diff --git a/app/api/tii/tii_group_attachment_api.rb b/app/api/tii/tii_group_attachment_api.rb
index ae73765e88..9b85c7d5f2 100644
--- a/app/api/tii/tii_group_attachment_api.rb
+++ b/app/api/tii/tii_group_attachment_api.rb
@@ -6,6 +6,10 @@ class TiiGroupAttachmentApi < Grape::API
     helpers AuthorisationHelpers
     include LogHelper
 
+    before do
+      authenticated?
+    end
+
     desc 'Get the group attachments for a given task definition'
     get '/units/:unit_id/task_definitions/:task_def_id/tii_group_attachments' do
       unit = Unit.find(params[:unit_id])
diff --git a/test/api/tii/tii_group_attachment_api_test.rb b/test/api/tii/tii_group_attachment_api_test.rb
index b716db1a7e..8f207d0bf7 100644
--- a/test/api/tii/tii_group_attachment_api_test.rb
+++ b/test/api/tii/tii_group_attachment_api_test.rb
@@ -34,6 +34,26 @@ def app
     )
   end
 
+  def test_group_attachments_require_authentication
+    clear_auth_header
+    path = "/api/units/#{@unit.id}/task_definitions/#{@task_def.id}/tii_group_attachments"
+    attachment = @task_def.tii_group_attachments.first
+
+    get path
+    assert_equal 419, last_response.status, last_response_body
+
+    put_json "#{path}/#{attachment.id}", { action: 'upload' }
+    assert_equal 419, last_response.status, last_response_body
+
+    delete "#{path}/#{attachment.id}"
+    assert_equal 419, last_response.status, last_response_body
+    assert TiiGroupAttachment.exists?(attachment.id)
+
+    add_auth_header_for(user: @unit.main_convenor_user, auth_token: 'invalid')
+    get path
+    assert_equal 419, last_response.status, last_response_body
+  end
+
   def test_only_main_convenor_can_access_group_attachments_for_task_definition
     tutor = FactoryBot.create(:user, :tutor)
     @unit.employ_staff tutor, Role.tutor