I am trying to figure out the best way around a small problem i have with a design for a Hypermedia API i am currently building.

I have a notion of a site, very simple doesn't have much going on and it is accesible via:

  • /sites
  • /sites/{id}

Sites have a bunch of properties and none is all too sensitive. However, a site has the notion of a budget, its nothing too exotic, in fact for the offset it will be a simple object that holds a decimal field and a pointer to a currency, but this should not be visible to every person requesting the resource as it is deemed as sensitive information that project managers should have.

Some options:

  1. Just sent it - problem here is i don't know what the clients consuming the API will do with it and this is just a terrible option all round
  2. Send down an empty object i.e. Budget:{}
  3. Make Budget a sub-resource of Site and only give users with the appropriate access level access to it

As this is a hypermedia API i am leaning towards option 3, as i could(or not) as the case may be provide the link and also protect that endpoint separately, but at the same time this feels a little wrong, not sure why.

Item 3 could look like this:

  • /sites/{id}/budget

Anyone out there with some helpful advice on something like this?

1 Answer 1


Treat it as a sub-resource

Your REST API should be decoupled from the internal domain model. Therefore you can provide a limited picture of your internal domain state through the REST API. This is one of the main features of REST.

To accomplish this, you may want to look into the Hypertext Application Language (HAL) representation.

  • 1
    I am already using HAL. Issue comes with using WebAPI and typed objects with the formatter i am currently using. I will look into altering it to see if i can ommit items. Commented Aug 15, 2013 at 14:32
  • 1
    In Java I've had a lot of success with HalBuilder. This might give you insight into how to construct/adjust your own.
    – Gary
    Commented Aug 15, 2013 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.