title: Ignore or not API endpoint parameters based on access level
body: <p>I am working on an API endpoint that returns a list of products:</p>
  
  <pre><code>"api/products"
  </code></pre>
  
  <p>The endpoint accepts the following parameters:</p>
  
  <pre><code>page_size
  page_number 
  </code></pre>
  
  <p>Each product has a boolean property named IsApproved.</p>
  
  <p>In the web application used by common users I always want to return only the Approved products ... On the web ADMIN application used by administrators I want to return all products, Approved or Not ...</p>
  
  <p>My idea would be to add a new parameter (enumeration) named:</p>
  
  <pre><code>ApprovedStatus
  </code></pre>
  
  <p>And the values would be <code>Approved</code>, <code>NotApproved</code> and <code>All</code>.</p>
  
  <p>On each API call I would check the user permissions ... If is admin I will consider the value on this parameter. If not then I will always return only approved products.</p>
  
  <p>Another solution would be to have different endpoints ...</p>
  
  <p>Any advice on which approach to take or is there other options?</p>