diff --git a/index.js b/index.js
index e291bd4..89c5333 100644
--- a/index.js
+++ b/index.js
@@ -16,6 +16,7 @@ const scenarioRoute = require('./routes/scenario/scenario');
 const patientRoute = require('./routes/patient/patient');
 const gradeRoute = require('./routes/grade/grade');
 const userRoute = require('./routes/user/user');
+const orderRoute = require('./routes/order/order');
 
 // connect mongodb server
 mongoose.connect(
@@ -34,7 +35,7 @@ app.use("/scenario", scenarioRoute); // use scenario endpoints if url starts wit
 app.use("/patient", patientRoute); // use patient endpoints if url starts with /patient
 app.use("/grade", gradeRoute); // use grade endpoints if url starts with /grade
 app.use("/user", userRoute); // use user endpoints if url starts with /user
-
+app.use("/order", orderRoute); // use order endpoints if url starts with /order
 
 // get certificates
 const privLocation = process.env.PRIVATE_LOCATION;
diff --git a/models/OrderMedicineModel.js b/models/OrderMedicineModel.js
new file mode 100644
index 0000000..3a3078f
--- /dev/null
+++ b/models/OrderMedicineModel.js
@@ -0,0 +1,20 @@
+const { default: mongoose } = require("mongoose");
+
+const OrderMedicineSchema = new mongoose.Schema({
+    medicineName: {
+        type: String,
+        required: true
+    },
+    dose: {
+        type: String
+    },
+    periods: {
+        type: String
+    },
+    type: {
+        type: Number,
+        required: true
+    },
+}, { timestamps: true });
+
+module.exports = mongoose.model('OrderMedicineModel', OrderMedicineSchema);
\ No newline at end of file
diff --git a/models/OrderModel.js b/models/OrderModel.js
new file mode 100644
index 0000000..f42abec
--- /dev/null
+++ b/models/OrderModel.js
@@ -0,0 +1,8 @@
+const mongoose = require('mongoose');
+
+const OrderSchema = new mongoose.Schema({
+    patient: { type: mongoose.Types.ObjectId, ref: 'PatientModel' },
+    medicines: [{ type: mongoose.Types.ObjectId, ref: 'OrderMedicineModel' }],
+}, { timestamps: true });
+
+module.exports = mongoose.model('OrderModel', OrderSchema);
\ No newline at end of file
diff --git a/routes/order/medicine/medicine.js b/routes/order/medicine/medicine.js
new file mode 100644
index 0000000..e4daf79
--- /dev/null
+++ b/routes/order/medicine/medicine.js
@@ -0,0 +1,68 @@
+const router = require("express").Router();
+const { auth, verifyTokenAndAdmin, verifyTokenAndAuthorization } = require('../../auth/verifyToken');
+const OrderMedicineModel = require('../../../models/OrderMedicineModel');
+
+// get all medicines
+router.get("/get", auth, verifyTokenAndAdmin, async(req, res) => {
+    // get medicines
+    const medicines = await OrderMedicineModel.find();
+
+    // return
+    res.status(200).json(medicines);
+});
+
+// get medicine by name
+router.get("/get/:name", auth, verifyTokenAndAdmin, async(req, res) => {
+    // get medicine
+    const medicine = await OrderMedicineModel.findOne({ medicineName: req.params.name });
+
+    // if medicine not found
+    if (!medicine) {
+        // return error
+        return res.status(400).json({ message: "Medicine not found" });
+    }
+
+    // return
+    res.status(200).json(medicine);
+});
+
+// create a new order mdicine medicine
+router.post("/create", verifyTokenAndAdmin, async(req, res) => {
+    // create model
+    var medicine = new OrderMedicineModel({
+        medicineName: req.body.medicineName,
+        dose: req.body.dose ? req.body.dose : "",
+        periods: req.body.periods ? req.body.periods : "",
+        type: req.body.type,
+    });
+
+    // insert medicine
+    OrderMedicineModel.create(medicine)
+        .then(medicine => res.status(200).json(medicine))
+        .catch(err => res.status(500).json({ message: err }));
+});
+
+// delete medicine by name
+router.delete("/delete", verifyTokenAndAdmin, async(req, res) => {
+
+    // find and delete medicine
+    OrderMedicineModel.deleteOne({ medicineName: req.body.medicineName })
+        .then(medicine => res.status(200).json(medicine))
+        .catch(err => res.status(500).json({ message: err }));
+});
+
+// update medicine by name
+router.put("/update", verifyTokenAndAdmin, async(req, res) => {
+
+    // find and update medicine
+    OrderMedicineModel.updateOne({ medicineName: req.body.medicineName }, {
+            medicineName: req.body.medicineName,
+            dose: req.body.dose ? req.body.dose : "",
+            periods: req.body.periods ? req.body.periods : "",
+            type: req.body.type,
+        })
+        .then(medicine => res.status(200).json(medicine))
+        .catch(err => res.status(500).json({ message: err }));
+});
+
+module.exports = router;
\ No newline at end of file
diff --git a/routes/order/order.js b/routes/order/order.js
new file mode 100644
index 0000000..701e919
--- /dev/null
+++ b/routes/order/order.js
@@ -0,0 +1,6 @@
+const router = require("express").Router();
+const MedicineRoute = require("./medicine/medicine");
+
+router.use("/medicine", MedicineRoute); // /order/medicine
+
+module.exports = router;
\ No newline at end of file
diff --git a/routes/patient/order/order.js b/routes/patient/order/order.js
new file mode 100644
index 0000000..591472f
--- /dev/null
+++ b/routes/patient/order/order.js
@@ -0,0 +1,84 @@
+const router = require("express").Router();
+const { auth, verifyTokenAndAdmin, verifyTokenAndAuthorization } = require('../../auth/verifyToken');
+const { queryValidation, idValidation } = require('../../../common/validation');
+const { verifyPatient } = require('../verifyPatient');
+const OrderMedicineModel = require('../../../models/OrderMedicineModel');
+const OrderModel = require('../../../models/OrderModel');
+
+// create a new order with given medicine names
+router.post("/create", verifyTokenAndAdmin, verifyPatient, async(req, res) => {
+    // get patient
+    let patient = req.patient;
+
+    // check if patient has an order
+    const existingOrder = await OrderModel.findOne({ patient: patient._id });
+
+    // if order exists
+    if (existingOrder) {
+        // return error
+        return res.status(400).json({ message: "Patient already has an order" });
+    }
+
+    // create medicines
+    let medicines = [];
+
+    // get medicines by name
+    for (let i = 0; i < req.body.medicines.length; i++) {
+        // get medicine
+        let medicine = await OrderMedicineModel.findOne({ medicineName: req.body.medicines[i] });
+
+        // if medicine not found
+        if (!medicine) {
+            // return error
+            return res.status(400).json({ message: "Medicine not found" });
+        }
+
+        // add medicine
+        medicines.push(medicine);
+    }
+
+    // create model
+    var order = new OrderModel({
+        patient: patient._id,
+        medicines: medicines
+    });
+
+    // insert
+    OrderModel.create(order)
+        .then(order => res.status(200).json(order))
+        .catch(err => res.status(500).json({ message: err }));
+});
+
+// get patient orders with medicines
+router.get("/get", auth, verifyPatient, async(req, res) => {
+    // get patient
+    let patient = req.patient;
+
+    // get orders
+    const orders = await OrderModel.find({ patient: patient._id }).populate('medicines');
+
+    // return
+    res.status(200).json(orders);
+});
+
+// remove patient order
+router.delete("/remove", verifyTokenAndAdmin, verifyPatient, async(req, res) => {
+    // get patient
+    let patient = req.patient;
+
+    // check if patient has an order
+    const existingOrder = await OrderModel.findOne({ patient: patient._id });
+
+    // if order does not exist
+    if (!existingOrder) {
+        // return error
+        return res.status(400).json({ message: "Patient does not have an order" });
+    }
+
+    // remove order
+    OrderModel.deleteOne({ patient: patient._id })
+        .then(() => res.status(200).json({ message: "Order removed" }))
+        .catch(err => res.status(500).json({ message: err }));
+});
+
+module.exports = router;
\ No newline at end of file
diff --git a/routes/patient/patient.js b/routes/patient/patient.js
index 3fd92f0..98836d5 100644
--- a/routes/patient/patient.js
+++ b/routes/patient/patient.js
@@ -10,6 +10,7 @@ const medicineRoute = require('./medicine/medicine');
 const nortonPressureUlcerRoute = require('./nortonpressureulcer/nortonpressureulcer');
 const vitalSignRoute = require('./vitalsign/vitalsign');
 const lifeActivityRoute = require('./lifeactivity/lifeactivity');
+const orderRoute = require('./order/order');
 const GradeModel = require("../../models/GradeModel");
 
 // create request of patient
@@ -117,5 +118,6 @@ router.use("/medicine", medicineRoute); // use medicine endpoints if url starts
 router.use("/nortonpressureulcer", nortonPressureUlcerRoute); // use nortonpressureulcer endpoints if url starts with /nortonpressureulcer
 router.use("/vitalsign", vitalSignRoute); // use vitalsign endpoints if url starts with /vitalsign
 router.use("/lifeactivity", lifeActivityRoute); // use lifeactivity endpoints if url starts with /lifeactivity
+router.use("/order", orderRoute); // use order endpoints if url starts with /order
 
 module.exports = router;
\ No newline at end of file
diff --git a/routes/patient/verifyPatient.js b/routes/patient/verifyPatient.js
index 342f4e3..270702f 100644
--- a/routes/patient/verifyPatient.js
+++ b/routes/patient/verifyPatient.js
@@ -2,7 +2,7 @@ const { queryValidation, idValidation } = require('../../common/validation');
 const PatientModel = require('../../models/PatientModel');
 
 // verify patient middleware
-const verifyPatient = async (req, res, next) => {
+const verifyPatient = async(req, res, next) => {
     // get id from query
     let queryId = req.query.id;