I have a use case that I need to check the authorization based on a query parameter.
I have an /products endpoint for fetching the list of products. But the products have reviewStatus and end users are only allowed to fetch products that reviewStatus is approved. But admin can fetch every product. Based on this requirements, I came up with the below API design.
/products?reviewStatus=[REVIEW_STATUS]
if REVIEW_STATUS is set to waiting or rejected, and the client who makes the request doesn't have permission to read those products, then the server should return the 401 Unauthorized response.
But it seems writing an OpenAPI specification for these requirements isn't possible. I couldn't set security for each query parameter.
How do I resolve it? Is there a better API design for this?