i had similar problem but i managed to figure it out.
the problem is that you didn’t give permission to find the user.
under: settings/USERS & PERMISSIONS PLUGIN/Roles/ Authenticated /users-permissions
enable find user.
and i think in your data you are trying to post change “user” to “users-permissions_user” because this is how you named the field .