[api] User endpoint