For every API response, ask: what does the client actually need from this response to do its job? Return exactly that — nothing more.

A user profile endpoint accessed by other users should return: name, bio, avatar, joinDate. That's it. It should not return: email, age, weight, city, birthday, workout stats — even if those fields exist in the database and the user has technically set them.

A user profile endpoint accessed by the user themselves may return more — but still not passwordHash, resetToken, or internal system fields.

Design each endpoint's response based on the consumer's actual data needs — not the database schema.

Peloton's profile endpoint returned age, weight, city, birthday, workout stats. The app displayed almost none of this. The API returned all of it. The fix wasn't to show more in the UI — it was to not send it from the server in the first place.

Minimizing data per endpoint still requires manually reviewing every endpoint to ensure it's returning only what's needed. Pair with MIT 06 (schema validation) to catch regressions when the data model changes.