diff --git a/app/controllers/api/product_categories_controller.rb b/app/controllers/api/product_categories_controller.rb
index 87a0949e3..82eefe555 100644
--- a/app/controllers/api/product_categories_controller.rb
+++ b/app/controllers/api/product_categories_controller.rb
@@ -4,7 +4,7 @@
 # ProductCategorys are used to group products
 class API::ProductCategoriesController < API::ApiController
   before_action :authenticate_user!, except: :index
-  before_action :set_product_category, only: %i[show update destroy]
+  before_action :set_product_category, only: %i[show update destroy position]
 
   def index
     @product_categories = ProductCategoryService.list
@@ -32,6 +32,16 @@ class API::ProductCategoriesController < API::ApiController
     end
   end
 
+  def position
+    authorize @product_category
+
+    if @product_category.insert_at(params[:position])
+      render :show
+    else
+      render json: @product_category.errors.full_messages, status: :unprocessable_entity
+    end
+  end
+
   def destroy
     authorize @product_category
     ProductCategoryService.destroy(@product_category)
@@ -45,6 +55,6 @@ class API::ProductCategoriesController < API::ApiController
   end
 
   def product_category_params
-    params.require(:product_category).permit(:name, :parent_id, :slug, :position)
+    params.require(:product_category).permit(:name, :parent_id, :slug)
   end
 end
diff --git a/app/frontend/src/javascript/api/product-category.ts b/app/frontend/src/javascript/api/product-category.ts
index 964ef4e8f..2870e35a6 100644
--- a/app/frontend/src/javascript/api/product-category.ts
+++ b/app/frontend/src/javascript/api/product-category.ts
@@ -27,4 +27,9 @@ export default class ProductCategoryAPI {
     const res: AxiosResponse<void> = await apiClient.delete(`/api/product_categories/${productCategoryId}`);
     return res?.data;
   }
+
+  static async updatePosition (productCategory: ProductCategory, position: number): Promise<ProductCategory> {
+    const res: AxiosResponse<ProductCategory> = await apiClient.patch(`/api/product_categories/${productCategory.id}/position`, { position });
+    return res?.data;
+  }
 }
diff --git a/app/policies/product_category_policy.rb b/app/policies/product_category_policy.rb
index 776560827..484d88297 100644
--- a/app/policies/product_category_policy.rb
+++ b/app/policies/product_category_policy.rb
@@ -13,4 +13,8 @@ class ProductCategoryPolicy < ApplicationPolicy
   def destroy?
     user.admin?
   end
+
+  def position?
+    user.admin?
+  end
 end
diff --git a/config/routes.rb b/config/routes.rb
index ce86bef55..6abcf4dca 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -150,7 +150,9 @@ Rails.application.routes.draw do
 
     resources :profile_custom_fields
 
-    resources :product_categories
+    resources :product_categories do
+      patch 'position', on: :member
+    end
 
     # for admin
     resources :trainings do