diff --git a/api-v3/src/asset-master/inventory-family-catalog.controller.ts b/api-v3/src/asset-master/inventory-family-catalog.controller.ts
index 00a0a17..88708c2 100644
--- a/api-v3/src/asset-master/inventory-family-catalog.controller.ts
+++ b/api-v3/src/asset-master/inventory-family-catalog.controller.ts
@@ -1,11 +1,66 @@
-import { Controller, Get, Param, ParseUUIDPipe } from '@nestjs/common';
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  ParseUUIDPipe,
+  Patch,
+  Post,
+  Put,
+  Req,
+} from '@nestjs/common';
+import { CurrentAuth } from '../auth/decorators/current-auth.decorator';
 import { RequirePermissions } from '../authorization/decorators/require-permissions.decorator';
+import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
+import {
+  CreateInventoryFamilyDto,
+  ReplaceInventoryFamilyFindingsDto,
+  UpdateInventoryFamilyDto,
+} from './dto/inventory-family-admin.dto';
 import { InventoryFamilyCatalogService } from './inventory-family-catalog.service';
 
 @Controller('inventory-families')
 export class InventoryFamilyCatalogController {
   constructor(private readonly families: InventoryFamilyCatalogService) {}
 
+  @Get('admin')
+  @RequirePermissions('asset_types.read')
+  admin() {
+    return this.families.listAdmin();
+  }
+
+  @Post()
+  @RequirePermissions('asset_types.manage')
+  create(
+    @Body() dto: CreateInventoryFamilyDto,
+    @CurrentAuth() principal: AuthPrincipal,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.families.create(dto,principal,request);
+  }
+
+  @Patch(':familyId')
+  @RequirePermissions('asset_types.manage')
+  update(
+    @Param('familyId',new ParseUUIDPipe({version:'4'})) familyId:string,
+    @Body() dto:UpdateInventoryFamilyDto,
+    @CurrentAuth() principal:AuthPrincipal,
+    @Req() request:RequestWithContext,
+  ) {
+    return this.families.update(familyId,dto,principal,request);
+  }
+
+  @Put(':familyId/findings')
+  @RequirePermissions('finding_catalog.manage')
+  replaceFindings(
+    @Param('familyId',new ParseUUIDPipe({version:'4'})) familyId:string,
+    @Body() dto:ReplaceInventoryFamilyFindingsDto,
+    @CurrentAuth() principal:AuthPrincipal,
+    @Req() request:RequestWithContext,
+  ) {
+    return this.families.replaceFindings(familyId,dto,principal,request);
+  }
+
   @Get(':familyId/findings')
   @RequirePermissions('assets.read')
   findings(@Param('familyId', new ParseUUIDPipe({ version: '4' })) familyId: string) {