diff --git a/Admin/Routes/Web/Api.php b/Admin/Routes/Web/Api.php
index 8cd8f9e..64e8d94 100755
--- a/Admin/Routes/Web/Api.php
+++ b/Admin/Routes/Web/Api.php
@@ -31,6 +31,46 @@ return [
             ],
         ],
     ],
+
+    '^.*/humanresource/staff/file(\?.*|$)$' => [
+        [
+            'dest'       => '\Modules\HumanResourceManagement\Controller\ApiController:apiMediaAddToVehicle',
+            'verb'       => RouteVerb::PUT,
+            'csrf'       => true,
+            'active'     => true,
+            'permission' => [
+                'module' => ApiController::NAME,
+                'type'   => PermissionType::CREATE,
+                'state'  => PermissionCategory::HR,
+            ],
+        ],
+    ],
+
+    '^.*/humanresource/staff/note(\?.*$|$)' => [
+        [
+            'dest'       => '\Modules\HumanResourceManagement\Controller\ApiController:apiNoteCreate',
+            'verb'       => RouteVerb::PUT,
+            'csrf'       => true,
+            'active'     => true,
+            'permission' => [
+                'module' => ApiController::NAME,
+                'type'   => PermissionType::CREATE,
+                'state'  => PermissionCategory::EMPLOYEE_NOTE,
+            ],
+        ],
+        [
+            'dest'       => '\Modules\HumanResourceManagement\Controller\ApiController:apiNoteUpdate',
+            'verb'       => RouteVerb::SET,
+            'csrf'       => true,
+            'active'     => true,
+            'permission' => [
+                'module' => ApiController::NAME,
+                'type'   => PermissionType::MODIFY,
+                'state'  => PermissionCategory::EMPLOYEE_NOTE,
+            ],
+        ],
+    ],
+
     '^.*/humanresource/staff/history(\?.*$|$)' => [
         [
             'dest'       => '\Modules\HumanResourceManagement\Controller\ApiController:apiEmployeeHistoryCreate',
diff --git a/Controller/ApiController.php b/Controller/ApiController.php
index 76edcd2..1858223 100755
--- a/Controller/ApiController.php
+++ b/Controller/ApiController.php
@@ -464,7 +464,7 @@ final class ApiController extends Controller
         }
 
         /** @var \Modules\HumanResourceManagement\Models\Employee $employee */
-        $employee = EmployeeMapper::get()->where('id', (int) $request->getData('employee'))->execute();
+        $employee = EmployeeMapper::get()->where('id', (int) $request->getData('ref'))->execute();
         $path     = $this->createEmployeeDir($employee);
 
         $uploaded = new NullCollection();
@@ -533,7 +533,7 @@ final class ApiController extends Controller
     {
         $val = [];
         if (($val['media'] = (!$request->hasData('media') && empty($request->files)))
-            || ($val['employee'] = !$request->hasData('employee'))
+            || ($val['ref'] = !$request->hasData('ref'))
         ) {
             return $val;
         }
@@ -565,7 +565,7 @@ final class ApiController extends Controller
 
         $request->setData('isencrypted', true, true);
         $request->setData('isvisible', false, true);
-        $request->setData('virtualpath', '/Modules/HumanResourceManagement/Employee/' . $request->getData('id'), true);
+        $request->setData('virtualpath', '/Modules/HumanResourceManagement/Employee/' . $request->getData('ref'), true);
 
         $this->app->moduleManager->get('Editor', 'Api')->apiEditorCreate($request, $response, $data);
 
@@ -579,7 +579,7 @@ final class ApiController extends Controller
         }
 
         $model = $responseData['response'];
-        $this->createModelRelation($request->header->account, (int) $request->getData('id'), $model->id, EmployeeMapper::class, 'notes', '', $request->getOrigin());
+        $this->createModelRelation($request->header->account, (int) $request->getData('ref'), $model->id, EmployeeMapper::class, 'notes', '', $request->getOrigin());
     }
 
     /**
@@ -594,7 +594,7 @@ final class ApiController extends Controller
     private function validateNoteCreate(RequestAbstract $request) : array
     {
         $val = [];
-        if (($val['id'] = !$request->hasData('id'))
+        if (($val['ref'] = !$request->hasData('ref'))
         ) {
             return $val;
         }
diff --git a/Theme/Backend/staff-view.tpl.php b/Theme/Backend/staff-view.tpl.php
index fd4f206..67e974d 100644
--- a/Theme/Backend/staff-view.tpl.php
+++ b/Theme/Backend/staff-view.tpl.php
@@ -250,7 +250,7 @@ echo $this->data['nav']->render(); ?>
                     'week'  => 0,
                 ];
 
-                $type   = $this->data['lastSession'] !== null ? $this->data['lastSession']->type : ClockingType::OFFICE;
+                //$type   = $this->data['lastSession'] !== null ? $this->data['lastSession']->type : ClockingType::OFFICE;
                 $status = $this->data['lastSession'] !== null ? $this->data['lastSession']->getStatus() : ClockingStatus::END;
 
                 $startMonth = new SmartDateTime('now');
@@ -433,12 +433,12 @@ echo $this->data['nav']->render(); ?>
 
         <input type="radio" id="c-tab-4" name="tabular-2"<?= $this->request->uri->fragment === 'c-tab-4' ? ' checked' : ''; ?>>
         <div class="tab col-simple">
-            <?= $this->data['media-upload']->render('employee-file', 'files', '', $employee->files); ?>
+            <?= $this->data['media-upload']->render('employee-file', 'files', '', $employee->files, '{/api}humanresource/staff/file?csrf={$CSRF}', (string) $vehicle->id); ?>
         </div>
 
         <input type="radio" id="c-tab-5" name="tabular-2"<?= $this->request->uri->fragment === 'c-tab-5' ? ' checked' : ''; ?>>
         <div class="tab col-simple">
-            <?= $this->data['employee-notes']->render('employee-notes', '', $employee->notes); ?>
+            <?= $this->data['employee-notes']->render('employee-notes', '', $employee->notes, '{/api}humanresource/staff/note?csrf={$CSRF}', (string) $vehicle->id); ?>
         </div>
 
         <input type="radio" id="c-tab-7" name="tabular-2"<?= $this->request->uri->fragment === 'c-tab-7' ? ' checked' : ''; ?>>