restrict user api to production_centre_id and name