diff --git a/src/main/kotlin/com/stack/knowledge/global/health/HealthCheckWebAdapter.kt b/src/main/kotlin/com/stack/knowledge/global/health/HealthCheckWebAdapter.kt
index 836a3f49..9eec7ab6 100644
--- a/src/main/kotlin/com/stack/knowledge/global/health/HealthCheckWebAdapter.kt
+++ b/src/main/kotlin/com/stack/knowledge/global/health/HealthCheckWebAdapter.kt
@@ -6,6 +6,6 @@ import org.springframework.web.bind.annotation.RestController
 @RestController
 class HealthCheckWebAdapter {
 
-    @GetMapping
+    @GetMapping("/health")
     fun healthCheck() = "OK"
 }
\ No newline at end of file
diff --git a/src/main/kotlin/com/stack/knowledge/global/security/SecurityConfig.kt b/src/main/kotlin/com/stack/knowledge/global/security/SecurityConfig.kt
index 4fd961f4..d801da5d 100644
--- a/src/main/kotlin/com/stack/knowledge/global/security/SecurityConfig.kt
+++ b/src/main/kotlin/com/stack/knowledge/global/security/SecurityConfig.kt
@@ -52,20 +52,19 @@ class SecurityConfig(
             .antMatchers(HttpMethod.GET , "/item").hasRole(student)
 
             // user
-            .antMatchers(HttpMethod.GET, "/user/scoring/list/{page}").hasRole(teacher)
+            .antMatchers(HttpMethod.GET, "/user/scoring").hasRole(teacher)
             .antMatchers(HttpMethod.GET, "/user/scoring/{solve_id}").hasRole(teacher)
             .antMatchers(HttpMethod.POST, "/user/scoring/{solve_id}").hasRole(teacher)
 
             // student
             .antMatchers(HttpMethod.GET, "/student/ranking").authenticated()
             .antMatchers(HttpMethod.GET, "/student/my").hasRole(student)
-            .antMatchers(HttpMethod.POST, "/student/image").hasRole(student)
-            .antMatchers(HttpMethod.PATCH, "/student/image").hasRole(student)
+            .antMatchers(HttpMethod.POST, "/student/image").authenticated()
 
             // order
-            .antMatchers(HttpMethod.POST, "/order/{item_id}").hasRole(student)
+            .antMatchers(HttpMethod.POST, "/order").hasRole(student)
             .antMatchers(HttpMethod.GET, "/order").hasRole(teacher)
-            .antMatchers(HttpMethod.PATCH, "/order/{order_id}").hasRole(teacher)
+            .antMatchers(HttpMethod.PATCH, "/order").hasRole(teacher)
 
             // mission
             .antMatchers(HttpMethod.GET, "/mission").authenticated()