diff --git a/nicohack202002/uncloud/api/models.py b/nicohack202002/uncloud/api/models.py
index 71a8362..7288ecf 100644
--- a/nicohack202002/uncloud/api/models.py
+++ b/nicohack202002/uncloud/api/models.py
@@ -1,3 +1,6 @@
 from django.db import models
 
 # Create your models here.
+
+class CreditCard(models.Model):
+    pass
diff --git a/nicohack202002/uncloud/api/views.py b/nicohack202002/uncloud/api/views.py
index d7f3dae..c9b1e57 100644
--- a/nicohack202002/uncloud/api/views.py
+++ b/nicohack202002/uncloud/api/views.py
@@ -3,17 +3,30 @@ from django.shortcuts import render
 # Create your views here.
 
 from django.contrib.auth.models import User, Group
-from rest_framework import viewsets
+from rest_framework import viewsets, permissions
+
 from api.serializers import UserSerializer, GroupSerializer
 
+class CreditCardViewSet(viewsets.ModelViewSet):
+
+    """
+    API endpoint that allows credit cards to be listed
+    """
+    queryset = User.objects.all().order_by('-date_joined')
+    serializer_class = UserSerializer
+
+    permission_classes = [permissions.IsAuthenticated]
+
 
 class UserViewSet(viewsets.ModelViewSet):
+
     """
     API endpoint that allows users to be viewed or edited.
     """
     queryset = User.objects.all().order_by('-date_joined')
     serializer_class = UserSerializer
 
+    permission_classes = [permissions.IsAuthenticated]
 
 class GroupViewSet(viewsets.ModelViewSet):
     """
@@ -21,3 +34,5 @@ class GroupViewSet(viewsets.ModelViewSet):
     """
     queryset = Group.objects.all()
     serializer_class = GroupSerializer
+
+    permission_classes = [permissions.IsAuthenticated]