diff --git a/app/Config/Routes.php b/app/Config/Routes.php
index 86e47622..89785051 100755
--- a/app/Config/Routes.php
+++ b/app/Config/Routes.php
@@ -566,10 +566,15 @@ $routes->group("employeeRest", ['filter' => ["appSignature"] ], function ($route
     $routes->get("getHRAccessData", "RestAuthenticationController::getHRAccessData");
 
     $routes->post("getPostEmployeeDataForAuth", "RestAuthenticationController::getPostEmployeeDataForAuth");
+    $routes->post("getRetailUserData", "RestAuthenticationController::getRetailUserData");
 
     $routes->get("getClientDetails", "EmployeeRestController::getClientDetails");
     $routes->get("getAdvertisementImage", "EmployeeRestController::getAdvertisementImage");
 
+    //retail user apis
+    $routes->post("getVerifiedRetailUserData", "RestAuthenticationController::getVerifiedRetailUserData");
+    $routes->post("updateRetailUserAuthDetails", "RestAuthenticationController::updateRetailUserAuthDetails");
+
 });
 
 $routes->group("employeeRest", ["filter" => ["authJWT"]], function ($routes) {
diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php
index 8aa30d71..d5b9abae 100755
--- a/app/Controllers/EmployeeRestController.php
+++ b/app/Controllers/EmployeeRestController.php
@@ -2820,7 +2820,36 @@ class EmployeeRestController extends AdminController
 
 
     function getEmployeeActiveOrInactivePolicy()
-    {
+    {   
+
+        // for retail user policy only
+        $receviedPayload = $this->request->getGet();
+
+        if(
+            empty($receviedPayload['client_id']) && 
+            empty($receviedPayload['client_branch_id']) && 
+            empty($receviedPayload['emp_code'])
+        ){
+            
+            if(!empty($receviedPayload['mobile_no']) || !empty($receviedPayload['email_id'])){
+                
+                $retailUserData['id'] = null;
+                $retailUserData['mobile'] = $receviedPayload['mobile_no'];
+                $retailUserData['email_id'] = $receviedPayload['email_id'];
+                $emp_reatail_policy_data = $this->getEmpRetailPolicy($retailUserData);
+
+                $query = $this->clientModel->where('is_active', 1)->where('client_type', 2);
+                if(!empty($receviedPayload['mobile_no'])){
+                    $query->where('phone', $receviedPayload['mobile_no']);
+                }else {
+                    $query->where('email', $receviedPayload['email_id']);
+                };
+                $retailClientData = $query->first();
+
+                return $this->respond(['status' => 'success', 'code' => 200, 'data' => [], 'emp_name' => $retailClientData['client_name'] ?? "", 'pre_policy_count' => 0, 'retail_policy_data' => $emp_reatail_policy_data, 'wellness_data' => []], 200);
+            }
+        }
+
         if ($this->request->getGet('type') == 'Active') {
             $policy_status = 1;
             $policy_status_key = "Active";
@@ -4648,6 +4677,7 @@ class EmployeeRestController extends AdminController
 
             $emp_id = $employeeData->id ?? null;
             $mobile_number = $employeeData->mobile ?? null;
+            $email_id = $employeeData->email_id ?? null;
 
             $emp_retail_policy_data = [];
             if ($emp_id != null) {
@@ -4696,6 +4726,27 @@ class EmployeeRestController extends AdminController
                     ->where('clients.is_active', 1)
                     ->where('clients.phone', $mobile_number)
                     ->findAll();
+            }else {
+                $emp_retail_client_data = $this->clientModel
+                    ->select("
+                        $emp_id as emp_id,
+                        policy_transaction.insurer_id,
+                        policy_transaction.policy_type_id,
+                        policy_transaction.policy_no,
+                        DATE_FORMAT(policy_transaction.policy_start_date, '%d-%b-%Y') as policy_start_date,
+                        DATE_FORMAT(policy_transaction.policy_end_date, '%d-%b-%Y') as policy_end_date,
+                        policy_type.policy_type, 
+                        policy_type.long_name as policy_type_long_name, 
+                        insurers.name as insurer_name,
+                        insurers.short_name as insurer_short_name
+                    ")
+                    ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
+                    ->join('insurers', 'policy_transaction.insurer_id = insurers.id')
+                    ->join('policy_type', 'policy_transaction.policy_type_id = policy_type.id')
+                    ->where('policy_transaction.is_active', 1)
+                    ->where('clients.is_active', 1)
+                    ->where('clients.email', $email_id)
+                    ->findAll();
             }
 
             // print_r($emp_retail_policy_data); die;
diff --git a/app/Controllers/RestAuthenticationController.php b/app/Controllers/RestAuthenticationController.php
index 45a8db6b..6fae56a7 100755
--- a/app/Controllers/RestAuthenticationController.php
+++ b/app/Controllers/RestAuthenticationController.php
@@ -339,7 +339,7 @@ class RestAuthenticationController extends AdminController
     public function updateEmpMPIN()
     {
         try {
-            log_message('info', 'MPIN update request received.');
+            log_message('error', 'MPIN update request received.');
 
             $requestData = $this->request->getJSON();
             log_message('debug', 'Request data: ' . json_encode($requestData));
@@ -361,7 +361,7 @@ class RestAuthenticationController extends AdminController
             $updated = $this->employeeModel->where('id', $employee_id)->set(['mpin' => $mpin])->update();
 
             if ($updated) {
-                log_message('info', "MPIN updated successfully for employee ID: {$employee_id}");
+                log_message('error', "MPIN updated successfully for employee ID: {$employee_id}");
                 return $this->response->setJSON([
                     'status' => true,
                     'message' => 'MPIN updated successfully.'
@@ -1283,7 +1283,7 @@ class RestAuthenticationController extends AdminController
             // Step 2: Fetch employee data
             if ($mobile_number) {
 
-                log_message('info', 'Looking up employee by mobile number: ' . $mobile_number);
+                log_message('error', 'Looking up employee by mobile number: ' . $mobile_number);
                 $builder = $this->employeeModel
                                     ->select('employees.*')
                                     ->join('employee_polices', 'employees.id = employee_polices.employee_id')
@@ -1302,7 +1302,7 @@ class RestAuthenticationController extends AdminController
 
             } else {
 
-                log_message('info', 'Looking up employee by email: ' . $email_id);
+                log_message('error', 'Looking up employee by email: ' . $email_id);
                 $builder = $this->employeeModel
                                     ->select('employees.*')
                                     ->join('employee_polices', 'employees.id = employee_polices.employee_id')
@@ -1343,7 +1343,7 @@ class RestAuthenticationController extends AdminController
                     ->update();
 
                 if ($updated) {
-                    log_message('info', 'MPIN reset successful for employee ID: ' . $employeeData['id']);
+                    log_message('error', 'MPIN reset successful for employee ID: ' . $employeeData['id']);
                     return $this->respond([
                         'status' => 'success',
                         'code' => 200,
@@ -1776,7 +1776,7 @@ class RestAuthenticationController extends AdminController
 
                 $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Verified employee found");
 
-                // ✅ Log authentication info
+                // ✅ Log authentication error
                 $auth = HttpRequestHelper::getRequestInfo();
                 if ($auth) {
                     $this->authHistoryModel->insert([
@@ -2043,4 +2043,246 @@ class RestAuthenticationController extends AdminController
             ], 500);
         }
     }
+
+    public function getRetailUserData()
+    {
+        $params = $this->request->getJSON(true);
+        // print_r( $params); die;
+
+        $mobile_number = $params['mobile_number'] ?? null;
+        $email_id      = $params['email_id'] ?? null;
+        $otp           = $params['otp'] ?? null;
+        $old_mpin      = $params['old_mpin'] ?? null;
+
+        if (empty($mobile_number) && empty($email_id)) {
+            return $this->respond(['status' => 'failed', 'message' => 'Mobile number or Email ID is required.', 'data' => [],], 200);
+        }
+
+        if (!empty($mobile_number)) {
+
+            $builder = $this->clientModel
+                ->select('clients.*')
+                ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
+                ->where('policy_transaction.is_active', 1)
+                ->where('clients.is_active', 1)
+                ->where('clients.phone', $mobile_number);
+
+            if (!empty($otp)) {
+                $builder->where('clients.otp', $otp);
+            }
+
+            if (!empty($old_mpin)) {
+                $builder->where('clients.mpin', $old_mpin);
+            }
+
+            $retailUserData = $builder->orderBy('clients.id', 'desc')->first();
+        } else {
+
+            $builder = $this->clientModel
+                ->select('clients.*')
+                ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
+                ->where('policy_transaction.is_active', 1)
+                ->where('clients.is_active', 1)
+                ->where('clients.email', $email_id);
+
+            if (!empty($otp)) {
+                $builder->where('clients.otp', $otp);
+            }
+
+            if (!empty($old_mpin)) {
+                $builder->where('clients.mpin', $old_mpin);
+            }
+
+            $retailUserData = $builder->orderBy('clients.id', 'desc')->first();
+        }
+
+        if ($retailUserData) {
+            return $this->respond(['status' => 'success', 'data' => $retailUserData,], 200);
+        }
+
+        return $this->respond(['status' => 'failed', 'message' => 'No employee found.', 'code' => 404, 'data' => [],], 200);
+    }
+
+    public function updateRetailUserAuthDetails()
+    {
+        try {
+
+            log_message('error', 'Retail Auth Update Request Received');
+
+            $requestData = $this->request->getJSON();
+
+            $client_id      = $requestData->client_id      ?? null;
+            $email_id       = $requestData->email_id       ?? null;
+            $mobile_number  = $requestData->mobile_number  ?? null;
+            $otp            = $requestData->otp            ?? null;
+            $mpin           = $requestData->mpin           ?? null;
+            $password       = $requestData->password       ?? null;
+
+            /** Check if at least one identification exists */
+            if (!$client_id && !$email_id && !$mobile_number) {
+                log_message('error', 'Identification missing: Need client_id or mobile/email.');
+                return $this->respond(['status' => false,'message' => 'client_id, email or mobile number is required.']);
+            }
+
+            /** Find client by ID or Email or Mobile */
+            $clientQuery = $this->clientModel->where('is_active', 1);
+
+            if ($client_id) {
+                $clientQuery->where('id', $client_id);
+            } elseif ($email_id) {
+                $clientQuery->where('email', $email_id);
+            } elseif ($mobile_number) {
+                $clientQuery->where('phone', $mobile_number);
+            }
+
+            $clientData = $clientQuery->get()->getRowArray();
+
+            /** If no client found, return error */
+            if (!$clientData) {
+                log_message('error', 'Client not found for given identifier.');
+                return $this->respond(['status' => false,'message' => 'Client not found.']);
+            }
+
+            /** Now update fields that exist in request */
+            $updateData = [];
+
+            if ($otp) {
+                $updateData['otp'] = $otp;
+            }
+
+            if ($mpin) {
+                $updateData['mpin'] = password_hash($mpin, PASSWORD_DEFAULT); // Secure MPIN Hash
+            }
+
+            if ($password) {
+                $updateData['password'] = password_hash($password, PASSWORD_DEFAULT); // Secure Password Hash
+            }
+
+            /** If nothing to update */
+            if (empty($updateData)) {
+                log_message('error', 'No valid fields to update (OTP/MPIN/Password missing)');
+                return $this->respond(['status' => false,'message' => 'No valid credentials provided for update.']);
+            }
+
+            /** Update */
+            $updated = $this->clientModel->where('id', $clientData['id'])->set($updateData)->update();
+
+            if ($updated) {
+                log_message('error', "Credentials updated successfully for Client ID: {$clientData['id']}");
+                return $this->respond(['status' => true,'message' => 'Credentials updated successfully.']);
+            } else {
+                log_message('error', "Failed updating credentials for Client ID: {$clientData['id']}");
+                return $this->respond(['status' => false,'message' => 'Failed to update credentials.']);
+            }
+
+        } catch (\Exception $e) {
+
+            log_message('error', 'Exception in updateRetailAuthDetails: ' . $e->getMessage());
+            return $this->respond(['status' => false,'message' => 'Unexpected error occurred.','error' => $e->getMessage()], 500);
+        }
+    }
+
+    public function getVerifiedRetailUserData()
+    {
+        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Received payload = " . json_encode($this->request->getJSON() ?? []));
+
+        try {
+           
+            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
+            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
+            $otp = isset($this->request->getJSON()->otp) ? $this->request->getJSON()->otp : null;
+            $client_id = $this->request->getJSON()->client_id ?? null;
+
+            if(empty($otp)){
+                return $this->respond(['status' => 'OTP is required','code'   => 400,'message' => 'OTP is required'], 200);
+            }
+
+            if (empty($mobile_number) && empty($email_id)) {
+                return $this->respond(['status' => 'failed','code'   => 400,'message' => 'Mobile number or Email ID is required'], 200);
+            }
+
+            if (!empty($mobile_number)) {
+
+                $builder = $this->clientModel
+                    ->select('clients.*')
+                    ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
+                    ->where('policy_transaction.is_active', 1)
+                    ->where('clients.is_active', 1)
+                    ->where('clients.phone', $mobile_number);
+
+                if (!empty($otp)) {
+                    $builder->where('clients.otp', $otp);
+                }
+
+                if (!empty($old_mpin)) {
+                    $builder->where('clients.mpin', $old_mpin);
+                }
+
+                $retailUserData = $builder->orderBy('clients.id', 'desc')->first();
+            } else {
+
+                $builder = $this->clientModel
+                    ->select('clients.*')
+                    ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
+                    ->where('policy_transaction.is_active', 1)
+                    ->where('clients.is_active', 1)
+                    ->where('clients.email', $email_id);
+
+                if (!empty($otp)) {
+                    $builder->where('clients.otp', $otp);
+                }
+
+                if (!empty($old_mpin)) {
+                    $builder->where('clients.mpin', $old_mpin);
+                }
+
+                $retailUserData = $builder->orderBy('clients.id', 'desc')->first();
+            } 
+            
+            $lastQuery = $this->clientModel->db->getLastQuery();
+            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Last Executed Query: " . $lastQuery);        
+            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: retailUserData: " . json_encode($retailUserData ?? []));        
+
+            
+            if ($retailUserData && isset($this->request->getJSON()->otp) ) 
+            {
+                $auth =  HttpRequestHelper::getRequestInfo();
+                if ($auth) {
+                    $data = [
+                       'user_id' => $retailUserData['id'],
+                       'user_type' => 'retail_user',
+                       'ip' => $auth['ip'],
+                       'platform' => $auth['platform'],
+                       'broswer' => $auth['browser'],
+                    ];
+                    $this->authHistoryModel->insert($data);                    
+                }
+              
+                $retailUserData['client_id'] = null;
+                $retailUserData['client_branch_id'] = null;
+                $retailUserData['emp_code'] = null;
+                $retailUserData['emp_status'] = null;
+                $retailUserData['name'] = $retailUserData['client_name'];
+                $retailUserData['email_corporate'] = $retailUserData['email'];
+                $retailUserData['token_type'] = "retail";
+                $result = JWTToken::encode($retailUserData);
+
+                if(isset($this->request->getJSON()->otp)){ 
+                    $this->clientModel->where('id', $retailUserData['id'])->where('otp', $otp)->set(['otp'=>null])->update();
+                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Reset the otp to null");
+                }
+
+
+                return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);
+
+            } else {
+                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Employee not verified POST"); 
+                return $this->respond(['status' => 'failed','code' => 404,'data' => "", 'message' => 'Invalid OTP'],200);
+            }
+        } catch (\Exception $e) {
+            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() .  " --- Trace: " . $e->getTraceAsString());
+            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => "Invalid OTP", 'error' =>  $e->getMessage()],500);
+        }
+    }
+
 }
\ No newline at end of file
diff --git a/app/Models/ClientModel.php b/app/Models/ClientModel.php
index 2397f4df..90a9b1f6 100755
--- a/app/Models/ClientModel.php
+++ b/app/Models/ClientModel.php
@@ -41,6 +41,7 @@ class ClientModel extends Model
         "mail_domain",
         "addon_subheading",
         "parent_client_id",
+        "otp",
     ];