Ability to query for identity properties without admin rate throttling

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

xenodochial-mestorf-alar1uohvl

Describe your problem

We've been using Ory as a single source of truth for user properties, avoiding replication within our application data so as not to increase our exposure to PII. The key properties in our application are user email address and 'display name', both of which are retained solely with Ory.

We have a need to surface this data to our front end, however, in various user listings pages (e.g. listing users who are a member of a team). To achieve this, we've been pulling these properties via our backend calling the https://www.ory.sh/docs/reference/api#tag/identity/operation/getIdentity endpoint

The issue we've encountered is that this solution does not scale, due to rate limiting on the Ory side. Indeed, it would seem this API is not expected to be used for the kind of realtime, user facing use flow we're currently employing it for.

We can address the problem by replicating these properties in our application, but at the cost of maintaining this PII ourselves.

As such, it would be desirable if Ory supported identity property retrieval via an API for such real time use cases such as the one I've described.

Describe your ideal solution

The existence of an API for retrieval of identity properties for any user with rate limiting aligned with the /sessions/whoami (etc) APIs (ref)

Bonus points if the API could accept a set of identities IDs to retrieve properties for

Workarounds or alternatives

Replicating the PII our side, avoiding the need to query Ory for such flows

Version

Ory Network (i.e. your managed, cloud solution)

Additional Context

No response

Review the documented getIdentity endpoint and the rate-limit guidance for /sessions/whoami, then compare their intended usage and limits. Done means a decided API design for realtime identity-property retrieval, including whether batch identity lookup is supported and how its rate limits should work; the issue names no repository files or tests.