--- a/controllers/routes.go	Thu Jul 26 20:06:45 2018 +0200
+++ b/controllers/routes.go	Fri Jul 27 11:05:03 2018 +0200
@@ -15,6 +15,10 @@
 	sysAdmin := auth.EnsureRole("sys_admin")
 
 	api.Handle("/users", sysAdmin(&JSONHandler{
+		Handle: listUsers,
+	})).Methods(http.MethodGet)
+
+	api.Handle("/users", sysAdmin(&JSONHandler{
 		Input:  func() interface{} { return new(User) },
 		Handle: createUser,
 	})).Methods(http.MethodPost)

--- a/controllers/user.go	Thu Jul 26 20:06:45 2018 +0200
+++ b/controllers/user.go	Fri Jul 27 11:05:03 2018 +0200
@@ -29,7 +29,7 @@
 	User struct {
 		User     string       `json:"user"`
 		Role     Role         `json:"role"`
-		Password string       `json:"password"`
+		Password string       `json:"password,omitempty"`
 		Email    Email        `json:"email"`
 		Country  Country      `json:"country"`
 		Extent   *BoundingBox `json:"extent"`
@@ -46,8 +46,19 @@
   ST_MakeBox2D(ST_Point($6, $7), ST_Point($8, $9)), $10)`
 
 	deleteUserSQL = `SELECT sys_admin.delete_user($1)`
+
+	listUsersSQL = `SELECT
+  rolename,
+  username,
+  country,
+  email_address,
+  ST_XMin(map_extent), ST_YMin(map_extent),
+  ST_XMax(map_extent), ST_YMax(map_extent)
+FROM sys_admin.list_users`
 )
 
+var errNoString = errors.New("Not a string")
+
 var (
 	// https://stackoverflow.com/questions/201323/how-to-validate-an-email-address-using-a-regular-expression
 	emailRe = regexp.MustCompile(
@@ -79,6 +90,15 @@
 	return string(e), nil
 }
 
+func (e *Email) Scan(src interface{}) (err error) {
+	if s, ok := src.(string); ok {
+		*e = Email(s)
+	} else {
+		err = errNoString
+	}
+	return
+}
+
 var (
 	validCountries = []string{
 		"AT", "BG", "DE", "HU", "HR",
@@ -106,6 +126,15 @@
 	return string(c), nil
 }
 
+func (c *Country) Scan(src interface{}) (err error) {
+	if s, ok := src.(string); ok {
+		*c = Country(s)
+	} else {
+		err = errNoString
+	}
+	return
+}
+
 var (
 	validRoles = []string{
 		"waterway_user",
@@ -119,6 +148,15 @@
 	return string(r), nil
 }
 
+func (r *Role) Scan(src interface{}) (err error) {
+	if s, ok := src.(string); ok {
+		*r = Role(s)
+	} else {
+		err = errNoString
+	}
+	return
+}
+
 func (r *Role) UnmarshalJSON(data []byte) error {
 	var s string
 	if err := json.Unmarshal(data, &s); err != nil {
@@ -257,3 +295,43 @@
 	}
 	return
 }
+
+func listUsers(
+	rw http.ResponseWriter, req *http.Request,
+	input interface{}, db *sql.DB,
+) (jr JSONResult, err error) {
+
+	var rows *sql.Rows
+
+	rows, err = db.Query(listUsersSQL)
+	if err != nil {
+		return
+	}
+	defer rows.Close()
+
+	var users []*User
+
+	for rows.Next() {
+		user := &User{Extent: &BoundingBox{}}
+		if err = rows.Scan(
+			&user.Role,
+			&user.User,
+			&user.Country,
+			&user.Email,
+			&user.Extent.X1, &user.Extent.Y1,
+			&user.Extent.X2, &user.Extent.Y2,
+		); err != nil {
+			return
+		}
+		users = append(users, user)
+	}
+
+	jr = JSONResult{
+		Result: struct {
+			Users []*User `json:"users"`
+		}{
+			Users: users,
+		},
+	}
+	return
+}