diff --git a/src/Tgstation.Server.Client/ApiClient.cs b/src/Tgstation.Server.Client/ApiClient.cs
index 176253e06d..032d6b9b52 100644
--- a/src/Tgstation.Server.Client/ApiClient.cs
+++ b/src/Tgstation.Server.Client/ApiClient.cs
@@ -106,10 +106,16 @@ namespace Tgstation.Server.Client
 				}
 				catch (JsonException) { }
 
+				const string BadSpecExtension = " This is not part of TGS4 communication specification and should be reported if it was returned from a TGS4 server!";
+
 				switch (response.StatusCode)
 				{
 					case HttpStatusCode.UpgradeRequired:
-						throw new ApiMismatchException(errorMessage);
+						throw new ApiMismatchException(errorMessage ?? new ErrorMessage
+						{
+							Message = "API Mismatch but no current API version provided!" + BadSpecExtension,
+							SeverApiVersion = null
+						});
 					case HttpStatusCode.Unauthorized:
 						throw new UnauthorizedException();
 					case HttpStatusCode.RequestTimeout:
@@ -119,9 +125,25 @@ namespace Tgstation.Server.Client
 					case HttpStatusCode.ServiceUnavailable:
 						throw new ServiceUnavailableException();
 					case HttpStatusCode.Gone:
-					case HttpStatusCode.NotFound:
+						errorMessage = errorMessage ?? new ErrorMessage
+						{
+							Message = "The requested resource could not be found!",
+							SeverApiVersion = null
+						};
+						goto case HttpStatusCode.Conflict;
+					case HttpStatusCode.NotFound:	//our fault somehow
+						errorMessage = errorMessage ?? new ErrorMessage
+						{
+							Message = "This is not a valid route!" + BadSpecExtension,
+							SeverApiVersion = null
+						};
+						goto case HttpStatusCode.Conflict;
 					case HttpStatusCode.Conflict:
-						throw new ConflictException(errorMessage, response.StatusCode);
+						throw new ConflictException(errorMessage ?? new ErrorMessage
+						{
+							Message = "An undescribed conflict occurred!" + BadSpecExtension,
+							SeverApiVersion = null
+						}, response.StatusCode);
 					case HttpStatusCode.NotImplemented:
 					case (HttpStatusCode)422:   //unprocessable entity
 						throw new MethodNotSupportedException();
diff --git a/src/Tgstation.Server.Client/InstanceManagerClient.cs b/src/Tgstation.Server.Client/InstanceManagerClient.cs
index 974017ffdb..63b78d47af 100644
--- a/src/Tgstation.Server.Client/InstanceManagerClient.cs
+++ b/src/Tgstation.Server.Client/InstanceManagerClient.cs
@@ -43,7 +43,8 @@ namespace Tgstation.Server.Client
 		/// <inheritdoc />
 		public Task<Instance> Update(Instance instance, CancellationToken cancellationToken) => apiClient.Update<Instance, Instance>(Routes.InstanceManager, instance, cancellationToken);
 
-		public Task<Instance> GetId(Instance instance, CancellationToken cancellationToken) => apiClient.Read<Instance>(Routes.InstanceManager, instance.Id, cancellationToken);
+		/// <inheritdoc />
+		public Task<Instance> GetId(Instance instance, CancellationToken cancellationToken) => apiClient.Read<Instance>(Routes.SetID(Routes.InstanceManager, instance.Id), cancellationToken);
 
 		/// <inheritdoc />
 		public IInstanceClient CreateClient(Instance instance)
diff --git a/src/Tgstation.Server.Client/Tgstation.Server.Client.csproj b/src/Tgstation.Server.Client/Tgstation.Server.Client.csproj
index 546c1d416b..40ffb4c446 100644
--- a/src/Tgstation.Server.Client/Tgstation.Server.Client.csproj
+++ b/src/Tgstation.Server.Client/Tgstation.Server.Client.csproj
@@ -3,7 +3,7 @@
   <PropertyGroup>
     <TargetFramework>netstandard2.0</TargetFramework>
     <DebugType>Full</DebugType>
-    <Version>4.0.0.0-preview7</Version>
+    <Version>4.0.0.0-preview8</Version>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <Authors>Cyberboss</Authors>
     <Company>/tg/station 13</Company>
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceController.cs b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
index fb07995f22..30f111dede 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
@@ -348,7 +348,7 @@ namespace Tgstation.Server.Host.Controllers
 		}
 
 		/// <inheritdoc />
-		[TgsAuthorize]
+		[TgsAuthorize(InstanceManagerRights.List | InstanceManagerRights.Read)]
 		public override async Task<IActionResult> List(CancellationToken cancellationToken)
 		{
 			IQueryable<Models.Instance> query = DatabaseContext.Instances;
@@ -359,12 +359,24 @@ namespace Tgstation.Server.Host.Controllers
 		}
 
 		/// <inheritdoc />
-		[TgsAuthorize]
-		public override Task<IActionResult> Read(CancellationToken cancellationToken)
+		[TgsAuthorize(InstanceManagerRights.List | InstanceManagerRights.Read)]
+		public override async Task<IActionResult> GetId(long id, CancellationToken cancellationToken)
 		{
-			if (Instance == null)
-				return Task.FromResult<IActionResult>(BadRequest(new ErrorMessage { Message = "No instance specified" }));
-			return Task.FromResult<IActionResult>(Json(Instance.ToApi()));
+			var query = DatabaseContext.Instances.Where(x => x.Id == id);
+			var cantList = !AuthenticationContext.User.InstanceManagerRights.Value.HasFlag(InstanceManagerRights.List);
+
+			if (cantList)
+				query = query.Include(x => x.InstanceUsers);
+
+			var instance = await query.FirstOrDefaultAsync(cancellationToken).ConfigureAwait(false);
+
+			if (instance == null)
+				return StatusCode((int)HttpStatusCode.Gone);
+
+			if (cantList && !instance.InstanceUsers.Any(x => x.UserId == AuthenticationContext.User.Id && x.AnyRights))
+				return Forbid();
+
+			return Json(instance.ToApi());
 		}
 	}
 }