great. so in that case /user/api should work whilst the access token is still valid.