diff --git a/internal/contract/self_order_contract.go b/internal/contract/self_order_contract.go
index fe9d938..4918f92 100644
--- a/internal/contract/self_order_contract.go
+++ b/internal/contract/self_order_contract.go
@@ -60,7 +60,8 @@ type SelfOrderCreateOrderItem struct {
 }
 
 type SelfOrderListCategoriesRequest struct {
-	SessionID string `form:"session_id" validate:"required"`
+	OrganizationID string `form:"organisasi_id" validate:"required"`
+	OutletID       string `form:"outlet_id" validate:"required"`
 }
 
 type SelfOrderCategoryItem struct {
diff --git a/internal/handler/self_order_handler.go b/internal/handler/self_order_handler.go
index c383d2e..c632a7c 100644
--- a/internal/handler/self_order_handler.go
+++ b/internal/handler/self_order_handler.go
@@ -382,29 +382,53 @@ func (h *SelfOrderHandler) ListCategories(c *gin.Context) {
 		return
 	}
 
-	if req.SessionID == "" {
+	if req.OrganizationID == "" {
 		util.HandleResponse(c.Writer, c.Request, contract.BuildErrorResponse([]*contract.ResponseError{
-			contract.NewResponseError(constants.MissingFieldErrorCode, constants.RequestEntity, "session_id is required"),
+			contract.NewResponseError(constants.MissingFieldErrorCode, constants.RequestEntity, "organisasi_id is required"),
 		}), "SelfOrderHandler::ListCategories")
 		return
 	}
 
-	session, table, _, err := h.resolveSession(ctx, req.SessionID)
-	if err != nil {
+	if req.OutletID == "" {
 		util.HandleResponse(c.Writer, c.Request, contract.BuildErrorResponse([]*contract.ResponseError{
-			contract.NewResponseError(constants.ValidationErrorCode, constants.RequestEntity, err.Error()),
+			contract.NewResponseError(constants.MissingFieldErrorCode, constants.RequestEntity, "outlet_id is required"),
 		}), "SelfOrderHandler::ListCategories")
 		return
 	}
-	if session == nil {
+
+	orgID, err := uuid.Parse(req.OrganizationID)
+	if err != nil {
 		util.HandleResponse(c.Writer, c.Request, contract.BuildErrorResponse([]*contract.ResponseError{
-			contract.NewResponseError(constants.NotFoundErrorCode, constants.RequestEntity, "session not found or expired"),
+			contract.NewResponseError(constants.ValidationErrorCode, constants.RequestEntity, "invalid organisasi_id format"),
+		}), "SelfOrderHandler::ListCategories")
+		return
+	}
+
+	outletID, err := uuid.Parse(req.OutletID)
+	if err != nil {
+		util.HandleResponse(c.Writer, c.Request, contract.BuildErrorResponse([]*contract.ResponseError{
+			contract.NewResponseError(constants.ValidationErrorCode, constants.RequestEntity, "invalid outlet_id format"),
+		}), "SelfOrderHandler::ListCategories")
+		return
+	}
+
+	outlet, err := h.outletRepo.GetByID(ctx, outletID)
+	if err != nil || outlet == nil {
+		util.HandleResponse(c.Writer, c.Request, contract.BuildErrorResponse([]*contract.ResponseError{
+			contract.NewResponseError(constants.NotFoundErrorCode, constants.RequestEntity, "outlet not found"),
+		}), "SelfOrderHandler::ListCategories")
+		return
+	}
+
+	if outlet.OrganizationID != orgID {
+		util.HandleResponse(c.Writer, c.Request, contract.BuildErrorResponse([]*contract.ResponseError{
+			contract.NewResponseError(constants.ValidationErrorCode, constants.RequestEntity, "outlet does not belong to the specified organization"),
 		}), "SelfOrderHandler::ListCategories")
 		return
 	}
 
 	catResp := h.categoryService.ListCategories(ctx, &contract.ListCategoriesRequest{
-		OrganizationID: &table.OrganizationID,
+		OrganizationID: &orgID,
 		Page:           1,
 		Limit:          100,
 	})