Check the permission for Users-permissions in API Tokens there should be allowed to find users.
Users-permissions
API Tokens