Lookup
Resolve a UUID to its mutable attributes — display name, last-known email. Token consumers don't normally need this; the JWT carries the UUID and consumers fetch attributes only when they're about to render them to a human.
M1 stub. The lookup endpoint ships in M7. Submitting this form does nothing yet.
Why attributes aren't in the token
Email and display name change. Tokens are signed and short-lived (~5 min) but cached in memory by consumers; baking mutable data into them risks staleness and re-issuance pressure. The token carries only the immutable UUID; attributes are pulled on-demand from this endpoint, which can return fresh values without touching the signing key.