Python API compatibility gaps

[gtema]

Description

Create a dedicated document in the project documentation describing the compatibility matrix.

Compatibility Matrix

Category	Missing endpoint(s)	Typical HTTP actions	Status
Service catalog	/v3/services (list, create, show, update, delete)	GET / POST / GET {id} / PATCH {id} / DELETE {id}	Done
Endpoints	/v3/endpoints (list, create, show, update, delete)	GET / POST / GET {id} / PATCH {id} / DELETE {id}	Done (fixed: legacy region attr now auto-vivifies a Region and is mirrored back on responses, matching python keystone back-compat)
Regions	/v3/regions (list, create, show, update, delete)	GET / POST / GET {id} / PATCH {id} / DELETE {id}	Done (#1078; PUT /v3/regions/{id} create-or-update-with-caller-id also added)
Limits	/v3/limits (list, show); /v3/limits-model (model discovery); Unified Limits API (/v3/limits with include_limits flag, /v3/unified-limits if present)	GET / GET {id} / GET (with query)	Missing
Project tags	/v3/projects/{project_id}/tags (list, add, delete)	GET / PUT / DELETE	Missing
Application credentials (v3.10)	/v3/users/{user_id}/application_credentials (create, list); /v3/users/{user_id}/application_credentials/{app_cred_id} (show, update, delete)	POST / GET / GET {id} / PATCH {id} / DELETE {id}	Missing
Access rules (read-only, v3.13)	/v3/users/{user_id}/access_rules (list)	GET	Missing
System role assignments	/v3/system/role_assignments (list)	GET	Missing
Project hierarchy	/v3/projects/{project_id}/parents, /v3/projects/{project_id}/subtree, create/delete subtree, list parents, etc.	POST / DELETE / GET	Missing
OS-INHERIT (role inference list)	/v3/role_inferences (list)	GET	Missing
OS-TRUST (trusts)	/v3/OS-TRUST/trusts (CRUD)	POST GET PATCH DELETE	Partial: create/get/list/delete implemented (no PATCH, matching python keystone which has none either). Still missing: /v3/OS-TRUST/trusts/{id}/roles sub-resource (list/show/check trust role), and response links.self (see #1082).
OAuth2	/v3/OS-OAUTH2/* (token exchange, introspection, etc.)	Various	Missing

Tempest Progression

Full tempest identity suite (tools/run-tempest-local.sh) during 2026-07-23 cleanup:

• Initial: 52/132 passed
• After OS-TRUST create/policy/serialization fixes: 55/132 passed