diff --git a/api/tests/Feature.CitizenReports.Comments.UnitTests/Endpoints/DeleteEndpointTests.cs b/api/tests/Feature.CitizenReports.Comments.UnitTests/Endpoints/DeleteEndpointTests.cs
index e33640321..e3860c2c0 100644
--- a/api/tests/Feature.CitizenReports.Comments.UnitTests/Endpoints/DeleteEndpointTests.cs
+++ b/api/tests/Feature.CitizenReports.Comments.UnitTests/Endpoints/DeleteEndpointTests.cs
@@ -1,23 +1,54 @@
+using System.Security.Claims;
 using Feature.CitizenReports.Comments.Delete;
 using Feature.CitizenReports.Comments.Specifications;
+using Microsoft.AspNetCore.Authorization;
 using Vote.Monitor.Domain.Entities.CitizenReportCommentAggregate;
 
 namespace Feature.CitizenReports.Comments.UnitTests.Endpoints;
 
 public class DeleteEndpointTests
 {
+    private readonly IAuthorizationService _authorizationService;
     private readonly IRepository<CitizenReportComment> _repository;
     private readonly Endpoint _endpoint;
 
     public DeleteEndpointTests()
     {
+        _authorizationService = Substitute.For<IAuthorizationService>();
         _repository = Substitute.For<IRepository<CitizenReportComment>>();
-        _endpoint = Factory.Create<Endpoint>(_repository);
+        _endpoint = Factory.Create<Endpoint>(_authorizationService, _repository);
+    }
+
+    [Fact]
+    public async Task ShouldReturnNotFound_WhenNotAuthorized()
+    {
+        _authorizationService.AuthorizeAsync(Arg.Any<ClaimsPrincipal>(), Arg.Any<object?>(),
+                Arg.Any<IEnumerable<IAuthorizationRequirement>>())
+            .Returns(AuthorizationResult.Failed());
+
+        var result = await _endpoint.ExecuteAsync(new Request
+        {
+            ElectionRoundId = Guid.NewGuid(),
+            CitizenReportId = Guid.NewGuid(),
+            Id = Guid.NewGuid(),
+            UserId = Guid.NewGuid()
+        }, CancellationToken.None);
+
+        result
+            .Should().BeOfType<Results<NoContent, NotFound>>()
+            .Which
+            .Result.Should().BeOfType<NotFound>();
+
+        await _repository.DidNotReceive().DeleteAsync(Arg.Any<CitizenReportComment>());
     }
 
     [Fact]
     public async Task ShouldReturnNotFound_WhenCommentDoesNotExist()
     {
+        _authorizationService.AuthorizeAsync(Arg.Any<ClaimsPrincipal>(), Arg.Any<object?>(),
+                Arg.Any<IEnumerable<IAuthorizationRequirement>>())
+            .Returns(AuthorizationResult.Success());
+
         _repository.FirstOrDefaultAsync(Arg.Any<GetCommentByIdSpecification>())
             .ReturnsNull();
 
@@ -43,6 +74,10 @@ public async Task ShouldDeleteComment_WhenUserIsTheAuthor()
         var userId = Guid.NewGuid();
         var fakeComment = new CitizenReportCommentFaker(authorId: userId).Generate();
 
+        _authorizationService.AuthorizeAsync(Arg.Any<ClaimsPrincipal>(), Arg.Any<object?>(),
+                Arg.Any<IEnumerable<IAuthorizationRequirement>>())
+            .Returns(AuthorizationResult.Success());
+
         _repository.FirstOrDefaultAsync(Arg.Any<GetCommentByIdSpecification>())
             .Returns(fakeComment);
 
diff --git a/api/tests/Feature.CitizenReports.Comments.UnitTests/Endpoints/UpdateEndpointTests.cs b/api/tests/Feature.CitizenReports.Comments.UnitTests/Endpoints/UpdateEndpointTests.cs
index 5f5a9278d..1e33ed2f6 100644
--- a/api/tests/Feature.CitizenReports.Comments.UnitTests/Endpoints/UpdateEndpointTests.cs
+++ b/api/tests/Feature.CitizenReports.Comments.UnitTests/Endpoints/UpdateEndpointTests.cs
@@ -1,23 +1,55 @@
+using System.Security.Claims;
 using Feature.CitizenReports.Comments.Specifications;
 using Feature.CitizenReports.Comments.Update;
+using Microsoft.AspNetCore.Authorization;
 using Vote.Monitor.Domain.Entities.CitizenReportCommentAggregate;
 
 namespace Feature.CitizenReports.Comments.UnitTests.Endpoints;
 
 public class UpdateEndpointTests
 {
+    private readonly IAuthorizationService _authorizationService;
     private readonly IRepository<CitizenReportComment> _repository;
     private readonly Endpoint _endpoint;
 
     public UpdateEndpointTests()
     {
+        _authorizationService = Substitute.For<IAuthorizationService>();
         _repository = Substitute.For<IRepository<CitizenReportComment>>();
-        _endpoint = Factory.Create<Endpoint>(_repository);
+        _endpoint = Factory.Create<Endpoint>(_authorizationService, _repository);
+    }
+
+    [Fact]
+    public async Task ShouldReturnNotFound_WhenNotAuthorized()
+    {
+        _authorizationService.AuthorizeAsync(Arg.Any<ClaimsPrincipal>(), Arg.Any<object?>(),
+                Arg.Any<IEnumerable<IAuthorizationRequirement>>())
+            .Returns(AuthorizationResult.Failed());
+
+        var result = await _endpoint.ExecuteAsync(new Request
+        {
+            ElectionRoundId = Guid.NewGuid(),
+            CitizenReportId = Guid.NewGuid(),
+            Id = Guid.NewGuid(),
+            UserId = Guid.NewGuid(),
+            Text = "updated"
+        }, CancellationToken.None);
+
+        result
+            .Should().BeOfType<Results<Ok<CitizenReportCommentModel>, NotFound>>()
+            .Which
+            .Result.Should().BeOfType<NotFound>();
+
+        await _repository.DidNotReceive().UpdateAsync(Arg.Any<CitizenReportComment>());
     }
 
     [Fact]
     public async Task ShouldReturnNotFound_WhenCommentDoesNotExist()
     {
+        _authorizationService.AuthorizeAsync(Arg.Any<ClaimsPrincipal>(), Arg.Any<object?>(),
+                Arg.Any<IEnumerable<IAuthorizationRequirement>>())
+            .Returns(AuthorizationResult.Success());
+
         _repository.FirstOrDefaultAsync(Arg.Any<GetCommentByIdSpecification>())
             .ReturnsNull();
 
@@ -44,6 +76,10 @@ public async Task ShouldUpdateComment_WhenUserIsTheAuthor()
         var userId = Guid.NewGuid();
         var fakeComment = new CitizenReportCommentFaker(authorId: userId).Generate();
 
+        _authorizationService.AuthorizeAsync(Arg.Any<ClaimsPrincipal>(), Arg.Any<object?>(),
+                Arg.Any<IEnumerable<IAuthorizationRequirement>>())
+            .Returns(AuthorizationResult.Success());
+
         _repository.FirstOrDefaultAsync(Arg.Any<GetCommentByIdSpecification>())
             .Returns(fakeComment);