diff --git a/json/users.json b/json/users.json
index c0f9a3f..987f277 100644
--- a/json/users.json
+++ b/json/users.json
@@ -2,6 +2,8 @@
     "tblname": "users",
 	"title":"用户",
     "params": {
+        "new_data_url": "{{entire_url('/rbac/api/add_user.dspy')}}",
+        "update_data_url": "{{entire_url('/rbac/api/update_user.dspy')}}",
 		"sortby":"username",
 		"confidential_fields":["password"],
 		"logined_userorgid":"orgid",
diff --git a/wwwroot/api/add_user.dspy b/wwwroot/api/add_user.dspy
new file mode 100644
index 0000000..27e91e5
--- /dev/null
+++ b/wwwroot/api/add_user.dspy
@@ -0,0 +1,58 @@
+
+ns = params_kw.copy()
+for k,v in ns.items():
+	if v == 'NaN' or v == 'null':
+		ns[k] = None
+# remove _text suffix fields sent by Tabular (not real DB columns)
+for k in list(ns.keys()):
+	if k.endswith('_text'):
+		ns.pop(k, None)
+id = params_kw.id
+if not id or len(id) > 32:
+	id = uuid()
+ns['id'] = id
+
+if params_kw.get('password'):
+	ns['password'] = password_encode(params_kw.get('password'))
+
+ns['created_at'] = curDateString()
+
+userorgid = await get_userorgid()
+if not userorgid:
+	return {
+		"widgettype":"Error",
+		"options":{
+			"title":"Authorization Error",
+			"timeout":3,
+			"cwidth":16,
+			"cheight":9,
+			"message":"Please login"
+		}
+	}
+ns['orgid'] = userorgid
+
+db = DBPools()
+dbname = get_module_dbname('rbac')
+async with db.sqlorContext(dbname) as sor:
+	r = await sor.C('users', ns.copy())
+	return {
+		"widgettype":"Message",
+		"options":{
+			"cwidth":16,
+			"cheight":9,
+			"title":"Add Success",
+			"timeout":3,
+			"message":"ok"
+		}
+	}
+
+return {
+	"widgettype":"Error",
+	"options":{
+		"title":"Add Error",
+		"cwidth":16,
+		"cheight":9,
+		"timeout":3,
+		"message":"failed"
+	}
+}
diff --git a/wwwroot/api/update_user.dspy b/wwwroot/api/update_user.dspy
new file mode 100644
index 0000000..51e49e5
--- /dev/null
+++ b/wwwroot/api/update_user.dspy
@@ -0,0 +1,78 @@
+
+ns = params_kw.copy()
+for k,v in ns.items():
+	if v == 'NaN' or v == 'null':
+		ns[k] = None
+# remove _text suffix fields sent by Tabular (not real DB columns)
+for k in list(ns.keys()):
+	if k.endswith('_text'):
+		ns.pop(k, None)
+
+userorgid = await get_userorgid()
+if not userorgid:
+	return {
+		"widgettype":"Error",
+		"options":{
+			"title":"Authorization Error",
+			"timeout":3,
+			"cwidth":16,
+			"cheight":9,
+			"message":"Please login"
+		}
+	}
+ns['orgid'] = userorgid
+
+
+if params_kw.get('password'):
+	ns['password'] = password_encode(params_kw.get('password'))
+else:
+	ns.pop('password', None)
+
+
+db = DBPools()
+dbname = get_module_dbname('rbac')
+async with db.sqlorContext(dbname) as sor:
+
+	ns1 = {
+
+		"orgid": userorgid,
+
+
+		"id": params_kw.id
+	}
+	recs = await sor.R('users', ns1)
+	if len(recs) < 1:
+		return {
+			"widgettype":"Error",
+			"options":{
+				"title":"Update Error",
+				"cwidth":16,
+				"cheight":9,
+				"timeout":3,
+				"message":"Record no exist or with wrong ownership"
+			}
+		}
+
+	r = await sor.U('users', ns)
+	debug('update success');
+	return {
+		"widgettype":"Message",
+		"options":{
+			"title":"Update Success",
+			"cwidth":16,
+			"cheight":9,
+			"timeout":3,
+			"message":"ok"
+		} 
+	}
+		
+return {
+	"widgettype":"Error",
+	"options":{
+		"title":"Update Error",
+		"cwidth":16,
+		"cheight":9,
+		"timeout":3,
+		"message":"failed"
+	}
+}