Thank you for your assistance. Maybe helpful to remove the email property from the PUT /u/{username.json} in the documentation. Could save time spent on debugging ;-).
The thing with the confirmation mail: I read about it on another topic. I don’t get the point. Just in case, Discourse is an application of many others in the project and the authentication of users is handled by a custom-made auth server (like my case). The auth server handles email confirmation. The applications should just do, what the auth server says. This is in my opinion the normal way. Otherwise it comes with multiple confirmation mails, different datasets…
Then you need to configure it to tell discourse that the email address has been validated and not update email on the API, but on your authentication server.