diff --git a/CarParkValidationAPI.csproj b/CarParkValidationAPI.csproj
index 10d6344..62387aa 100644
--- a/CarParkValidationAPI.csproj
+++ b/CarParkValidationAPI.csproj
@@ -2,6 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
+    <UserSecretsId>punt</UserSecretsId>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/Controllers/ConcessionValidationController.cs b/Controllers/ConcessionValidationController.cs
index 5459c6f..c3468eb 100644
--- a/Controllers/ConcessionValidationController.cs
+++ b/Controllers/ConcessionValidationController.cs
@@ -71,6 +71,19 @@ namespace CarParkValidationAPI.Controllers
             var retval =  await _concessionValidation.LoadConcessionValidationByIdAsync(id);
             return Ok(retval);
         }
+        [HttpPost("[action]")]
+        public async Task<IActionResult> GetConcessionCard(CardNoCriteria criteria)
+        {
+            /*
+            // only admins can access other user records
+            var currentUser = (User)HttpContext.Items["User"];
+            if (id != currentUser.Id && currentUser.Role != Role.Admin)
+                return Unauthorized(new { message = "Unauthorized" });
+            */
+            var retval = await _concessionValidation.LoadConcessionValidationByCardNumberAsync(criteria.CardNo);
+            return Ok(retval);
+        }
+
         [HttpDelete("{id:int}")]
         public async Task<IActionResult> DeleteConcessionValidation(int id)
         {            
diff --git a/Controllers/UsersController.cs b/Controllers/UsersController.cs
index a557786..bcee018 100644
--- a/Controllers/UsersController.cs
+++ b/Controllers/UsersController.cs
@@ -32,14 +32,14 @@ namespace CarParkValidationAPI.Controllers
         }
         [AllowAnonymous]
         [HttpPost("[action]")]
-        public async Task<IActionResult> LoginAD(AuthenticateRequest model)
+        public async Task<IActionResult> LoginAD([FromBody] AuthenticateRequest model)
         {
             var response = await _userService.LoginAD(model);
             return Ok(response);
         }
         [AllowAnonymous]
         [HttpPost("[action]")]
-        public async Task<IActionResult> LoginApiAD(AuthenticateRequest model)
+        public async Task<IActionResult> LoginApiAD([FromBody] AuthenticateRequest model)
         {
            var response = await _userService.LoginApiAD(model);           
             return Ok(response);
diff --git a/Entities/ConcessionValidationDto.cs b/Entities/ConcessionValidationDto.cs
index c956c27..2635c20 100644
--- a/Entities/ConcessionValidationDto.cs
+++ b/Entities/ConcessionValidationDto.cs
@@ -5,6 +5,10 @@ using System.Threading.Tasks;
 
 namespace CarParkValidationAPI.Entities
 {
+	public class CardNoCriteria
+	{
+		public string CardNo { get; set; }
+	}
 	public class ConcessionValidationExtDto: ConcessionValidationDto
     {
 		public string ConcessionType { get; set; }
diff --git a/Interface/IConcessionValidation.cs b/Interface/IConcessionValidation.cs
index ab7adde..8ae4d8e 100644
--- a/Interface/IConcessionValidation.cs
+++ b/Interface/IConcessionValidation.cs
@@ -4,6 +4,7 @@ using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
+using CarParkValidationAPI.Repository;
 
 
 namespace CarParkValidationAPI.Interface
@@ -15,6 +16,7 @@ namespace CarParkValidationAPI.Interface
         Task<ResultModel<int>> CheckConcessionValidationStaffLinkNoAsync(string staffLinkNo, string concessionCard, DateTime currentDate, int id);
         Task<ResultModel<int>> SaveConcessionValidationAsync(ConcessionValidationDto item);
         Task<ResultModel<ConcessionValidationDto>> LoadConcessionValidationByIdAsync(int id);
+        Task<ResultModel<ConcessionValidationDto>> LoadConcessionValidationByCardNumberAsync(string cardNo);
         Task<ResultModel<bool>> DeleteConcessionValidationAsync(int id);
         
         void SetCurrentUser(string username);
diff --git a/Repository/ConcessionValidationRepository.cs b/Repository/ConcessionValidationRepository.cs
index 2e68da6..2c7d3f0 100644
--- a/Repository/ConcessionValidationRepository.cs
+++ b/Repository/ConcessionValidationRepository.cs
@@ -12,6 +12,7 @@ using CarParkValidationAPI.Datas;
 using CarParkValidationAPI.Interface;
 using Microsoft.EntityFrameworkCore;
 using System;
+using System.Security.Cryptography.Xml;
 
 namespace CarParkValidationAPI.Repository
 {
@@ -238,18 +239,54 @@ namespace CarParkValidationAPI.Repository
 			};
 		}
 
-		public async Task<ResultModel<ConcessionValidationDto>> LoadConcessionValidationByIdAsync(int id)
+        public async Task<ResultModel<ConcessionValidationDto>> LoadConcessionValidationByIdAsync(int id)
+        {
+            ConcessionValidationDto result = null;
+            int statuscode = 0;
+            string error = "";
+            try
+            {
+                if (id > 0)
+                {
+                    ConcessionValidation model = await _context.ConcessionValidations.FindAsync(id);
+                    result = FillConcessionValidationDto(model);
+                    statuscode = 1;
+                }
+
+            }
+            catch (Exception ex)
+            {
+                statuscode = 0;
+                error = ex.ToString();
+                throw;
+            }
+
+            return new ResultModel<ConcessionValidationDto>()
+            {
+                Data = result,
+                StatusCode = statuscode,
+                Message = error
+            };
+        }
+        public async Task<ResultModel<ConcessionValidationDto>> LoadConcessionValidationByCardNumberAsync(string cardNo)
 		{
 			ConcessionValidationDto result = null;
 			int statuscode = 0;
 			string error = "";
 			try
 			{
-				if (id > 0)
+				if (!string.IsNullOrEmpty(cardNo))
 				{
-					ConcessionValidation model = await _context.ConcessionValidations.FindAsync(id);
-					result = FillConcessionValidationDto(model);
-					statuscode = 1;
+					
+					var list = await _context.ConcessionValidations.Where(x => x.ConcessionCard == cardNo).ToListAsync();
+					if (list != null && list.Count > 0)
+					{
+
+						result = FillConcessionValidationDto(list[0]);
+						statuscode = 1;
+					}
+					else
+						statuscode = -1;
 				}
 
 			}