Fix openapi specs for user endpoints (#1892, #1894)