title: What are some methods for returning a subset of resources user is authorized to access with a REST API?
body: <p>Say I have an endpoint: <code>/task</code> that returns <code>task</code> resources.</p>
  
  <p>It's an endpoint that all authenticated users are authorized to hit, but it should only return the subset of <code>tasks</code> that the user has access to (created by, owned, or shared with).</p>
  
  <p>I don't want to offload this to query parameters and expect the client to filter on the user ID.</p>
  
  <p>What are some methods for handling this?</p>
  
  <p>Are there any using Auth0 or other 3rd party authorization services?</p>