Endpoint
GET /api/admin/users/stats
Overview
Retrieves aggregate user statistics including total users, premium users, and free users. Requires admin access via DROP service accessFlags or INTERNAL_SECRET.
Request
Requires authentication via Bearer token (with admin privileges) or x-internal-secret header.
Response
Total number of users in the system
Number of users with premium DROP service access
Number of users without premium DROP service access (totalUsers - premiumUsers)
Authentication
Admin Access via DROP Service
User must have DROP service entitlement with:
accessFlags.isNullDropTeam: trueaccessFlags.nullDropTeamRole: "founder" or "dev"
Internal Secret
Alternatively, use x-internal-secret header with INTERNAL_SECRET value.
Implementation Details
Code Reference
export async function GET(request: NextRequest) {
const corsResponse = handleCors(request)
if (corsResponse) return corsResponse
const internalSecret = request.headers.get('x-internal-secret')
const isInternal = INTERNAL_SECRET && internalSecret === INTERNAL_SECRET
if (!isInternal) {
const auth = await requireAuth(request)
if ('error' in auth) {
return auth.error
}
const dropService = await prisma.userServiceEntitlement.findUnique({
where: {
userId_service: {
userId: auth.userId,
service: 'DROP',
},
},
})
const accessFlags = (dropService?.accessFlags as any) || {}
const isAdmin = accessFlags.isNullDropTeam && ['founder', 'dev'].includes(accessFlags.nullDropTeamRole)
if (!isAdmin) {
return errorResponse('Forbidden - Admin access required', 403, request.headers.get('origin'))
}
}
try {
const totalUsers = await prisma.user.count()
const premiumUsers = await prisma.userServiceEntitlement.count({
where: {
service: 'DROP',
isPremium: true,
},
})
return jsonResponse({
totalUsers,
premiumUsers,
freeUsers: totalUsers - premiumUsers,
}, 200, request.headers.get('origin'))
} catch (error) {
console.error('Admin users stats error:', error)
return errorResponse('Internal server error', 500, request.headers.get('origin'))
}
}
Status Codes
Missing or invalid authentication
Example Request
curl -X GET https://auth.nullpass.xyz/api/admin/users/stats \
-H "Authorization: Bearer YOUR_TOKEN"
Example Response
{
"totalUsers": 1000,
"premiumUsers": 250,
"freeUsers": 750
}
Notes
- Premium users are counted based on DROP service
isPremium flag
- Free users calculation:
totalUsers - premiumUsers
- Statistics are real-time (not cached)
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
