Make API v2 return the minimum required information only

[giohappy]

We want to enforce the same restrictions to response as implemented for the legacy API.
@marthamareal please go through API v2 and verify if the same logic must be enforced for the new endpoints.

[marthamareal]

From What I see, V2 uses UserSerializer to return user data, and by default, this returns only the following fields
('pk', 'username', 'first_name', 'last_name', 'avatar')
On listing users,

• Non-authenticated users get an empty list, and can’t view a single user object.
• For authenticated users, On getting a list of users, admins can view all users () and Non-admins can only see their details.

[giohappy]

thx @marthamareal then we're fine.