diff --git a/backend/src/main/java/com/alttd/altitudeweb/controllers/event/EventController.java b/backend/src/main/java/com/alttd/altitudeweb/controllers/event/EventController.java
index e91dd1a..6b4057c 100644
--- a/backend/src/main/java/com/alttd/altitudeweb/controllers/event/EventController.java
+++ b/backend/src/main/java/com/alttd/altitudeweb/controllers/event/EventController.java
@@ -42,7 +42,7 @@ public class EventController {
         }
 
         List<String> authorities = jwt.getClaimAsStringList("authorities");
-        if (authorities == null || !authorities.contains(PermissionClaimDto.HEAD_MOD.getValue())) {
+        if (authorities == null || doesNotHavePermission(authorities)) {
             throw new ResponseStatusException(HttpStatus.FORBIDDEN);
         }
 
@@ -64,4 +64,8 @@ public class EventController {
 
         return eventPublisher.subscribe(new EventUser(subject, authorities), json);
     }
+
+    private static boolean doesNotHavePermission(List<String> authorities) {
+        return !authorities.contains(PermissionClaimDto.HEAD_MOD.getValue()) && !authorities.contains(PermissionClaimDto.MOD.getValue());
+    }
 }
diff --git a/open_api/src/main/resources/schemas/permissions/permissions.yml b/open_api/src/main/resources/schemas/permissions/permissions.yml
index 16466f8..01ad80b 100644
--- a/open_api/src/main/resources/schemas/permissions/permissions.yml
+++ b/open_api/src/main/resources/schemas/permissions/permissions.yml
@@ -2,7 +2,7 @@ components:
   schemas:
     PermissionClaim:
       type: string
-      enum: [ SCOPE_user, SCOPE_head_mod ]
+      enum: [ SCOPE_user, SCOPE_head_mod, SCOPE_mod ]
       description: Permission claims used for authorization
-      x-enum-varnames: [ USER, HEAD_MOD ]
+      x-enum-varnames: [ USER, HEAD_MOD, MOD ]
       x-enum-descriptions: [ "User permission", "Head moderator permission" ]