[Freeipa-users] Minimum Privileges to list OTP already-created token users via API (otptoken_find)

Hi, Does anyone know how to create user with the minimum privileges to list the users which have any OTP token created? I need to obtain this list via API (otptoken_find). It should be something alternative to assign "Full admin user" role. Thanks!