Only the User associated with the APIKey will returned. I aspect all users had to be return. Example: curl -H "X-Authorization: Bearer _____APIKEY_____" "https://www.example.de/index.php?option=com_api&app=users&resource=user&format=raw&limit=99"