/v1/users/{user}/{endpoint}: the routes an offline recovery key holder uses without any device (docs/recovery-key-reset.md). Never ServerAuth-signed.
/v1/users/{user}/{endpoint}