add REST documentation for principals module

That makes sense. Are there any PRs that are not dependent on the others? In that case, it might be worth keeping those separate to expedite the review process.