# Limit API responses based on user or role

**URL:** https://community.dreamfactory.com/t/limit-api-responses-based-on-user-or-role/693
**Category:** REST API
**Created:** [December 23, 2014, 6:03pm UTC](https://community.dreamfactory.com/t/limit-api-responses-based-on-user-or-role/693 "2014-12-23T18:03:23Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jvc](https://avatars.discourse-cdn.com/v4/letter/j/85e7bf/32.png) [@jvc](https://community.dreamfactory.com/u/jvc)
#### Post date: [December 23, 2014, 6:03pm UTC](https://community.dreamfactory.com/t/limit-api-responses-based-on-user-or-role/693/1 "2014-12-23T18:03:23Z")

</div>

Is there a method to limit the fields displayed in a response by user role? For instance, I have a user/role that I don’t want them to see certain fields like Id, OwnerId, etc…

---

<div class="post-metadata">

### Author: ![toddappleton](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/toddappleton/32/159_2.png) [@toddappleton](https://community.dreamfactory.com/u/toddappleton)
#### Post date: [December 23, 2014, 8:09pm UTC](https://community.dreamfactory.com/t/limit-api-responses-based-on-user-or-role/693/2 "2014-12-23T20:09:49Z")

</div>

You can create a post-process server side script that checks the user role id before allowing those fields to be returned.

```
var result = platform.api.get("user/session");
if (result.role_id === 4 || result.role_id === 7) {
    if (event.response.record) {
        _.each(event.response.record, function(record) {
            delete record.id;
        });
    } 
}

```

[https://github.com/dreamfactorysoftware/dsp-core/wiki/Server-Side-Scripting](https://github.com/dreamfactorysoftware/dsp-core/wiki/Server-Side-Scripting)

Another way would be to write a pre-process script that changed the “fields” parameter based on role id. That would be faster than looping through every record to remove fields.

```
var result = platform.api.get("user/session");
if (result.role_id === 4 || result.role_id === 7) {
    // remove unwanted fields from event.request.body.fields
}
```