API: Trouble getting list of users

[thalix]

I have problems getting a list of all users from the API.
This works:

curl -H "Authorization: Bearer xxxxxxxx-1c44-44b0-847c-xxxxxxxxxxxx" http://localhost:4567/api/categories?_uid=1

This won't work:

curl -H "Authorization: Bearer xxxxxxxx-1c44-44b0-847c-xxxxxxxxxxxx" http://localhost:4567/api/users?_uid=1

{"status":{"code":"not-authorised","message":"A valid login session was not found. Please log in and try again."},"response":{}}

What I am doing wrong?

[thalix]

Is there really no way to get the user list without going all the way through CSFR tokens, login, session, etc? That would not really be a REST API. Or have I understood something completely wrong? That's a knockout criteria for us.

[thalix]

I found a good way to get the user list out of mongodb. In case anyone need it:

async function doMongoDb() {

  const { MongoClient } = require("mongodb");
  const username = encodeURIComponent("admin");
  const password = encodeURIComponent("mypassword");
  const clusterUrl = "localhost:27017";
  const authMechanism = "DEFAULT";
  const uri = `mongodb://${username}:${password}@${clusterUrl}/?authMechanism=${authMechanism}`;
  const client = new MongoClient(uri, { useNewUrlParser: true, useUnifiedTopology: true });

  try {
    await client.connect();
    const database = client.db("nodebb");
    const objects = database.collection("objects");

    // get all user
    const query = { _key: /^user:\d+$/ };
    // select fields we want to see
    const options = {
      projection: { _id: 0, username: true, _id: false, email: true, "email:confirmed": true, joindate: true, fullname: true },
    };

    const cursor = objects.find(query, options);
    if ((await cursor.count()) === 0) {
      console.log("No user found!");
    }

    // iterate over the users
    await cursor.forEach(user => {
      if (user["email:confirmed"] == 1 ) {
        console.dir(user);
      }
    });

  } finally {
    // make sure we close the connection
    await client.close();
  }
}
// ---------------------------------------------------


function init() {
  try {

    doMongoDb();

  } catch(e) {
    console.log(e);
  }
}
// ---------------------------------------------------


init();