How to filter json to create a public api response subset
- Step 1Paste the full internal data record — Paste a complete internal JSON record — the full database row or ORM object as it exists internally, including all fields you want to verify are excluded.
- Step 2Define the public field whitelist — List only the fields safe for public exposure: id, name, description, price, createdAt. Do not include: internalId, costPrice, adminNotes, deletedAt, or any field with internal meaning.
- Step 3Run the filter and verify the output — Confirm the output contains only the whitelisted fields. Verify that no internal fields snuck through by checking the key count and reviewing the output structure.
- Step 4Use as your serializer or DTO template — Use the filtered key list to define your DTO class, serializer schema, or OpenAPI response schema. The whitelist becomes the authoritative list of allowed fields in your API response.
Frequently asked questions
How is a whitelist approach safer than a blacklist approach for public APIs?+
A blacklist approach removes known-sensitive fields but fails silently when new internal fields are added to the data model — they appear in the public API by default. A whitelist approach is explicit: new fields are absent from the public API until they are consciously added to the whitelist, preventing accidental exposure of internal data.
What is the best way to implement this in a Node.js Express API?+
Define the allowed fields as a constant array and use lodash.pick(record, ALLOWED_FIELDS) to create the public response object. Alternatively, define a serializer class or a Zod schema that only includes the allowed fields and run every response through it before res.json().
Is the internal data record transmitted to JAD Apps?+
No. Processing runs entirely in your browser. Internal records including cost prices, admin flags, and private audit data are never transmitted to JAD Apps servers.
Privacy first
Conversion runs locally in your browser. No file is uploaded — only metadata counters are saved for signed-in dashboard stats.