At $dayjob-1 we relied on this to pull in your Facebook friends as contacts. Eventually FB limited the scope of this to friends who also had the app.

I can confirm this, at least generally. Given access by a user, you had access to all the data the user could access, including the user’s friends’. There may have been exceptions, but, for example, friends’ likes were accessible.

It’s gone from the FB Graph API docs, but the wayback machine still has it:

https://web.archive.org/web/20130911191323/https://developer...

I was possible to use the v1.0 API until Q2/2015 if I remember correctly (only if you had a v1.0 app though)

it was in TFA, btw