diff --git a/.gitignore b/.gitignore
index de82e0b..b93b0b2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -89,3 +89,6 @@ SubitonBackend/.vs/SubitonBackend/v15/Server/sqlite3/storage.ide
 SubitonAPI/.vs/SubitonAPI/DesignTimeBuild/.dtbcache
 SubitonAPI/.vs/SubitonAPI/v16/Server/sqlite3/db.lock
 SubitonAPI/.vs/SubitonAPI/v16/Server/sqlite3/storage.ide
+SubitonAPI/SubitonAPI/appsettings.json
+SubitonAPI/SubitonAPI/appsettings.json
+SubitonAPI/SubitonAPI/appsettings.json
diff --git a/SubitonAPI/.vs/SubitonAPI/config/applicationhost.config b/SubitonAPI/.vs/SubitonAPI/config/applicationhost.config
index 032d57e..d401068 100644
--- a/SubitonAPI/.vs/SubitonAPI/config/applicationhost.config
+++ b/SubitonAPI/.vs/SubitonAPI/config/applicationhost.config
@@ -157,7 +157,7 @@
       </site>
       <site name="SubitonAPI" id="2">
         <application path="/" applicationPool="SubitonAPI AppPool">
-          <virtualDirectory path="/" physicalPath="C:\GiT\Subiton-DEMO\SubitonAPI\SubitonAPI" />
+          <virtualDirectory path="/" physicalPath="C:\GiT\Subiton\SubitonAPI\SubitonAPI" />
         </application>
         <bindings>
           <binding protocol="http" bindingInformation="*:50708:localhost" />
diff --git a/SubitonAPI/.vs/SubitonAPI/v16/TestStore/0/000-0000.testlog b/SubitonAPI/.vs/SubitonAPI/v16/TestStore/0/000-0000.testlog
index 0cd5930..3fdbd4a 100644
Binary files a/SubitonAPI/.vs/SubitonAPI/v16/TestStore/0/000-0000.testlog and b/SubitonAPI/.vs/SubitonAPI/v16/TestStore/0/000-0000.testlog differ
diff --git a/SubitonAPI/SubitonAPI/Controllers/PhotosController.cs b/SubitonAPI/SubitonAPI/Controllers/PhotosController.cs
new file mode 100644
index 0000000..a42a1a0
--- /dev/null
+++ b/SubitonAPI/SubitonAPI/Controllers/PhotosController.cs
@@ -0,0 +1,131 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using AutoMapper;
+using CloudinaryDotNet;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+using SubitonAPI.Data;
+using SubitonAPI.Helpers;
+using SubitonAPI.Models;
+
+namespace SubitonAPI.Controllers
+{
+    [Authorize]
+    [Route("api/[controller]")]
+    [ApiController]
+    public class PhotosController : ControllerBase
+    {
+        private readonly DataContext _context;
+        private readonly IUserRepository _userRepository;
+        private readonly IMapper _mapper;
+        private readonly IOptions<ClaudinarySettings> _claudinarySettings;
+        private readonly Cloudinary _cloudinary;
+
+        public PhotosController(DataContext context, IUserRepository userRepository, IMapper mapper, IOptions<ClaudinarySettings> claudinarySettings)
+        {
+            _context = context;
+            _userRepository = userRepository;
+            _mapper = mapper;
+            _claudinarySettings = claudinarySettings;
+
+            Account account = new Account(
+                _claudinarySettings.Value.CloudName,
+                _claudinarySettings.Value.ApiKey,
+                _claudinarySettings.Value.ApiSecret
+            );
+
+            _cloudinary = new Cloudinary(account);
+        }
+
+        // GET: api/Photos
+        [HttpGet]
+        public async Task<ActionResult<IEnumerable<Photo>>> GetPhotos()
+        {
+            return await _context.Photos.ToListAsync();
+        }
+
+        // GET: api/Photos/5
+        [HttpGet("{id}")]
+        public async Task<ActionResult<Photo>> GetPhoto(int id)
+        {
+            var photo = await _context.Photos.FindAsync(id);
+
+            if (photo == null)
+            {
+                return NotFound();
+            }
+
+            return photo;
+        }
+
+        // PUT: api/Photos/5
+        // To protect from overposting attacks, please enable the specific properties you want to bind to, for
+        // more details see https://aka.ms/RazorPagesCRUD.
+        [HttpPut("{id}")]
+        public async Task<IActionResult> PutPhoto(int id, Photo photo)
+        {
+            if (id != photo.Id)
+            {
+                return BadRequest();
+            }
+
+            _context.Entry(photo).State = EntityState.Modified;
+
+            try
+            {
+                await _context.SaveChangesAsync();
+            }
+            catch (DbUpdateConcurrencyException)
+            {
+                if (!PhotoExists(id))
+                {
+                    return NotFound();
+                }
+                else
+                {
+                    throw;
+                }
+            }
+
+            return NoContent();
+        }
+
+        // POST: api/Photos
+        // To protect from overposting attacks, please enable the specific properties you want to bind to, for
+        // more details see https://aka.ms/RazorPagesCRUD.
+        [HttpPost]
+        public async Task<ActionResult<Photo>> PostPhoto(Photo photo)
+        {
+            _context.Photos.Add(photo);
+            await _context.SaveChangesAsync();
+
+            return CreatedAtAction("GetPhoto", new { id = photo.Id }, photo);
+        }
+
+        // DELETE: api/Photos/5
+        [HttpDelete("{id}")]
+        public async Task<ActionResult<Photo>> DeletePhoto(int id)
+        {
+            var photo = await _context.Photos.FindAsync(id);
+            if (photo == null)
+            {
+                return NotFound();
+            }
+
+            _context.Photos.Remove(photo);
+            await _context.SaveChangesAsync();
+
+            return photo;
+        }
+
+        private bool PhotoExists(int id)
+        {
+            return _context.Photos.Any(e => e.Id == id);
+        }
+    }
+}
diff --git a/SubitonAPI/SubitonAPI/Startup.cs b/SubitonAPI/SubitonAPI/Startup.cs
index bc6e532..c8721c4 100644
--- a/SubitonAPI/SubitonAPI/Startup.cs
+++ b/SubitonAPI/SubitonAPI/Startup.cs
@@ -39,6 +39,8 @@ public void ConfigureServices(IServiceCollection services)
             services.AddDbContext<DataContext>(x => x.UseSqlite("Data Source =Subiton.db"));
             services.AddControllers();
             services.AddCors();
+            //claudinary config
+            services.Configure<ClaudinarySettings>(Configuration.GetSection("ClaudinarySettings"));
             //automapper init
             services.AddAutoMapper(typeof(Startup));
             // Auto Mapper Configurations
diff --git a/SubitonAPI/SubitonAPI/Subiton.db b/SubitonAPI/SubitonAPI/Subiton.db
index 5ec2431..068fdb6 100644
Binary files a/SubitonAPI/SubitonAPI/Subiton.db and b/SubitonAPI/SubitonAPI/Subiton.db differ
diff --git a/SubitonAPI/SubitonAPI/SubitonAPI.csproj b/SubitonAPI/SubitonAPI/SubitonAPI.csproj
index 2b3a65c..5211b2b 100644
--- a/SubitonAPI/SubitonAPI/SubitonAPI.csproj
+++ b/SubitonAPI/SubitonAPI/SubitonAPI.csproj
@@ -11,6 +11,10 @@
     <PackageReference Include="CloudinaryDotNet" Version="1.8.0" />
     <PackageReference Include="EntityFramework" Version="6.3.0" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="3.0.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.FxCopAnalyzers" Version="2.9.7">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="3.0.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>