Rest API fields restrict for role

Question

I'm designing some REST API and just wondering how to restrict frontend users access some of resource fields.

Lets say this is our user resource:

{
  "username" : "user",
  "email" : "email@example.com",
  "created_at" : "2011-06-13T21:56:36"
}

It's obvious that email shouldn't be disclosed and returned to public audience. However in admin section I would like to receive this field.

Is there any kind of strategies for such problems?

My ideas:

• Create separate endpoints for administration.
• Auth mechanism for fields?

Answer 1

Creating a proper authentication mechanism in a REST API is (i) not trivial, and (ii) already done in many many languages. Unless for learning purposes, I would suggest not to rewrite that.

Depending on your backend language of choice, you can choose a framework to do exactly that. For example, in Python, I would suggest Django with Django Rest Framework.