/v1/users returns a 200 status code for unknown users

[poisa]

Hi!

I'm calling the GET users endpoint and searching by email (https://harvest.greenhouse.io/v1/users?email=). What I'm getting is not consistent from this endpoint.

1. If I look for my own email address I get a 200 and my user record is returned. I expected this.
2. If I look for [email protected] I get a 403. I expected this as well since this account does not exist.
3. If I look for [email protected] I get a 200 with an empty array [] as the body. I did not expect this because this account also doesn't exist.

There are MANY bogus addresses that return a 200 and this is what's breaking reliability on this endpoint. For example, searching by all these addresses return a 200 with [] as the body:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

There is another case where a a 200 with [] as the body is returned. In my company we have Gmail accounts that are aliased to another domain. So for example, we have [email protected] and those are aliased to [email protected]. If a Greenhouse user is registered and has both aliases set for their email address, then it all works fine. However, if a user only has the primary email address assigned and you search for them using the alias, a 200 with [] as the body is returned.