Unable to hide user's fields from REST API

[djoo]

I want to hide ACF fields on my users.

For exemple on this https://domain.com/wp-json/acf/v3/users/279/

I did enabled the filter in functions.php :

add_filter( 'acf/rest_api/field_settings/show_in_rest', '__return_true' );

The toggle Show in REST API? is visible in field settings but set to No by default. Despite that, all fields are still included in the API. Turning it on and back off does not remove them either.

Any idea ?

it's really important because it's confidential informations

[djoo]

Found a way, if it can help

add_filter( 'rest_endpoints', 'disable_custom_colivys_rest_endpoints' );
function disable_custom_colivys_rest_endpoints( $endpoints ) {

    $routes = array( 
        '/wp/v2/users', 
        '/wp/v2/users/(?P<id>[\d]+)',
        '/acf/v3/users',
        '/acf/v3/users/(?P<id>[\\d]+)/?(?P<field>[\\w\\-\\_]+)?',
     );

    foreach ( $routes as $route ) {
        if ( empty( $endpoints[ $route ] ) ) {
            continue;
        }

        foreach ( $endpoints[ $route ] as $i => $handlers ) {
            if ( is_array( $handlers ) && isset( $handlers['methods'] ) &&
                'GET' === $handlers['methods'] ) {
                unset( $endpoints[ $route ][ $i ] );
            }
        }
    }

    return $endpoints;
}

[brownsugar]

You can use Disable REST API.