[rand_r]

Does OpenAPI have a way for the client to whitelist fields? I see that as a major selling point for GraphQL.

Without it, you end up having to create tailored endpoints for each use-case vs. for example a single “user” endpoint/vertex that supports the complete buffet of fields for all use-cases in one convenient place.

[hardwaresofton]

I can't say that it should have that feature -- I'd say that is outside the purview of OpenAPI itself, but it could definitely be built in in a repeatable and scalable way pretty simply. I can tell you that tools like PostgREST have had this for a long time[0].

[0]: https://postgrest.org/en/v7.0.0/api.html#vertical-filtering-...