I was going to comment on this, but I guess I forgot.

Yes, I couldn't decide if we should return users or app_users.

Also, this makes me think: should the search API be under app_users too?