I have been reading through your docs, and either something changed relatively recently, or I have been lucky for a few months, which is possible.
This is what would happen:
I have users_profiles attribute turned on for facebook connections in Auth0. When I would use the management-api, users endpoint, it would provide me an array, mutual_friends, which included the facebook IDs of all the user’s friends who used my app. It was a very simplified version of facebook’s user_friends api, as it only included IDs, but it was effective as I could just cross reference my own data store.
What I mean is:
As part of the payload provided by the management api, if users_friends was checked, I would receive a payload: mutual_friends inside the context node. This would include a list of facebook userids, note not auth0, and thus I could just cross reference those Ids with my store. This was also advantageous in that it saved me a network request as I already need to ping the management api for the Access Token.
From the documentation, it doesn’t sound like I was doing something which was doing the recommended approach. I should go out and fetch the data from facebook’s graph api, and that is fine. Please let me know if you think my conclusion is wrong.