diff --git a/routes/api.php b/routes/api.php
index e3f8bddc..6a311eb5 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -43,8 +43,6 @@
     Route::name('user.servers_abilities')
         ->get('/user/servers_abilities', [ServersController::class, 'allServersAbilities']);
 
-    Route::name('game_mods.get_mods_list')->get('game_mods/get_list_for_game/{game}', [GameModsController::class, 'getListForGame']);
-
     Route::middleware('isAdmin')->group(function () {
         // Dedicated servers
         Route::name('dedicated_servers')
@@ -113,6 +111,7 @@
         Route::name('games.destroy')->delete('/games/{game}', [GamesController::class, 'destroy']);
 
         Route::name('game_mods')->get('/game_mods', [GameModsController::class, 'index']);
+        Route::name('game_mods.get_mods_list')->get('game_mods/get_list_for_game/{game}', [GameModsController::class, 'getListForGame']);
         Route::name('game_mods.store')->post('/game_mods', [GameModsController::class, 'store']);
         Route::name('game_mods.show')->get('/game_mods/{game_mod}', [GameModsController::class, 'show']);
         Route::name('game_mods.update')->put('/game_mods/{game_mod}', [GameModsController::class, 'update']);
diff --git a/tests/Feature/Permissions/Controllers/API/DedicatedServersControllerTest.php b/tests/Feature/Permissions/Controllers/API/DedicatedServersControllerTest.php
index 4d4ffaa2..bc9dbeca 100644
--- a/tests/Feature/Permissions/Controllers/API/DedicatedServersControllerTest.php
+++ b/tests/Feature/Permissions/Controllers/API/DedicatedServersControllerTest.php
@@ -2,13 +2,8 @@
 
 namespace Tests\Feature\Permissions\Controllers\API;
 
-use Gameap\Models\User;
-use Gameap\Repositories\UserRepository;
 use Illuminate\Http\Response;
-use Silber\Bouncer\Bouncer;
 use Tests\Feature\Permissions\PermissionsTestCase;
-use Tests\TestCase;
-
 
 class DedicatedServersControllerTest extends PermissionsTestCase
 {
@@ -24,11 +19,11 @@ public function routesDataProvider()
             ['get', 'api.dedicated_servers.summary'],
             ['get', 'api.dedicated_servers.setup'],
             ['get', 'api.dedicated_servers.certificates'],
-            ['get', 'api.dedicated_servers.logs'],
-            ['get', 'api.dedicated_servers.get'],
-            ['get', 'api.dedicated_servers.daemon'],
-            ['get', 'api.dedicated_servers.ip_list'],
-            ['get', 'api.dedicated_servers.busy_ports'],
+            ['get', 'api.dedicated_servers.logs', 1],
+            ['get', 'api.dedicated_servers.get', 1],
+            ['get', 'api.dedicated_servers.daemon', 1],
+            ['get', 'api.dedicated_servers.ip_list', 1],
+            ['get', 'api.dedicated_servers.busy_ports', 1],
             ['post', 'api.dedicated_servers.store'],
             ['put', 'api.dedicated_servers.update', 1],
             ['delete', 'api.dedicated_servers.destroy', 1],
diff --git a/tests/Feature/Permissions/Controllers/API/GameModsControllerTest.php b/tests/Feature/Permissions/Controllers/API/GameModsControllerTest.php
new file mode 100644
index 00000000..7dcb9205
--- /dev/null
+++ b/tests/Feature/Permissions/Controllers/API/GameModsControllerTest.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace Tests\Feature\Permissions\Controllers\API;
+
+use Illuminate\Http\Response;
+use Tests\Feature\Permissions\PermissionsTestCase;
+
+class GameModsControllerTest extends PermissionsTestCase
+{
+    public function setUp(): void
+    {
+        parent::setUp();
+    }
+
+    public function routesDataProvider()
+    {
+        return [
+            ['get', 'api.game_mods'],
+            ['get', 'api.game_mods.get_mods_list'],
+            ['post', 'api.game_mods.store'],
+            ['get', 'api.game_mods.show', 1],
+            ['put', 'api.game_mods.update', 1],
+            ['delete', 'api.game_mods.destroy', 1],
+        ];
+    }
+
+    /**
+     * @dataProvider routesDataProvider
+     */
+    public function testForbidden($method, $route, $param = null, $data = [])
+    {
+        $this->setCurrentUserRoles(['user']);
+
+        $response = $this->{$method}(route($route, $param), $data);
+        $response->assertStatus(Response::HTTP_FORBIDDEN);
+    }
+}
\ No newline at end of file
diff --git a/tests/Feature/Permissions/Controllers/API/GamesControllerTest.php b/tests/Feature/Permissions/Controllers/API/GamesControllerTest.php
new file mode 100644
index 00000000..8eb0605f
--- /dev/null
+++ b/tests/Feature/Permissions/Controllers/API/GamesControllerTest.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace Tests\Feature\Permissions\Controllers\API;
+
+use Illuminate\Http\Response;
+use Tests\Feature\Permissions\PermissionsTestCase;
+
+class GamesControllerTest extends PermissionsTestCase
+{
+    public function setUp(): void
+    {
+        parent::setUp();
+    }
+
+    public function routesDataProvider()
+    {
+        return [
+            ['get', 'api.games'],
+            ['post', 'api.games.store'],
+            ['get', 'api.games.show', 1],
+            ['put', 'api.games.update', 1],
+            ['post', 'api.games.upgrade'],
+            ['get', 'api.games.mods', 1],
+            ['delete', 'api.games.destroy', 1],
+        ];
+    }
+
+    /**
+     * @dataProvider routesDataProvider
+     */
+    public function testForbidden($method, $route, $param = null, $data = [])
+    {
+        $this->setCurrentUserRoles(['user']);
+
+        $response = $this->{$method}(route($route, $param), $data);
+        $response->assertStatus(Response::HTTP_FORBIDDEN);
+    }
+}
\ No newline at end of file