diff --git a/src/query/base/base-query.controller.ts b/src/query/base/base-query.controller.ts
index 0680dff..30c22aa 100644
--- a/src/query/base/base-query.controller.ts
+++ b/src/query/base/base-query.controller.ts
@@ -21,7 +21,6 @@ import { Query } from "../entities/query.entity";
 import { Token } from "src/api/entities/token.entity";
 import { QueryPublicGuard } from "../guards/query-public";
 
-@UseGuards(ApiTokenGuard)
 export abstract class BaseQueryController {
   constructor(
     @Inject(QueryHandlerService)
@@ -35,6 +34,7 @@ export abstract class BaseQueryController {
   protected abstract getIsCommand(): boolean;
 
   @Post("create")
+  @UseGuards(ApiTokenGuard)
   async createQuery(
     @Req() req: Request & { apiToken: Token },
     @Body()
@@ -50,7 +50,7 @@ export abstract class BaseQueryController {
   }
 
   @Post("update/:id")
-  @UseGuards(QueryGuard)
+  @UseGuards(ApiTokenGuard, QueryGuard)
   async updateQuery(
     @Body()
     updateData: Partial<{
@@ -161,7 +161,7 @@ export abstract class BaseQueryController {
   }
 
   @Post("/run/:id")
-  @UseGuards(QueryGuard)
+  @UseGuards(ApiTokenGuard, QueryGuard)
   async runQuery(
     @Param("id") id: string,
     @Body() query: Record<string, any>,
@@ -173,7 +173,7 @@ export abstract class BaseQueryController {
   }
 
   @Delete("/delete/:id")
-  @UseGuards(QueryGuard)
+  @UseGuards(ApiTokenGuard, QueryGuard)
   async deleteQuery(@Param("id") id: string) {
     return this.queryHandlerService.deleteQuery(id);
   }
diff --git a/src/query/session/session.controller.ts b/src/query/session/session.controller.ts
new file mode 100644
index 0000000..d9a7f5f
--- /dev/null
+++ b/src/query/session/session.controller.ts
@@ -0,0 +1,59 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Inject,
+  Param,
+  Post,
+  Put,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import { ApiTokenGuard } from "src/api/guards/api-token.guard";
+import { SessionService } from "./session.service";
+
+@Controller("session")
+@UseGuards(ApiTokenGuard)
+export class SessionController {
+  constructor(
+    @Inject(SessionService)
+    private readonly sessionService: SessionService
+  ) {}
+
+  @Get("get/:sessionId")
+  getSession(
+    @Param("sessionId") sessionId: string,
+    @Req() req: Request & { apiToken: { project: { id: string } } }
+  ) {
+    return this.sessionService.get(sessionId, req.apiToken.project.id);
+  }
+
+  @Delete("delete/:sessionId")
+  deleteSession(
+    @Param("sessionId") sessionId: string,
+    @Req() req: Request & { apiToken: { project: { id: string } } }
+  ) {
+    return this.sessionService.delete(sessionId, req.apiToken.project.id);
+  }
+
+  @Post("create")
+  createSession(
+    @Req() req: Request & { apiToken: { project: { id: string } } }
+  ) {
+    return this.sessionService.create(req.apiToken.project.id);
+  }
+
+  @Put("set/:sessionId")
+  setSession(
+    @Param("sessionId") sessionId: string,
+    @Req() req: Request & { apiToken: { project: { id: string } } },
+    @Body() body: { data: any }
+  ) {
+    return this.sessionService.set(
+      sessionId,
+      req.apiToken.project.id,
+      body.data
+    );
+  }
+}
diff --git a/src/query/session/session.service.ts b/src/query/session/session.service.ts
index 1f3674a..85eff64 100644
--- a/src/query/session/session.service.ts
+++ b/src/query/session/session.service.ts
@@ -56,9 +56,20 @@ export class SessionService {
   }
 
   async set(sessionId: string, prefix: string, data: any): Promise<void> {
+    const existingSession = await this.redisClient.get(
+      `${prefix}:${sessionId}`
+    );
+
+    if (!existingSession) {
+      throw new Error("Session not found");
+    }
+
     await this.redisClient.set(
       `${prefix}:${sessionId}`,
-      data,
+      {
+        ...existingSession,
+        ...data,
+      },
       await this.getSessionTTL(prefix)
     );
   }