[api]

Sometimes it is. Often it's done in the database itself, but then you have to be very careful you never have a query that returns data that belongs to someone else.