diff --git a/Admin/Installer.php b/Admin/Installer.php
index 3c15f18..74e4f4a 100755
--- a/Admin/Installer.php
+++ b/Admin/Installer.php
@@ -108,7 +108,7 @@ final class Installer extends InstallerAbstract
             $request  = new HttpRequest();
 
             $request->header->account = 1;
-            $request->setData('title', $l11n['name']);
+            $request->setData('content', $l11n['name']);
             $request->setData('is_required', $l11n['is_required'] ?? false);
 
             $module->apiSupplierL11nTypeCreate($request, $response);
@@ -151,7 +151,7 @@ final class Installer extends InstallerAbstract
 
             $request->header->account = 1;
             $request->setData('name', $attribute['name'] ?? '');
-            $request->setData('title', \reset($attribute['l11n']));
+            $request->setData('content', \reset($attribute['l11n']));
             $request->setData('language', \array_keys($attribute['l11n'])[0] ?? 'en');
             $request->setData('repeatable', $attribute['repeatable'] ?? false);
             $request->setData('internal', $attribute['internal'] ?? false);
@@ -182,9 +182,9 @@ final class Installer extends InstallerAbstract
                 $request  = new HttpRequest();
 
                 $request->header->account = 1;
-                $request->setData('title', $l11n);
+                $request->setData('content', $l11n);
                 $request->setData('language', $language);
-                $request->setData('type', $supplierAttrType[$attribute['name']]['id']);
+                $request->setData('ref', $supplierAttrType[$attribute['name']]['id']);
 
                 $module->apiSupplierAttributeTypeL11nCreate($request, $response);
             }
@@ -227,7 +227,7 @@ final class Installer extends InstallerAbstract
                 $request->setData('type', $supplierAttrType[$attribute['name']]['id']);
 
                 if (isset($value['l11n']) && !empty($value['l11n'])) {
-                    $request->setData('title', \reset($value['l11n']));
+                    $request->setData('content', \reset($value['l11n']));
                     $request->setData('language', \array_keys($value['l11n'])[0] ?? 'en');
                 }
 
@@ -255,9 +255,9 @@ final class Installer extends InstallerAbstract
                     $request  = new HttpRequest();
 
                     $request->header->account = 1;
-                    $request->setData('title', $l11n);
+                    $request->setData('content', $l11n);
                     $request->setData('language', $language);
-                    $request->setData('value', $attrValue['id']);
+                    $request->setData('ref', $attrValue['id']);
 
                     $module->apiSupplierAttributeValueL11nCreate($request, $response);
                 }
diff --git a/Admin/Routes/Web/Api.php b/Admin/Routes/Web/Api.php
index 1f02632..a2f39b0 100644
--- a/Admin/Routes/Web/Api.php
+++ b/Admin/Routes/Web/Api.php
@@ -55,6 +55,57 @@ return [
             ],
         ],
     ],
+
+    '^.*/supplier/file(\?.*|$)$' => [
+        [
+            'dest'       => '\Modules\SupplierManagement\Controller\ApiController:apiFileCreate',
+            'verb'       => RouteVerb::PUT,
+            'csrf'       => true,
+            'active'     => true,
+            'permission' => [
+                'module' => ApiController::NAME,
+                'type'   => PermissionType::CREATE,
+                'state'  => PermissionCategory::SUPPLIER,
+            ],
+        ],
+    ],
+
+    '^.*/supplier/note(\?.*|$)$' => [
+        [
+            'dest'       => '\Modules\SupplierManagement\Controller\ApiController:apiNoteCreate',
+            'verb'       => RouteVerb::PUT,
+            'csrf'       => true,
+            'active'     => true,
+            'permission' => [
+                'module' => ApiController::NAME,
+                'type'   => PermissionType::CREATE,
+                'state'  => PermissionCategory::SUPPLIER,
+            ],
+        ],
+        [
+            'dest'       => '\Modules\SupplierManagement\Controller\ApiController:apiNoteUpdate',
+            'verb'       => RouteVerb::SET,
+            'csrf'       => true,
+            'active'     => true,
+            'permission' => [
+                'module' => ApiController::NAME,
+                'type'   => PermissionType::MODIFY,
+                'state'  => PermissionCategory::SUPPLIER,
+            ],
+        ],
+        [
+            'dest'       => '\Modules\SupplierManagement\Controller\ApiController:apiNoteDelete',
+            'verb'       => RouteVerb::DELETE,
+            'csrf'       => true,
+            'active'     => true,
+            'permission' => [
+                'module' => ApiController::NAME,
+                'type'   => PermissionType::DELETE,
+                'state'  => PermissionCategory::SUPPLIER,
+            ],
+        ],
+    ],
+
     '^.*/supplier/attribute(\?.*|$)$' => [
         [
             'dest'       => '\Modules\SupplierManagement\Controller\ApiAttributeController:apiSupplierAttributeCreate',
diff --git a/Controller/ApiController.php b/Controller/ApiController.php
index bf044b4..2522dd9 100755
--- a/Controller/ApiController.php
+++ b/Controller/ApiController.php
@@ -248,10 +248,10 @@ final class ApiController extends Controller
     private function createSupplierL11nFromRequest(RequestAbstract $request) : BaseStringL11n
     {
         $supplierL11n           = new BaseStringL11n();
-        $supplierL11n->ref      = $request->getDataInt('supplier') ?? 0;
+        $supplierL11n->ref      = $request->getDataInt('ref') ?? 0;
         $supplierL11n->type     = new NullBaseStringL11nType($request->getDataInt('type') ?? 0);
         $supplierL11n->language = ISO639x1Enum::tryFromValue($request->getDataString('language')) ?? $request->header->l11n->language;
-        $supplierL11n->content  = $request->getDataString('description') ?? '';
+        $supplierL11n->content  = $request->getDataString('content') ?? '';
 
         return $supplierL11n;
     }
@@ -268,9 +268,9 @@ final class ApiController extends Controller
     private function validateSupplierL11nCreate(RequestAbstract $request) : array
     {
         $val = [];
-        if (($val['supplier'] = !$request->hasData('supplier'))
+        if (($val['ref'] = !$request->hasData('ref'))
             || ($val['type'] = !$request->hasData('type'))
-            || ($val['description'] = !$request->hasData('description'))
+            || ($val['content'] = !$request->hasData('content'))
         ) {
             return $val;
         }
@@ -370,10 +370,10 @@ final class ApiController extends Controller
             files: $request->files,
             account: $request->header->account,
             basePath: __DIR__ . '/../../../Modules/Media/Files/Modules/SupplierManagement/Suppliers/' . ($request->getData('supplier') ?? '0'),
-            virtualPath: '/Modules/SupplierManagement/Suppliers/' . ($request->getData('supplier') ?? '0'),
+            virtualPath: '/Modules/SupplierManagement/Suppliers/' . ($request->getData('ref') ?? '0'),
             pathSettings: PathSettings::FILE_PATH,
             tag: $request->getDataInt('tag'),
-            rel: (int) $request->getData('supplier'),
+            rel: (int) $request->getData('ref'),
             mapper: SupplierMapper::class,
             field: 'files'
         );
@@ -402,7 +402,7 @@ final class ApiController extends Controller
      */
     public function apiNoteCreate(RequestAbstract $request, ResponseAbstract $response, array $data = []) : void
     {
-        $request->setData('virtualpath', '/Modules/SupplierManagement/Suppliers/' . $request->getData('id'), true);
+        $request->setData('virtualpath', '/Modules/SupplierManagement/Suppliers/' . $request->getData('ref'), true);
         $this->app->moduleManager->get('Editor')->apiEditorCreate($request, $response, $data);
 
         $data = $response->getDataArray($request->uri->__toString());
@@ -413,7 +413,7 @@ final class ApiController extends Controller
         $model = $data['response'];
         $this->createModelRelation(
             $request->header->account,
-            $request->getData('id'),
+            $request->getData('ref'),
             $model->id,
             SupplierMapper::class,
             'notes',
diff --git a/Theme/Backend/supplier-view.tpl.php b/Theme/Backend/supplier-view.tpl.php
index 0415910..f3ce26b 100644
--- a/Theme/Backend/supplier-view.tpl.php
+++ b/Theme/Backend/supplier-view.tpl.php
@@ -878,7 +878,7 @@ echo $this->data['nav']->render();
 
         <input type="radio" id="c-tab-8" name="tabular-2"<?= $this->request->uri->fragment === 'c-tab-8' ? ' checked' : ''; ?>>
         <div class="tab col-simple">
-            <?= $this->data['media-upload']->render('supplier-file', 'files', '', $supplier->files); ?>
+            <?= $this->data['media-upload']->render('supplier-file', 'files', '', $supplier->files, '{/api}supplier/file?csrf={$CSRF}', (string) $item->id); ?>
         </div>
 
         <input type="radio" id="c-tab-9" name="tabular-2"<?= $this->request->uri->fragment === 'c-tab-9' ? ' checked' : ''; ?>>
@@ -1136,7 +1136,7 @@ echo $this->data['nav']->render();
 
         <input type="radio" id="c-tab-7" name="tabular-2" checked>
         <div class="tab col-simple">
-            <?= $this->data['note']->render('supplier-note', 'notes', $supplier->notes); ?>
+            <?= $this->data['note']->render('supplier-note', 'notes', $supplier->notes, '{/api}supplier/note?csrf={$CSRF}', (string) $supplier->id); ?>
         </div>
 
         <?php if (!empty($logs)) : ?>
diff --git a/tests/Controller/Api/ApiControllerSupplierTrait.php b/tests/Controller/Api/ApiControllerSupplierTrait.php
index 3722647..468f956 100755
--- a/tests/Controller/Api/ApiControllerSupplierTrait.php
+++ b/tests/Controller/Api/ApiControllerSupplierTrait.php
@@ -86,7 +86,7 @@ trait ApiControllerSupplierTrait
 
         $request->header->account = 1;
         $request->setData('name', '123456 backend');
-        $request->setData('supplier', 1);
+        $request->setData('ref', 1);
         $request->setData('tag', '1');
 
         TestUtils::setMember($request, 'files', [
@@ -117,7 +117,7 @@ trait ApiControllerSupplierTrait
 
         $request->header->account = 1;
         $request->setData('name', 'test file backend');
-        $request->setData('supplier', 1);
+        $request->setData('ref', 1);
 
         TestUtils::setMember($request, 'files', [
             'file1' => [
@@ -147,7 +147,7 @@ trait ApiControllerSupplierTrait
 
         $MARKDOWN = "# Test Title\n\nThis is **some** text.";
 
-        $request->setData('id', 1);
+        $request->setData('ref', 1);
         $request->setData('title', \trim(\strtok($MARKDOWN, "\n"), ' #'));
         $request->setData('plain', \preg_replace('/^.+\n/', '', $MARKDOWN));