I am trying to figure out the best way around a small problem i have with a design for a Hypermedia API i am currently building.
I have a notion of a site, very simple doesn't have much going on and it is accesible via:
Sites have a bunch of properties and none is all too sensitive. However, a site has the notion of a budget, its nothing too exotic, in fact for the offset it will be a simple object that holds a decimal field and a pointer to a currency, but this should not be visible to every person requesting the resource as it is deemed as sensitive information that project managers should have.
- Just sent it - problem here is i don't know what the clients consuming the API will do with it and this is just a terrible option all round
- Send down an empty object i.e.
Budgeta sub-resource of
Siteand only give users with the appropriate access level access to it
As this is a hypermedia API i am leaning towards option 3, as i could(or not) as the case may be provide the link and also protect that endpoint separately, but at the same time this feels a little wrong, not sure why.
Item 3 could look like this:
Anyone out there with some helpful advice on something like this?