if you for example, call the API giving an user instead an organization login, the API can't distinguish between them and will return an "empty" organization with some user data