It looks like capi-release v1.45.0 (API v2.99.0) introduced an "experimental" origin field to several APIs including PUT v2/organizations/:guid/users. Despite being "experimental", these changes make it absolutely necessary for someone to include the origin field in all requests which operate on users which are in multiple origins (e.g. local UAA and LDAP), otherwise the API request will fail because CAPI can't disambiguate the user.
Please see tracker #3704323.
Also, see the Slack conversation