diff --git a/src/main/java/au/com/royalpay/payment/manage/dev/web/TestController.java b/src/main/java/au/com/royalpay/payment/manage/dev/web/TestController.java
index 490359c5a..4801d9230 100644
--- a/src/main/java/au/com/royalpay/payment/manage/dev/web/TestController.java
+++ b/src/main/java/au/com/royalpay/payment/manage/dev/web/TestController.java
@@ -545,7 +545,7 @@ public class TestController implements ApplicationEventPublisherAware {
                 });
     }
 
-    @GetMapping("/reports/ato_reports/royalpay_ato_report_{year}.bttps")
+    @ManagerMapping(value = "/reports/ato_reports/royalpay_ato_report_{year}.bttps", role = ManagerRole.DEVELOPER, method = RequestMethod.GET)
     @ReadOnlyConnection
     public void downloadATOReport(@PathVariable String year, HttpServletResponse resp) throws IOException {
         DateTime from = DateTime.parse(year + "-07-01");