add REST documentation for principals module

`joinable` and `visibility` are optional too