add REST documentation for principals module

Global admins are always private