API bug : final "." in username causes error

I think so. I used How to reverse engineer the Discourse APIv to figure out the path. And then, I guess, looked at the source to see that the user ID and email address also work.

Yes, sso only updates groups on login, so api is your solution.