Ah, sorry I read your original post wrong. I thought it was createdAt and updatedAt that you were looking for, when you are actually looking for createdBy and updatedBy. I believe there is currently a long running bug with bringing back a user relationship in the api. Don’t remember the specifics (I’ll try to link the ticket when I find it) but I believe there is a sanitize method being called on the api that strips out any of the user data before it sends the response back to you. I think they hadn’t best decided on how to handle these situations when the user object could contain sensitive data. I think the current best way to fix this is to override your api endpoint and modify it to include your user data.
Edit: Link to the issue on github Population does not work for Users in Users-Permissions · Issue #11957 · strapi/strapi · GitHub