diff --git a/src/routes/api.js b/src/routes/api.js
index 3bcfca342e..c0c69db4ef 100644
--- a/src/routes/api.js
+++ b/src/routes/api.js
@@ -19,9 +19,9 @@ module.exports = function (app, middleware, controllers) {
 	router.get('/user/uid/:userslug/export/uploads', middleware.checkAccountPermissions, middleware.exposeUid, controllers.user.exportUploads);
 	router.get('/user/uid/:userslug/export/profile', middleware.checkAccountPermissions, middleware.exposeUid, controllers.user.exportProfile);
 
-	router.get('/:type/pid/:id', controllers.api.getObject);
-	router.get('/:type/tid/:id', controllers.api.getObject);
-	router.get('/:type/cid/:id', controllers.api.getObject);
+	router.get('/:type/pid/:id', middleware.authenticate, controllers.api.getObject);
+	router.get('/:type/tid/:id', middleware.authenticate, controllers.api.getObject);
+	router.get('/:type/cid/:id', middleware.authenticate, controllers.api.getObject);
 
 	router.get('/categories/:cid/moderators', controllers.api.getModerators);
 	router.get('/recent/posts/:term?', controllers.posts.getRecentPosts);