I'm building quite complex REST API. The whole API is protected with authentication.
Some of the resources (like, let's say, Person) should be accessible for anyone in the system, however I'd like to "hide" some fields for specific user's roles.
Let's say the Person resource has following fields:
FirstName
LastName
BirthDate
Address
I'd like them all to be visible for users with HRManager role, hide Address for JuniorHRManager and leave FirstName + LastName for everyone else.
Is that RESTful way to just remove fields from the response based on rules applied for the role which logged in user has? This would be most simple to implement I guess (since I'm using an excellent ServiceStack which has global response filters), yet I'm not sure if that doesn't break the REST rules?
The only other way I've so far thought of is creating role-specific Resources (like PersonForHRManager etc.) however this would be ridiculous as the system is supposed to have variety of combinations of visible & hidden fields for roles.