2

REST APIs conventionally expose resources addressed at the object level. While it's easy to do object level permissions using the appropriate HTTP responses, handling field level permissions is a bit less clear.

Imagine the hypothetical app which exposes the user object. Publicly, you want to show some subset of the fields, for the user themself all fields should be shown.

Should the public and private versions be different endpoints, or is it reasonable to return a different set of fields depending on permissions?

1 Answer 1

2

A resource is a resource. The resource doesn't change simply because the permissions change. What you can do with the resource or what you can know about the resource might change, but the mapping of the resource doesn't change. If it does it becomes a different resource type. So in your description, it's conceivable that various properties would exist at any access of the user resource, but there would only be certain properties available based on the accessor's permissions. The inaccessible properties would simply be null.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.