How to query all NFts for a given account?

I'm using both the Accounts and Tokens SDK. After creating a NFT using a flow, I need to list all the NFTs this account has in the backend.

CreateNFTHouseTokenFlow.kt

@StartableByRPC
class CreateNFTHouseTokenFlow(
    private val noOfBedRooms: Short,
    private val address: String,
    private val price: Int,
    private val icon: String,
    private val name: String,
    private val holder: PublicKey
) : FlowLogic<Unit>() {
  @Suspendable
  @Throws(FlowException::class)
  override fun call() {
    val houseTokenState = HouseTokenState(/* ...arguments */)

    val transactionState = houseTokenState.withNotary(notary)
    subFlow(CreateEvolvableTokens(transactionState))

    val issuedHouseToken = houseTokenState
        .toPointer<HouseTokenState>()
        .issuedBy(ourIdentity)
        .heldBy(AnonymousParty(holder))

    subFlow(IssueTokensFlow(issuedHouseToken))
  }
}

Now, in the backend: Controller.kt

@GetMapping("/tokens/{user}")
    fun getUserTokens(@PathVariable user: UUID): ResponseEntity<String> {
        return try {
            val criteria = QueryCriteria
                .VaultQueryCriteria()
                .withExternalIds(listOf(user))

            val userNFTs = proxy
                .vaultQueryByCriteria(criteria, NonFungibleToken::class.java)
                .states

            ResponseEntity
                .status(HttpStatus.ACCEPTED)
                .body("tokens: $userNFTs")
        } catch (e: Exception) {
            ResponseEntity
                .status(HttpStatus.BAD_REQUEST)
                .body("exception: ${e.message}")
        }
    }

The code above returns an empty array. The problem seems to be related to the criteria. For some reason, Corda cannot combine the withExternalIds(listOf(user)) method with the NonFungibleToken::class.java method. If I remove the criteria, Corda can fetch all NonFungibleToken tokens (even those owned by other users).