You must supply either username or password in the query string.
Duplicate Email Addresses
Although the same email address can be shared by multiple users, this endpoint will only return the first match when searching by email. The
/api/peopleendpoint should be used in place of this if you believe multiple users will be returned.