title: What is REST API and user roles design Best Practice?
body: <p>I'm developing a Grails REST App. I've three user roles: BusinessOwner, User, Admin, Public(Not Authentication)</p>
  
  <p>I've endpoints like <code>api/business/1</code>. </p>
  
  <p>When a user with BusinessOwner role calls that, it returns all details of a business but if user with Public(Not Authentication) role calls that, it returns a subset of the details. 
  So the question is how to implement the endpoints:</p>
  
  <p>1- Having One endpoint like <code>api/business/1</code> and check what the user role is and return proper values (several if/else statements,....)</p>
  
  <p>OR</p>
  
  <p>2- Having separate API areas like the following where each has it's own specific security and returns specific subset:</p>
  
  <p><code>api/admin/business/1</code></p>
  
  <p><code>api/businessOwner/business/1</code></p>
  
  <p><code>api/public/business/1</code></p>
  
  <p><strong>Which one is better? and</strong></p>
  
  <p><strong>What is the best practice in designing REST APIs and applying user roles?</strong></p>