Just to supplement Mark's excellent reply: the security information isn't stored in the FME Server repository,but in the "fmeserver" database instance (Postgresql by default) notably in the tables fme_useraccount,fme_role,etc.
The REST API is definitely the best way to access it,however.
David
Admin guide here:
Have a look at the Security section under API
http://docs.亚搏在线safe.com/fme/html/FME_REST/v2/apidoc/index.html#