Principals

Identities -- listing, creating, amending and removing.

Operation	Auth	Purpose
GET /api/principals	Bearer + DPoP	List principals of one type.
POST /api/principals	Bearer + DPoP	Create a password, LDAP or group principal by name.
POST /api/principals/xauth	Bearer + DPoP	Create an externally-authenticated (XAuth) principal. Idempotent by exact id.
GET /api/principals/{id}	Bearer + DPoP	Read one principal by id.
DELETE /api/principals/{id}	Bearer + DPoP	Remove a principal -- DISABLING it first and REASSIGNING ITS KEYS to a recipient.
GET /api/principals/{id}/roles	Bearer + DPoP	List the roles a principal holds, with names where the catalogue resolves them.
PUT /api/principals/{id}/roles	Bearer + DPoP	REPLACE the whole set of roles a principal holds.
PUT /api/principals/{id}/flags	Bearer + DPoP	Set named boolean flags on a principal, by read-modify-write.