diff --git a/src/server.js b/src/server.js
index 5f47744af..b1b48ae71 100644
--- a/src/server.js
+++ b/src/server.js
@@ -113,16 +113,17 @@ async function initializeExpressSync() {
     router.post('/api/v1/dashboard/location',         json, token, authorizeAdmin, routes.dashboard.changeLocation);
 
     // system (vm/server)
-    router.get ('/api/v1/system/info',                           token, authorizeAdmin, routes.system.getInfo);
+    router.get ('/api/v1/system/info',                           token, authorizeAdmin, routes.system.getInfo); // vendor, product name etc
     router.post('/api/v1/system/reboot',                   json, token, authorizeAdmin, routes.system.reboot);
     router.get ('/api/v1/system/graphs',                         token, authorizeAdmin, routes.system.getSystemGraphs);
-    router.get ('/api/v1/system/cpus',                           token, authorizeAdmin, routes.system.getCpus);
     router.get ('/api/v1/system/disk_usage',                     token, authorizeAdmin, routes.system.getDiskUsage);
     router.post('/api/v1/system/disk_usage',                     token, authorizeAdmin, routes.system.updateDiskUsage);
     router.get ('/api/v1/system/block_devices',                  token, authorizeAdmin, routes.system.getBlockDevices);
-    router.get ('/api/v1/system/memory',                         token, authorizeAdmin, routes.system.getMemory);
     router.get ('/api/v1/system/logs/:unit',                     token, authorizeAdmin, routes.system.getLogs);
     router.get ('/api/v1/system/logstream/:unit',                token, authorizeAdmin, routes.system.getLogStream);
+    // app operators require cpu and memory info for the Resources UI
+    router.get ('/api/v1/system/cpus',                           token, authorizeUser, routes.system.getCpus);
+    router.get ('/api/v1/system/memory',                         token, authorizeUser, routes.system.getMemory);
 
     // eventlog
     router.get ('/api/v1/eventlog',                                token, authorizeAdmin, routes.eventlog.list);