title: Per Field Permission in Django REST Framework
body: <p>I am using Django REST Framework to serialize a Django model.  I have a ListCreateAPIView view to list the objects and a RetrieveUpdateDestroyAPIView view to retrieve/update/delete individual objects.  The model stores information that the users submit themselves.  The information they submit contains some private information and some public information.  I want all users to be able to list and retrieve the public information but I want only the owner to list/retrieve/update/delete the private information.  Therefore, I need per-field permissions and not object permissions.</p>
  
  <p>The closest suggestion I found was <a href="https://groups.google.com/forum/#!topic/django-rest-framework/FUd27n_k3U0" rel="noreferrer">https://groups.google.com/forum/#!topic/django-rest-framework/FUd27n_k3U0</a> which changes the serializer based on the request type.  This won't work for my situation because I don't have the queryset or object at that point to determine if it is owned by the user or not.</p>
  
  <p>Of course, I have my frontend hiding the private information but smart people can still snoop the API requests to get the full objects.  If code is needed, I can provide it but my request applies to vanilla Django REST Framework designs.</p>