Fernando
Hello. Im doing a API REST and i have doutb about the api design. I have 3 roles (admin, professionals, patients). They have diferents things what they can see or do, but also things that are very similar.
For example, and admin can see all the users and information and a patients only can see a list of professionals with limit information.
I think about two endpoints, with a Plug to ensure the role. :
GET /api/patient/users, PatientController, :index
GET /api/admin/users, AdminController, :index
The other way i see, is one endpoint:
GET /api/users
and in the controller make and if, to load the right information to the role, or make a plug to redirect to the right controller o path.
What is the proper way?
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
At WyeWorks, we believe great software is built by combining technical excellence with genuine human connection
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #ai
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixirconf-us
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #security
- #metaprogramming
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
bottlenecked
Hi, if I think of this from a graphql perspective then the entity is always the same (‘user’) but then each resolver that would resolve sensitive fields would check to see if it should attempt to resolve the field based on credentials.
Assuming that the view of users a patient sees is a strict subset of what an admin can see for example, I’d go for the 2nd option with code that would perhaps look like this
essentially ‘decorating’ the base object with extra detail if appropriate. Do note that this may increase sql query count however depending on how the data is fetched, so keep that in mind as well