In reply toby Jan Boddez
Interestingly, it seems that isn’t what gets exposed through the API. I don’t think I have any specific limits on the WP API. When I look at the API call to list my site’s users it lists authors, but not by their user names. Listed are the user’s chosen name shown on blogposts and a slug that seems to be based on roles. Whereas the AP plugin did expose the actual usernames I log in with. Users in my site that don’t have postings attached to them are also not listed at all.
Just FYI, but if you don’t disable (parts of) WordPress’s JSON API, these usernames are already exposed to the public.