API: No way to determine which users have access to a board when all_access is false

[adamdill]

API: No way to determine which users have access to a board when all_access is false

Summary

The board object returned by the API includes an all_access boolean field, but when all_access is false (i.e. the board has limited user access), there's no API endpoint to retrieve which users actually have access to that board.

Current behavior

• GET /{account_id}/users returns all active users in the account
• GET /{account_id}/boards/{board_id} returns the board object with all_access: true|false
• When all_access is true, you can infer that all account users have access
• When all_access is false, there is no way via the API to determine which users are allowed on that board

Expected behavior

There should be a way to retrieve the users who have access to a specific board. A few possible approaches:

1. New endpoint: GET /{account_id}/boards/{board_id}/users — returns the list of users with access to the board
2. Include users in board response: Add a users array to the board JSON when all_access is false
3. Filter param on existing endpoint: GET /{account_id}/users?board_id={board_id} — filter the account users list by board access

Why this matters

For any integration that needs to respect board-level access control — assigning cards, building user pickers scoped to a board, syncing permissions with external tools — you currently can't tell who is allowed where. The internal data model already supports this (AGENTS.md references "Board-level access control via Access records"), so this would be a matter of exposing what's already there.

Additional context

Of the three approaches, I'd lean toward (1) — a dedicated /{account_id}/boards/{board_id}/users endpoint. Modeling board-user access as its own resource opens the door for future REST operations like POST to grant a user access to a board or DELETE to revoke it, rather than having to manage access through a less discoverable side channel.

Happy to help with a PR if there's a preferred approach.