diff --git a/src/api2/config/remote.rs b/src/api2/config/remote.rs
index 444ca348..86f09445 100644
--- a/src/api2/config/remote.rs
+++ b/src/api2/config/remote.rs
@@ -1,10 +1,11 @@
 use failure::*;
 use serde_json::Value;
 
-use proxmox::api::{api, ApiMethod, Router, RpcEnvironment};
+use proxmox::api::{api, ApiMethod, Router, RpcEnvironment, Permission};
 
 use crate::api2::types::*;
 use crate::config::remote;
+use crate::config::acl::{PRIV_SYS_AUDIT, PRIV_SYS_MODIFY};
 
 #[api(
     input: {
@@ -37,6 +38,9 @@ use crate::config::remote;
             },
         },
     },
+    access: {
+        permission: &Permission::Privilege(&[], PRIV_SYS_AUDIT, false),
+    },
 )]
 /// List all remotes
 pub fn list_remotes(
@@ -78,6 +82,9 @@ pub fn list_remotes(
             },
         },
     },
+    access: {
+        permission: &Permission::Privilege(&[], PRIV_SYS_MODIFY, false),
+    },
 )]
 /// Create new remote.
 pub fn create_remote(name: String, param: Value) -> Result<(), Error> {
@@ -111,6 +118,9 @@ pub fn create_remote(name: String, param: Value) -> Result<(), Error> {
         description: "The remote configuration (with config digest).",
         type: remote::Remote,
     },
+    access: {
+        permission: &Permission::Privilege(&[], PRIV_SYS_AUDIT, false),
+    }
 )]
 /// Read remote configuration data.
 pub fn read_remote(name: String) -> Result<Value, Error> {
@@ -154,6 +164,9 @@ pub fn read_remote(name: String) -> Result<Value, Error> {
             },
         },
     },
+    access: {
+        permission: &Permission::Privilege(&[], PRIV_SYS_MODIFY, false),
+    },
 )]
 /// Update remote configuration.
 pub fn update_remote(
@@ -208,6 +221,9 @@ pub fn update_remote(
             },
         },
     },
+    access: {
+        permission: &Permission::Privilege(&[], PRIV_SYS_MODIFY, false),
+    },
 )]
 /// Remove a remote from the configuration file.
 pub fn delete_remote(name: String) -> Result<(), Error> {