Expose REST for flagged users