diff --git a/app/Config/Filters.php b/app/Config/Filters.php
index 686e867..fb757f0 100644
--- a/app/Config/Filters.php
+++ b/app/Config/Filters.php
@@ -32,9 +32,9 @@ class Filters extends BaseFilters
         'secureheaders' => SecureHeaders::class,
         'forcehttps'    => ForceHTTPS::class,
         'pagecache'     => PageCache::class,
-        'performance'   => PerformanceMetrics::class,
-        'auth' 			=> \App\Filters\Auth::class,    
+        'performance'   => PerformanceMetrics::class,    
         'cors'          => \App\Filters\Cors::class,
+        'auth' 			=> \App\Filters\Auth::class,
     ];
 
     /**
@@ -74,6 +74,7 @@ class Filters extends BaseFilters
      */
     public array $globals = [
         'before' => [
+            // 'cors',
             'auth' => [ 'except' => [
 				'auth/*', 'lqms/*', 'key/*', 'api/*'
 			]]
diff --git a/app/Config/Routes.php b/app/Config/Routes.php
index 1bbe8e1..1d74b98 100644
--- a/app/Config/Routes.php
+++ b/app/Config/Routes.php
@@ -256,12 +256,15 @@ $routes->group('', ['filter' => 'cors'], function($routes) {
 });
 
 // REST API
-// $routes->get('/api/getProductList', 'Api::getProductList'); 
+$routes->get('/api/zones', 'Api\ZonesApi::getAll');
+// $routes->get('/api/provinces', 'Api\ZonesApi::getProvinces');
+// $routes->get('/api/cities', 'Api\ZonesApi::getCities');
 $routes->get('/api/getProductAlias', 'Api::getProductAlias'); 
 $routes->get('/api/getProductSites', 'Api::getProductSites'); 
 $routes->get('/api/getProvinces', 'Api::getProvinces'); 
 $routes->get('/api/getCities', 'Api::getCities'); 
 
+
 //CLQMS
 // $routes->get('/clqms', 'Clqms::index'); // for CLQMS Inst select
 /*
diff --git a/app/Controllers/Api/ZonesApi.php b/app/Controllers/Api/ZonesApi.php
new file mode 100644
index 0000000..a71eb1f
--- /dev/null
+++ b/app/Controllers/Api/ZonesApi.php
@@ -0,0 +1,47 @@
+<?php
+namespace App\Controllers\Api;
+
+use CodeIgniter\API\ResponseTrait;
+use App\Controllers\BaseController;
+use App\Models\ZonesModel;
+
+class ZonesApi extends BaseController {
+    use ResponseTrait;
+    
+    protected $model;
+
+    public function __construct() {
+        $this->model = new ZonesModel();
+    }
+
+    public function getAll() {
+        $rows = $this->model->getAll();
+
+        if (empty($rows)) { return $this->respond([ 'status'  => 'success', 'message' => "data not found", 'data' => [] ], 200); }
+        return $this->respond([ 'status' => 'success', 'message'=> "Data fetched successfully", 'data' => $rows ], 200);
+    }
+
+    // public function getProvinces() {
+    //     // $filters = [
+    //     //     'zoneid' => $this->request->getVar('zoneid') ?? null,
+    //     //     'zonename' => $this->request->getVar('zonename') ?? null
+    //     // ];
+
+    //     $rows = $this->model->getAllProvinces();
+        
+    //     if (empty($rows)) { return $this->respond([ 'status'  => 'success', 'message' => "data not found", 'data' => [] ], 200); }
+    //     return $this->respond([ 'status' => 'success', 'message'=> "Data fetched successfully", 'data' => $rows ], 200); 
+    // }
+
+    // public function getCities() {
+
+    //     $filter = [
+    //         'zoneid' => $this->request->getVar('zoneid') ?? null
+    //     ];
+
+    //     $rows = $this->model->getAllCities($filter);
+        
+    //     if (empty($rows)) { return $this->respond([ 'status'  => 'success', 'message' => "data not found", 'data' => [] ], 200); }
+    //     return $this->respond([ 'status' => 'success', 'message'=> "Data fetched successfully", 'data' => $rows ], 200); 
+    // }
+}
\ No newline at end of file
diff --git a/app/Filters/Cors.php b/app/Filters/Cors.php
index 36947ac..7104441 100644
--- a/app/Filters/Cors.php
+++ b/app/Filters/Cors.php
@@ -6,21 +6,48 @@ use CodeIgniter\Filters\FilterInterface;
 
 class Cors implements FilterInterface
 {
+    // CORS BARU
+    // protected $allowedOrigins = [
+    //     'http://localhost:5173',
+    //     'https://clqms01.services-summit.my.id',
+    // ];
+
     public function before(RequestInterface $request, $arguments = null)
     {
+        // CORS LAMA
         header('Access-Control-Allow-Origin: *');
         header('Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE');
         header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With, X-CSRF-TOKEN');
-
         // Handle preflight requests
         // if ($request->getMethod() === 'options') {
         //     header('HTTP/1.1 200 OK');
         //     exit();
         // }
+
+        // CORS BARU
+        // log_message('debug', 'Cors Filter Triggered First');
+        // $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
+        // $response = service('response');
+
+        // if (in_array($origin, $this->allowedOrigins)) {
+        //     $response->setHeader('Access-Control-Allow-Origin', $origin);
+        //     $response->setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
+        //     $response->setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, Accept, Origin, Cache-Control, Pragma, X-CSRF-TOKEN');
+        //     // $response->setHeader('Access-Control-Allow-Headers', '*');
+        //     $response->setHeader('Access-Control-Allow-Credentials', 'true');
+        // }
+
+        // Tangani preflight OPTIONS dengan return response
+        // if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
+        //     // log_message('debug', 'Cors Filter Triggered OK');
+        //     return $response->setStatusCode(200)->setBody('OK');
+        // }
+        // log_message('debug', 'Cors Filter Triggered Second');
     }
 
     public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
     {
         // No actions required after the request
+        // return $response;
     }
 }
diff --git a/app/Models/ZonesModel.php b/app/Models/ZonesModel.php
index c607bc7..6caf13b 100644
--- a/app/Models/ZonesModel.php
+++ b/app/Models/ZonesModel.php
@@ -3,7 +3,36 @@
 use CodeIgniter\Model;
 
 class ZonesModel extends Model {
+
 	protected $table 		= 'zones';
 	protected $primaryKey 	= 'zoneid';
 	protected $allowedFields = [ 'zonecode', 'zoneclass', 'parentzoneid', 'zonename' ];
+
+	public function getAll() {
+		return $this->findAll();
+	}
+
+	// public function getAllProvinces() {
+	// 	$this->select('zoneid, zonename')->where('parentzoneid IS NULL', null, false);
+
+	// 	// if (!empty($filters['zoneid'])) {
+	// 	// 	$this->where('zoneid', $filters['zoneid']);
+	// 	// }
+	// 	// if (!empty($filters['zonename'])) {
+	// 	// 	$this->like('zonename', $filters['zonename'], 'both');
+	// 	// }
+
+	// 	return $this->findAll();
+	// }
+
+	// public function getAllCities($filter = []) {
+	// 	$rows = $this->select('zoneid, zonename')->where('parentzoneid IS NOT NULL', null, false);
+
+	// 	if (!empty($filter['zoneid'])) {
+	// 		$this->where('parentzoneid', $filter['zoneid']);
+	// 	}
+
+	// 	return $this->findAll();
+	// }
+
 }
\ No newline at end of file