hide JSON:API endpoint parameters for a client application The Existence
I 'am using the JSON:API core module to serve a  client (react application)
so that each time I have made a back-office modification I  need to reconstruct the URL parameters  ex :

to send the feature image information
?include=field_featured_image

then I have added a paragraph to my article content type so to include the paragraph:
?include =field_featured_image,field_composants

to display specific element in the created parapgraph and not all fields I have use the field set
?include =field_featured_image,field_composants&amp;fields[paragraph--composant]=video

and so on the modification keep going...


then I need to send the new endpoint to the client (ex: react application)
The problem
the client is not up to date with the new URL so each time I made a modification I need to communicate it to the front team.
What do you think about this solution
THE JSON:API parameters will be like BlackBox for the react application :

REACT sends a request to DRUPAL without sending any parameters  ex:
GET /jsonapi/node/article/55d611ab-5752-469a-bf44-648c8cad2a9f
OR
GET /jsonapi/node/article

on kernel.request Drupal takes the request url and alter it by appending the proper JSON:API parmters  to it ex:
/jsonapi/node/article?include =field_featured_image,field_composants&amp;fields[paragraph--composant]=video



NOTE:

for easy administration The JSON:API parameters will be configurable from BO.
The request handler method can change the parameters according to the requested node bundle or according to collection or single entity request



using HTTP client ex(GuzzleHttp\Client) to request the new constructed JSON:API endpoint
$res = $client-&gt;request('GET', '/jsonapi/node/article?include =field_featured_image,field_composants&amp;fields[paragraph--composant]=video');


problem: for each request instead of a single request I Nedd to execute 2 requests.

4.then send a response to the client :
$event-&gt;setResponse($response );
note: for a technical reasons I prefer to keep using JSON:API and not creating custom rest endpoints.
Rather than the JSON:API I would go with the REST resource plugins. Here you are basically only writing controller methods and return what you want. That is already part of the Drupal core:
https://www.drupal.org/docs/drupal-apis/restful-web-services-api/restful-web-services-api-overview
Here is a code example (ServicekontoResource.php):
&lt;?php

namespace Drupal\fms_api\Plugin\rest\resource;

use Drupal\fms_api\Exception\ServicekontoApi\NoServiceKontoResponseException;
use Drupal\fms_api\ServicekontoApi;
use Drupal\rest\Plugin\ResourceBase;
use Drupal\rest\ResourceResponse;
use Drupal\servicekonto_integrator\Exception\ServicekontoResponseStorageException;
use Psr\Log\LoggerInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\HttpFoundation\Response;

/**
 * @RestResource(
 *   id = &quot;servicekonto_resource&quot;,
 *   label = @Translation(&quot;Servicekonto resource&quot;),
 *   uri_paths = {
 *     &quot;canonical&quot; = &quot;/fms-api/servicekonto-data/{session_hash}&quot;
 *   }
 * )
 */
class ServicekontoResource extends ResourceBase {

  /**
   * @var \Drupal\fms_api\ServicekontoApi
   */
  private $servicekontoApi;

  public function __construct(array $configuration, string $plugin_id, array $plugin_definition, array $serializer_formats, LoggerInterface $logger, ServicekontoApi $servicekontoApi) {
    parent::__construct($configuration, $plugin_id, $plugin_definition, $serializer_formats, $logger);
    $this-&gt;serializerFormats = $serializer_formats;
    $this-&gt;logger = $logger;
    $this-&gt;servicekontoApi = $servicekontoApi;
  }

  /**
   * {@inheritdoc}
   */
  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
    return new static(
      $configuration,
      $plugin_id,
      $plugin_definition,
      $container-&gt;getParameter('serializer.formats'),
      $container-&gt;get('logger.factory')-&gt;get('rest'),
      $container-&gt;get('fms_api.servicekonto_api')
    );
  }

  public function get(string $sessionHash) {
    try {
      return new ResourceResponse($this-&gt;servicekontoApi-&gt;provideData($sessionHash));
    } catch (NoServiceKontoResponseException $exception) {
      $response = new Response('Could not retrieve dataset of service konto response.', 500);
      return $response;
    } catch (ServicekontoResponseStorageException $exception) {
      $response = new Response($exception-&gt;getMessage(), 400);
      return $response;
    }
  }

}