diff --git a/src/backend/core/http/middleware/fullAccessToken.http.test.ts b/src/backend/core/http/middleware/fullAccessToken.http.test.ts
index 1da434440..8fac75352 100644
--- a/src/backend/core/http/middleware/fullAccessToken.http.test.ts
+++ b/src/backend/core/http/middleware/fullAccessToken.http.test.ts
@@ -101,6 +101,8 @@ describe('full-access token route admissions', () => {
         ['POST', '/auth/get-user-app-token', { origin: 'https://probe.test' }],
         ['POST', '/auth/grant-user-app', { app_uid: 'app-x', permission: 'p' }],
         ['POST', '/open_item', { path: '~/' }],
+        // Only `requireAuth` on the route; the refusal is AuthService's.
+        ['POST', '/auth/create-access-token', { permissions: ['fs:read'] }],
     ];
 
     it.each(REFUSED)(