title: What is the REST best practice with PUT / PATCH and permissions?
body: <p>I'm working on a REST API and I cannot find any response to my question. Here is my problem :</p>
  
  <p>On my application, I have severals user roles "Admin" and "User". Both can PUT / PATCH an entity "Agency", but they cannot modify same fields : </p>
  
  <ul>
  <li><p>Admin can modify all fields</p></li>
  <li><p>User can modify only "name" and "adress" fields</p></li>
  </ul>
  
  <p>So my colleagues and I don't know how to choose between two options :</p>
  
  <ul>
  <li><p>Create two endpoints PATCH /api/agency/{id} and PATCH /api/agency/{id}/restricted : first only allowed to admin, second for both but only update "name" and "adress" ? => this is simpler but it creates a new route to the world</p></li>
  <li><p>Only one enpoint, that return a 403 response if a User try to update unauthorized field ? => this can be complex in the future if permissions rules become more complex, but only one endpoint is exposed...</p></li>
  </ul>
  
  <p>Thanks a lot for your response, and pardon my english !</p>