Track REST API coverage gaps (roadmap: Reports/PfbApiCoverageRoadmap.md) #46

Umbrella tracking issue for closing FlashBlade REST API coverage gaps found by
Reports/PfbApiDriftReport.md.

Numbers live in the drift report, not here. This issue carries the ranking and the
ownership map only. Current figures (regenerated 2026-08-02 against REST 2.0-2.28):
96 uncovered endpoints, 438 endpoints with parameter gaps, 422 addable body fields.

Claim a task by assigning yourself.

Done

• -Limit is ignored under AutoPaginate — paginator has no running-total guard #30 — -Limit ignored under AutoPaginate (PR Fix: -Limit ignored under AutoPaginate (#30) #48)
• Write cmdlets silently drop documented body parameters (~48 New-*/Update-* cmdlets) #31 — Write cmdlets drop documented body parameters — 56 cmdlets (PR Write cmdlets: add typed body/query parameters for 56 New-*/Update-* cmdlets #66)
• Centralize -Limit/-Sort/-Filter/-TotalOnly query-param handling in Invoke-PfbApiRequest #32 — Centralize -Limit/-Sort/-Filter/-TotalOnly (PR Centralize -Filter/-Sort/-Limit/-TotalOnly query params (#32) #49)
• Migrate cmdlets to centralized query-param handling #33 — Migrate remaining Get-Pfb* to the helper (PR Migrate remaining Get-Pfb* cmdlets to Add-PfbCommonQueryParams (#33) #51; 205/215, 0 hand-rollers)
• User & group quota policy cmdlets (user-group-quota-policies + reporting reads) #34 — User & group quota policies, 19 endpoints (PR Add user & group quota policy cmdlets (#34) #68)

Correctness (bugs in shipping cmdlets — ahead of net-new capability)

• Dead names query key breaks -Name on five array-connection cmdlets and Update-PfbAsyncLog (unfiltered-PATCH risk falsified by live testing) #64 — Update-PfbArrayConnection sends an undocumented names key; the default
  parameter set may issue an unfiltered PATCH. Highest severity open item.
• Update-PfbSmtp targets a nonexistent 2.x path; consolidate the SMTP cmdlets onto /smtp-servers #80 — Update-PfbSmtp targets a 2.x path that does not exist; consolidate onto
  /smtp-servers. Also satisfies Miscellaneous endpoint coverage (login-banner, smtp PATCH, fs performance, presets/workload, …) #45's smtp-servers PATCH box.
• New-PfbFilesystem: safe-by-default creation (no implicit exports, snapshot dir, or open SMB permissions) #55 — New-PfbFilesystem creates implicit exports, snapshot dir, open SMB policy.
• Follow-up scope for #31 (write-cmdlet body parameters): everything deliberately deferred #65 — residual write-cmdlet body parameters: 95 cmdlets / 96 endpoints still
  have addable body fields (top: Update-PfbFileSystem 20, New-PfbCertificate 16,
  Set-PfbPresetWorkload 14, New-PfbActiveDirectory 13).

Capability families — live-testable on the 2.26 lab today

• Object-store & bucket write operations (bucket-replica-link create/modify, object-store PATCH) #35 — Object-store & bucket write operations (8 endpoints, 2.0-2.17) — P1
• Local directory services — local user/group cmdlets #36 — Local directory services users/groups (10, 2.24) — P1
• RBAC & admin-lifecycle cmdlets (management-access-policies, management-authentication-policies, admin create/delete) #37 — RBAC & admin lifecycle (27, 2.15-2.26) — P2 ⚠ 403 lab blocker on the
  management-access-policies subset
• Fusion Fleet/Realm management cmdlets (realm-connections, topology-groups, remote-realms) #38 — Fusion Fleet/Realm object management (17 of 18, 2.25-2.26) — P2.
  All 7 topology-group endpoints are 2.26 and testable. Owes a binding contract to
  Implement Fusion context_names injection #25: Get-PfbTopologyGroup must emit a top-level Name.
• Software upgrade & support-management cmdlets (software-bundle, software-patches, support-diagnostics) #39 — Software upgrade & support management (7, 2.24-2.26) — P3
• Certificate-group membership & KMIP server cmdlets #40 — Certificate-group membership & KMIP (4, 2.0-2.1) — P3
• Data-eviction attachment & file-system junction cmdlets #41 — Data-eviction attachment & FS junctions (6, 2.21/2.25) — P3
• TLS-policy ↔ network-interface binding cmdlets #42 — TLS-policy <-> network-interface binding (4, 2.17) — P4, smallest
• Miscellaneous endpoint coverage (login-banner, smtp PATCH, fs performance, presets/workload, …) #45 — Miscellaneous singletons (6 remaining, 2.0-2.23) — P5

Blocked

• Batch-operation cmdlets (nodes, resource-accesses, workload-tags, fleet-members) #44 — Batch operations. Blocked on Capability map records no body fields for array-bodied endpoints (schema walk never descends through items) #82 (via Tracking: coordinated changes to the capability-map generator and schema (#71, #82, #83, contextScope) #84 PR 1): the capability map records
  zero body fields for all four array-bodied endpoints, so the drift report cannot
  inform the parameter design and Assert-PfbApiCapability cannot version-gate them.
• Config-validation (test) PATCH cmdlets for AD/SAML/directory-services #43 — Config-validation (test) PATCH. Two of three testable; active-directory/test
  is 2.27.

Cannot be live-tested until 2.27+ firmware is available

• POST /fleets/members/batch (2.27) — currently double-listed on Fusion Fleet/Realm management cmdlets (realm-connections, topology-groups, remote-realms) #38 and Batch-operation cmdlets (nodes, resource-accesses, workload-tags, fleet-members) #44
• PATCH /active-directory/test (2.27) — on Config-validation (test) PATCH cmdlets for AD/SAML/directory-services #43

Adjacent trackers (not children of this issue)

• Tracking: coordinated changes to the capability-map generator and schema (#71, #82, #83, contextScope) #84 — capability-map generator/schema changes (Capability map records 5 body fields with introducedVersion one release too late (MaxDepth=8 truncation in fb2.12-2.16) #71, Capability map records no body fields for array-bodied endpoints (schema walk never descends through items) #82, Capability map cannot record array-body cardinality constraints (minItems/maxItems/uniqueItems) — needs schemaVersion 2 #83, contextScope). Batch-operation cmdlets (nodes, resource-accesses, workload-tags, fleet-members) #44
  is the only coverage item downstream of it.
• Implement Fusion context_names injection #25 / PR Design spec rev 3: cardinality is not the HTTP verb (stacked on #22) #72 — Fusion context_names injection. Owns context_names (270 gap
  endpoints) and allow_errors (118). Blocked on Move context_names component resolution from tools/lib into Private/ before the Fusion injection path is built #74. Unblocks Workload preset cmdlets are non-functional: every write and every name-scoped read needs context_names=<fleet> #79.
• Report generators emit in filesystem order: a 10k-line phantom diff blocks the capability-map auto-PR #85 — the report generators emit rows in filesystem-enumeration order, so regenerating
  produces a ~10k-line phantom diff. Until it lands, any regeneration of the figures above is
  hard to review, and the update-api-capability-map auto-PR cannot usefully be turned back on.
• CI silently skips ~23% of the test suite, including the absolute-path regression guards #63 — CI silently skips ~23% of the suite. Everything above is verified by a suite
  that does not fully run.

Owner: TBD (per-item ownership on each issue).