Investigate the undocumented bulkSearch attribute on /cucm-uds/users (v14 schema) as a faster enumeration path

[bandrel]

Summary

The official CUCM 14 UDS schema defines an optional bulkSearch attribute on the <users> response wrapper that appears in no Cisco prose documentation. From UDS-xsd-14.zip, xsd/pub/users/users.get.xsd:

<xs:element name="users">
    <xs:complexType>
        <xs:sequence>
            <xs:element name="user" type="user" minOccurs="0" maxOccurs="unbounded"/>
        </xs:sequence>
        <xs:attribute name="uri" type="xs:anyURI" use="required"/>
        <xs:attribute name="version" type="xs:string" use="required"/>
        <xs:attribute name="start" type="xs:int" use="required"/>
        <xs:attribute name="requestedCount" type="xs:int" use="required"/>
        <xs:attribute name="returnedCount" type="xs:int" use="required"/>
        <xs:attribute name="totalCount" type="xs:int" use="required"/>
        <xs:attribute name="bulkSearch" type="xs:string" use="optional"/>
    </xs:complexType>
</xs:element>

bulkSearch is in neither the developer guide nor the API reference nor any "New and Changed" section. The name strongly suggests a server-side bulk/batched search mode — which, if it can be requested, is the single biggest possible win for --userenum and --directory performance (see #34, which currently proposes raising page size to the 500 UserSearchLimit ceiling).

What needs investigating

This is a research task, not a known fix. Open questions:

1. Is bulkSearch a request parameter as well as a response attribute? Try GET /cucm-uds/users?bulkSearch=true and variants against a live 14 cluster and diff the response.
2. What are its legal values? It is xs:string, not xs:boolean — so it may be a token, a mode name, or an opaque continuation/cursor handle rather than a flag. If it is a cursor, that changes paging strategy entirely and would supersede the start/max arithmetic in UDS pagination sends start=N+1 but Cisco's start offset is 0-based, skipping one user per page #33 and UDS user enumeration is stuck at 64 users/page; read UserSearchLimit and send max (up to 500) #34.
3. Does it bypass or interact with the UserSearchLimit enterprise parameter?
4. Which release introduced it, and is it present in 12.5? The older XSD bundles are not downloadable (403 on direct CDN paths; only v14 uses the authenticated /fileMedia/download/<uuid>/ redirect), so this needs a live capture or a DevNet-side answer.

How to settle it

The related resources may be the real lead: v14 also ships xsd/priv/users/users.post.xsd (a POST to a private users resource) and xsd/priv/users/phoneContacts/*. A POST-based user search would be the natural home for a bulk query, and the priv/ prefix implies it is authenticated. Worth diffing the whole priv/ tree against what we currently touch — we may be leaving authenticated-but-low-privilege enumeration paths entirely unexplored.

Capture /cucm-uds/users on the next 14 or 15 cluster in scope, check whether bulkSearch is echoed at all, and save the body as a test fixture either way. Bundle saved at /tmp/UDS-xsd-14.zip.