Add to the API a route that returns a user object when provided only profile data. This would still be within the scope of the same appId.
This is to provide multiauth capability, where someone auths without a userId, user context is found if there's a match with the profile, and user object is returned.