title: Exclude some fields of Spring-data-rest resource
body: <p>I'm trying to use Spring-data-rest with spring-data-mongodb to expose read-only resources. </p>
  
  <p>The problem I met, is that I want to have different views of my documents. 
  Let's say I have some private information in a document, I don't want to expose them publicly. </p>
  
  <p>So I tried several ways. 
  I read this post <a href="https://spring.io/blog/2014/12/02/latest-jackson-integration-improvements-in-spring" rel="noreferrer">https://spring.io/blog/2014/12/02/latest-jackson-integration-improvements-in-spring</a> describing how to use JsonView in order to select the fields we want to expose.</p>
  
  <p>I've tried like this :</p>
  
  <pre><code>@RepositoryRestResource(collectionResourceRel = "recommandation", path =    "recommandations")
  interface RecommandationRepository extends MongoRepository&lt;Recommendation,   ObjectId&gt; {
  
  @Override
  @JsonView(View.Public.class)
  Iterable&lt;Recommendation&gt; findAll(Iterable&lt;ObjectId&gt; objectIds);
  ... // other find methods
  }
  </code></pre>
  
  <p>It doesn't works. It is however said in the comments : <a href="https://spring.io/blog/2014/12/02/latest-jackson-integration-improvements-in-spring#comment-1725671983" rel="noreferrer">https://spring.io/blog/2014/12/02/latest-jackson-integration-improvements-in-spring#comment-1725671983</a>
  The answer suggests to use @Projections
  However @Projections result in url like that : "…/recommandations{?projection}"
  It means that the projection is just an option, so the full object is still exposed. </p>
  
  <p>There is another method described here <a href="https://github.com/spring-projects/spring-data-rest/wiki/Configuring-the-REST-URL-path" rel="noreferrer">https://github.com/spring-projects/spring-data-rest/wiki/Configuring-the-REST-URL-path</a> 
  It suggests to use @RestResource(exported = false) annotation for the fields we don't want to expose. </p>
  
  <p>But it's not flexible. If I want to expose a public read-only API and a private full access API. This annotation can't be disabled per api.</p>
  
  <p>Is there another suggestion ?</p>