Spring security access with multiple roles

How try with , separate. See doc here and here.

<security:intercept-url pattern="/rest/api/myUrl*" access="ROLE1,ROLE2"/>

OR

hasAnyRole('ROLE1','ROLE2')