I'm curious when building a proper restful resource, what is the best action to take returning a resource based on a user's role.
For example, If User 1 calls, GET: api/Users/1 That user should get the base user object (first name, last name, email) along with proprietary information like SSN. But if User 2 calls, GET: api/Users/1 That user should get the base user object along with maybe their mutual friends they share.
Is this something that is advocated in a restful resource, or would be easier to separate these concerns into something more specific, like api/Users/1/sensitive, and api/Users/1/Friends?
If the former is acceptable, would this be something manageable through inheritance?
Thanks!