diff --git a/api/client-server/filter.yaml b/api/client-server/filter.yaml
index 1f932e2c1..cfd559208 100644
--- a/api/client-server/filter.yaml
+++ b/api/client-server/filter.yaml
@@ -98,6 +98,8 @@ paths:
   "/user/{userId}/filter/{filterId}":
     get:
       summary: Download a filter
+      security:
+        - accessToken: []
       parameters:
         - in: path
           name: userId
diff --git a/changelogs/client_server.rst b/changelogs/client_server.rst
index 7fe0b0309..ec4a09b23 100644
--- a/changelogs/client_server.rst
+++ b/changelogs/client_server.rst
@@ -75,6 +75,8 @@
   - Make ``m.notice`` description a bit harder in its phrasing to try to
     dissuade the same issues that occurred with IRC
     (`#750 <https://github.com/matrix-org/matrix-doc/pull/750>`_).
+  - ``GET /user/{userId}/filter/{filterId}`` requires authentication
+    (`#1003 <https://github.com/matrix-org/matrix-doc/pull/1003>`_).
 
 r0.2.0
 ======