> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nullpass.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# List Users

> List all users (admin only)

## Endpoint

```
GET /api/admin/users
```

## Overview

Retrieves a paginated list of all users. Requires admin access via DROP service `accessFlags` or `INTERNAL_SECRET`.

## Request

Requires authentication via Bearer token (with admin privileges) or `x-internal-secret` header.

### Query Parameters

<ParamField query="page" type="number" default="1">
  Page number (1-indexed)
</ParamField>

<ParamField query="limit" type="number" default="50">
  Maximum number of users to return per page
</ParamField>

## Response

<ResponseField name="users" type="array">
  Array of user objects

  <Expandable title="User Object">
    <ResponseField name="id" type="string">
      User ID
    </ResponseField>

    <ResponseField name="email" type="string">
      User email
    </ResponseField>

    <ResponseField name="displayName" type="string">
      Display name (nullable)
    </ResponseField>

    <ResponseField name="avatar" type="string">
      Avatar path or URL (nullable)
    </ResponseField>

    <ResponseField name="createdAt" type="string">
      Account creation timestamp (ISO string)
    </ResponseField>

    <ResponseField name="updatedAt" type="string">
      Last update timestamp (ISO string)
    </ResponseField>

    <ResponseField name="serviceAccess" type="object">
      DROP service access information

      <Expandable title="Service Access Object">
        <ResponseField name="tier" type="string">
          Access tier (default: "free")
        </ResponseField>

        <ResponseField name="isPremium" type="boolean">
          Premium access flag (default: false)
        </ResponseField>

        <ResponseField name="accessFlags" type="object">
          Custom access flags
        </ResponseField>

        <ResponseField name="metadata" type="object">
          Service-specific metadata
        </ResponseField>

        <ResponseField name="customStorageLimit" type="number">
          Custom storage limit in bytes (nullable)
        </ResponseField>

        <ResponseField name="customApiKeyLimit" type="number">
          Custom API key limit (nullable)
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="pagination" type="object">
  Pagination information

  <Expandable title="Pagination Object">
    <ResponseField name="page" type="number">
      Current page number
    </ResponseField>

    <ResponseField name="limit" type="number">
      Items per page
    </ResponseField>

    <ResponseField name="totalCount" type="number">
      Total number of users
    </ResponseField>

    <ResponseField name="totalPages" type="number">
      Total number of pages
    </ResponseField>

    <ResponseField name="hasMore" type="boolean">
      Whether there are more pages
    </ResponseField>
  </Expandable>
</ResponseField>

## Authentication

### Admin Access via DROP Service

User must have DROP service entitlement with:

* `accessFlags.isNullDropTeam`: `true`
* `accessFlags.nullDropTeamRole`: `"founder"` or `"dev"`

### Internal Secret

Alternatively, use `x-internal-secret` header with `INTERNAL_SECRET` value.

## Status Codes

<ResponseField name="200" type="OK">
  Success
</ResponseField>

<ResponseField name="401" type="Unauthorized">
  Missing or invalid authentication
</ResponseField>

<ResponseField name="403" type="Forbidden">
  Admin access required
</ResponseField>

## Example Request

```bash theme={null}
curl -X GET "https://auth.nullpass.xyz/api/admin/users?page=1&limit=20" \
  -H "Authorization: Bearer YOUR_TOKEN"
```

## Example Response

```json theme={null}
{
  "users": [
    {
      "id": "clx1234567890",
      "email": "user@example.com",
      "displayName": "User Name",
      "avatar": "clx1234567890/avatar_1234567890.jpg",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "updatedAt": "2024-01-02T00:00:00.000Z",
      "serviceAccess": {
        "tier": "premium",
        "isPremium": true,
        "accessFlags": {
          "isNullDropTeam": false
        },
        "metadata": {},
        "customStorageLimit": null,
        "customApiKeyLimit": null
      }
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "totalCount": 1000,
    "totalPages": 50,
    "hasMore": true
  }
}
```


## OpenAPI

````yaml GET /admin/users
openapi: 3.1.0
info:
  title: Null Pass API
  description: >-
    Internal API documentation for Null Pass authentication and service
    management system
  version: 1.0.0
servers:
  - url: https://auth.nullpass.xyz/api
security: []
paths:
  /admin/users:
    get:
      tags:
        - Admin
      summary: List Users
      description: Get paginated list of all users (admin only)
      parameters:
        - name: page
          in: query
          schema:
            type: integer
            default: 1
        - name: limit
          in: query
          schema:
            type: integer
            default: 50
      responses:
        '200':
          description: List of users
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersListResponse'
      security:
        - bearerAuth: []
components:
  schemas:
    UsersListResponse:
      type: object
      properties:
        users:
          type: array
          items:
            $ref: '#/components/schemas/User'
        pagination:
          type: object
          properties:
            page:
              type: integer
            limit:
              type: integer
            totalCount:
              type: integer
            totalPages:
              type: integer
            hasMore:
              type: boolean
    User:
      type: object
      properties:
        id:
          type: string
        email:
          type: string
          format: email
        username:
          type: string
          nullable: true
        displayName:
          type: string
          nullable: true
        avatar:
          type: string
          nullable: true
        twoFactorEnabled:
          type: boolean
        createdAt:
          type: string
          format: date-time
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

````