What’s he gonna do about it?

Sue them?

I don’t know the Immich API, but I’ve seen several REST APIs that used the usual pattern of

GET /api/v1/user/<id> - read user
POST /api/v1/user/ - create user
...

but also allowed

GET /api/v1/user/<id> - read user
GET /api/v1/user/?action=create - create user
...

imagining a giant Reese’s PB cup

There’s chocolate in my peanut butter in my chocolate!