Excessive data exposure

APIs frequently return the whole object and rely on the interface to display only part of it.

The mobile app shows a name; the response contains the date of birth, the internal identifiers and the account flags. Nothing is hidden from anybody who looks at the response directly, which takes no skill at all. Filtering belongs on the server, decided by who is asking.