hide JSON:API endpoint parameters for a client application
Rather than the JSON:API I would go with the REST resource plugins. Here you are basically only writing controller methods and return what you want. That is already part of the Drupal core:
https://www.drupal.org/docs/drupal-apis/restful-web-services-api/restful-web-services-api-overview
Here is a code example (ServicekontoResource.php):
&lt;?php

namespace Drupal\fms_api\Plugin\rest\resource;

use Drupal\fms_api\Exception\ServicekontoApi\NoServiceKontoResponseException;
use Drupal\fms_api\ServicekontoApi;
use Drupal\rest\Plugin\ResourceBase;
use Drupal\rest\ResourceResponse;
use Drupal\servicekonto_integrator\Exception\ServicekontoResponseStorageException;
use Psr\Log\LoggerInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\HttpFoundation\Response;

/**
 * @RestResource(
 *   id = &quot;servicekonto_resource&quot;,
 *   label = @Translation(&quot;Servicekonto resource&quot;),
 *   uri_paths = {
 *     &quot;canonical&quot; = &quot;/fms-api/servicekonto-data/{session_hash}&quot;
 *   }
 * )
 */
class ServicekontoResource extends ResourceBase {

  /**
   * @var \Drupal\fms_api\ServicekontoApi
   */
  private $servicekontoApi;

  public function __construct(array $configuration, string $plugin_id, array $plugin_definition, array $serializer_formats, LoggerInterface $logger, ServicekontoApi $servicekontoApi) {
    parent::__construct($configuration, $plugin_id, $plugin_definition, $serializer_formats, $logger);
    $this-&gt;serializerFormats = $serializer_formats;
    $this-&gt;logger = $logger;
    $this-&gt;servicekontoApi = $servicekontoApi;
  }

  /**
   * {@inheritdoc}
   */
  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
    return new static(
      $configuration,
      $plugin_id,
      $plugin_definition,
      $container-&gt;getParameter('serializer.formats'),
      $container-&gt;get('logger.factory')-&gt;get('rest'),
      $container-&gt;get('fms_api.servicekonto_api')
    );
  }

  public function get(string $sessionHash) {
    try {
      return new ResourceResponse($this-&gt;servicekontoApi-&gt;provideData($sessionHash));
    } catch (NoServiceKontoResponseException $exception) {
      $response = new Response('Could not retrieve dataset of service konto response.', 500);
      return $response;
    } catch (ServicekontoResponseStorageException $exception) {
      $response = new Response($exception-&gt;getMessage(), 400);
      return $response;
    }
  }

}