A user with the correct permission can use the users API

users.js

var router = require('express').Router();
router.use(require('permission.js')('manageUsers'));

/* GET users listing. */
router.get('/', function(req, res) {
  res.send('respond with a resource');
});

/* GET a user */
router.get('/:id', function(req, res) {
  res.send('This is the user id ' + req.params.id);
});

module.exports = router;