Apparently it’s an overzealous anti-spam default. I changed trust level required for User API from TL2 to TL1.