Hiding fields from RESTful services? So, this may be a stupid question because it seems pretty basic to me, but I can't find any information about this on here or elsewhere. Is it possible to specify fields to be visible/invisible to RESTful requests in Drupal 8? I would expect that this should be possible to configure--or, at the least, that fields hidden from the display would not be accessible via such requests.

Is this possible, or is there something that I'm simply not understanding here?
The only way to do this is using field access (hook_entity_field_access()) and denying view access to fields that you don't want to be visible.

The primary use case that the default rest.module/entity integration aims to support is data synchronization. My standard suggestion for anyone who wants to offer public services on a site or build a custom frontend is to consider writing and defining services tailored for that specific use case.

It's also quite possible that more flexible solutions will be developed in contrib, one of those is relaxed, I don't know if it helps with this specific use case, though.