Does REST specify any way to hide some properties in response based on client access level?
For example, I'm building an application in which I have a user which has profile.
It is exposed via /users/:userId/profile. Let's assume that user wants to hide some informations in his profile from other users. However, if profile owner wants to see his profile he should be able to view all the information. Is it REST-full to do this with only 1 endpoint, or would I need to have more than one endpoint for this, e.g. /users/:userId/fullProfile, /user/:userId/publicProfile?
Hide some properties in rest API response based on user access level
Viewed 207
1 Answers
As REST is more of an architecture style and not a standard, it doesn't define anything like this.
If I need to design something like the above, I would split it into two:
Business use case: Is there a business need for two resources? For example, does person with full permissions needs to access the publicProfile? If yes, there is a need for two resource.
Access. Usually some access token is used together with RESTful request. It's not part of the actual resource API, but rather meta-data. Normally it's implemented with HTTP Header of a sort. The resource can either deny or return partial data based on the client's access. Both solutions are valid.
Related