# Scope "users:show" does not include admin routes

**URL:** <https://meta.discourse.org/t/scope-users-show-does-not-include-admin-routes/415809>\
**Category:** Bug\
**Tags:** rest-api\
**Created:** [October 26, 2026, 10:40pm UTC](https://meta.discourse.org/t/scope-users-show-does-not-include-admin-routes/415809 "2026-10-26T22:40:39Z")\
**Posts on this page:** 1\
**Page:** 1

## AI-generated summary

[johann150](/t/-/415809/1) reports a bug where the `users:show` scope for REST API tokens does not include the `/admin/users/:id.json` route, despite it being the only available endpoint to access a user by their unique ID. The user notes that this URL is missing from the help popup's permitted URLs and cannot be found under any other permission. This behavior contrasts with other scopes, such as `badges:list` or `groups:manage_groups`, which generally include relevant admin routes in their permitted URLs.

<div class="post-metadata">

**Author:** ![johann150](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@johann150](https://meta.discourse.org/u/johann150)\
**Post date:** [October 26, 2026, 10:40pm UTC](https://meta.discourse.org/t/scope-users-show-does-not-include-admin-routes/415809/1 "2026-10-26T22:40:39Z")

</div>

When creating a scoped token for the REST API, I want to be able to access a user by their unique ID, for which the API currently only provides `/admin/users/:id.json`. So I want to permit this route on a granular API token.

However, this URL is not included in the permitted URLs when I check the help popup for the users:show permission. I could also not find any other permission which would permit this URL. It seems that generally admin routes are included for other scopes, e.g. badges:list or groups:manage\_groups.