title: Authorization dependent REST API
body: <p>as part of a server REST API design I'm considering I'd like to be able to return data that is conditional on the level of authorization of the client. What would be the recommended way of doing accomplishing that and still calling it one API? More specifically, consider the following example for a book access API:</p>
  
  <pre><code>HTTP GET /library/books/{book-name}
  </code></pre>
  
  <ol>
  <li><p>Any authenticated client should be able to get (JSON) data for the book, like:</p>
  
  <p>{
   "book":
      {"book-name":"abc", "author":"someone"}
  }</p></li>
  <li><p>But a specific sub-set of authenticated clients should also be able to get:</p>
  
  <p>{
   "book":
      {"book-name":"abc", "author":"someone"},
      "private-info" :
      {"book-status":"on-loan", "price":"$20"}
  }</p></li>
  </ol>
  
  <p>For a given book, any suitably authorized client can also access the "private info" via a direct HTTP GET /library/books/{book-name}/private-info.</p>
  
  <p>Now, assuming a suitable client authentication scheme is in place, I cannot help but think that the HTTP GET /library/books/{book-name} above is actually looking like two API's, distinguished by authorization state on the server regarding authentication. This seems not very RESTful. </p>
  
  <p>Perhaps it would be better to keep the base GET book API the same for all without ever having any "private-info", while offerring authorized clients only access to the private-info URI and returning 403 to all others?</p>
  
  <p>How does this type of conditional data access typically get handled with REST APIs?</p>