---
title: "List all Database Users"
method: GET
path: "/v2/databases/{database_cluster_uuid}/users"
tags: ["DigitalOcean-public.v2-new_Databases"]
---

# List all Database Users

`GET /v2/databases/{database_cluster_uuid}/users`

To list all of the users for your database cluster, send a GET request to
`/v2/databases/$DATABASE_ID/users`.

Note: User management is not supported for Caching or Valkey clusters.

The result will be a JSON object with a `users` key. This will be set to an array
of database user objects, each of which will contain the standard database user attributes.
User passwords will not show without the `database:view_credentials` scope.

For MySQL clusters, additional options will be contained in the mysql_settings object.

For MongoDB clusters, additional information will be contained in the mongo_user_settings object

## Path parameters

- `database_cluster_uuid` string, uuid, required

## Response `200`

A JSON object with a key of `users`.

- object
  - `users` DatabaseUser[]
    - `name` string, required — The name of a database user.
    - `role` 'primary' | 'normal' — A string representing the database user's role. The value will be either "primary" or "normal".
    - `password` string — A randomly generated password for the database user.<br>Requires `database:view_credentials` scope.
    - `access_cert` string — Access certificate for TLS client authentication. (Kafka only)
    - `access_key` string — Access key for TLS client authentication. (Kafka only)
    - `mysql_settings` MysqlSettings
      - `auth_plugin` 'mysql_native_password' | 'caching_sha2_password', required — A string specifying the authentication method to be used for connections to the MySQL user account. The valid values are `mysql_native_password` or `caching_sha2_password`. If excluded when creating a new user, the default for the version of MySQL in use will be used. As of MySQL 8.0, the default is `caching_sha2_password`.
    - `settings` UserSettings
      - `pg_allow_replication` boolean — For Postgres clusters, set to `true` for a user with replication rights. This option is not currently supported for other database engines.
      - `opensearch_acl` object[] — ACLs (Access Control Lists) specifying permissions on index within a OpenSearch cluster.
        - `index` string — A regex for matching the indexes that this ACL should apply to.
        - `permission` 'deny' | 'admin' | 'read' | 'readwrite' | 'write' — Permission set applied to the ACL. 'read' allows user to read from the index. 'write' allows for user to write to the index. 'readwrite' allows for both 'read' and 'write' permission. 'deny'(default) restricts user from performing any operation over an index. 'admin' allows for 'readwrite' as well as any operations to administer the index.
      - `acl` object[] — ACLs (Access Control Lists) specifying permissions on topics within a Kafka cluster.
        - `id` string — An identifier for the ACL. Will be computed after the ACL is created/updated.
        - `topic` string, required — A regex for matching the topic(s) that this ACL should apply to.
        - `permission` 'admin' | 'consume' | 'produce' | 'produceconsume', required — Permission set applied to the ACL. 'consume' allows for messages to be consumed from the topic. 'produce' allows for messages to be published to the topic. 'produceconsume' allows for both 'consume' and 'produce' permission. 'admin' allows for 'produceconsume' as well as any operations to administer the topic (delete, update).
      - `mongo_user_settings` object — MongoDB-specific settings for the user. This option is not currently supported for other database engines.
        - `databases` string[] — A list of databases to which the user should have access. When the database is set to `admin`, the user will have access to all databases based on the user's role i.e. a user with the role `readOnly` assigned to the `admin` database will have read access to all databases.
        - `role` 'readOnly' | 'readWrite' | 'dbAdmin' — The role to assign to the user with each role mapping to a MongoDB built-in role. `readOnly` maps to a [read](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-read) role. `readWrite` maps to a [readWrite](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-readWrite) role. `dbAdmin` maps to a [dbAdmin](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-dbAdmin) role.

## Other responses

- `401` — Authentication failed due to invalid credentials.
- `404` — The resource was not found.
- `429` — The API rate limit has been exceeded.
- `500` — There was a server error.
- `default` — There was an unexpected error.

---

[API](https://skmtc.net/digitalocean/apis/digitalocean-api.md) · [All operations](https://skmtc.net/digitalocean/apis/digitalocean-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/digitalocean/digitalocean-api/versions/cb3bf9b21459/schema)