diff --git a/database/factories/UserFactory.php b/database/factories/UserFactory.php
index 604666eda..bb89d3524 100644
--- a/database/factories/UserFactory.php
+++ b/database/factories/UserFactory.php
@@ -295,6 +295,11 @@ class UserFactory extends Factory
         return $this->appendPermission(['companies.delete' => '1']);
     }
 
+    public function editCompanies()
+    {
+        return $this->appendPermission(['companies.edit' => '1']);
+    }
+
     public function viewUsers()
     {
         return $this->appendPermission(['users.view' => '1']);
diff --git a/tests/Feature/Companies/Api/CreateCompaniesTest.php b/tests/Feature/Companies/Api/CreateCompaniesTest.php
new file mode 100644
index 000000000..ab9c0eecb
--- /dev/null
+++ b/tests/Feature/Companies/Api/CreateCompaniesTest.php
@@ -0,0 +1,44 @@
+<?php
+
+namespace Tests\Feature\Companies\Api;
+
+use App\Models\User;
+use Tests\Concerns\TestsPermissionsRequirement;
+use Tests\TestCase;
+
+class CreateCompaniesTest extends TestCase implements TestsPermissionsRequirement
+{
+    public function testRequiresPermission()
+    {
+        $this->actingAsForApi(User::factory()->create())
+            ->postJson(route('api.companies.store'))
+            ->assertForbidden();
+    }
+
+    public function testValidationForCreatingCompany()
+    {
+        $this->actingAsForApi(User::factory()->createCompanies()->create())
+            ->postJson(route('api.companies.store'))
+            ->assertStatus(200)
+            ->assertStatusMessageIs('error')
+            ->assertJsonStructure([
+                'messages' => [
+                    'name',
+                ],
+            ]);
+    }
+
+    public function testCanCreateCompany()
+    {
+        $this->actingAsForApi(User::factory()->createCompanies()->create())
+            ->postJson(route('api.companies.store'), [
+                'name' => 'My Cool Company',
+            ])
+            ->assertStatus(200)
+            ->assertStatusMessageIs('success');
+
+        $this->assertDatabaseHas('companies', [
+            'name' => 'My Cool Company',
+        ]);
+    }
+}
diff --git a/tests/Feature/Companies/Api/UpdateCompaniesTest.php b/tests/Feature/Companies/Api/UpdateCompaniesTest.php
new file mode 100644
index 000000000..000bca113
--- /dev/null
+++ b/tests/Feature/Companies/Api/UpdateCompaniesTest.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Tests\Feature\Companies\Api;
+
+use App\Models\Company;
+use App\Models\User;
+use Tests\TestCase;
+
+class UpdateCompaniesTest extends TestCase
+{
+    public function testRequiresPermissionToPatchCompany()
+    {
+        $company = Company::factory()->create();
+
+        $this->actingAsForApi(User::factory()->create())
+            ->patchJson(route('api.companies.update', $company))
+            ->assertForbidden();
+    }
+
+    public function testValidationForPatchingCompany()
+    {
+        $company = Company::factory()->create();
+
+        $this->actingAsForApi(User::factory()->editCompanies()->create())
+            ->patchJson(route('api.companies.update', ['company' => $company->id]), [
+                'name' => '',
+            ])
+            ->assertStatus(200)
+            ->assertStatusMessageIs('error')
+            ->assertJsonStructure([
+                'messages' => [
+                    'name',
+                ],
+            ]);
+    }
+
+    public function testCanPatchCompany()
+    {
+        $company = Company::factory()->create();
+
+        $this->actingAsForApi(User::factory()->editCompanies()->create())
+            ->patchJson(route('api.companies.update', ['company' => $company->id]), [
+                'name' => 'A Changed Name',
+            ])
+            ->assertStatus(200)
+            ->assertStatusMessageIs('success');
+
+        $this->assertEquals('A Changed Name', $company->fresh()->name);
+    }
+}