diff --git a/src/Tgstation.Server.Client/InstanceManagerClient.cs b/src/Tgstation.Server.Client/InstanceManagerClient.cs
index 974017ffdb..63b78d47af 100644
--- a/src/Tgstation.Server.Client/InstanceManagerClient.cs
+++ b/src/Tgstation.Server.Client/InstanceManagerClient.cs
@@ -43,7 +43,8 @@ namespace Tgstation.Server.Client
 		/// <inheritdoc />
 		public Task<Instance> Update(Instance instance, CancellationToken cancellationToken) => apiClient.Update<Instance, Instance>(Routes.InstanceManager, instance, cancellationToken);
 
-		public Task<Instance> GetId(Instance instance, CancellationToken cancellationToken) => apiClient.Read<Instance>(Routes.InstanceManager, instance.Id, cancellationToken);
+		/// <inheritdoc />
+		public Task<Instance> GetId(Instance instance, CancellationToken cancellationToken) => apiClient.Read<Instance>(Routes.SetID(Routes.InstanceManager, instance.Id), cancellationToken);
 
 		/// <inheritdoc />
 		public IInstanceClient CreateClient(Instance instance)
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceController.cs b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
index fb07995f22..30f111dede 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
@@ -348,7 +348,7 @@ namespace Tgstation.Server.Host.Controllers
 		}
 
 		/// <inheritdoc />
-		[TgsAuthorize]
+		[TgsAuthorize(InstanceManagerRights.List | InstanceManagerRights.Read)]
 		public override async Task<IActionResult> List(CancellationToken cancellationToken)
 		{
 			IQueryable<Models.Instance> query = DatabaseContext.Instances;
@@ -359,12 +359,24 @@ namespace Tgstation.Server.Host.Controllers
 		}
 
 		/// <inheritdoc />
-		[TgsAuthorize]
-		public override Task<IActionResult> Read(CancellationToken cancellationToken)
+		[TgsAuthorize(InstanceManagerRights.List | InstanceManagerRights.Read)]
+		public override async Task<IActionResult> GetId(long id, CancellationToken cancellationToken)
 		{
-			if (Instance == null)
-				return Task.FromResult<IActionResult>(BadRequest(new ErrorMessage { Message = "No instance specified" }));
-			return Task.FromResult<IActionResult>(Json(Instance.ToApi()));
+			var query = DatabaseContext.Instances.Where(x => x.Id == id);
+			var cantList = !AuthenticationContext.User.InstanceManagerRights.Value.HasFlag(InstanceManagerRights.List);
+
+			if (cantList)
+				query = query.Include(x => x.InstanceUsers);
+
+			var instance = await query.FirstOrDefaultAsync(cancellationToken).ConfigureAwait(false);
+
+			if (instance == null)
+				return StatusCode((int)HttpStatusCode.Gone);
+
+			if (cantList && !instance.InstanceUsers.Any(x => x.UserId == AuthenticationContext.User.Id && x.AnyRights))
+				return Forbid();
+
+			return Json(instance.ToApi());
 		}
 	}
 }