The endpoint is `users` (plural) not `user`