title: REST GET endpoints returning different models based on user role
body: <p>I'm currently dealing few endpoints returning different kinds of models based on permissions:</p>
  
  <p>For example, our business object is getting converted to either an object of type <code>Model</code> or <code>AdvancedModel</code>.</p>
  
  <pre><code>public class Model
  {
    public int Property1 {get; set;}
  }
  
  public class AdvancedModel : Model
  {
    public int Property2 {get; set;}
  }
  
  public IActionResult Get()
  {    
     (...)
     return User.IsAdmin 
        ? Mapper.Map&lt;AdvancedModel&gt;(Client);
        : Mapper.Map&lt;Model&gt;(Client);
  }
  </code></pre>
  
  <p>Initially this was built so everyone could retrieve client's basic details (name...) BUT only admin could get access to "sensitive" information (preferred payment info, billing contacts).</p>
  
  <p>This makes makes our API harder to understand as we need to identity what fields are returned based on the permission level... This works well but I'm afraid it will become funky as we scale up (new roles, endpoints). </p>
  
  <p>We have considered introducing new endpoints but it will add a bunch of them to our already packed API.</p>
  
  <pre><code>/api/v1/admin/clients/1234
  vs
  /api/v1/clients/1234
  </code></pre>
  
  <p>I was just wondering what's the best practice to handle that kind of scenario?</p>
  
  <p>Thx</p>