diff --git a/api/rpk-api/hub/firm/__init__.py b/api/rpk-api/hub/firm/__init__.py
index ffe6340..62787dd 100644
--- a/api/rpk-api/hub/firm/__init__.py
+++ b/api/rpk-api/hub/firm/__init__.py
@@ -22,7 +22,8 @@ class FirmRead(BaseModel):
     name: str = Field()
 
 class FirmCreate(FirmRead):
-    pass
+    instance: str = Field(max_length=32, min_length=3, pattern="^[0-9a-z-]+$")
+    name: str = Field(max_length=32, min_length=3, pattern="^[0-9a-z-]+$")
 
-class FirmUpdate(FirmRead):
-    pass
+class FirmUpdate(BaseModel):
+    owner: PydanticObjectId = Field()
diff --git a/api/rpk-api/hub/firm/routes.py b/api/rpk-api/hub/firm/routes.py
index 7afa19b..e772135 100644
--- a/api/rpk-api/hub/firm/routes.py
+++ b/api/rpk-api/hub/firm/routes.py
@@ -12,15 +12,15 @@ model_update = FirmUpdate
 router = APIRouter()
 
 @router.post("/", response_description="{} added to the database".format(model.__name__))
-async def create(item: model_create, user=Depends(get_current_user)) -> dict:
+async def create(item: model_create, user=Depends(get_current_user)) -> model_read:
     exists = await Firm.find_one({"name": item.name, "instance": item.instance})
     if exists:
         raise HTTPException(status_code=400, detail="Firm already exists")
 
-    item.created_by = user.id
-    item.updated_by = user.id
-    item.owner = user.id
-    o = await model(**item.model_dump()).create()
+    record = model(created_by=user.id, updated_by=user.id, owner=user.id, **item.model_dump())
+    o = await record.create()
+    user.firms.append(o.id)
+    user.save()
     return model_read(**o.model_dump())
 
 @router.get("/{id}", response_description="{} record retrieved".format(model.__name__))
diff --git a/api/rpk-api/hub/user/__init__.py b/api/rpk-api/hub/user/__init__.py
index 774f3ae..3843519 100644
--- a/api/rpk-api/hub/user/__init__.py
+++ b/api/rpk-api/hub/user/__init__.py
@@ -1,12 +1,13 @@
+from beanie import PydanticObjectId
 from fastapi_users_db_beanie import BaseOAuthAccount, BeanieUserDatabase, BeanieBaseUserDocument
 from pydantic import Field
 
-
 class OAuthAccount(BaseOAuthAccount):
     pass
 
 class User(BeanieBaseUserDocument):
     oauth_accounts: list[OAuthAccount] = Field(default_factory=list)
+    firms: list[PydanticObjectId] = Field(default_factory=list)
 
 class UserDatabase(BeanieUserDatabase):
     pass
diff --git a/api/rpk-api/hub/user/schemas.py b/api/rpk-api/hub/user/schemas.py
index 389ea26..bb41033 100644
--- a/api/rpk-api/hub/user/schemas.py
+++ b/api/rpk-api/hub/user/schemas.py
@@ -1,5 +1,7 @@
 from beanie import PydanticObjectId
 from fastapi_users.schemas import BaseUser
+from pydantic import Field
+
 
 class UserSchema(BaseUser[PydanticObjectId]):
-    pass
+    firms: list[PydanticObjectId] = Field()
diff --git a/gui/rpk-gui/src/App.tsx b/gui/rpk-gui/src/App.tsx
index 6c61247..eba68c9 100644
--- a/gui/rpk-gui/src/App.tsx
+++ b/gui/rpk-gui/src/App.tsx
@@ -13,9 +13,9 @@ import routerBindings, {
   DocumentTitleHandler,
   UnsavedChangesNotifier,
 } from "@refinedev/react-router";
-import dataProvider from "@refinedev/simple-rest";
 import { BrowserRouter, Outlet, Route, Routes } from "react-router";
 import { authProvider } from "./providers/auth-provider";
+import { dataProvider } from "./providers/data-provider";
 import { ColorModeContextProvider } from "./contexts/color-mode";
 import { Login } from "./components/auth/Login";
 import { Register } from "./components/auth/Register";
@@ -36,7 +36,7 @@ function App() {
           <RefineSnackbarProvider>
             <Refine
               authProvider={authProvider}
-              dataProvider={dataProvider("https://api.fake-rest.refine.dev")}
+              dataProvider={dataProvider}
               notificationProvider={useNotificationProvider}
               routerProvider={routerBindings}
               options={{
diff --git a/gui/rpk-gui/src/providers/data-provider.tsx b/gui/rpk-gui/src/providers/data-provider.tsx
index 33943db..f6fef36 100644
--- a/gui/rpk-gui/src/providers/data-provider.tsx
+++ b/gui/rpk-gui/src/providers/data-provider.tsx
@@ -1,20 +1,10 @@
 import type { DataProvider } from "@refinedev/core";
 
-const API_URL = "http://localhost:8000";
-
-const fetcher = async (url: string, options?: RequestInit) => {
-  return fetch(url, {
-    ...options,
-    headers: {
-      ...options?.headers,
-      Authorization: "Bearer " + localStorage.getItem("access_token"),
-    },
-  });
-};
+const API_URL = "/api/v1";
 
 export const dataProvider: DataProvider = {
   getOne: async ({ resource, id, meta }) => {
-    const response = id !== "" ? await fetcher(`${API_URL}/${resource}/${id}`) : await fetcher(`${API_URL}/${resource}`);
+    const response = id !== "" ? await fetch(`${API_URL}/${resource}/${id}`) : await fetch(`${API_URL}/${resource}`);
     if (response.status < 200 || response.status > 299) throw response;
 
     const data = await response.json();
@@ -24,7 +14,7 @@ export const dataProvider: DataProvider = {
     };
   },
   update: async ({ resource, id, variables }) => {
-    const response = await fetcher(`${API_URL}/${resource}/${id}`, {
+    const response = await fetch(`${API_URL}/${resource}/${id}`, {
       method: "PUT",
       body: JSON.stringify(variables),
       headers: {
@@ -58,7 +48,7 @@ export const dataProvider: DataProvider = {
       });
     }
 
-    const response = await fetcher(`${API_URL}/${resource}?${params.toString()}`);
+    const response = await fetch(`${API_URL}/${resource}?${params.toString()}`);
 
     if (response.status < 200 || response.status > 299) throw response;
 
@@ -70,7 +60,7 @@ export const dataProvider: DataProvider = {
     };
   },
   create: async ({ resource, variables }) => {
-    const response = await fetcher(`${API_URL}/${resource}`, {
+    const response = await fetch(`${API_URL}/${resource}`, {
       method: "POST",
       body: JSON.stringify(variables),
       headers: {
@@ -85,7 +75,7 @@ export const dataProvider: DataProvider = {
     return { data };
   },
   deleteOne: async ({ resource, id, variables, meta }) => {
-    const response = await fetcher(`${API_URL}/${resource}/${id}`,{
+    const response = await fetch(`${API_URL}/${resource}/${id}`,{
       method: "DELETE",
     });