Interestingly, something like /admin/users/{id}.json doesn’t return the user’s email as part of the response, but getting a list of users (/admin/users/list/{flag}.json) does. If you pass a parameter like username, you can probably get the specific user.