Merge changes I864b949b,Ic3222d67

* changes:
  Add a note about service users
  Test that invalid hex account option is correctly handled
diff --git a/javatests/com/google/gerrit/plugins/codeowners/acceptance/restapi/AbstractGetCodeOwnersForPathRestIT.java b/javatests/com/google/gerrit/plugins/codeowners/acceptance/restapi/AbstractGetCodeOwnersForPathRestIT.java
index cadf021..7aa024d 100644
--- a/javatests/com/google/gerrit/plugins/codeowners/acceptance/restapi/AbstractGetCodeOwnersForPathRestIT.java
+++ b/javatests/com/google/gerrit/plugins/codeowners/acceptance/restapi/AbstractGetCodeOwnersForPathRestIT.java
@@ -163,6 +163,15 @@
   }
 
   @Test
+  public void cannotGetCodeOwnersWithInvalidHexAccountOption() throws Exception {
+    String invalidHexOption = "INVALID";
+    RestResponse r = adminRestSession.get(getUrl(TEST_PATH, "O=" + invalidHexOption));
+    r.assertBadRequest();
+    assertThat(r.getEntityContent())
+        .isEqualTo(String.format("\"%s\" is not a valid value for \"-O\"", invalidHexOption));
+  }
+
+  @Test
   @GerritConfig(name = "plugin.code-owners.backend", value = "non-existing-backend")
   public void cannotGetCodeOwnersIfPluginConfigurationIsInvalid() throws Exception {
     RestResponse r = adminRestSession.get(getUrl(TEST_PATH));
diff --git a/resources/Documentation/rest-api.md b/resources/Documentation/rest-api.md
index c937cb2..01087f1 100644
--- a/resources/Documentation/rest-api.md
+++ b/resources/Documentation/rest-api.md
@@ -643,7 +643,7 @@
 
 The following code owners are filtered out additionally:
 
-* service users (members of the `Service Users` group)
+* [service users](#serviceUsers) (members of the `Service Users` group)
 * the change owner (since the change owner cannot be added as reviewer)
 
 In addition, by default the change number is used as seed if none was specified.
@@ -1028,6 +1028,39 @@
 assigned on the `All-Project` project in the `Global Capabilities` access
 section.
 
+---
+
+## <a id="serviceUsers">Service Users
+
+Some of the @PLUGIN@ REST endpoints have special handling of code owners that
+are service users:
+
+* The [Suggest Code Owners for path in change](#list-code-owners-for-path-in-change)
+  REST endpoint filters out code owners that are service users.
+
+To detect service users the @PLUGIN@ plugin relies on the `Service Users` group.
+This group should contain all service users, such as bots, and is maintained by
+the host admins.
+
+If you are a host admin, please make sure all bots that run against your host
+are part of the `Service Users` group.
+
+If you are a bot owner, please make sure your bot is part of the `Service Users`
+group on all hosts it runs on.
+
+To add users to the "Service Users" group, first ensure that the group exists on
+your host. If it doesn't, create it. The name must exactly be `Service Users`.
+
+To create a group, use the Gerrit UI: `BROWSE` -> `Groups` -> `CREATE NEW`.
+
+Then, add the bots as members in this group. Alternatively, add an existing
+group that only contains bots as a subgroup of the `Service Users` group.
+
+To add members or subgroups, use the Gerrit UI: `BROWSE` -> `Groups` ->
+search for `Service Users` -> `Members`.
+
+---
+
 Back to [@PLUGIN@ documentation index](index.html)
 
 Part of [Gerrit Code Review](../../../Documentation/index.html)