Optionalfr-attr-group?: string[]OptionalisMemberOf?: string[]Cloud (AIC) admin-group membership, as full group DNs (e.g.
'cn=super-admins,ou=groups,o=root,ou=identities'). Confirmed
self-readable via this AM-native API even when the equivalent IDM
teammember managed-object record is not (403 even for a self-read) —
see CallerTrustTierOps.ts. Not present on ForgeOps/classic.
OptionalmodifyTimestamp?: string[]OptionalpostalAddress?: string[]Optionalroles?: string[]AM UI-privilege role markers (e.g. 'ui-global-admin', 'ui-realm-admin')
— present only on privileged ForgeOps/classic identities (confirmed live:
absent on ordinary IDM-synced managed users in the same realm). Not
present on cloud identities, which carry the equivalent signal in
isMemberOf/fr-attr-group instead — see CallerTrustTierOps.ts.
OptionaltelephoneNumber?: string[]
Cloud (AIC) admin-group membership, as bare group names. Not always populated even when
isMemberOfis (confirmed absent for atenant-auditoridentity that still hadisMemberOfset) — preferisMemberOfas the more reliable signal.