diff --git a/src/faction/faction.controller.ts b/src/faction/faction.controller.ts
index 734e9d836655e06f606d560c7e455be8706e2ba7..98fcc856d6a5e1cb469e81249eea044df4011877 100644
--- a/src/faction/faction.controller.ts
+++ b/src/faction/faction.controller.ts
@@ -21,7 +21,7 @@ import {
   JoinGameGroupDTO,
 } from './faction.dto';
 import { FactionService } from './faction.service';
-import { Roles } from '../shared/guard.decorator';
+import { Roles, GameStates } from '../shared/guard.decorator';
 
 @Controller('faction')
 export class FactionController {
@@ -30,6 +30,7 @@ export class FactionController {
   // takes gameId from the url to verify user role
   @Post('create-group/:id')
   @Roles('soldier')
+  @GameStates('CREATED')
   @UsePipes(new ValidationPipe())
   async createGroup(
     @User('id') person,
@@ -50,6 +51,7 @@ export class FactionController {
   // takes gameId from the url to verify user role
   @Put('join-group/:id')
   @Roles('soldier')
+  @GameStates('CREATED')
   async joinGroup(
     @User('id') person,
     @Param('id') id,
@@ -66,17 +68,24 @@ export class FactionController {
 
   // param game ID is passed to @Roles
   @Put('promote/:id')
-  @UseGuards(new AuthGuard())
-  @UsePipes(new ValidationPipe())
   @Roles('admin')
+  @GameStates('CREATED')
+  @UsePipes(new ValidationPipe())
   promotePlayer(@Param('id') game, @Body() body: PromotePlayerDTO) {
     return this.factionservice.promotePlayer(body);
   }
 
-  @Put('join-faction')
+  // used to join a faction
+  // :id is the id of the game, and is needed for GameStates to check the state of the game
+  @Put('join-faction/:id')
   @UseGuards(new AuthGuard())
+  @GameStates('CREATED')
   @UsePipes(new ValidationPipe())
-  joinFaction(@User('id') person, @Body() data: JoinFactionDTO) {
+  joinFaction(
+    @User('id') person,
+    @Param('id') game,
+    @Body() data: JoinFactionDTO,
+  ) {
     return this.factionservice.joinFaction(person, data);
   }
 }
diff --git a/src/game/game.controller.ts b/src/game/game.controller.ts
index 7cd7a4f17cc4146e1301ba9e7b4555f3f7a4b83d..24d42bbae81d23bbba83af27d06ec58268e69127 100644
--- a/src/game/game.controller.ts
+++ b/src/game/game.controller.ts
@@ -70,6 +70,7 @@ export class GameController {
   }
 
   @Post('flag/:id')
+  @GameStates('STARTED')
   async flagboxEvent(@Param('id') id: string, @Body() data: FlagboxEventDTO) {
     return this.gameservice.flagboxEvent(id, data);
   }