diff --git a/core/apps/companies/urls.py b/core/apps/companies/urls.py
index 276a2b2..18f5daa 100644
--- a/core/apps/companies/urls.py
+++ b/core/apps/companies/urls.py
@@ -26,5 +26,10 @@ urlpatterns: list[object] = [
         r"companies/<uuid:pk>/accounts",
         views.CompanyAccountApiView.as_view(),
         name="company-accounts-api-view"
+    ),
+    path(
+        r"company-folders/<uuid:pk>/contracts",
+        views.ContractFolderApiView.as_view(),
+        name="company-folders-api-view"
     )
 ]
diff --git a/core/apps/companies/views/companies.py b/core/apps/companies/views/companies.py
index 98f6f73..c2fbccb 100644
--- a/core/apps/companies/views/companies.py
+++ b/core/apps/companies/views/companies.py
@@ -5,20 +5,15 @@ from drf_spectacular.utils import extend_schema
 
 from rest_framework.decorators import action  # type: ignore
 from rest_framework.permissions import AllowAny, IsAdminUser  # type: ignore
-from rest_framework.viewsets import ModelViewSet, GenericViewSet  # type: ignore
+from rest_framework.viewsets import ModelViewSet  # type: ignore
 from rest_framework.generics import GenericAPIView  # type: ignore
 from rest_framework.request import HttpRequest  # type: ignore
 from rest_framework.response import Response  # type: ignore
 from rest_framework import status  # type: ignore
-from rest_framework.generics import get_object_or_404  # type: ignore
 
 from core.utils.views import BaseApiViewMixin
 from core.apps.companies.permissions import IsCompanyAccount
-from core.apps.companies.models import (
-    CompanyModel,
-    CompanyFolderModel,
-    CompanyAccountModel,
-)
+from core.apps.companies.models import CompanyModel, CompanyFolderModel, CompanyAccountModel
 from core.apps.companies.serializers import (
     CreateCompanySerializer,
     ListCompanySerializer,
@@ -34,7 +29,7 @@ from core.apps.companies.serializers import (
 
 from core.apps.contracts.serializers import (
     RetrieveContractSerializer,
-    BaseContractSerializer
+    BaseContractSerializer,
 )
 
 from core.apps.contracts.models import ContractModel
diff --git a/core/apps/companies/views/folders.py b/core/apps/companies/views/folders.py
index 086c916..55aafd4 100644
--- a/core/apps/companies/views/folders.py
+++ b/core/apps/companies/views/folders.py
@@ -5,14 +5,15 @@ from django.db import transaction
 from drf_spectacular.utils import extend_schema
 from rest_framework.decorators import action  # type: ignore
 from rest_framework.permissions import AllowAny, IsAdminUser  # type: ignore
-from rest_framework.viewsets import ModelViewSet, GenericViewSet  # type: ignore
+from rest_framework.viewsets import ModelViewSet  # type: ignore
 from rest_framework.generics import GenericAPIView  # type: ignore
 from rest_framework.request import HttpRequest  # type: ignore
 from rest_framework.response import Response  # type: ignore
 from rest_framework import status  # type: ignore
-
-from core.apps.contracts.serializers.contracts import CreateContractSerializer
 from core.apps.companies.permissions.folders import IsFolderOwner
+
+from core.utils.views import BaseApiViewMixin
+from core.apps.contracts.serializers.contracts import CreateContractSerializer
 from core.apps.companies.models import CompanyFolderModel
 from core.apps.companies.serializers.folders import (
     CreateCompanyFolderSerializer,
@@ -48,24 +49,25 @@ class CompanyFolderCrudViewSet(BaseViewSetMixin, ModelViewSet):
 
 
 ######################################################################
-# /contract-folders/<uuid:pk>/contracts
+# /company-folders/<uuid:pk>/contracts
 ######################################################################
-class ContractFolderApiView(GenericAPIView):
+class ContractFolderApiView(BaseApiViewMixin, GenericAPIView):  # type: ignore
     queryset = CompanyFolderModel.objects.all()
-    permission_classes = [AllowAny]
-    serializer_class = None
+    permission_classes = [IsFolderOwner]
+    serializer_class = CreateContractSerializer
 
-    def get_serializer_class(self):  # type: ignore
-        if self.request.method == "POST":
-            return CreateContractSerializer
-        return self.serializer_class
+    method_permission_classes = {
+        "post": [IsFolderOwner]
+    }
+    method_serializer_class = {
+        "post": CreateContractSerializer
+    }
 
     @extend_schema(
         summary="Create Contract For Folder",
         description="Create Contract For Folder",
     )
-    @action(methods=["POST"], detail=True, url_path="contracts")
-    def create_contract(self, request: HttpRequest, *args: object, **kwargs: object) -> Response:
+    def post(self, request: HttpRequest, *args: object, **kwargs: object) -> Response:
         with transaction.atomic():
             folder = cast(CompanyFolderModel, self.get_object())
             ser = cast(CreateContractSerializer, self.get_serializer(data=request.data))  # type: ignore