Best practice when returning from Restful services - returning Java Object vs returning manually constructed JSON

I'm currently working on restful web services that returns, say a List<ConfidentialData>. (I'm using this ConfidentialData as an example for this question)

Suppose that this ConfidentialData is defined as follows:

@Getter
@Setter
public class ConfidentialData {
    private Integer id; // unique-identifier
    private String data;
    private String creationDate;
    private String approvalDate;
}

Now, I'm using jackson which behind the scene converts this List<ConfidentialData> to JSON and sends it as Response.

Now, different components in UI requires different state of ConfidentialData. Let's suppose that one of my UI pages (say page1) require the pure ConfidentialData object (without any additional members in JSON), and another page (say page2) requires ConfidentialData object with some additional members (Say these members are related to some statistics of ConfidentialData. These statistics don't really belong to the ConfidentialData object, but are to be added when page2 asks for it).

I've 3 options to go about it:

• Construct a separate domain object for page1 and page2.
  • I'm afraid that this solution is not very scalable as there can be more page that required slightly different composition of ConfidentialData and I'll end up bloating up my domain objects.
• Just keep one single domain object and construct JSON - by adding additional members that are required by specific pages.
  • I can see that I'll have to play with JSON in this case. (But I'm also aware of the fact that there exists sophisticated libraries like GSON that will make my life easy)
• I can can simply create one single domain object that will contain everything that's required by page1, page2, page3 and so on. (And I'll keep adding any additional members to this ConfidentialData domain object as and when required)
  • I'm very much opposed to this approach as the additional members that we're talking about with confidential data aren't easy to calculate. In some cases it can be some statistics related to ConfidentialData and it'll be computationally expensive to calculate those statistics. I don't want my simple API call to do all this computation, when the UI won't ever use it (eg. in case of page1)

I can see obvious drawbacks of both the first and the second approach.
My question here is what is the good practice in terms of restful services to handle such a situation.

Why not manipulate the JSON:

• Also, I'm not very much in favor of using JSON, as our java's permissions-filter (which is an interceptor - which intercepts the response from the services, and does some filtering on the list based on user's permissions) will then have to tweak JsonArray for doing the filtering, instead of simply filtering List<ConfidentialData>.
• But given that we've sophisticated libraries like GSON, the filtering can be easy.
• Also, as the filtering is to be done only on the basis of ConfidentialData#getId() (and this is never going to change) I can think of going ahead with JSON based approach which at the moment looks promising in terms of scalability.

I can see it as a trade-off between manipulating JSON and creating multiple domain objects. Is there any standard that's followed in industry to handle this kind of situation?

Depending on how your service has been called, you can populate only corresponding properties of the ConfidentialData and leave others intact. During serialization you can omit any unset properties. This can be achieved by supplying appropriate metadata of serialization library, be it Jackson or Gson.