Very frustrating box and pretty straightforward once you get the initial foothold. It is just some credentials reuse stuff…
To get the initial foothold easily, don’t be like me and sometimes, try to add some file extensions to your enumeration dictionary.
I saw that a lot of people are not confident enough with curl syntax in that thread. If so, just use something like Postman or Insomnia which are designed to handle REST api.
Be brave and try harder, you will do it 