It's a little hard to cite now - most of the user-level permissions are gone, or are behind a "This permission is restricted to a limited set of partners and usage requires prior approval by Facebook" restriction.

They've clamped down repeatedly on how much data comes out of the API - you used to get full info on friends, then just their names and IDs, then that list wound up filtered to just other friends who'd authorized the same app.

It used to be extremely wide-open.