API3 BOPLA: Property-Level Authorization, PATCH Requests and Response Shaping
You close BOPLA not with serializer settings but with a separate response type per role and a writable-field allowlist per role. Projections with Mapperly that break the build when a field is added, moving a different view to its own endpoint and policy, rejecting locked fields in JSON Merge Patch, and using the OpenAPI schema as a contract guarded by a test.
8 Nov 2026
·
12 min
·
4
