diff --git a/reviewboard/webapi/tests/mixins.py b/reviewboard/webapi/tests/mixins.py
index 0d3d6e2f26de74ac2748c4150ee985720ddd4635..b0e1af7a356c01ca8cdf864e4fdcf87f2255a2fc 100644
--- a/reviewboard/webapi/tests/mixins.py
+++ b/reviewboard/webapi/tests/mixins.py
@@ -114,8 +114,9 @@ class BasicTestsMetaclass(type):
 
             bases = mixins + bases
 
-        if 'POST' in test_http_methods and (is_list or is_singleton):
-            if 'POST' not in resource.allowed_methods:
+        if 'POST' in test_http_methods:
+            if (not (is_list or is_singleton) or
+                'POST' not in resource.allowed_methods):
                 mixins = (BasicPostNotAllowedTestsMixin,)
             elif test_local_sites:
                 mixins = (BasicPostTestsWithLocalSiteMixin,)
@@ -132,8 +133,8 @@ class BasicTestsMetaclass(type):
 
             bases = mixins + bases
 
-        if 'PUT' in test_http_methods and not is_list:
-            if 'PUT' not in resource.allowed_methods:
+        if 'PUT' in test_http_methods:
+            if is_list or 'PUT' not in resource.allowed_methods:
                 mixins = (BasicPutNotAllowedTestsMixin,)
             elif test_local_sites:
                 mixins = (BasicPutTestsWithLocalSiteMixin,)
diff --git a/reviewboard/webapi/tests/test_api_token.py b/reviewboard/webapi/tests/test_api_token.py
index 0954efb48b32d9908834bf2e9be44042169e490f..7705169c24ed32f03d906dd6ef2c208357d7d6c8 100644
--- a/reviewboard/webapi/tests/test_api_token.py
+++ b/reviewboard/webapi/tests/test_api_token.py
@@ -72,6 +72,9 @@ class ResourceListTests(SpyAgency, ExtraDataListMixin, BaseWebAPITestCase,
 
     compare_item = _compare_item
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_api_token_list_url(user)
+
     #
     # HTTP GET tests
     #
@@ -275,6 +278,11 @@ class ResourceItemTests(ExtraDataItemMixin, BaseWebAPITestCase,
 
     compare_item = _compare_item
 
+    def setup_http_not_allowed_list_test(self, user):
+        token = self.create_webapi_token(user)
+
+        return get_api_token_item_url(token)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_default_reviewer.py b/reviewboard/webapi/tests/test_default_reviewer.py
index cf526d09a7232b41a2e8c43edb74e521761ef224..e1c85fce74cac1fd40eb5cc8ae4801d8cb55cec8 100644
--- a/reviewboard/webapi/tests/test_default_reviewer.py
+++ b/reviewboard/webapi/tests/test_default_reviewer.py
@@ -475,6 +475,12 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
 
         self.assertEqual(len(item_rsp['repositories']), len(repos))
 
+    def setup_http_not_allowed_list_test(self, user):
+        default_reviewer = DefaultReviewer.objects.create(
+            name='default1', file_regex='.*')
+
+        return get_default_reviewer_item_url(default_reviewer.pk)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_diff.py b/reviewboard/webapi/tests/test_diff.py
index 488c7d1d70ede14cc086d015a113b42edd2ede04..0861c09e92afbfee8998f6e4230580613c9a4887 100644
--- a/reviewboard/webapi/tests/test_diff.py
+++ b/reviewboard/webapi/tests/test_diff.py
@@ -31,6 +31,14 @@ class ResourceListTests(ExtraDataListMixin, ReviewRequestChildListMixin,
     def setup_review_request_child_test(self, review_request):
         return get_diff_list_url(review_request), diff_list_mimetype
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            submitter=user,
+            publish=True)
+
+        return get_diff_list_url(review_request)
+
     def compare_item(self, item_rsp, diffset):
         self.assertEqual(item_rsp['id'], diffset.pk)
         self.assertEqual(item_rsp['name'], diffset.name)
@@ -362,6 +370,14 @@ class ResourceItemTests(ExtraDataItemMixin, ReviewRequestChildItemMixin,
                                                     publish=True)
         return get_diff_item_url(review_request, 1)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            submitter=user)
+        diffset = self.create_diffset(review_request)
+
+        return get_diff_item_url(review_request, diffset.revision)
+
     def compare_item(self, item_rsp, diffset):
         self.assertEqual(item_rsp['id'], diffset.pk)
         self.assertEqual(item_rsp['name'], diffset.name)
diff --git a/reviewboard/webapi/tests/test_diff_file_attachment.py b/reviewboard/webapi/tests/test_diff_file_attachment.py
index d2fe4b6d168c63383ba14c58586cc6aa8990e3a3..7918c8dc68c9ecfb99caeedbede047fd6668373b 100644
--- a/reviewboard/webapi/tests/test_diff_file_attachment.py
+++ b/reviewboard/webapi/tests/test_diff_file_attachment.py
@@ -22,6 +22,11 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(item_rsp['caption'], attachment.caption)
         self.assertEqual(item_rsp['mimetype'], attachment.mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        repository = self.create_repository()
+
+        return get_diff_file_attachment_list_url(repository)
+
     def setup_http_not_allowed_list_test(self, user):
         repository = self.create_repository()
 
@@ -176,6 +181,15 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
 
         return get_diff_file_attachment_item_url(repository, attachment)
 
+    def setup_http_not_allowed_list_test(self, user):
+        repository = self.create_repository(public=False)
+        repository.users.add(self.user)
+        diffset = self.create_diffset(repository=repository)
+        filediff = self.create_filediff(diffset)
+        attachment = self.create_diff_file_attachment(filediff)
+
+        return get_diff_file_attachment_item_url(attachment, repository)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_diffcommit.py b/reviewboard/webapi/tests/test_diffcommit.py
index f37b7e73ce52ce3f036eff6a9de5f775a93b3b5a..19047cc2c53583d4e9b8598057a1f2559ef04c66 100644
--- a/reviewboard/webapi/tests/test_diffcommit.py
+++ b/reviewboard/webapi/tests/test_diffcommit.py
@@ -54,6 +54,16 @@ class ResourceListTests(ReviewRequestChildListMixin, BaseWebAPITestCase,
 
     compare_item = compare_diffcommit
 
+    def setup_http_not_allowed_item_test(self, user):
+        repository = self.create_repository(tool_name='Git')
+        review_request = self.create_review_request(
+            repository=repository,
+            create_with_history=True,
+            public=True)
+
+        diffset = self.create_diffset(review_request=review_request)
+        return get_diffcommit_list_url(review_request, diffset.revision)
+
     def setup_http_not_allowed_list_test(self, user):
         repository = self.create_repository(tool_name='Git')
         review_request = self.create_review_request(
@@ -136,6 +146,19 @@ class ResourceItemTests(ExtraDataItemMixin, ReviewRequestChildItemMixin,
         return get_diffcommit_item_url(review_request, diffset.revision,
                                        commit.commit_id)
 
+    def setup_http_not_allowed_list_test(self, user):
+        repository = self.create_repository(tool_name='Git')
+        review_request = self.create_review_request(
+            repository=repository,
+            submitter=user)
+        diffset = self.create_diffset(review_request)
+        commit = self.create_diffcommit(diffset=diffset,
+                                        repository=repository)
+
+        return get_diffcommit_item_url(review_request,
+                                       diffset.revision,
+                                       commit.commit_id)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_draft_diff.py b/reviewboard/webapi/tests/test_draft_diff.py
index 526f3d0c0deb20c5bcb97edb6066cb025e742bf7..50c990cab566ea8346c6cef1821d140e534f1e9a 100644
--- a/reviewboard/webapi/tests/test_draft_diff.py
+++ b/reviewboard/webapi/tests/test_draft_diff.py
@@ -39,6 +39,14 @@ class ResourceListTests(ExtraDataListMixin, BaseWebAPITestCase,
         self.assertEqual(item_rsp['base_commit_id'], diffset.base_commit_id)
         self.assertEqual(item_rsp['extra_data'], diffset.extra_data)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            submitter=user,
+            publish=True)
+
+        return get_draft_diff_list_url(review_request)
+
     #
     # HTTP GET tests
     #
@@ -280,6 +288,11 @@ class ResourceItemTests(kgb.SpyAgency, ExtraDataItemMixin, BaseWebAPITestCase,
                                                     publish=True)
         return get_draft_diff_item_url(review_request, 1)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(create_repository=True,
+                                                    publish=True)
+        return get_draft_diff_item_url(review_request, 1)
+
     def compare_item(self, item_rsp, diffset):
         self.assertEqual(item_rsp['id'], diffset.pk)
         self.assertEqual(item_rsp['name'], diffset.name)
diff --git a/reviewboard/webapi/tests/test_draft_diffcommit.py b/reviewboard/webapi/tests/test_draft_diffcommit.py
index 6341e6008d971a43f4dddcd53c376a2ffeb19126..76255810831d8da3cdd1a285da3dfa5dead96a9f 100644
--- a/reviewboard/webapi/tests/test_draft_diffcommit.py
+++ b/reviewboard/webapi/tests/test_draft_diffcommit.py
@@ -54,6 +54,13 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         'parent_id': 'r0',
     }
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            public=True)
+        diffset = self.create_diffset(review_request=review_request)
+        return get_draft_diffcommit_list_url(review_request, diffset.revision)
+
     def setup_http_not_allowed_list_test(self, user):
         review_request = self.create_review_request(
             create_repository=True,
@@ -492,6 +499,18 @@ class ResourceItemTests(ExtraDataItemMixin, BaseWebAPITestCase,
                                              diffset.revision,
                                              commit.commit_id)
 
+    def setup_http_not_allowed_list_test(self, user):
+        repository = self.create_repository(tool_name='Git')
+        review_request = self.create_review_request(repository=repository,
+                                                    submitter=user)
+        diffset = self.create_diffset(review_request, draft=True)
+        commit = self.create_diffcommit(repository=repository,
+                                        diffset=diffset)
+
+        return get_draft_diffcommit_item_url(review_request,
+                                             diffset.revision,
+                                             commit.commit_id)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_draft_filediff.py b/reviewboard/webapi/tests/test_draft_filediff.py
index 7b64326cb10e9f9d9c217af6dbdbeee5fe79653a..cacdd215380b15970c34d0888482638741b63d7a 100644
--- a/reviewboard/webapi/tests/test_draft_filediff.py
+++ b/reviewboard/webapi/tests/test_draft_filediff.py
@@ -30,6 +30,14 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(item_rsp['source_file'], filediff.source_file)
         self.assertEqual(item_rsp['extra_data'], filediff.extra_data)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            submitter=user)
+        diffset = self.create_diffset(review_request, draft=True)
+
+        return get_draft_filediff_list_url(diffset, review_request)
+
     def setup_http_not_allowed_list_test(self, user):
         review_request = self.create_review_request(
             create_repository=True,
diff --git a/reviewboard/webapi/tests/test_file_attachment.py b/reviewboard/webapi/tests/test_file_attachment.py
index 4c84392a713adf7a5f2ae2060a170d83364856d4..2348d2e4397a6d53d307faac382ce30dd839af3e 100644
--- a/reviewboard/webapi/tests/test_file_attachment.py
+++ b/reviewboard/webapi/tests/test_file_attachment.py
@@ -38,6 +38,13 @@ class ResourceListTests(ReviewRequestChildListMixin,
         return (get_file_attachment_list_url(review_request),
                 file_attachment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+
+        return get_file_attachment_list_url(review_request)
+
     def compare_item(self, item_rsp, attachment):
         self.assertEqual(item_rsp['id'], attachment.pk)
         self.assertEqual(item_rsp['extra_data'], attachment.extra_data)
@@ -237,6 +244,13 @@ class ResourceItemTests(ReviewRequestChildItemMixin,
         self.assertEqual(item_rsp['absolute_url'],
                          attachment.get_absolute_url())
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user)
+        file_attachment = self.create_file_attachment(review_request)
+
+        return get_file_attachment_item_url(file_attachment)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_file_attachment_comment.py b/reviewboard/webapi/tests/test_file_attachment_comment.py
index dead4376dbf10748d68eaed72c84aab4967d9398..b393dac0a6710209f8615e4fc661eaa1187c6722 100644
--- a/reviewboard/webapi/tests/test_file_attachment_comment.py
+++ b/reviewboard/webapi/tests/test_file_attachment_comment.py
@@ -25,6 +25,13 @@ class ResourceListTests(ReviewRequestChildListMixin, BaseWebAPITestCase,
         return (get_file_attachment_comment_list_url(file_attachment),
                 file_attachment_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(submitter=user,
+                                                    publish=True)
+        file_attachment = self.create_file_attachment(review_request)
+
+        return get_file_attachment_comment_list_url(file_attachment)
+
     def setup_http_not_allowed_list_test(self, user):
         review_request = self.create_review_request(submitter=user,
                                                     publish=True)
diff --git a/reviewboard/webapi/tests/test_file_attachment_draft.py b/reviewboard/webapi/tests/test_file_attachment_draft.py
index f9dddc6b62e716b19b33d4880d95bd53174c8338..54a119dd63b0efc3ffc783badccf858bda3326be 100644
--- a/reviewboard/webapi/tests/test_file_attachment_draft.py
+++ b/reviewboard/webapi/tests/test_file_attachment_draft.py
@@ -31,6 +31,12 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(item_rsp['id'], attachment.pk)
         self.assertEqual(item_rsp['filename'], attachment.filename)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user)
+
+        return get_draft_file_attachment_list_url(review_request)
+
     #
     # HTTP GET tests
     #
@@ -161,6 +167,15 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(item_rsp['id'], attachment.pk)
         self.assertEqual(item_rsp['filename'], attachment.filename)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user)
+        file_attachment = self.create_file_attachment(review_request,
+                                                      draft=True)
+
+        return get_draft_file_attachment_item_url(review_request,
+                                                  file_attachment.pk)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_file_diff_comment.py b/reviewboard/webapi/tests/test_file_diff_comment.py
index ae1a2ca8cf4045de072d4e67f996f91d44827cb2..b9f6a8ca3b032ce9d909a4dcb6585756b40b3e4e 100644
--- a/reviewboard/webapi/tests/test_file_diff_comment.py
+++ b/reviewboard/webapi/tests/test_file_diff_comment.py
@@ -27,6 +27,15 @@ class ResourceListTests(ReviewRequestChildListMixin, BaseWebAPITestCase,
         return (get_filediff_comment_list_url(filediff),
                 filediff_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(create_repository=True,
+                                                    submitter=user,
+                                                    publish=True)
+        diffset = self.create_diffset(review_request)
+        filediff = self.create_filediff(diffset)
+
+        return get_filediff_comment_list_url(filediff)
+
     def setup_http_not_allowed_list_test(self, user):
         review_request = self.create_review_request(create_repository=True,
                                                     submitter=user,
diff --git a/reviewboard/webapi/tests/test_hosting_service.py b/reviewboard/webapi/tests/test_hosting_service.py
index dd8cf860ab5347f5aeed129cbdb67a61c0e36ed8..3f6d48eae13587a0dfeca94470c03806ed9b6773 100644
--- a/reviewboard/webapi/tests/test_hosting_service.py
+++ b/reviewboard/webapi/tests/test_hosting_service.py
@@ -75,6 +75,9 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
 
     compare_item = _compare_item
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_hosting_service_list_url()
+
     def setup_http_not_allowed_list_test(self, user):
         return get_hosting_service_list_url()
 
@@ -103,6 +106,12 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
 
         return get_hosting_service_item_url(hosting_service)
 
+    def setup_http_not_allowed_list_test(self, user):
+        hosting_service = \
+            hosting_service_registry.get_hosting_service('github')
+
+        return get_hosting_service_item_url(hosting_service)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_hosting_service_account.py b/reviewboard/webapi/tests/test_hosting_service_account.py
index 22ed938ad26c5eef35661ae80fabee437afd971f..2f3627338b50bd70f3cbcbbe9d8ecae70d7f7619 100644
--- a/reviewboard/webapi/tests/test_hosting_service_account.py
+++ b/reviewboard/webapi/tests/test_hosting_service_account.py
@@ -26,6 +26,9 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
 
     compare_item = _compare_item
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_hosting_service_account_list_url()
+
     def setup_http_not_allowed_list_test(self, user):
         return get_hosting_service_account_list_url()
 
@@ -129,6 +132,13 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
 
         return get_hosting_service_account_item_url(account.pk)
 
+    def setup_http_not_allowed_list_test(self, user):
+        account = HostingServiceAccount.objects.create(
+            service_name='googlecode',
+            username='bob')
+
+        return get_hosting_service_account_item_url(account.pk)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_oauth_app.py b/reviewboard/webapi/tests/test_oauth_app.py
index 0e9dd42ab0c1cddffe2319335170a20f8ec055ca..2cf2a57bd32847e4e05a8e486ca9b91363366635 100644
--- a/reviewboard/webapi/tests/test_oauth_app.py
+++ b/reviewboard/webapi/tests/test_oauth_app.py
@@ -50,6 +50,9 @@ class ResourceListTests(ExtraDataListMixin, BaseWebAPITestCase,
 
     compare_item = _compare_item
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_oauth_app_list_url()
+
     #
     # HTTP GET tests
     #
@@ -581,6 +584,11 @@ class ResourceItemTests(ExtraDataItemMixin, BaseWebAPITestCase,
 
     compare_item = _compare_item
 
+    def setup_http_not_allowed_list_test(self, user):
+        app = self.create_oauth_application(user)
+
+        return get_oauth_app_item_url(app.pk)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_oauth_token.py b/reviewboard/webapi/tests/test_oauth_token.py
index c5c766bbb330862bfce19c321bb643c7dde5fb26..875060b393108a3f5fb564fe852c03f9316d8cd0 100644
--- a/reviewboard/webapi/tests/test_oauth_token.py
+++ b/reviewboard/webapi/tests/test_oauth_token.py
@@ -36,6 +36,9 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
 
     compare_item = _compare_item
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_oauth_token_list_url()
+
     def setup_http_not_allowed_list_test(self, user):
         return get_oauth_token_list_url()
 
@@ -108,6 +111,9 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
     def setup_http_not_allowed_item_test(self, user):
         return get_oauth_token_item_url(1)
 
+    def setup_http_not_allowed_list_test(self, user):
+        return get_oauth_token_item_url(1)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_remote_repository.py b/reviewboard/webapi/tests/test_remote_repository.py
index 3b0536fc58c92f51d8208b1e7fd58e9b6a27db6f..f057aa80be4125d36a82260221f6c47192dd3e74 100644
--- a/reviewboard/webapi/tests/test_remote_repository.py
+++ b/reviewboard/webapi/tests/test_remote_repository.py
@@ -48,6 +48,12 @@ class ResourceListTests(SpyAgency, BaseWebAPITestCase,
 
     compare_item = _compare_item
 
+    def setup_http_not_allowed_item_test(self, user):
+        account = HostingServiceAccount.objects.create(service_name='github',
+                                                       username='bob')
+
+        return get_remote_repository_list_url(account)
+
     def setup_http_not_allowed_list_test(self, user):
         account = HostingServiceAccount.objects.create(service_name='github',
                                                        username='bob')
@@ -124,6 +130,20 @@ class ResourceItemTests(SpyAgency, BaseWebAPITestCase,
 
         return get_remote_repository_item_url(remote_repository)
 
+    def setup_http_not_allowed_list_test(self, user):
+        account = HostingServiceAccount.objects.create(service_name='github',
+                                                       username='bob')
+
+        remote_repository = RemoteRepository(
+            account.service,
+            repository_id='123',
+            name='repo1',
+            owner='bob',
+            scm_type='Git',
+            path='ssh://example.com/repo1')
+
+        return get_remote_repository_item_url(remote_repository)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_repository.py b/reviewboard/webapi/tests/test_repository.py
index 17b98dceb9ea8485e0e25409c14b368e6716a7b8..d31cf7ab2d4036822c4e4ce3e3b8c3e447e1b785 100644
--- a/reviewboard/webapi/tests/test_repository.py
+++ b/reviewboard/webapi/tests/test_repository.py
@@ -125,6 +125,9 @@ class ResourceListTests(ExtraDataListMixin, BaseRepositoryTests,
 
     compare_item = BaseRepositoryTests.compare_item
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_repository_list_url()
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_repository_group.py b/reviewboard/webapi/tests/test_repository_group.py
index 024bb0fe1e0a8cc47b1949b8069b6142f8e7076b..21923f2f39cd192e8e791ccf6324f7aa41442ab5 100644
--- a/reviewboard/webapi/tests/test_repository_group.py
+++ b/reviewboard/webapi/tests/test_repository_group.py
@@ -47,6 +47,11 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(item_rsp['name'], group.name)
         self.assertEqual(item_rsp['display_name'], group.display_name)
 
+    def setup_http_not_allowed_item_test(self, user):
+        repository = self.create_repository()
+
+        return get_repository_group_list_url(repository)
+
     #
     # HTTP GET tests
     #
@@ -264,7 +269,27 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
             The URL to fetch for the test.
         """
         repository = self.create_repository()
-        return get_repository_group_list_url(repository)
+        group = self.create_review_group(invite_only=True)
+        repository.review_groups.add(group)
+
+        return get_repository_group_item_url(repository, group.name)
+
+    def setup_http_not_allowed_list_test(self, user):
+        """Set up the HTTP not allowed test.
+
+        Args:
+            user (django.contrib.auth.models.User, unused):
+                The user to set up the test for.
+
+        Returns:
+            str:
+            The URL to fetch for the test.
+        """
+        repository = self.create_repository()
+        group = self.create_review_group(invite_only=True)
+        repository.review_groups.add(group)
+
+        return get_repository_group_item_url(repository, group.name)
 
     def compare_item(self, item_rsp, group):
         """Compare an item in the results.
diff --git a/reviewboard/webapi/tests/test_repository_user.py b/reviewboard/webapi/tests/test_repository_user.py
index 0316a08f1253064669ec7062d0779ba3e89bdc3d..ef149bf34bc7626e44be145b6e280efe9db55db5 100644
--- a/reviewboard/webapi/tests/test_repository_user.py
+++ b/reviewboard/webapi/tests/test_repository_user.py
@@ -48,6 +48,11 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(item_rsp['first_name'], user.first_name)
         self.assertEqual(item_rsp['last_name'], user.last_name)
 
+    def setup_http_not_allowed_item_test(self, user):
+        repository = self.create_repository()
+
+        return get_repository_user_list_url(repository)
+
     #
     # HTTP GET tests
     #
@@ -245,7 +250,27 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
             The URL to fetch for the test.
         """
         repository = self.create_repository()
-        return get_repository_user_list_url(repository)
+        doc = User.objects.get(username='doc')
+        repository.users.add(doc)
+
+        return get_repository_user_item_url(repository, doc.username)
+
+    def setup_http_not_allowed_list_test(self, user):
+        """Set up the HTTP not allowed test.
+
+        Args:
+            user (django.contrib.auth.models.User, unused):
+                The user to set up the test for.
+
+        Returns:
+            str:
+            The URL to fetch for the test.
+        """
+        repository = self.create_repository()
+        doc = User.objects.get(username='doc')
+        repository.users.add(doc)
+
+        return get_repository_user_item_url(repository, doc.username)
 
     def compare_item(self, item_rsp, user):
         """Compare an item in the results.
diff --git a/reviewboard/webapi/tests/test_review.py b/reviewboard/webapi/tests/test_review.py
index 1aa7812728a78f29c91688a7a52c704e09ca81d6..272f6b6688d4b5dbdef515437c243cb23ef81bca 100644
--- a/reviewboard/webapi/tests/test_review.py
+++ b/reviewboard/webapi/tests/test_review.py
@@ -36,6 +36,13 @@ class ResourceListTests(ReviewListMixin, ReviewRequestChildListMixin,
         return (get_review_list_url(review_request),
                 review_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+
+        return get_review_list_url(review_request)
+
     def compare_item(self, item_rsp, review):
         self.assertEqual(item_rsp['id'], review.pk)
         self.assertEqual(item_rsp['ship_it'], review.ship_it)
@@ -145,6 +152,14 @@ class ResourceItemTests(SpyAgency, ReviewItemMixin,
         return (get_review_item_url(review_request, review.pk),
                 review_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        review = self.create_review(review_request, user=user)
+
+        return get_review_item_url(review_request, review.pk)
+
     def compare_item(self, item_rsp, review):
         self.assertEqual(item_rsp['id'], review.pk)
         self.assertEqual(item_rsp['ship_it'], review.ship_it)
diff --git a/reviewboard/webapi/tests/test_review_comment.py b/reviewboard/webapi/tests/test_review_comment.py
index f9d7a5a79a76f01b82dd4b30436d9c00c3981282..c485cdaec00a260a8f7dc2af44ce9f45fbb290ea 100644
--- a/reviewboard/webapi/tests/test_review_comment.py
+++ b/reviewboard/webapi/tests/test_review_comment.py
@@ -170,6 +170,14 @@ class ResourceListTests(SpyAgency, CommentListMixin,
         return (get_review_diff_comment_list_url(review),
                 review_diff_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            submitter=user,
+            publish=True)
+        review = self.create_review(review_request, publish=True)
+
+        return get_review_diff_comment_list_url(review)
     #
     # HTTP GET tests
     #
@@ -923,6 +931,18 @@ class ResourceItemTests(CommentItemMixin, ReviewRequestChildItemMixin,
         return (get_review_diff_comment_item_url(review, comment.pk),
                 review_diff_comment_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            submitter=user,
+            publish=True)
+        diffset = self.create_diffset(review_request)
+        filediff = self.create_filediff(diffset)
+        review = self.create_review(review_request, user=user)
+        comment = self.create_diff_comment(review, filediff)
+
+        return get_review_diff_comment_item_url(review, comment.pk)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_review_general_comment.py b/reviewboard/webapi/tests/test_review_general_comment.py
index b0091970b49bf3da76976d45844c184582c91201..5da6827de57a5eaec496e15fba99ad799fe05c07 100644
--- a/reviewboard/webapi/tests/test_review_general_comment.py
+++ b/reviewboard/webapi/tests/test_review_general_comment.py
@@ -58,6 +58,14 @@ class ResourceListTests(CommentListMixin, ReviewRequestChildListMixin,
         return (get_review_general_comment_list_url(review),
                 general_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        review = self.create_review(review_request, user=user)
+
+        return get_review_general_comment_list_url(review)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
@@ -180,6 +188,15 @@ class ResourceItemTests(CommentItemMixin, ReviewRequestChildItemMixin,
         return (get_review_general_comment_item_url(review, comment.pk),
                 general_comment_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        review = self.create_review(review_request, user=user)
+        comment = self.create_general_comment(review)
+
+        return get_review_general_comment_item_url(review, comment.pk)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_review_group.py b/reviewboard/webapi/tests/test_review_group.py
index acd34d56ddb56cb3ee8338d332447241e49091f2..88bac71703cfa10d4d9a834f2db392a6e5010766 100644
--- a/reviewboard/webapi/tests/test_review_group.py
+++ b/reviewboard/webapi/tests/test_review_group.py
@@ -40,6 +40,9 @@ class ResourceListTests(ExtraDataListMixin, BaseWebAPITestCase,
         self.assertEqual(item_rsp['absolute_url'],
                          self.base_url + group.get_absolute_url())
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_review_group_list_url()
+
     #
     # HTTP GET tests
     #
@@ -533,6 +536,11 @@ class ResourceItemTests(ExtraDataItemMixin, BaseWebAPITestCase,
         self.assertEqual(item_rsp['invite_only'], group.invite_only)
         self.assertEqual(item_rsp['extra_data'], group.extra_data)
 
+    def setup_http_not_allowed_list_test(self, user):
+        group = self.create_review_group()
+
+        return get_review_group_item_url(group.name)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_review_group_user.py b/reviewboard/webapi/tests/test_review_group_user.py
index 32facf7a7bdb8a0e4a73f6421a09aa9c7943a81d..50edabb36e0869d487b9e19f6c26f65d836b581c 100644
--- a/reviewboard/webapi/tests/test_review_group_user.py
+++ b/reviewboard/webapi/tests/test_review_group_user.py
@@ -27,6 +27,11 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(item_rsp['first_name'], user.first_name)
         self.assertEqual(item_rsp['last_name'], user.last_name)
 
+    def setup_http_not_allowed_item_test(self, user):
+        group = self.create_review_group()
+
+        return get_review_group_user_list_url(group.name)
+
     #
     # HTTP GET tests
     #
@@ -215,7 +220,18 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
     basic_put_use_admin = True
 
     def setup_http_not_allowed_item_test(self, user):
-        return get_review_group_user_list_url('my-group')
+        group = self.create_review_group()
+        doc = User.objects.get(username='doc')
+        group.users.add(doc)
+
+        return get_review_group_user_item_url(group.name, doc.username)
+
+    def setup_http_not_allowed_list_test(self, user):
+        group = self.create_review_group()
+        doc = User.objects.get(username='doc')
+        group.users.add(doc)
+
+        return get_review_group_user_item_url(group.name, doc.username)
 
     def compare_item(self, item_rsp, user):
         self.assertEqual(item_rsp['id'], user.pk)
diff --git a/reviewboard/webapi/tests/test_review_reply.py b/reviewboard/webapi/tests/test_review_reply.py
index 972235f85714a66585ba891bc0a9353e77b38df5..153cf9e170ea8d28a1742c06bce731bc4326c1bf 100644
--- a/reviewboard/webapi/tests/test_review_reply.py
+++ b/reviewboard/webapi/tests/test_review_reply.py
@@ -41,6 +41,14 @@ class ResourceListTests(ReviewListMixin, ReviewRequestChildListMixin,
         return (get_review_reply_list_url(review),
                 review_reply_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        review = self.create_review(review_request, publish=True)
+
+        return get_review_reply_list_url(review)
+
     def compare_item(self, item_rsp, reply):
         self.assertEqual(item_rsp['id'], reply.pk)
         self.assertEqual(item_rsp['body_top'], reply.body_top)
@@ -165,6 +173,15 @@ class ResourceItemTests(ReviewItemMixin, ReviewRequestChildItemMixin,
         return (get_review_reply_item_url(review, reply.pk),
                 review_reply_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        review = self.create_review(review_request, user=user, publish=True)
+        reply = self.create_reply(review, user=user)
+
+        return get_review_reply_item_url(review, reply.pk)
+
     def compare_item(self, item_rsp, reply):
         self.assertEqual(item_rsp['id'], reply.pk)
         self.assertEqual(item_rsp['body_top'], reply.body_top)
diff --git a/reviewboard/webapi/tests/test_review_reply_diff_comment.py b/reviewboard/webapi/tests/test_review_reply_diff_comment.py
index 6dfbde63d1c4d1c00a6c4b5f426b3c5e959f59bb..43f9de800a883ce1bb3dcb8865a4077df035209b 100644
--- a/reviewboard/webapi/tests/test_review_reply_diff_comment.py
+++ b/reviewboard/webapi/tests/test_review_reply_diff_comment.py
@@ -24,6 +24,19 @@ class ResourceListTests(CommentReplyListMixin, ReviewRequestChildListMixin,
         'review-requests/<id>/reviews/<id>/replies/<id>/diff-comments/'
     resource = resources.review_reply_diff_comment
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            submitter=user,
+            publish=True)
+        diffset = self.create_diffset(review_request)
+        filediff = self.create_filediff(diffset)
+        review = self.create_review(review_request, user=user)
+        comment = self.create_diff_comment(review, filediff)
+        reply = self.create_reply(review, user=user)
+
+        return get_review_reply_diff_comment_list_url(reply)
+
     def setup_review_request_child_test(self, review_request):
         if not review_request.repository_id:
             # The group tests don't create a repository by default.
@@ -170,6 +183,21 @@ class ResourceItemTests(CommentReplyItemMixin, ReviewRequestChildItemMixin,
         return (get_review_reply_diff_comment_list_url(reply),
                 review_reply_diff_comment_list_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            create_repository=True,
+            submitter=user,
+            publish=True)
+        diffset = self.create_diffset(review_request)
+        filediff = self.create_filediff(diffset)
+        review = self.create_review(review_request, user=user, publish=True)
+        comment = self.create_diff_comment(review, filediff)
+        reply = self.create_reply(review, user=user)
+        reply_comment = self.create_diff_comment(reply, filediff,
+                                                 reply_to=comment)
+
+        return get_review_reply_diff_comment_item_url(reply, reply_comment.pk)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
diff --git a/reviewboard/webapi/tests/test_review_reply_file_attachment_comment.py b/reviewboard/webapi/tests/test_review_reply_file_attachment_comment.py
index c3ab9b2969bbe29ded4b3a825a66a80b25506fb9..262f7dc23fd0b07d3e29cd8609cc7b97c40cb3f3 100644
--- a/reviewboard/webapi/tests/test_review_reply_file_attachment_comment.py
+++ b/reviewboard/webapi/tests/test_review_reply_file_attachment_comment.py
@@ -34,6 +34,17 @@ class ResourceListTests(CommentReplyListMixin, ReviewRequestChildListMixin,
         return (get_review_reply_file_attachment_comment_list_url(reply),
                 review_reply_file_attachment_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        file_attachment = self.create_file_attachment(review_request)
+        review = self.create_review(review_request, user=user)
+        comment = self.create_file_attachment_comment(review, file_attachment)
+        reply = self.create_reply(review, user=user)
+
+        return get_review_reply_file_attachment_comment_list_url(reply)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
@@ -190,6 +201,20 @@ class ResourceItemTests(CommentReplyItemMixin, ReviewRequestChildItemMixin,
                 reply, reply_comment.pk),
             review_reply_file_attachment_comment_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        file_attachment = self.create_file_attachment(review_request)
+        review = self.create_review(review_request, user=user, publish=True)
+        comment = self.create_file_attachment_comment(review, file_attachment)
+        reply = self.create_reply(review, user=user)
+        reply_comment = self.create_file_attachment_comment(
+            reply, file_attachment, reply_to=comment)
+
+        return get_review_reply_file_attachment_comment_item_url(
+            reply, reply_comment.pk)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
diff --git a/reviewboard/webapi/tests/test_review_reply_general_comment.py b/reviewboard/webapi/tests/test_review_reply_general_comment.py
index ff49a1100c25a397a0d14c1ac7d5711009c7f43d..92b0de0ce13ff71d99ed5a19ac533cf5c9106124 100644
--- a/reviewboard/webapi/tests/test_review_reply_general_comment.py
+++ b/reviewboard/webapi/tests/test_review_reply_general_comment.py
@@ -33,6 +33,16 @@ class ResourceListTests(CommentReplyListMixin, ReviewRequestChildListMixin,
         return (get_review_reply_general_comment_list_url(reply),
                 review_reply_general_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        review = self.create_review(review_request, user=user)
+        comment = self.create_general_comment(review)
+        reply = self.create_reply(review, user=user)
+
+        return get_review_reply_general_comment_list_url(reply)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
@@ -149,6 +159,18 @@ class ResourceItemTests(CommentReplyItemMixin, ReviewRequestChildItemMixin,
                                                           reply_comment.pk),
                 review_reply_general_comment_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        review = self.create_review(review_request, user=user, publish=True)
+        comment = self.create_general_comment(review)
+        reply = self.create_reply(review, user=user)
+        reply_comment = self.create_general_comment(reply, reply_to=comment)
+
+        return get_review_reply_general_comment_item_url(
+            reply, reply_comment.pk)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
diff --git a/reviewboard/webapi/tests/test_review_reply_screenshot_comment.py b/reviewboard/webapi/tests/test_review_reply_screenshot_comment.py
index 3caffeeb32460b24ffd4609d6226f262d5aae8f2..b6a5d2b2caffae875f348e80b205fbba470f73f8 100644
--- a/reviewboard/webapi/tests/test_review_reply_screenshot_comment.py
+++ b/reviewboard/webapi/tests/test_review_reply_screenshot_comment.py
@@ -34,6 +34,17 @@ class ResourceListTests(CommentReplyListMixin, ReviewRequestChildListMixin,
         return (get_review_reply_screenshot_comment_list_url(reply),
                 review_reply_screenshot_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        screenshot = self.create_screenshot(review_request)
+        review = self.create_review(review_request, user=user)
+        comment = self.create_screenshot_comment(review, screenshot)
+        reply = self.create_reply(review, user=user)
+
+        return get_review_reply_screenshot_comment_list_url(reply)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
@@ -158,6 +169,20 @@ class ResourceItemTests(CommentReplyItemMixin, ReviewRequestChildItemMixin,
                                                              reply_comment.pk),
                 review_reply_screenshot_comment_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        screenshot = self.create_screenshot(review_request)
+        review = self.create_review(review_request, user=user, publish=True)
+        comment = self.create_screenshot_comment(review, screenshot)
+        reply = self.create_reply(review, user=user)
+        reply_comment = self.create_screenshot_comment(reply, screenshot,
+                                                       reply_to=comment)
+
+        return get_review_reply_screenshot_comment_item_url(
+            reply, reply_comment.pk)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
diff --git a/reviewboard/webapi/tests/test_review_request.py b/reviewboard/webapi/tests/test_review_request.py
index c863199854df5c87b8359aa5ad8870766a4634cf..8e4fa851f36835a614e4016bf513ecff038ecf1d 100644
--- a/reviewboard/webapi/tests/test_review_request.py
+++ b/reviewboard/webapi/tests/test_review_request.py
@@ -62,6 +62,10 @@ class ResourceListTests(kgb.SpyAgency, ExtraDataListMixin, SSLTestsMixin,
         self.assertEqual(
             item_rsp['extra_data'],
             self.resource.serialize_extra_data_field(review_request))
+
+    def setup_http_not_allowed_item_test(self, user):
+        return get_review_request_list_url()
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_review_screenshot_comment.py b/reviewboard/webapi/tests/test_review_screenshot_comment.py
index 88cc5124b0d53a026c5d32f6a681acdaa7bd4e68..b209b899e4dc4bab2a809d0d0994149d3418f8b0 100644
--- a/reviewboard/webapi/tests/test_review_screenshot_comment.py
+++ b/reviewboard/webapi/tests/test_review_screenshot_comment.py
@@ -61,6 +61,15 @@ class ResourceListTests(CommentListMixin, ReviewRequestChildListMixin,
         return (get_review_screenshot_comment_list_url(review),
                 screenshot_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        screenshot = self.create_screenshot(review_request)
+        review = self.create_review(review_request, user=user)
+
+        return get_review_screenshot_comment_list_url(review)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['text'], comment.text)
@@ -179,6 +188,16 @@ class ResourceItemTests(CommentItemMixin, ReviewRequestChildItemMixin,
         return (get_review_screenshot_comment_item_url(review, comment.pk),
                 screenshot_comment_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        screenshot = self.create_screenshot(review_request)
+        review = self.create_review(review_request, user=user)
+        comment = self.create_screenshot_comment(review, screenshot)
+
+        return get_review_screenshot_comment_item_url(review, comment.pk)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_screenshot.py b/reviewboard/webapi/tests/test_screenshot.py
index 6deaaf494b19025301310fe6957d02a652c07847..be05663da949f32e2e0fa12d94804f52921cf705 100644
--- a/reviewboard/webapi/tests/test_screenshot.py
+++ b/reviewboard/webapi/tests/test_screenshot.py
@@ -22,6 +22,13 @@ class ResourceListTests(ReviewRequestChildListMixin, BaseWebAPITestCase,
         return (get_screenshot_list_url(review_request),
                 screenshot_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+
+        return get_screenshot_list_url(review_request)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['caption'], comment.caption)
@@ -120,6 +127,14 @@ class ResourceItemTests(ReviewRequestChildItemMixin, BaseWebAPITestCase,
         return (get_screenshot_item_url(screenshot),
                 screenshot_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        screenshot = self.create_screenshot(review_request)
+
+        return get_screenshot_item_url(screenshot)
+
     def compare_item(self, item_rsp, comment):
         self.assertEqual(item_rsp['id'], comment.pk)
         self.assertEqual(item_rsp['caption'], comment.caption)
diff --git a/reviewboard/webapi/tests/test_screenshot_comment.py b/reviewboard/webapi/tests/test_screenshot_comment.py
index 82a4a007183ed1b3f7d4c8c1ec47304d75e25cec..ebd814ba7f98c5b0e63711c40a831ed4be94900a 100644
--- a/reviewboard/webapi/tests/test_screenshot_comment.py
+++ b/reviewboard/webapi/tests/test_screenshot_comment.py
@@ -19,6 +19,13 @@ class ResourceListTests(ReviewRequestChildListMixin, BaseWebAPITestCase,
         return (get_screenshot_comment_list_url(screenshot),
                 screenshot_comment_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(submitter=user,
+                                                    publish=True)
+        screenshot = self.create_screenshot(review_request)
+
+        return get_screenshot_comment_list_url(screenshot)
+
     def setup_http_not_allowed_list_test(self, user):
         review_request = self.create_review_request(submitter=user,
                                                     publish=True)
diff --git a/reviewboard/webapi/tests/test_screenshot_draft.py b/reviewboard/webapi/tests/test_screenshot_draft.py
index 02b072266307d91a6c77bc5a81bd3575b4749f80..f9eb404c26a48c107fbae4a7de8bdbe53bdf2006 100644
--- a/reviewboard/webapi/tests/test_screenshot_draft.py
+++ b/reviewboard/webapi/tests/test_screenshot_draft.py
@@ -20,6 +20,13 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(item_rsp['id'], screenshot.pk)
         self.assertEqual(item_rsp['caption'], screenshot.caption)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+
+        return get_screenshot_draft_list_url(review_request)
+
     #
     # HTTP GET tests
     #
@@ -102,6 +109,14 @@ class ResourceItemTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
     sample_api_url = 'review-requests/<id>/draft/screenshots/<id>/'
     resource = resources.draft_screenshot
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        screenshot = self.create_screenshot(review_request, draft=True)
+
+        return get_screenshot_draft_item_url(review_request, screenshot.pk)
+
     def compare_item(self, item_rsp, screenshot):
         self.assertEqual(item_rsp['id'], screenshot.pk)
         self.assertEqual(item_rsp['caption'], screenshot.caption)
diff --git a/reviewboard/webapi/tests/test_status_update.py b/reviewboard/webapi/tests/test_status_update.py
index 23def0b000eae30b4d49e29e5a302bbe75497404..783ca3c72b4c3ffa0c4499708c9fd0d31817e822 100644
--- a/reviewboard/webapi/tests/test_status_update.py
+++ b/reviewboard/webapi/tests/test_status_update.py
@@ -33,6 +33,13 @@ class ResourceListTests(ExtraDataListMixin, ReviewRequestChildListMixin,
         return (get_status_update_list_url(review_request),
                 status_update_list_mimetype)
 
+    def setup_http_not_allowed_item_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+
+        return get_status_update_list_url(review_request)
+
     def compare_item(self, item_rsp, status_update):
         self.assertEqual(item_rsp['id'], status_update.pk)
         self.assertEqual(item_rsp['summary'], status_update.summary)
@@ -227,6 +234,14 @@ class ResourceItemTests(SpyAgency, ReviewRequestChildItemMixin,
         return (get_status_update_item_url(review_request, status_update.pk),
                 status_update_item_mimetype)
 
+    def setup_http_not_allowed_list_test(self, user):
+        review_request = self.create_review_request(
+            submitter=user,
+            publish=True)
+        status_update = self.create_status_update(review_request, user=user)
+
+        return get_status_update_item_url(review_request, status_update.pk)
+
     def compare_item(self, item_rsp, status_update):
         self.assertEqual(item_rsp['id'], status_update.pk)
 
diff --git a/reviewboard/webapi/tests/test_user_file_attachment.py b/reviewboard/webapi/tests/test_user_file_attachment.py
index 9b9e1270b066cf0a2611b0341264f3e26dab107d..1de3a4158b4282f112ffd8baf55ce0517998515b 100644
--- a/reviewboard/webapi/tests/test_user_file_attachment.py
+++ b/reviewboard/webapi/tests/test_user_file_attachment.py
@@ -28,6 +28,9 @@ class ResourceListTests(BaseWebAPITestCase,
         self.assertEqual(item_rsp['filename'], attachment.filename)
         self.assertEqual(item_rsp['extra_data'], attachment.extra_data)
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_user_file_attachment_list_url(user)
+
     #
     # HTTP GET tests
     #
@@ -122,6 +125,11 @@ class ResourceItemTests(BaseWebAPITestCase,
         self.assertEqual(item_rsp['filename'], attachment.filename)
         self.assertEqual(item_rsp['extra_data'], attachment.extra_data)
 
+    def setup_http_not_allowed_list_test(self, user):
+        file_attachment = self.create_user_file_attachment(user)
+
+        return get_user_file_attachment_item_url(user, file_attachment)
+
     #
     # HTTP DELETE tests
     #
diff --git a/reviewboard/webapi/tests/test_watched_review_group.py b/reviewboard/webapi/tests/test_watched_review_group.py
index 26c331d31696685304d65f00e58b5aacccc06735..c327e083d0d34ca169e325524c37dc60e6599dbd 100644
--- a/reviewboard/webapi/tests/test_watched_review_group.py
+++ b/reviewboard/webapi/tests/test_watched_review_group.py
@@ -24,6 +24,9 @@ class ResourceListTests(BaseWebAPITestCase, metaclass=BasicTestsMetaclass):
         self.assertEqual(watched_rsp['id'], obj.pk)
         self.assertEqual(watched_rsp['name'], obj.name)
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_watched_review_group_list_url(user.username)
+
     #
     # HTTP GET tests
     #
diff --git a/reviewboard/webapi/tests/test_webhook.py b/reviewboard/webapi/tests/test_webhook.py
index 386648fbe32df768359d1c455a67415e5f7c3d21..9af12583a7ac5f44dd89982cc9cd2255af6012bb 100644
--- a/reviewboard/webapi/tests/test_webhook.py
+++ b/reviewboard/webapi/tests/test_webhook.py
@@ -50,6 +50,13 @@ class ResourceListTests(ExtraDataListMixin, BaseWebAPITestCase,
 
     compare_item = compare_item
 
+    def setup_http_not_allowed_item_test(self, user):
+        return get_webhook_list_url()
+
+    #
+    # HTTP GET tests
+    #
+
     def setup_basic_get_test(self, user, with_local_site, local_site_name,
                              populate_items):
         webhook = self.create_webhook(with_local_site=with_local_site)
@@ -63,6 +70,10 @@ class ResourceListTests(ExtraDataListMixin, BaseWebAPITestCase,
                 webhook_list_mimetype,
                 items)
 
+    #
+    # HTTP POST tests
+    #
+
     def setup_basic_post_test(self, user, with_local_site, local_site_name,
                               post_valid_data):
         if post_valid_data:
@@ -432,6 +443,15 @@ class ResourceItemTests(ExtraDataItemMixin, BaseWebAPITestCase,
 
     compare_item = compare_item
 
+    def setup_http_not_allowed_list_test(self, user):
+        webhook = self.create_webhook()
+
+        return get_webhook_item_url(webhook.pk)
+
+    #
+    # HTTP GET tests
+    #
+
     def setup_basic_get_test(self, user, with_local_site, local_site_name):
         webhook = self.create_webhook(with_local_site=with_local_site)
 
@@ -449,15 +469,9 @@ class ResourceItemTests(ExtraDataItemMixin, BaseWebAPITestCase,
                 webhook,
                 [local_site_name])
 
-    def check_put_result(self, user, item_rsp, item, local_site_name=None):
-        webhook = WebHookTarget.objects.get(pk=item_rsp['id'])
-
-        if local_site_name is None:
-            self.assertIsNone(webhook.local_site)
-        else:
-            self.assertEqual(webhook.local_site.name, local_site_name)
-
-        self.compare_item(item_rsp, webhook)
+    #
+    # HTTP DELETE tests
+    #
 
     def setup_basic_delete_test(self, user, with_local_site, local_site_name):
         webhook = self.create_webhook(with_local_site=with_local_site)
@@ -469,6 +483,20 @@ class ResourceItemTests(ExtraDataItemMixin, BaseWebAPITestCase,
         self.assertRaises(WebHookTarget.DoesNotExist,
                           lambda: WebHookTarget.objects.get(pk=webhook.pk))
 
+    #
+    # HTTP PUT tests
+    #
+
+    def check_put_result(self, user, item_rsp, item, local_site_name=None):
+        webhook = WebHookTarget.objects.get(pk=item_rsp['id'])
+
+        if local_site_name is None:
+            self.assertIsNone(webhook.local_site)
+        else:
+            self.assertEqual(webhook.local_site.name, local_site_name)
+
+        self.compare_item(item_rsp, webhook)
+
     @webapi_test_template
     def test_put_with_global_site_and_set_local_site(self):
         """Testing the PUT <URL> API and attempting to set a LocalSite for a