I came here to say the exact same thing. After having worked on/scaled an API that served >100k requests per minute, I feel I can say with some experience that defining your JSON in your model is a very bad idea.

A classic example that we ran into repeatedly: Assume you want to have an endpoint that populates a user's profile (for the user to see). You probably want id, name, email, age, location, created_at, updated_at, etc. However, when exposing this same user instance through an endpoint that publicly aggregates users (e.g. search), sending over all those fields is 1) overkill, and 2) raises privacy concerns.

So far, my favorite approach to this problem uses the ActiveModel::Serializer gem (https://github.com/rails-api/active_model_serializers). It moves the JSON logic to something more akin to a view, and provides an easy way to present instances differently depending on the context.

I don't think there's actually a good way to solve this (that I know of) for applications with complex enough permission and role hierarchies.

Once you need a list of all the glass marbles with their attributes, but can only see the color of marbles you supervise, and only the radius of a marble if it has a shooter role and only the names and emails of marbles ranked above you... ...and so on... it becomes a situation where each result has to be filtered item by item pretty much. And the filter hierarchies will snowball like tribbles.

The `djangorestframework-composed-permissions` package for DRF gets pretty close to handling this situation effectively. Basically roles and permissions arbitrarily composable with boolean expressions.

Although you can model permission hierarchies, I think there are enough corner cases that it's worthwhile to declare permissions as explicitly as conveniently possible.

API Docs: https://djangorestframework-composed-permissions.readthedocs...

View models/decorators have served me very well in this case. The view model would take the marble instance, viewing user instance, etc and decide which attributes it should emit as JSON. The result is frequently very clean, very maintainable code.

ActiveModel::Serializer is really nice, but it doesn't seem particularly fast when large responses are involved - when we have 500+ comments to serialize it can take 400ms or more in the views code.

Is there a way to speed it up when building large responses?

You can add caching to it pretty easily. If you cache the objects independently and leverage memcache multiget you can get some very nice speedups.

AMS have unfortunately no caching by default, and the development was stale for almost a year.

The mailing list is active again since the last couple days, so it might get fixed soon.

Good question. If you consider each API endpoint a very specific serialization of a model, are the serialization parameters considered part of the model itself? (I would consider them such, and decided to approach the development with that in mind.)

I don't think so. The data as presented to the user through the API is a view concern. The model should never, ever know or care about how it is presented; serialization (which is used to marshal the data as a whole for transport and reconstitution) and presentation (which is used to transform the data into some form acceptable for consumption by an external entity) are separate processes with separate goals.

I think you've conflated serialization and presentation here; if I can't reconstitute the whole object from the serialization provided, then it's not a serialization, it's a presentation. A valid presentation might be "the serialization of this object", but "a subset of this object suitable for display" is not a valid serialization.

Good points. I think it boils down to an issue of semantics, though. FastAPI effectively eliminates (or hides) the View layer by allowing the Model to determine which fields it should allow the View to access. If you don't believe this is explicit enough (which could be a fair argument!), it's perfectly reasonable to suggest this "breaks" standard MVC conventions (as it can easily be construed as the View being part of the Model!).

I would argue that it merely allows for more automated (albeit implicit) generation of a View.

The goal here was to simplify the API endpoint creation process for the vast majority of use cases, and provide a standard output that could be easily recognized and consistently managed by any external software.

Well, it certainly meets those goals, but it does so by putting view logic into the model layer.

You might take a look at the Presenter pattern; Draper is an excellent implementation of it, which permits for this kind of "model-attached" view behavior, while maintaining proper MVC separations.