Users portlet: endpoints audit and feature parity matrix

[hmoreras]

Goal

Before implementation starts, inventory the backend surface that supports the Users portlet, verify parity with the target UX, and identify any gaps that would require backend work.

Deliverables

1. Endpoint inventory — every REST/GraphQL endpoint touched by the portlet, with method, path, auth, request/response shape.
2. Feature parity matrix — target UX (from the Users portlet design prototype) mapped to available endpoints; gaps marked explicitly.
3. Gaps list — separate follow-up tickets filed for anything missing.
4. Permissions iframe contract — URL, query params, resize/close events.

Endpoints to inventory (baseline — extend as discovered)

• Users list / search / filter / paginate / sort
• Get user by id
• Create / update / delete user
• Password: set + server-side generator
• Active flag
• Roles: system role tree, user's granted roles, assign, unassign
• Access flags: CMS Admin, Back-end, Front-end, Can Login to Admin UI, Show Getting Started
• Permissions: current iframe entry URL + expected params
• API tokens: list (active/inactive), create (label, expires, CIDR), revoke
• Bulk delete, Add to Bundle

Feature parity matrix template

Feature (from prototype)	Endpoint	Status	Notes
List users with pagination	GET /api/v1/users/...	Available / Missing / Partial	...

Acceptance criteria

• Endpoint inventory posted in this ticket
• Feature parity matrix committed to the ticket body
• Gaps list published; each gap has a follow-up ticket linked
• Permissions iframe URL + params confirmed on a local environment
• Recommendations posted for the FE implementation (batching, pagination strategy, sort field names)

Design references

Interactive prototype: https://claude.ai/design/p/324a0e09-34dc-4925-a7fa-24f39fdafa54?via=share&file=Users.html