API Returns Too Much Data? The Window Envelope Call

2026-10-31

It's Monday, 9:35. The screen-share has been running for four minutes, and your client's mobile developer is scrolling through the network tab.

"Just checking the profile screen," he says. "It loads fast. Nice."

You nod. Your camera shows a calm face. Behind it, a small cold thought is already forming, because you can see the response body on his screen. It's longer than a profile screen needs. Much longer.

He doesn't notice. He's looking at the layout. But the JSON scrolls past, and you catch field names you didn't think about when you wrote the endpoint. role. internal_notes. created_by. Something that might be a hash.

The call moves on. Your pulse doesn't.

The letter with the little window

That morning, before the call, you opened a letter from your own insurer. The envelope had a clear window, and through it you could see your name, your address and a customer number. You hadn't thought about that number being visible until you saw it there, printed for anyone who handled the post.

Nothing bad had happened. The letter did its job. But you'd stood in the hallway for a second, thinking: someone decided what shows through the window, and it wasn't me.

Now you're looking at your own window. You built the endpoint the quick way, because the quick way worked. You fetched the whole user object and sent it back, and the app took what it needed and ignored the rest. Everyone was happy. The rest just went along for the ride, unseen and never decided on.

Until today, when you saw it.

What the worry actually costs

The call ends at 10:05. "Great work," he says. "We'll ship the beta Thursday."

You close the laptop lid halfway, then open it again.

You don't know if anything sensitive is in those responses. That's the part that sits badly. Not a known hole, just a not-knowing. You could read through every endpoint right now. But then what? Is a field fine, or not? Does it matter who's asking? What if the list route returns more than the detail route? What if an admin field leaks to a normal user, and you only ever tested with your own account?

You make coffee. It goes cold on the desk.

The quiet cost is this: Thursday should feel like a small win, a beta going out. Instead you carry a low hum through Tuesday and Wednesday. You re-read code you already wrote. You half-listen at lunch. You wonder whether to tell the client, and what exactly you would tell them. "I might be sending too much" doesn't sound like something a professional says. It sounds like someone who should have known.

So you say nothing and keep checking, in no particular order, from memory. Tired of that, you open a blank note and write: what does each route actually return, and to whom?

The note stays blank for a while.

The moment it shifts

The turning point isn't dramatic. It's a thought, while you're standing at the supermarket on Tuesday evening, holding a bag of lemons you don't need.

I'm not afraid of the data. I'm afraid because I have no list.

You've been treating this as a single big question, "is my API safe?", and a question that big has no bottom. But the window on the envelope wasn't a mystery. Somebody sat down and decided, field by field, what showed. That's all. It was a decision, made on purpose, written down once.

Your endpoints can work the same way. For every route you could say: this is what leaves, this is who may see it, this is checked. Not from memory. Not at 4:50 on a Friday. Written down in a place you can open, tick through and hand to someone else.

The hum eases a little. Not gone, but it has a shape now, and a shape can be dealt with.

A different Thursday

Picture the same Thursday, with the beta going out.

You've gone through your routes one at a time. A few responses were trimmed. One field you'd forgotten about is gone. Another stays, and now you know why it stays. You've tried some requests as a stranger would, with no login, with the wrong login, with someone else's ID. You've seen what comes back, and it's what you meant to send.

At 9:30 the client opens the app and scrolls through the network tab again, the way developers do. This time you watch the JSON go by and feel nothing at all. Just a plain, ordinary response, the size it should be.

If the client asks, "Have you checked what the API sends back?" you don't hesitate or mumble. You say yes, and you can show them the page where you did.

Then you close the laptop at six. The lemons sit on the kitchen counter, still unused. You don't mind.

If this sounds like your Monday

If you've ever watched a response scroll past and thought I don't remember deciding that, you're in good company. It's one of the most ordinary worries in building an API, and it rarely means something is badly wrong. It usually means nobody has written down what should be there.

We made the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit for that moment. It's a 58-item review kit with a PDF and an XLSX tracker, curl tests you can run yourself, an auth-route scanner script and a client report template, for Node/Express and Python. It's a structured way to look, not a promise that nothing can ever go wrong, and it doesn't replace a professional security audit when you need one.

Like everything we make, it comes with a 30-day money-back promise. If it doesn't help, you get a full refund, no questions.

An illustrative story, written with AI assistance.