.Get("/place-new-order", handler.PlaceNewOrder)
+	r.Get("/change-order-address", handler.ChangeOrderAddress)
+	r.Get("/change-order-status", handler.ChangeOrderStatus)
+
+	return r
+}
+
+// when a user (not admin) wants to list orders, we automatically append filter to only view his orders.
+// we base permissions and user based on target user only.
+func (h *OrdersHandler) ListOrders(c fiber.Ctx) error {
+	user, ok := localeExtractor.GetCustomer(c)
+	if !ok {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrInvalidBody)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrInvalidBody)))
+	}
+
+	paging, filters, err := query_params.ParseFilters[model.Order](c, columnMappingListOrders)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(err)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, err)))
+	}
+
+	list, err := h.ordersService.Find(user, paging, filters)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(err)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, err)))
+	}
+
+	return c.JSON(response.Make(&list.Items, int(list.Count), i18n.T_(c, response.Message_OK)))
+}
+
+var columnMappingListOrders map[string]string = map[string]string{
+	"order_id": "?",
+}
+
+func (h *OrdersHandler) PlaceNewOrder(c fiber.Ctx) error {
+	userID, ok := localeExtractor.GetUserID(c)
+	if !ok {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrInvalidBody)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrInvalidBody)))
+	}
+
+	cart_id_attribute := c.Query("cart_id")
+	cart_id, err := strconv.Atoi(cart_id_attribute)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrBadAttribute)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrBadAttribute)))
+	}
+
+	address_info := c.Query("address_info")
+	country_id_attribute := c.Query("country_id")
+	country_id, err := strconv.Atoi(country_id_attribute)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrBadAttribute)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrBadAttribute)))
+	}
+
+	err = h.ordersService.PlaceNewOrder(userID, cart_id, country_id, address_info)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(err)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, err)))
+	}
+
+	return c.JSON(response.Make(nullable.GetNil(""), 0, i18n.T_(c, response.Message_OK)))
+}
+
+// we base permissions and user based on target user only.
+func (h *OrdersHandler) ChangeOrderAddress(c fiber.Ctx) error {
+	user, ok := localeExtractor.GetCustomer(c)
+	if !ok {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrInvalidBody)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrInvalidBody)))
+	}
+
+	order_id_attribute := c.Query("order_id")
+	order_id, err := strconv.Atoi(order_id_attribute)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrBadAttribute)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrBadAttribute)))
+	}
+
+	address_info := c.Query("address_info")
+	country_id_attribute := c.Query("country_id")
+	country_id, err := strconv.Atoi(country_id_attribute)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrBadAttribute)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrBadAttribute)))
+	}
+
+	err = h.ordersService.ChangeOrderAddress(user, order_id, country_id, address_info)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(err)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, err)))
+	}
+
+	return c.JSON(response.Make(nullable.GetNil(""), 0, i18n.T_(c, response.Message_OK)))
+}
+
+// we base permissions and user based on target user only.
+func (h *OrdersHandler) ChangeOrderStatus(c fiber.Ctx) error {
+	user, ok := localeExtractor.GetCustomer(c)
+	if !ok {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrInvalidBody)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrInvalidBody)))
+	}
+
+	order_id_attribute := c.Query("order_id")
+	order_id, err := strconv.Atoi(order_id_attribute)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrBadAttribute)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrBadAttribute)))
+	}
+
+	status := c.Query("status")
+
+	err = h.ordersService.ChangeOrderStatus(user, order_id, status)
+	if err != nil {
+		return c.Status(responseErrors.GetErrorStatus(err)).
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, err)))
+	}
+
+	return c.JSON(response.Make(nullable.GetNil(""), 0, i18n.T_(c, response.Message_OK)))
+}
diff --git a/app/delivery/web/init.go b/app/delivery/web/init.go
index 2162d66..eb7a4c3 100644
--- a/app/delivery/web/init.go
+++ b/app/delivery/web/init.go
@@ -132,6 +132,10 @@ func (s *Server) Setup() error {
 	carts := s.restricted.Group("/carts")
 	restricted.CartsHandlerRoutes(carts)
 
+	// orders (restricted)
+	orders := s.restricted.Group("/orders")
+	restricted.OrdersHandlerRoutes(orders)
+
 	// addresses (restricted)
 	addresses := s.restricted.Group("/addresses")
 	restricted.AddressesHandlerRoutes(addresses)
diff --git a/app/model/order.go b/app/model/order.go
new file mode 100644
index 0000000..e69de29