---
title: "Clickhouse Customer Users List"
method: GET
path: "/clickhouse/customer-users/"
tags: ["users"]
---

# Clickhouse Customer Users List

`GET /clickhouse/customer-users/`

Mixin for views that need superadmin access to all resources.

Provides FOUR key features (all bundled - no separate mixins needed):
1. Queryset routing (superadmin sees all, regular user sees own org)
2. Organization injection (post/patch/put auto-inject org)
3. Object ownership checking (auto-registers ObjectOwnershipPermission)
4. Superadmin-only field protection (certain fields can only be modified by superadmins)

Inherits from:
- ObjectOwnershipMixin: Config attributes + auto-permission registration
- OrganizationInjectionMixin: Cross-org write protection + org injection

Config attributes (inherited from ObjectOwnershipMixin):
- ownership_object_field_name: Field on object (default: "organization_id")
- ownership_user_field_name: Field on user (default: "curr_org_id")
- is_allowing_global_object_read: Allow reading global objects (default: False)
- is_allowing_org_admin_access: Allow org admins access to any object in their org (default: False)
- is_requiring_org_admin_for_write: Require org admin for writes (default: False)

Config attributes (superadmin-only fields):
- superadmin_only_fields: List of field names that only superadmins can modify (default: [])
  On CREATE: Fields are stripped from non-superadmin requests (model defaults apply)
  On UPDATE: Non-superadmins trying to change these fields get PermissionDenied

- superadmin_lock_field: Field name that locks the entire object for non-superadmins (default: None)
  When this field is truthy on the instance, non-superadmins cannot modify ANY field.
  Common use case: is_managed=True means Keywords AI manages this resource, users can't edit it.

Note: Writing to global objects (ownership field is None) always requires superadmin.

Usage (detail view):

    class MyDetailView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
        # Optional: customize ownership config (inherited from ObjectOwnershipMixin)
        is_allowing_global_object_read = True

        def get_regular_user_queryset(self):
            return MyModel.objects.filter(organization_id=self.request.user.curr_org_id)

        def get_superadmin_queryset(self):
            return MyModel.objects.all()

Usage (superadmin-only fields):

    class IntegrationView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
        superadmin_only_fields = ['is_managed']  # Only superadmins can modify is_managed
        superadmin_lock_field = 'is_managed'  # When is_managed=True, object is locked for non-superadmins

        def get_regular_user_queryset(self):
            return Integration.objects.filter(organization_id=self.request.user.curr_org_id)

        def get_superadmin_queryset(self):
            return Integration.objects.all()

Usage (related-object org pattern like PromptVersion - PREFERRED: annotate queryset):

    from django.db.models import F

    class PromptVersionView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
        def get_regular_user_queryset(self):
            # Annotate organization_id so ownership checks work automatically
            return PromptVersion.objects.filter(
                prompt__organization_id=self.request.user.curr_org_id
            ).annotate(organization_id=F("prompt__organization_id"))

        def get_superadmin_queryset(self):
            return PromptVersion.objects.annotate(organization_id=F("prompt__organization_id"))

Alternative (override method - only if annotation not possible):

    class PromptVersionView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
        def get_affiliated_object_organization_id(self, instance):
            return instance.prompt.organization_id  # Org is on parent object

DO NOT use inline checks like this:
    # ❌ BAD - easy to forget in branching code
    def get_queryset(self):
        if has_staff_role(self.request.user):
            return MyModel.objects.all()
        return MyModel.objects.filter(...)

## Query parameters

- `page` integer
- `page_size` integer

## Headers

- `Authorization` string, required

## Response `200`

- PaginatedCustomerUserListList
  - `count` integer, required
  - `next` string, uri, nullable
  - `previous` string, uri, nullable
  - `total_count` integer
  - `current_filters` FilterParamDictPydantic — Pydantic model for FilterParamDict. A dictionary that maps metric names to their filter parameters. Each key is a metric name (str), and each value can be: - A single MetricFilterParamPydantic (one condition) - A List[MetricFilterParamPydantic] (multiple conditions for same metric) - A FilterBundlePydantic (nested filter bundle with connector) Note: Uses extra="allow" for dynamic metric name fields. The __pydantic_extra__ annotation tells Pydantic what types to expect for extra fields, and generates typed additionalProperties in JSON Schema.
  - `filters_data` PaginatedCustomerUserListListFiltersData
  - `results` CustomerUserList[], required
    - `id` string, required
    - `environment` string, required
    - `customer_identifier` string, required
    - `unique_organization_id` string
    - `name` string
    - `email` string
    - `first_seen` string, date-time, required
    - `last_active_timeframe` string, required
    - `active_days` integer, required
    - `number_of_requests` integer, required
    - `total_requests` integer, required
    - `total_tokens` integer, required
    - `tokens` integer, required
    - `total_cost` number, double, required
    - `cost` number, double, required
    - `average_latency` number, double, required
    - `average_ttft` number, double, required
    - `average_monthly_cost` string, required
    - `period_budget` string, required
    - `budget_duration` string, required
    - `total_budget` string, required

---

[API](https://skmtc.net/keywordsai/apis/api-reference.md) · [All operations](https://skmtc.net/keywordsai/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keywordsai/api-reference/versions/c26d550029f8/schema)