Replying just quickly on my phone: current_user_can('edit_user', $id) is called a meta cap. It maps to the correct real permission internally (edit_users/edit_profile or appropriate other permission).—
Sent from Mailbox for iPhone

On Sun, Apr 13, 2014 at 10:33 AM, Toby Champion <notifications@github.com>
wrote:

>> +	 * @return true on success
>> +	 */
>> +	function edit_user( $id, $data, $_headers = array() ) {
>> +		$id = (int) $id;
>> +
>> +		if ( empty( $id ) )
>> +			return new WP_Error( 'json_user_invalid_id', __( 'Invalid user ID (EMPTY).' ), array( 'status' => 404 ) );
>> +
>> +		// http://codex.wordpress.org/Function_Reference/get_userdata
>> +		$user = get_userdata( $id ); // returns False on failure
>> +
>> +		if ( ! $user )
>> +			return new WP_Error( 'json_user_invalid_id', __( 'Invalid user ID (COULD NOT LOAD).' ), array( 'status' => 404 ) );
>> +
>> +		// Permissions check
>> +		if ( ! current_user_can( 'edit_users' ) ) {
> `edit_user` is a capability: https://codex.wordpress.org/Roles_and_Capabilities#edit_users
> Should I check that AND check edit_user too, with the ID, even though it's not a built-in capability?
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/WP-API/WP-API/pull/128/files#r11562702