Been trying this for a while and can't for the sake of God figure it out.
I try to call /api/user/<USERID>

with a payload such as

{
    "user": {
        "email": "emudojo@gmail.com",
         "username": "caperusita",
          "verified": false
    }
}

knowing that both the email and username exists, I scoped my API_KEY left all permissions open like my office window's, disabled CORS and I'm sending

authorization
content-type
X-FusionAuth-TenantId

with correct values, then the API happily responds with a 200, which makes me believe it went OK, then.... NOTHING WAS updated, been trying to set new paswords, change data/.... nothing nada....

what am I doing wrong ?