Either 'id' or 'username' must be provided, but not both