diff --git a/src/api2/access/user.rs b/src/api2/access/user.rs
index 72c79def..9ac9bbfa 100644
--- a/src/api2/access/user.rs
+++ b/src/api2/access/user.rs
@@ -1,4 +1,4 @@
-use anyhow::{bail, Error};
+use anyhow::{bail, format_err, Error};
 use serde::{Serialize, Deserialize};
 use serde_json::{json, Value};
 use std::collections::HashMap;
@@ -94,7 +94,6 @@ impl UserWithTokens {
     }
 }
 
-
 #[api(
     input: {
         properties: {
@@ -113,7 +112,7 @@ impl UserWithTokens {
     },
     access: {
         permission: &Permission::Anybody,
-        description: "Returns all or just the logged-in user, depending on privileges.",
+        description: "Returns all or just the logged-in user (/API token owner), depending on privileges.",
     },
 )]
 /// List users
@@ -125,9 +124,12 @@ pub fn list_users(
 
     let (config, digest) = user::config()?;
 
-    // intentionally user only for now
-    let userid: Userid = rpcenv.get_auth_id().unwrap().parse()?;
-    let auth_id = Authid::from(userid.clone());
+    let auth_id: Authid = rpcenv
+        .get_auth_id()
+        .ok_or_else(|| format_err!("no authid available"))?
+        .parse()?;
+
+    let userid = auth_id.user();
 
     let user_info = CachedUserInfo::new()?;
 
@@ -135,7 +137,7 @@ pub fn list_users(
     let top_level_allowed = (top_level_privs & PRIV_SYS_AUDIT) != 0;
 
     let filter_by_privs = |user: &user::User| {
-        top_level_allowed || user.userid == userid
+        top_level_allowed || user.userid == *userid
     };