What is the best practice for exposing different fields for a resource based on user's role/ACL privileges in the system?
Let's say I have an endpoint, groups/{:group_id}
. My business rules state the following:
- Non-authenticated users can see only:
name
andID
fields - Authenticated users can see:
name
,ID
,managers
, andaccess_code
fields - Group managers can see
name
,ID
,managers
,access_code
andmembers
.
Respectively, the records may look like:
/* Non-Authenticated User */
{
"id": "abe80d",
"name": "Foobar Group"
}
/* Authenticated User */
{
"id": "abe80d",
"name": "Foobar Group",
"access_code": "abc123",
"managers": {
"_href": "http://example.org/people/bds983a",
"_href": "http://example.org/people/cde03rf",
}
}
/* Manager */
{
"id": "abe80d",
"name": "Foobar Group",
"access_code": "abc123",
"managers": {
"_href": "http://example.org/people/bds983a",
"_href": "http://example.org/people/cde03rf",
},
"members": {
"_href": "http://example.org/people/bds983a",
"_href": "http://example.org/people/cde03rf",
"_href": "http://example.org/people/jvs239a",
"_href": "http://example.org/people/nnd9323",
}
}
Should this be a single endpoint/URI that shows different sets of fields for different authentication levels, or should I somehow break these up into three different URIs?
It seems like different URLs for the same resource is bad, but a client not knowing exactly what fields would be retrieved is also bad? Is there a best practice in this situation?