The management API includes user management methods. Before issuing a MAPI call, request and submit a CSRF token.