GET /api/admin/users
Retrieve a complete list of all users in the system. This endpoint is restricted to administrators only.
This endpoint requires ADMIN role. Regular users will receive a 403 Forbidden error.
Authentication
This endpoint requires:
- Valid JWT token in the Authorization header
- User must have ADMIN role
Authorization: Bearer <admin-token>
Response
Returns an array of user objects.
Array of user objects
LOCAL, GOOGLE, MICROSOFT, or APPLE
Email verification timestamp
Account creation timestamp
Example Request
curl -X GET http://localhost:3000/api/admin/users \
-H "Authorization: Bearer <admin-token>"
const response = await fetch('http://localhost:3000/api/admin/users', {
method: 'GET',
headers: {
'Authorization': `Bearer ${adminToken}`
}
});
const users = await response.json();
Example Response
[
{
"id": "user-uuid-1",
"email": "[email protected]",
"firstName": "John",
"lastName": "Doe",
"role": "USER",
"isActive": true,
"subscription": "FREE",
"authProvider": "LOCAL",
"emailVerified": "2024-01-15T10:00:00.000Z",
"createdAt": "2024-01-15T10:00:00.000Z",
"lastLogin": "2024-01-20T14:30:00.000Z"
},
{
"id": "user-uuid-2",
"email": "[email protected]",
"firstName": "Jane",
"lastName": "Smith",
"role": "USER",
"isActive": true,
"subscription": "PRO",
"authProvider": "GOOGLE",
"emailVerified": "2024-01-16T09:15:00.000Z",
"createdAt": "2024-01-16T09:15:00.000Z",
"lastLogin": "2024-01-21T08:45:00.000Z"
},
{
"id": "admin-uuid-3",
"email": "[email protected]",
"firstName": "Admin",
"lastName": "User",
"role": "ADMIN",
"isActive": true,
"subscription": "PRO",
"authProvider": "LOCAL",
"emailVerified": "2024-01-01T00:00:00.000Z",
"createdAt": "2024-01-01T00:00:00.000Z",
"lastLogin": "2024-01-21T10:00:00.000Z"
}
]
Error Responses
{
"statusCode": 403,
"message": "Forbidden resource"
}
{
"statusCode": 401,
"message": "Unauthorized"
}
Security Considerations
- Password hashes are never included in the response
- Sensitive fields like reset tokens are excluded
- This endpoint is protected by both JWT authentication and role-based authorization
- All admin actions should be logged for audit purposes
Use Cases
User Management
Display all users in an admin dashboard
User Analytics
Analyze user registration trends and activity
Subscription Tracking
Monitor FREE vs PRO subscription distribution
Support
Look up user accounts for customer support
Delete User
Permanently delete a user account
Reset Password
Reset a user’s password
