Do not use doAsSuperUser in order to use API in SegmentQueryDecorator. Instead use new service-layer class that is not accessible from API and does not do access checking.