Context:
See parent task.

AT:

• identity.type is optional on the collection add role API
• on missing type the backend tries to resolve this as a userID first and if there is no such user tries to resolve it as groupId
• if the id neither belongs to a user nor a group a 400 error is returned indicating the user or group does not exist