diff --git a/api.http b/api.http
index f1eaaf9..9da28e5 100644
--- a/api.http
+++ b/api.http
@@ -2,7 +2,7 @@ GET http://192.168.1.96:3006
 
 ###
 
-GET http://localhost:3006
+GET http://localhost:3000/oracle/SearchHolder/1
 
 ###
 
diff --git a/src/dto/manage-holders/manage-holders.dto.ts b/src/dto/manage-holders/manage-holders.dto.ts
index 7a65fc3..98b50bf 100644
--- a/src/dto/manage-holders/manage-holders.dto.ts
+++ b/src/dto/manage-holders/manage-holders.dto.ts
@@ -96,5 +96,5 @@ export class HolderContactActivateOrInactivateDTO extends IntersectionType(
 
 export class SearchHolderDTO extends IntersectionType(
     SPID_DTO,
-    HOLDERNAME_DTO
+    PartialType(HOLDERNAME_DTO)
 ) { }
\ No newline at end of file
diff --git a/src/oracle/carnet-application/carnet-application.controller.ts b/src/oracle/carnet-application/carnet-application.controller.ts
index 1fb39e6..c9e7e88 100644
--- a/src/oracle/carnet-application/carnet-application.controller.ts
+++ b/src/oracle/carnet-application/carnet-application.controller.ts
@@ -78,6 +78,11 @@ export class CarnetApplicationController {
         return this.carnetApplicationService.UpdateShippingDetails(body);
     }
 
+    @Get('EstimatedFees/:P_SPID/:P_USERID/:P_HEADERID')
+    EstimatedFees(@Param() body: GetCarnetControlCenterDTO) {
+        return this.carnetApplicationService.EstimatedFees(body);
+    }
+
     // processing [ PROCESSINGCENTER_PKG ]
 
     @Patch('ProcessOriginalCarnet')
diff --git a/src/oracle/carnet-application/carnet-application.service.ts b/src/oracle/carnet-application/carnet-application.service.ts
index 6ec0497..14aa7e9 100644
--- a/src/oracle/carnet-application/carnet-application.service.ts
+++ b/src/oracle/carnet-application/carnet-application.service.ts
@@ -688,6 +688,41 @@ export class CarnetApplicationService {
         }
     }
 
+    async EstimatedFees(body: GetCarnetControlCenterDTO) {
+        let connection;
+
+        try {
+            connection = await this.oracleDBService.getConnection();
+
+            const result = await connection.execute(
+                `BEGIN
+                    CARNETAPPLICATION_PKG.EstimatedFees(
+                        :P_SPID, :P_USERID , :P_HEADERID, :P_CURSOR  
+                    );
+                END;`,
+                {
+                    P_SPID: { val: body.P_SPID, type: oracledb.DB_TYPE_NUMBER },
+                    P_USERID: { val: body.P_USERID, type: oracledb.DB_TYPE_NVARCHAR },
+                    P_HEADERID: { val: body.P_HEADERID, type: oracledb.DB_TYPE_NUMBER },
+                    P_CURSOR: { type: oracledb.CURSOR, dir: oracledb.BIND_OUT }
+                },
+                { outFormat: oracledb.OUT_FORMAT_OBJECT }
+            );
+
+            const outBinds = result.outBinds;
+            if (!outBinds?.P_CURSOR) {
+                this.logger.error('One or more expected cursors are missing from stored procedure output.');
+                throw new InternalServerException("Incomplete data received from the database.");
+            }
+
+            return await fetchCursor(outBinds.P_CURSOR, CarnetApplicationService.name);
+        } catch (error) {
+            handleError(error, CarnetApplicationService.name)
+        } finally {
+            await closeOracleDbConnection(connection, CarnetApplicationService.name)
+        }
+    }
+
     // processing [ PROCESSINGCENTER_PKG ]
 
     async ProcessOriginalCarnet(body: CarnetProcessingCenterDTO) {
diff --git a/src/oracle/manage-clients/manage-clients.controller.ts b/src/oracle/manage-clients/manage-clients.controller.ts
index c146f8d..b06e333 100644
--- a/src/oracle/manage-clients/manage-clients.controller.ts
+++ b/src/oracle/manage-clients/manage-clients.controller.ts
@@ -33,16 +33,19 @@ export class ManageClientsController {
   }
 
   @Put('UpdateClientContacts')
+  @Roles('ca','sa')
   UpdateClientContacts(@Body() body: UpdateClientContactsDTO) {
     return this.manageClientsService.UpdateClientContacts(body);
   }
 
   @Put('UpdateClientLocations')
+  @Roles('ca','sa')
   UpdateClientLocations(@Body() body: UpdateClientLocationsDTO) {
     return this.manageClientsService.UpdateClientLocations(body);
   }
 
   @Post('CreateClientContacts')
+  @Roles('ca','sa')
   CreateClientContact(@Body() body: CreateClientContactsDTO) {
     return this.manageClientsService.CreateClientContact(body);
   }
@@ -63,6 +66,7 @@ export class ManageClientsController {
   }
 
   @Post('CreateClientLocations')
+  @Roles('ca','sa')
   CreateClientLocation(@Body() body: CreateClientLocationsDTO) {
     return this.manageClientsService.CreateClientLocation(body);
   }
@@ -78,16 +82,19 @@ export class ManageClientsController {
   }
 
   @Get('GetPreparerContactsByClientid/:P_SPID/:P_CLIENTID')
+  @Roles('ca','sa')
   GetPreparerContactsByClientid(@Param() body: GetClientDTO) {
     return this.manageClientsService.GetPreparerContactsByClientid(body);
   }
 
   @Get('GetPreparerContactsbyClientLocationID/:P_SPID/:P_LOCATIONID')
+  @Roles('ca','sa')
   GetPreparerContactsbyClientLocationID(@Param() body: GetClientContactByLacationIdDTO) {
     return this.manageClientsService.GetPreparerContactsbyClientLocationID(body);
   }
 
   @Get('GetPreparerLocByClientid/:P_SPID/:P_CLIENTID')
+  @Roles('ca','sa')
   GetPreparerLocByClientid(@Param() body: GetClientDTO) {
     return this.manageClientsService.GetPreparerLocByClientid(body);
   }
diff --git a/src/oracle/manage-holders/manage-holders.controller.ts b/src/oracle/manage-holders/manage-holders.controller.ts
index b022bfd..f658cde 100644
--- a/src/oracle/manage-holders/manage-holders.controller.ts
+++ b/src/oracle/manage-holders/manage-holders.controller.ts
@@ -8,15 +8,16 @@ import {
   Patch,
   Post,
   Put,
+  Query,
   UseGuards,
 } from '@nestjs/common';
-import { ApiTags } from '@nestjs/swagger';
+import { ApiQuery, ApiTags } from '@nestjs/swagger';
 import { ManageHoldersService } from './manage-holders.service';
 
 import {
   CreateHolderContactsDTO,
   CreateHoldersDTO, GetHolderDTO, HolderActivateOrInactivateDTO,
-  HolderContactActivateOrInactivateDTO, SearchHolderDTO, UpdateHolderContactDTO, UpdateHolderDTO
+  HolderContactActivateOrInactivateDTO, SearchHolderDTO, SPID_DTO, UpdateHolderContactDTO, UpdateHolderDTO
 } from 'src/dto/property.dto';
 import { Roles } from 'src/decorators/roles.decorator';
 import { JwtAuthGuard } from 'src/guards/jwt-auth.guard';
@@ -29,16 +30,39 @@ import { RolesGuard } from 'src/guards/roles.guard';
 export class ManageHoldersController {
   constructor(private readonly manageHoldersService: ManageHoldersService) { }
 
-  @Get('SearchHolder/:P_SPID/:P_HOLDERNAME')
-  SearchHolder(@Param() param: SearchHolderDTO) {
-    return this.manageHoldersService.SearchHolder(param)
+  @Get('SearchHolder/:P_SPID')
+  @ApiQuery({ name: "P_HOLDERNAME", type: String, required: false, description: "Optional" })
+  SearchHolder(
+    @Param('P_SPID') P_SPID: number,
+    @Query('P_HOLDERNAME') P_HOLDERNAME?: string | null | undefined,
+  ) {
+    let rawHolderName: string | null | undefined = P_HOLDERNAME;
+
+    if (typeof rawHolderName === 'string') {
+      rawHolderName = rawHolderName.trim();
+      rawHolderName = rawHolderName.replace(/^['"]|['"]$/g, '');
+
+      if (rawHolderName === '' || rawHolderName.toLowerCase() === 'null') {
+        rawHolderName = null;
+      } else {
+        const allowedPattern = /^[A-Za-z0-9 _@&.-]+$/;
+
+        // uncomment for strict validation
+
+        // if (!allowedPattern.test(rawHolderName)) {
+        //   rawHolderName = null;
+        // }
+      }
+    } else {
+      rawHolderName = null;
+    }
+    const body = { P_SPID, P_HOLDERNAME: rawHolderName }
+    return this.manageHoldersService.SearchHolder(body)
   }
 
   @Post('/CreateHolderData')
   CreateHolders(@Body() body: CreateHoldersDTO) {
     return this.manageHoldersService.CreateHolders(body);
-    // return this.manageHoldersService.CreateHoldersX();
-    // return {message:"Request received.."}
   }
 
   @Post('CreateHoldercontact')
diff --git a/src/oracle/manage-holders/manage-holders.service.ts b/src/oracle/manage-holders/manage-holders.service.ts
index ec4821b..fd5a70c 100644
--- a/src/oracle/manage-holders/manage-holders.service.ts
+++ b/src/oracle/manage-holders/manage-holders.service.ts
@@ -8,7 +8,7 @@ import { closeOracleDbConnection, fetchCursor, handleError, setEmptyStringsToNul
 import {
   CreateHolderContactsDTO,
   CreateHoldersDTO, GetHolderDTO, HolderActivateOrInactivateDTO,
-  HolderContactActivateOrInactivateDTO, SearchHolderDTO, UpdateHolderContactDTO, UpdateHolderDTO
+  HolderContactActivateOrInactivateDTO, SearchHolderDTO, SPID_DTO, UpdateHolderContactDTO, UpdateHolderDTO
 } from 'src/dto/property.dto';
 import { OracleService } from '../oracle.service';
 import { BadRequestException } from 'src/exceptions/badRequest.exception';
@@ -631,7 +631,7 @@ export class ManageHoldersService {
     }
   };
 
-  SearchHolder = async (body: SearchHolderDTO) => {
+  SearchHolder = async (body: { P_SPID: number, P_HOLDERNAME: string | null }) => {
     let connection;
 
     try {