diff --git a/workflow/engine/src/ProcessMaker/Services/Api/Role.php b/workflow/engine/src/ProcessMaker/Services/Api/Role.php
index c8b08cb1e..d5fecc8b2 100644
--- a/workflow/engine/src/ProcessMaker/Services/Api/Role.php
+++ b/workflow/engine/src/ProcessMaker/Services/Api/Role.php
@@ -43,6 +43,8 @@ class Role extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url GET
      */
     public function index($filter = null, $start = null, $limit = null)
@@ -57,6 +59,8 @@ class Role extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url GET /:rol_uid
      *
      * @param string $rol_uid {@min 32}{@max 32}
@@ -73,6 +77,8 @@ class Role extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url POST
      *
      * @param array $request_data
@@ -93,6 +99,8 @@ class Role extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url PUT /:rol_uid
      *
      * @param string $rol_uid      {@min 32}{@max 32}
@@ -108,6 +116,8 @@ class Role extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url DELETE /:rol_uid
      *
      * @param string $rol_uid {@min 32}{@max 32}
diff --git a/workflow/engine/src/ProcessMaker/Services/Api/Role/User.php b/workflow/engine/src/ProcessMaker/Services/Api/Role/User.php
index 6dd793819..eb5ba4fad 100644
--- a/workflow/engine/src/ProcessMaker/Services/Api/Role/User.php
+++ b/workflow/engine/src/ProcessMaker/Services/Api/Role/User.php
@@ -30,6 +30,8 @@ class User extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url GET /:rol_uid/users
      * @url GET /:rol_uid/available-users
      *
@@ -51,6 +53,8 @@ class User extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url POST /:rol_uid/user
      *
      * @param string $rol_uid      {@min 32}{@max 32}
@@ -68,6 +72,8 @@ class User extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url DELETE /:rol_uid/user/:usr_uid
      *
      * @param string $rol_uid {@min 32}{@max 32}
diff --git a/workflow/engine/src/ProcessMaker/Services/Api/User.php b/workflow/engine/src/ProcessMaker/Services/Api/User.php
index 64699f333..614f36fe5 100644
--- a/workflow/engine/src/ProcessMaker/Services/Api/User.php
+++ b/workflow/engine/src/ProcessMaker/Services/Api/User.php
@@ -37,6 +37,8 @@ class User extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url GET
      */
     public function index($filter = null, $lfilter = null, $rfilter = null, $start = null, $limit = null)
@@ -59,6 +61,8 @@ class User extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url GET /:usr_uid
      *
      * @param string $usr_uid {@min 32}{@max 32}
@@ -78,6 +82,8 @@ class User extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url POST
      *
      * @param array $request_data
@@ -97,6 +103,8 @@ class User extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url PUT /:usr_uid
      *
      * @param string $usr_uid      {@min 32}{@max 32}
@@ -114,6 +122,8 @@ class User extends Api
     }
 
     /**
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url DELETE /:usr_uid
      *
      * @param string $usr_uid {@min 32}{@max 32}
@@ -131,6 +141,8 @@ class User extends Api
     /**
      * @param string $usr_uid {@min 32} {@max 32}
      *
+     * @access protected
+     * @class  AccessControl {@permission PM_USERS}
      * @url POST /:usr_uid/image-upload
      */
     public function doPostUserImageUpload($usr_uid)