A discussion is underway about creating an API call to unmask all emails in Discourse. Geoffrey_Challen notes that this option is available in the web interface for administrators, but not through the API. zogstrip suggests using the browser console to capture the request made when clicking the unmask button, and pfaffman provides a link to the relevant documentation on reverse-engineering the Discourse API. With this guidance, Geoffrey_Challen successfully implements the API call, noting that the correct syntax is show_emails=true, rather than show_emails=1.
In the web interface there is an option for administrators to unmask all emails when examining the active user list. I don’t think that there is an API equivalent, although it would be useful. We have a case where we need to use email addresses as keys to synchronize our user list, and having to unmask each email one at a time generates enough API calls to (quickly) hit the built-in rate limiting.
Apologies if I missed this in the API documentation.
While it’s probably not in the API documentation (I haven’t checked), you can open your browser’s console and see the request made when clicking the unmask button as admin.
Then you’ll be able to use that same query in your code 
Here’s the documentation: Reverse engineer the Discourse API.
Thanks so much guys! It’s working perfectly now.
FWIW, I was passing show_emails=1 as part of the query string, when what was needed was show_emails=true. Perhaps working with JavaScript has spoiled me WRT truthy values, but it would be nice the API was a bit more forgiving 
.