This might be an issue in core, and if so I can make an issue in github, but the API appears to have a bug dealing with numerical usernames. As it allows calls to /api/users using the ID or username, if a numerical username is used it will check type and do lookup on the ID only. This is my assumption based on testing, example below.
e.g.
GET /api/users/2
Returns HTTP 200
GET /api/users/8128084
Returns HTTP 404
Change the username and add a character to the number, and the api call starts working.
e.g.
GET /api/users/8128084s
Returns HTTP 200