REST APIs conventionally expose resources addressed at the object level. While it's easy to do object level permissions using the appropriate HTTP responses, handling field level permissions is a bit less clear.
Imagine the hypothetical app which exposes the user object. Publicly, you want to show some subset of the fields, for the user themself all fields should be shown.
Should the public and private versions be different endpoints, or is it reasonable to return a different set of fields depending on permissions?