How to restrict get rest api for few fields on incident and user table

[Vinitar]

Hi Team ,

I need to restrict read rest api for  few field in incident and user table ,what approach i can use?

[AshishKM]

Hi @Vinitar , 

Add more read ACL on that table's field and apply the required role or scripted conditions.

-Thanks,

AshishKM

[Vinitar]

Hi Ashish,

I have create a read ACL for name field on user table and create a new role too also assign this role to integration user still while testing with postman I can see all field in the response.What's wrong here?

Below role i have given to my user

[Sandeep Rajput]

@Vinitar It seems that there are more than one read ACLs created on your table one of which might be granting the read permissions to the API user due to which all fields are shown. I recommend using access analyzer to find the ACL which is granting the additional accessess. 

Also, please check if there is any sys_user.* read ACL, if there is one it might be giving the read access on the name field.