I have a bunch of REST webservices that my client uses. For instance, to create a user, I havePOST /usersand to modify itPOST /users/{id}The problem is, some fields, as marketArea, are allowed to be edited only by employees, that will have an EMPLOYEE role. Other fields, as name and age, are editable by end users, that will have a USER role. As I have access to endpoints restricted by role, in this case there is an obvious collision.I could easily go around the problem by setting different paths:POST /users/{id}/public  (require USER)POST /users/{id}/internal  (require EMPLOYEE)But this doesn't feel right to me. What's the best practice in this case?
How to structure path-colliding REST webservices with role-access
rest;web services;access control