title: Scope of returned resource highly depandant on user role encoded in JWT token - is it RESTful?
body: <p>I'm working on API that tries to stay in RESTful principles, although one requirement keeps bugging me.</p>
  
  <p>We use JWT based authentication. Inside JWT claims we store roles of the user. Now our main GET endpoint (let's call it ListAllOffers for simplicity) behaves differently depending on what role the user have:</p>
  
  <ul>
  <li>if API recognizes admin via JWT it responds with full list of Offers</li>
  <li>if API recognizes ordinary user via JWT it responds with narrowed list of Offers (depending on relation in DB)</li>
  </ul>
  
  <p>My concerns is: <strong>is it ok according to REST principles or any unwritten REST practices?</strong> I am used to modify response object according to argument from url, params from querystring or alternatively via header values. Altering JSON response basing JWT seems not explicit enough that is feels some kinda strange.</p>
  
  <hr>
  
  <p>Bonus question: is it against any of REST principles how should this requirement be implemented.</p>