diff --git a/game-server/app/servers/gm/filter/tokenFilter.ts b/game-server/app/servers/gm/filter/tokenFilter.ts
index d29e8e1b4..4161f7c94 100644
--- a/game-server/app/servers/gm/filter/tokenFilter.ts
+++ b/game-server/app/servers/gm/filter/tokenFilter.ts
@@ -1,4 +1,10 @@
 import {Application, RouteRecord, FrontendOrBackendSession, HandlerCallback } from "pinus";
+import { GM_API_TYPE, STATUS } from "../../../consts";
+import { GMGroupModel } from "../../../db/GMGroup";
+import { GMRecordModel } from "../../../db/GMRecord";
+import { GMUserGroupModel } from "../../../db/GMUserGroup";
+import { gameData } from "../../../pubUtils/data";
+import { resResult } from "../../../pubUtils/util";
 
 export function tokenFilter(app: Application) {
     return new Filter(app);
@@ -12,11 +18,34 @@ Filter.prototype.before = async function (routeRecord: RouteRecord, msg: any, se
     const uid = session.get('uid');
     let route = routeRecord.route;
     console.log('********uid', uid, route);
+    let dicApi = gameData.apiByUrl.get(route);
+    if(!dicApi) {
+        return next(new Error(), resResult(STATUS.GM_MISS_API));
+    }
+    let userGroup = await GMUserGroupModel.getUserGroupByUid(uid);
+    if(!userGroup) {
+        return next(new Error(), resResult(STATUS.GM_NO_AUTHORITY_GET));
+    } 
+    let group = await GMGroupModel.getGroupById(userGroup.groupId);
+    
+    if(!group) {
+        return next(new Error(), resResult(STATUS.GM_NO_AUTHORITY_GET));
+    } 
 
+    if(!group.apis.includes(0) && !group.apis.includes(dicApi.id)) {
+        return next(new Error(), resResult(STATUS.GM_NO_AUTHORITY_GET));
+    }
 
     next(null);
 };
 
 Filter.prototype.after = function (err: Error, routeRecord: RouteRecord, msg: any, session: FrontendOrBackendSession, resp: any, next: HandlerCallback) {
+    const uid = session.get('uid');
+    let route = routeRecord.route;
+    
+    let dicApi = gameData.apiByUrl.get(route);
+    if(dicApi.type != GM_API_TYPE.find) {
+        GMRecordModel.createRecord(uid, route, JSON.stringify(msg||{}), JSON.stringify(resp||{}));
+    }
     next(err);
 };
\ No newline at end of file
diff --git a/gm-server/app/middleware/tokenParser.ts b/gm-server/app/middleware/tokenParser.ts
index 255b4e172..f70fe4c61 100644
--- a/gm-server/app/middleware/tokenParser.ts
+++ b/gm-server/app/middleware/tokenParser.ts
@@ -2,7 +2,7 @@ import { GMUserModel } from '@db/GMUser';
 import { GMUserGroupModel } from '@db/GMUserGroup'
 import { GMGroupModel } from '@db/GMGroup'
 import { GMRecordModel } from '@db/GMRecord'
-import { STATUS } from '@consts';
+import { GM_API_TYPE, STATUS } from '@consts';
 import { gameData } from '@pubUtils/data';
 
 module.exports = () => {
@@ -44,8 +44,8 @@ module.exports = () => {
     
     ctx.user = user;
     await next();
-    if(ctx.request.method == "POST") {
-      await GMRecordModel.createRecord(user?user.uid:0, ctx.request.url, JSON.stringify(ctx.request.body||{}), JSON.stringify(ctx.body||{}));
+    if(dicApi.type != GM_API_TYPE.find) {
+       GMRecordModel.createRecord(user?user.uid:0, ctx.request.url, JSON.stringify(ctx.request.body||{}), JSON.stringify(ctx.body||{}));
     }
   };
 };
diff --git a/web-server/app/middleware/gmTokenParser.ts b/web-server/app/middleware/gmTokenParser.ts
index 4a7d2aa80..1ba6a3cd3 100644
--- a/web-server/app/middleware/gmTokenParser.ts
+++ b/web-server/app/middleware/gmTokenParser.ts
@@ -2,7 +2,7 @@ import { GMUserModel } from '@db/GMUser';
 import { GMUserGroupModel } from '@db/GMUserGroup'
 import { GMGroupModel } from '@db/GMGroup'
 import { GMRecordModel } from '@db/GMRecord'
-import { STATUS } from '@consts';
+import { GM_API_TYPE, STATUS } from '@consts';
 import { gameData } from 'app/pubUtils/data';
 
 module.exports = () => {
@@ -25,25 +25,27 @@ module.exports = () => {
       ctx.body = ctx.service.utils.resResult(STATUS.GM_MISS_API);
       return;
     }
-    let userGroups = await GMUserGroupModel.getUserGroupByUid(user.uid, ctx.app.config.realEnv);
-    let flag = 0;
-    for(let userGroup of userGroups) {
-      let { groupId } = userGroup;
-      let group = await GMGroupModel.getGroupById(groupId);
-      if(group) {
-        if(group.apis.includes(dicApi.id)) {
-          flag = 1; break;
-        }
-      }
-    }
-    if(flag != 1) {
+    let userGroup = await GMUserGroupModel.getUserGroupByUid(user.uid);
+    if(!userGroup) {
       ctx.body = ctx.service.utils.resResult(STATUS.GM_NO_AUTHORITY_GET);
-      return;
+      return
+    } 
+    let group = await GMGroupModel.getGroupById(userGroup.groupId);
+    
+    if(!group) {
+      ctx.body = ctx.service.utils.resResult(STATUS.GM_NO_AUTHORITY_GET);
+      return
+    } 
+
+    if(!group.apis.includes(0) && !group.apis.includes(dicApi.id)) {
+      ctx.body = ctx.service.utils.resResult(STATUS.GM_NO_AUTHORITY_GET);
+      return
     }
+    
     ctx.user = user;
     await next();
-    if(ctx.request.method == "POST") {
-      await GMRecordModel.createRecord(user?user.uid:0, ctx.request.url, JSON.stringify(ctx.request.body||{}), JSON.stringify(ctx.body||{}));
+    if(dicApi.type != GM_API_TYPE.find) {
+      GMRecordModel.createRecord(user?user.uid:0, ctx.request.url, JSON.stringify(ctx.request.body||{}), JSON.stringify(ctx.body||{}));
     }
   };
 };