diff --git a/src/test/java/com/hithomelabs/CFTunnels/Controllers/TunnelControllerTest.java b/src/test/java/com/hithomelabs/CFTunnels/Controllers/TunnelControllerTest.java
index 53507de..3af77b2 100644
--- a/src/test/java/com/hithomelabs/CFTunnels/Controllers/TunnelControllerTest.java
+++ b/src/test/java/com/hithomelabs/CFTunnels/Controllers/TunnelControllerTest.java
@@ -222,6 +222,152 @@ class TunnelControllerTest {
                 .andExpect(jsonPath("$.data.length()").value(2));
     }
 
+    @Test
+    @DisplayName("should create mapping request successfully")
+    void createTunnelMappingRequest_Success() throws Exception {
+        UUID tunnelId = UUID.randomUUID();
+        com.hithomelabs.CFTunnels.Entity.Request createdRequest = new com.hithomelabs.CFTunnels.Entity.Request();
+        createdRequest.setId(UUID.randomUUID());
+        createdRequest.setStatus(com.hithomelabs.CFTunnels.Entity.Request.RequestStatus.PENDING);
+
+        when(mappingRequestService.createMappingRequest(any(String.class), any(com.hithomelabs.CFTunnels.Models.Ingress.class), any())).thenReturn(createdRequest);
+
+        mockMvc.perform(post("/cloudflare/tunnels/configure/{tunnelId}/requests", tunnelId.toString())
+                        .with(oauth2Login().oauth2User(buildOidcUser("developer", Groups.HOMELAB_DEVELOPER)))
+                        .with(csrf())
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content(ingressJson))
+                .andExpect(status().isCreated())
+                .andExpect(MockMvcResultMatchers.content().contentType(MediaType.APPLICATION_JSON))
+                .andExpect(jsonPath("$.status").value("PENDING"));
+    }
+
+    @Test
+    @DisplayName("should approve mapping request successfully")
+    void approveMappingRequest_Success() throws Exception {
+        UUID requestId = UUID.randomUUID();
+        com.hithomelabs.CFTunnels.Entity.User approverUser = new com.hithomelabs.CFTunnels.Entity.User();
+        approverUser.setEmail("approver@example.com");
+        approverUser.setName("Approver");
+
+        com.hithomelabs.CFTunnels.Entity.Request approvedRequest = new com.hithomelabs.CFTunnels.Entity.Request();
+        approvedRequest.setId(requestId);
+        approvedRequest.setStatus(com.hithomelabs.CFTunnels.Entity.Request.RequestStatus.APPROVED);
+
+        when(mappingRequestService.approveRequest(eq(requestId), any(com.hithomelabs.CFTunnels.Entity.User.class)))
+                .thenReturn(approvedRequest);
+        when(userRepository.findByEmail("approver@example.com"))
+                .thenReturn(java.util.Optional.of(approverUser));
+
+        mockMvc.perform(put("/cloudflare/requests/{requestId}/approve", requestId)
+                        .with(oauth2Login().oauth2User(buildOidcUserWithEmail("approver", Groups.SYSTEM_ADMIN, "approver@example.com")))
+                        .with(csrf()))
+                .andExpect(status().isOk())
+                .andExpect(MockMvcResultMatchers.content().contentType(MediaType.APPLICATION_JSON))
+                .andExpect(jsonPath("$.status").value("APPROVED"));
+    }
+
+    @Test
+    @DisplayName("should return 404 when request not found")
+    void approveMappingRequest_NotFound() throws Exception {
+        UUID requestId = UUID.randomUUID();
+        com.hithomelabs.CFTunnels.Entity.User approverUser = new com.hithomelabs.CFTunnels.Entity.User();
+        approverUser.setEmail("approver@example.com");
+        approverUser.setName("Approver");
+
+        when(mappingRequestService.approveRequest(eq(requestId), any(com.hithomelabs.CFTunnels.Entity.User.class)))
+                .thenThrow(new NoSuchElementException("Request not found"));
+        when(userRepository.findByEmail("approver@example.com"))
+                .thenReturn(java.util.Optional.of(approverUser));
+
+        mockMvc.perform(put("/cloudflare/requests/{requestId}/approve", requestId)
+                        .with(oauth2Login().oauth2User(buildOidcUserWithEmail("approver", Groups.SYSTEM_ADMIN, "approver@example.com")))
+                        .with(csrf()))
+                .andExpect(status().isNotFound());
+    }
+
+    @Test
+    @DisplayName("should return 500 when mapping creation fails")
+    void approveMappingRequest_InternalServerError() throws Exception {
+        UUID requestId = UUID.randomUUID();
+        com.hithomelabs.CFTunnels.Entity.User approverUser = new com.hithomelabs.CFTunnels.Entity.User();
+        approverUser.setEmail("approver@example.com");
+        approverUser.setName("Approver");
+
+        when(mappingRequestService.approveRequest(eq(requestId), any(com.hithomelabs.CFTunnels.Entity.User.class)))
+                .thenThrow(new RuntimeException("Failed to add mapping to Cloudflare"));
+        when(userRepository.findByEmail("approver@example.com"))
+                .thenReturn(java.util.Optional.of(approverUser));
+
+        mockMvc.perform(put("/cloudflare/requests/{requestId}/approve", requestId)
+                        .with(oauth2Login().oauth2User(buildOidcUserWithEmail("approver", Groups.SYSTEM_ADMIN, "approver@example.com")))
+                        .with(csrf()))
+                .andExpect(status().isInternalServerError());
+    }
+
+    @Test
+    @DisplayName("should reject mapping request successfully")
+    void rejectMappingRequest_Success() throws Exception {
+        UUID requestId = UUID.randomUUID();
+        com.hithomelabs.CFTunnels.Entity.User rejecterUser = new com.hithomelabs.CFTunnels.Entity.User();
+        rejecterUser.setEmail("rejecter@example.com");
+        rejecterUser.setName("Rejecter");
+
+        com.hithomelabs.CFTunnels.Entity.Request rejectedRequest = new com.hithomelabs.CFTunnels.Entity.Request();
+        rejectedRequest.setId(requestId);
+        rejectedRequest.setStatus(com.hithomelabs.CFTunnels.Entity.Request.RequestStatus.REJECTED);
+
+        when(mappingRequestService.rejectRequest(eq(requestId), any(com.hithomelabs.CFTunnels.Entity.User.class)))
+                .thenReturn(rejectedRequest);
+        when(userRepository.findByEmail("rejecter@example.com"))
+                .thenReturn(java.util.Optional.of(rejecterUser));
+
+        mockMvc.perform(put("/cloudflare/requests/{requestId}/reject", requestId)
+                        .with(oauth2Login().oauth2User(buildOidcUserWithEmail("rejecter", Groups.SYSTEM_ADMIN, "rejecter@example.com")))
+                        .with(csrf()))
+                .andExpect(status().isOk())
+                .andExpect(MockMvcResultMatchers.content().contentType(MediaType.APPLICATION_JSON))
+                .andExpect(jsonPath("$.status").value("REJECTED"));
+    }
+
+    @Test
+    @DisplayName("should return 404 when rejecting non-existent request")
+    void rejectMappingRequest_NotFound() throws Exception {
+        UUID requestId = UUID.randomUUID();
+        com.hithomelabs.CFTunnels.Entity.User rejecterUser = new com.hithomelabs.CFTunnels.Entity.User();
+        rejecterUser.setEmail("rejecter@example.com");
+        rejecterUser.setName("Rejecter");
+
+        when(mappingRequestService.rejectRequest(eq(requestId), any(com.hithomelabs.CFTunnels.Entity.User.class)))
+                .thenThrow(new NoSuchElementException("Request not found"));
+        when(userRepository.findByEmail("rejecter@example.com"))
+                .thenReturn(java.util.Optional.of(rejecterUser));
+
+        mockMvc.perform(put("/cloudflare/requests/{requestId}/reject", requestId)
+                        .with(oauth2Login().oauth2User(buildOidcUserWithEmail("rejecter", Groups.SYSTEM_ADMIN, "rejecter@example.com")))
+                        .with(csrf()))
+                .andExpect(status().isNotFound());
+    }
+
+    @Test
+    @DisplayName("should return 409 when rejecting already processed request")
+    void rejectMappingRequest_Conflict() throws Exception {
+        UUID requestId = UUID.randomUUID();
+        com.hithomelabs.CFTunnels.Entity.User rejecterUser = new com.hithomelabs.CFTunnels.Entity.User();
+        rejecterUser.setEmail("rejecter@example.com");
+        rejecterUser.setName("Rejecter");
+
+        when(mappingRequestService.rejectRequest(eq(requestId), any(com.hithomelabs.CFTunnels.Entity.User.class)))
+                .thenThrow(new IllegalStateException("Request is not in PENDING status"));
+        when(userRepository.findByEmail("rejecter@example.com"))
+                .thenReturn(java.util.Optional.of(rejecterUser));
+
+        mockMvc.perform(put("/cloudflare/requests/{requestId}/reject", requestId)
+                        .with(oauth2Login().oauth2User(buildOidcUserWithEmail("rejecter", Groups.SYSTEM_ADMIN, "rejecter@example.com")))
+                        .with(csrf()))
+                .andExpect(status().isConflict());
+    }
+
     @Test
     void getTunnelConfigurations() throws Exception {