diff --git a/include/http_utility.hpp b/include/http_utility.hpp
index e2b1a11..b20952b 100644
--- a/include/http_utility.hpp
+++ b/include/http_utility.hpp
@@ -1,6 +1,8 @@
 #pragma once
 #include <boost/algorithm/string.hpp>
 
+#include "crow/http_request.h"
+
 namespace http_helpers
 {
 inline bool requestPrefersHtml(const crow::Request& req)
diff --git a/include/openbmc_dbus_rest.hpp b/include/openbmc_dbus_rest.hpp
index ab35bb2..9f7a855 100644
--- a/include/openbmc_dbus_rest.hpp
+++ b/include/openbmc_dbus_rest.hpp
@@ -1982,6 +1982,7 @@
 template <typename... Middlewares> void requestRoutes(Crow<Middlewares...> &app)
 {
     BMCWEB_ROUTE(app, "/bus/")
+        .requires({"Login"})
         .methods("GET"_method)(
             [](const crow::Request &req, crow::Response &res) {
                 res.jsonValue = {{"busses", {{{"name", "system"}}}},
@@ -1990,6 +1991,7 @@
             });
 
     BMCWEB_ROUTE(app, "/bus/system/")
+        .requires({"Login"})
         .methods("GET"_method)(
             [](const crow::Request &req, crow::Response &res) {
                 auto myCallback = [&res](const boost::system::error_code ec,
@@ -2018,13 +2020,23 @@
             });
 
     BMCWEB_ROUTE(app, "/list/")
+        .requires({"Login"})
         .methods("GET"_method)(
             [](const crow::Request &req, crow::Response &res) {
                 handleList(res, "/");
             });
 
     BMCWEB_ROUTE(app, "/xyz/<path>")
-        .methods("GET"_method, "PUT"_method, "POST"_method, "DELETE"_method)(
+        .requires({"Login"})
+        .methods("GET"_method)([](const crow::Request &req, crow::Response &res,
+                                  const std::string &path) {
+            std::string objectPath = "/xyz/" + path;
+            handleDBusUrl(req, res, objectPath);
+        });
+
+    BMCWEB_ROUTE(app, "/xyz/<path>")
+        .requires({"ConfigureComponents", "ConfigureManager"})
+        .methods("PUT"_method, "POST"_method, "DELETE"_method)(
             [](const crow::Request &req, crow::Response &res,
                const std::string &path) {
                 std::string objectPath = "/xyz/" + path;
@@ -2032,14 +2044,24 @@
             });
 
     BMCWEB_ROUTE(app, "/org/<path>")
-        .methods("GET"_method, "PUT"_method, "POST"_method, "DELETE"_method)(
+        .requires({"Login"})
+        .methods("GET"_method)([](const crow::Request &req, crow::Response &res,
+                                  const std::string &path) {
+            std::string objectPath = "/xyz/" + path;
+            handleDBusUrl(req, res, objectPath);
+        });
+
+    BMCWEB_ROUTE(app, "/org/<path>")
+        .requires({"ConfigureComponents", "ConfigureManager"})
+        .methods("PUT"_method, "POST"_method, "DELETE"_method)(
             [](const crow::Request &req, crow::Response &res,
                const std::string &path) {
-                std::string objectPath = "/org/" + path;
+                std::string objectPath = "/xyz/" + path;
                 handleDBusUrl(req, res, objectPath);
             });
 
     BMCWEB_ROUTE(app, "/download/dump/<str>/")
+        .requires({"ConfigureManager"})
         .methods("GET"_method)([](const crow::Request &req, crow::Response &res,
                                   const std::string &dumpId) {
             std::regex validFilename("^[\\w\\- ]+(\\.?[\\w\\- ]*)$");
@@ -2083,6 +2105,7 @@
         });
 
     BMCWEB_ROUTE(app, "/bus/system/<str>/")
+        .requires({"Login"})
         .methods("GET"_method)([](const crow::Request &req, crow::Response &res,
                                   const std::string &Connection) {
             introspectObjects(Connection, "/",