/api/roles is returning an array of users that are assigned the role

[pushpabrol]

/api/roles returns all the roles and under each role it is returning a "users" attribute that is apparently every user assigned to the role. If someone has a large amount of user say ~ 100K+ users. This endpoint will return a very large payload.

The correct way might be to provide this information under GET /api/roles/{role_id} or GET /api/roles/{role_id}/members

[jmward1978]

I think the second option might be preferable.

GET /api/roles/{role_id}/members 

It shouldn't affect the currently existing behavior of

GET /api/roles/{role_id}

[ShigeruNakagaki]

When I want to add roles to a user, I need the role id, so I call /api/roles beforehand, then it returns unnecessary "users" too. This is so costly.

[reggiepangilinan-s5]

I also have the same concern

We should have an endpoint that just returns a pure list of roles, not the entire database association. coz this will be very costly.

[nfadili]

I have a tangential question regarding this: the users field being discussed here is not documented in the get all roles endpoint in the API docs. Is this field safe to rely on or might it be removed without warning?