diff --git a/src/routes/rfids.js b/src/routes/rfids.js
index 0fda6cbb..2cc55102 100644
--- a/src/routes/rfids.js
+++ b/src/routes/rfids.js
@@ -1,4 +1,5 @@
 import * as RfidsController from '../controllers/rfids-controller.js';
+import tokensMiddleware, { TIPOS_USUARIOS } from '../middlewares/tokens-middleware';
 
 /**
  * @swagger
@@ -7,6 +8,7 @@ import * as RfidsController from '../controllers/rfids-controller.js';
  *     description: Operações de integração com RFID
  */
 export default app => {
+    const somenteCurador = tokensMiddleware([TIPOS_USUARIOS.CURADOR]);
 
     /**
      * @swagger
@@ -25,17 +27,21 @@ export default app => {
      *                 type: integer
      *             required:
      *               - tombo_foto_id
-     *             example:
-     *               tombo_foto_id: 15
+     *           example:
+     *             tombo_foto_id: 15
      *     responses:
      *       '201':
      *         description: Registro criado com status PENDENTE e EPC gerado.
+     *       '401':
+     *         $ref: '#/components/responses/Unauthorized'
+     *       '403':
+     *         $ref: '#/components/responses/Forbidden'
      *       '404':
      *         $ref: '#/components/responses/NotFound'
      *       '500':
      *         $ref: '#/components/responses/InternalServerError'
      */
-    app.route('/rfids/iniciar-gravacao').post(RfidsController.iniciarGravacao);
+    app.route('/rfids/iniciar-gravacao').post(somenteCurador, RfidsController.iniciarGravacao);
 
     /**
      * @swagger
@@ -62,18 +68,22 @@ export default app => {
      *                 enum: [CONCLUIDO, FALHA]
      *               tid:
      *                 type: string
-     *             example:
-     *               status: "CONCLUIDO"
-     *               tid: "E200001B4413"
+     *           example:
+     *             status: CONCLUIDO
+     *             tid: E200001B4413
      *     responses:
      *       '200':
      *         description: RFID atualizado com sucesso.
+     *       '401':
+     *         $ref: '#/components/responses/Unauthorized'
+     *       '403':
+     *         $ref: '#/components/responses/Forbidden'
      *       '404':
      *         $ref: '#/components/responses/NotFound'
      *       '500':
      *         $ref: '#/components/responses/InternalServerError'
      */
-    app.route('/rfids/finalizar-gravacao/:id').put(RfidsController.finalizarGravacao);
+    app.route('/rfids/finalizar-gravacao/:id').put(somenteCurador, RfidsController.finalizarGravacao);
 
     /**
      * @swagger
@@ -95,13 +105,57 @@ export default app => {
      *     responses:
      *       '200':
      *         description: Lista retornada com sucesso
+     *       '401':
+     *         $ref: '#/components/responses/Unauthorized'
+     *       '403':
+     *         $ref: '#/components/responses/Forbidden'
      *       '500':
      *         $ref: '#/components/responses/InternalServerError'
      */
-    app.route('/rfids').get(RfidsController.listagem);
+    app.route('/rfids').get(somenteCurador, RfidsController.listagem);
 
-    app.route('/rfids/tombos-pendentes').get(RfidsController.listarPendentesRfid);
-
-    app.route('/rfids/validar-tid/:tid').get(RfidsController.validarTid);
+    /**
+     * @swagger
+     * /rfids/tombos-pendentes:
+     *   get:
+     *     summary: Lista tombos pendentes de gravação RFID
+     *     tags: [RFIDs]
+     *     responses:
+     *       '200':
+     *         description: Lista paginada de tombos/fotos pendentes.
+     *       '401':
+     *         $ref: '#/components/responses/Unauthorized'
+     *       '403':
+     *         $ref: '#/components/responses/Forbidden'
+     *       '500':
+     *         $ref: '#/components/responses/InternalServerError'
+     */
+    app.route('/rfids/tombos-pendentes').get(somenteCurador, RfidsController.listarPendentesRfid);
 
+    /**
+     * @swagger
+     * /rfids/validar-tid/{tid}:
+     *   get:
+     *     summary: Valida uma tag RFID pelo TID
+     *     tags: [RFIDs]
+     *     parameters:
+     *       - in: path
+     *         name: tid
+     *         required: true
+     *         schema:
+     *           type: string
+     *         description: TID lido da tag física
+     *     responses:
+     *       '200':
+     *         description: TID validado com sucesso.
+     *       '401':
+     *         $ref: '#/components/responses/Unauthorized'
+     *       '403':
+     *         $ref: '#/components/responses/Forbidden'
+     *       '404':
+     *         $ref: '#/components/responses/NotFound'
+     *       '500':
+     *         $ref: '#/components/responses/InternalServerError'
+     */
+    app.route('/rfids/validar-tid/:tid').get(somenteCurador, RfidsController.validarTid);
 };