diff --git a/engines/dfc_provider/app/services/api_user.rb b/engines/dfc_provider/app/services/api_user.rb
index 4b9ca93220..4902c05ccc 100644
--- a/engines/dfc_provider/app/services/api_user.rb
+++ b/engines/dfc_provider/app/services/api_user.rb
@@ -17,4 +17,8 @@ class ApiUser
   def initialize(id)
     @id = id
   end
+
+  def enterprises
+    Enterprise.none
+  end
 end
diff --git a/engines/dfc_provider/spec/requests/catalog_items_spec.rb b/engines/dfc_provider/spec/requests/catalog_items_spec.rb
index ac8b091c9a..ac387c7214 100644
--- a/engines/dfc_provider/spec/requests/catalog_items_spec.rb
+++ b/engines/dfc_provider/spec/requests/catalog_items_spec.rb
@@ -3,6 +3,7 @@
 require_relative "../swagger_helper"
 
 RSpec.describe "CatalogItems", swagger_doc: "dfc.yaml" do
+  let(:Authorization) { nil }
   let(:user) { create(:oidc_user, id: 12_345) }
   let(:enterprise) {
     create(
@@ -35,8 +36,23 @@ RSpec.describe "CatalogItems", swagger_doc: "dfc.yaml" do
 
     get "List CatalogItems" do
       produces "application/json"
+      security [oidc_token: []]
 
       response "404", "not found" do
+        context "as platform user" do
+          let(:enterprise_id) { 10_000 }
+          let(:sib_token) { file_fixture("startinblox_access_token.jwt").read }
+          let(:Authorization) { "Bearer #{sib_token}" }
+
+          before { login_as nil }
+
+          around do |example|
+            Timecop.travel(Date.parse("2025-06-13")) { example.run }
+          end
+
+          run_test!
+        end
+
         context "without enterprises" do
           let(:enterprise_id) { "default" }
 
diff --git a/swagger/dfc.yaml b/swagger/dfc.yaml
index ea664ea867..edd2f6db59 100644
--- a/swagger/dfc.yaml
+++ b/swagger/dfc.yaml
@@ -137,6 +137,8 @@ paths:
         type: string
     get:
       summary: List CatalogItems
+      security:
+      - oidc_token: []
       tags:
       - CatalogItems
       responses: