If you look at /routes/api.js, you see the endpoints that you can access already.
One of them is /api/user//followers
But in line 179 you see app.get("/api/users", smw, anyReadAuth, listUsers);
so it turns out that the user list is already available. listUsers is defined