diff --git a/api/serializers.py b/api/serializers.py
index 9d49b09..e1c5a9c 100644
--- a/api/serializers.py
+++ b/api/serializers.py
@@ -6,10 +6,12 @@ class UserRegisterSerializer(serializers.ModelSerializer):
     phone = serializers.CharField(write_only=True, required=False, allow_blank=True)
     address = serializers.CharField(write_only=True, required=False, allow_blank=True)
     password = serializers.CharField(write_only=True)
+    first_name = serializers.CharField(required=False, allow_blank=True)
+    last_name = serializers.CharField(required=False, allow_blank=True)
 
     class Meta:
         model = User
-        fields = ['username', 'email', 'password', 'phone', 'address']
+        fields = ['username', 'email', 'password', 'first_name', 'last_name', 'phone', 'address']
 
     def create(self, validated_data):
         phone = validated_data.pop('phone', '')
@@ -19,6 +21,8 @@ class UserRegisterSerializer(serializers.ModelSerializer):
         user = User.objects.create_user(
             username=validated_data['username'],
             email=validated_data.get('email', ''),
+            first_name=validated_data.get('first_name', ''),
+            last_name=validated_data.get('last_name', ''),
             password=password
         )
         CustomerProfile.objects.create(user=user, phone=phone, default_address=address)
diff --git a/api/views.py b/api/views.py
index 8a97c80..efd5d14 100644
--- a/api/views.py
+++ b/api/views.py
@@ -31,28 +31,71 @@ class UserRegisterView(APIView):
         return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
 
 class UserProfileView(APIView):
-    permission_classes = [permissions.IsAuthenticated]
+    permission_classes = [permissions.AllowAny]
 
     def get(self, request):
-        user = request.user
+        username = request.query_params.get('username') or request.query_params.get('phone')
+        user = None
+        if request.user and request.user.is_authenticated:
+            user = request.user
+        elif username:
+            clean_digits = ''.join(c for c in str(username) if c.isdigit())
+            raw_10 = clean_digits[-10:] if len(clean_digits) >= 10 else clean_digits
+            from django.db.models import Q
+            user = User.objects.filter(Q(username__icontains=raw_10) | Q(username=username)).first()
+
+        if not user:
+            return Response({"error": "User not found"}, status=status.HTTP_404_NOT_FOUND)
+
         profile = getattr(user, 'customer_profile', None)
         return Response({
             "username": user.username,
+            "first_name": user.first_name,
+            "last_name": user.last_name,
             "email": user.email,
-            "phone": profile.phone if profile else "",
+            "phone": profile.phone if profile else user.username,
             "address": profile.default_address if profile else ""
         })
 
     def put(self, request):
-        user = request.user
-        profile = getattr(user, 'customer_profile', None)
-        user.email = request.data.get('email', user.email)
+        username = request.data.get('username') or request.data.get('phone')
+        user = None
+        if request.user and request.user.is_authenticated:
+            user = request.user
+        elif username:
+            clean_digits = ''.join(c for c in str(username) if c.isdigit())
+            raw_10 = clean_digits[-10:] if len(clean_digits) >= 10 else clean_digits
+            from django.db.models import Q
+            user = User.objects.filter(Q(username__icontains=raw_10) | Q(username=username)).first()
+
+        if not user:
+            return Response({"error": "User profile not found"}, status=status.HTTP_404_NOT_FOUND)
+
+        if 'email' in request.data:
+            user.email = request.data['email']
+        if 'first_name' in request.data:
+            user.first_name = request.data['first_name']
+        if 'last_name' in request.data:
+            user.last_name = request.data['last_name']
         user.save()
-        if profile:
-            profile.phone = request.data.get('phone', profile.phone)
-            profile.default_address = request.data.get('address', profile.default_address)
-            profile.save()
-        return Response({"message": "Profile updated successfully"})
+
+        from orders.models import CustomerProfile
+        profile, _ = CustomerProfile.objects.get_or_create(user=user)
+        if 'phone' in request.data:
+            profile.phone = request.data['phone']
+        if 'address' in request.data:
+            profile.default_address = request.data['address']
+        profile.save()
+
+        audit_logger.info(f"AUDIT - User Profile Updated: Username '{user.username}', Email '{user.email}'")
+
+        return Response({
+            "message": "Profile updated successfully",
+            "username": user.username,
+            "email": user.email,
+            "first_name": user.first_name,
+            "last_name": user.last_name
+        }, status=status.HTTP_200_OK)
 
 def send_msg91_whatsapp_direct(mobile_number, otp_code, template_name="mobile_number_verification"):
     clean_digits = ''.join(c for c in str(mobile_number) if c.isdigit())