add REST documentation for principals module

A group can be a member as well. We want a `BasicUser|BasicGroup` enumeration here