Index: modules/uoa-openaire-connector/branches/newClaimAPI/src/main/java/eu/dnetlib/openaire/rest/HelloWorldService.java
===================================================================
--- modules/uoa-openaire-connector/branches/newClaimAPI/src/main/java/eu/dnetlib/openaire/rest/HelloWorldService.java	(revision 46886)
+++ modules/uoa-openaire-connector/branches/newClaimAPI/src/main/java/eu/dnetlib/openaire/rest/HelloWorldService.java	(revision 46887)
@@ -7,6 +7,7 @@
 import eu.dnetlib.data.claims.migration.entity.Claim;
 import eu.dnetlib.data.claims.migration.handler.ClaimHandler;
 import eu.dnetlib.data.claims.migration.handler.FetchClaimHandler;
+import eu.dnetlib.openaire.rest.authorization.Authorization;
 import eu.dnetlib.openaire.rest.security.JWTValidator;
 import gr.uoa.di.driver.util.ServiceLocator;
 import org.apache.commons.validator.EmailValidator;
@@ -154,6 +155,7 @@
                 listTypes.add(types_array[i]);
             }
         }
+
         try {
             claims = fetchClaimHandler.fetchClaimsByResult(resultId, limit, offset,keyword, orderby, descending, listTypes);
             total = fetchClaimHandler.countClaimsByResult(resultId,keyword, listTypes);
@@ -276,29 +278,35 @@
                     .build();
         }
 
-        List<Claim> claims = null;
-        List<String> listTypes = new ArrayList<String>();
-        String [] types_array = types.split(",");
-        for(int i = 0; i< types_array.length; i++){
-            if(types_array[i].length()>0) {
-                listTypes.add(types_array[i]);
+        if(Authorization.isAdmin(token)) {
+
+            List<Claim> claims = null;
+            List<String> listTypes = new ArrayList<String>();
+            String[] types_array = types.split(",");
+            for (int i = 0; i < types_array.length; i++) {
+                if (types_array[i].length() > 0) {
+                    listTypes.add(types_array[i]);
+                }
             }
-        }
-        logger.debug("Types: "+ listTypes.toString());
+            logger.debug("Types: " + listTypes.toString());
 
-        int total = -1;
-        try {
-            claims = fetchClaimHandler.fetchAllClaims(limit, offset,keyword,orderby,descending,listTypes);
-            total = fetchClaimHandler.countAllClaims(keyword, listTypes);
+            int total = -1;
+            try {
+                claims = fetchClaimHandler.fetchAllClaims(limit, offset, keyword, orderby, descending, listTypes);
+                total = fetchClaimHandler.countAllClaims(keyword, listTypes);
 
-            return Response.status(200).entity(composeDataResponse(request, claims, total, offset, limit)).build();
+                return Response.status(200).entity(composeDataResponse(request, claims, total, offset, limit)).build();
 
-        } catch (Exception e) {
-            logger.error("Could not fetch claims.", e);
-            return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(compose500Message("Fail to fetch claims.", e))
-                    .type(MediaType.APPLICATION_JSON).build();
+            } catch (Exception e) {
+                logger.error("Could not fetch claims.", e);
+                return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(compose500Message("Fail to fetch claims.", e))
+                        .type(MediaType.APPLICATION_JSON).build();
+            }
         }
-
+        else
+            return Response.status(Response.Status.FORBIDDEN).entity(compose403Message("Forbidden: You don't have permission to access"))
+                    .type(MediaType.APPLICATION_JSON)
+                    .build();
     }
 
 
@@ -345,7 +353,9 @@
                         .header("Access-Control-Allow-Methods", "DELETE").type(MediaType.APPLICATION_JSON).build();
             }
 
-        } catch (Exception e) {
+        } catch (Exception e) {return Response.status(Response.Status.UNAUTHORIZED).entity(compose404Message("Not valid Token"))
+                    .type(MediaType.APPLICATION_JSON)
+                    .build();
             logger.error("Fail to delete claim with id " + claimId + ".", e);
             return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(compose500Message("Fail to delete claim with id " + claimId +".", e))
                     .header("Access-Control-Allow-Origin", "*")
@@ -616,6 +626,11 @@
                 "\"description\" : \""+  exception.getMessage() +"\" }";
     }
 
+    private String compose403Message(String message) {
+        return  "{ \"status\" : \"error\", \"code\" : \"400\", \"message\" : \"  " + message +"\", " +
+                "\"description\" : \" }";
+    }
+
     private String compose404BulkDeleteMessage(String message, ArrayList<String> deletedIds, ArrayList<String> notFoundIds) {
         return  "{ \"status\" : \"error\", \"code\" : \"404\", \"message\" : \"  " + message +" \""+  "\"deletedIds\" : " + new Gson().toJson(deletedIds) +","+  "\"notFoundIds\" : " + new Gson().toJson(notFoundIds) + " }";
     }
