I don't know the Immich API, but I've seen several REST APIs that used the usual pattern of
GET /api/v1/user/<id> - read user
POST /api/v1/user/ - create user
...
but also allowed
GET /api/v1/user/<id> - read user
GET /api/v1/user/?action=create - create user
...
What’s he gonna do about it?
Sue them?