/rooms/{roomId}/members: specify access_token requirement

as the behaviour of which members the users see is user-specific
and therefore requires authentication.

Signed-off-by: Florian Jacob <projects+git AT florianjacob )DOT( de>

api/client-server/rooms.yaml

@@ -288,6 +288,8 @@ paths:
           description: The room to get the member events for.
           required: true
           x-example: "!636q39766251:example.com"
+      security:
+        - accessToken: []
       responses:
         200:
           description: |-

changelogs/client_server.rst

@@ -35,6 +35,8 @@ Unreleased changes
     (`#1139 <https://github.com/matrix-org/matrix-doc/pull/1139>`_).
   - Clarify that ``/account/whoami`` should consider application services
     (`#1152 <https://github.com/matrix-org/matrix-doc/pull/1152>`_).
+  - Mark ``GET /rooms/{roomId}/members`` as requiring authentication
+    (`#1245 <https://github.com/matrix-org/matrix-doc/pull/1244>`_).
 
 - Changes to the API which will be backwards-compatible for clients: