Provide a consistent way of describing the difference between DB schema and request/response

[cebe]

For simple CRUD operations the DB schema often matches the JSON schema of the request response exactly. However there are a lot of use cases where the schema returned by the API is very different from the API.

Example:

User:
  type: object
  properties:
    id:
      type: integer
    username:
       type: string
       maxLength: 32
    password_hash:
       type: string
       maxLength: 64

For obvious reasons we do not want to expose the password_hash on the API.

Possible solutions:

1. use readOnly and writeOnly (related to #4)
2. use sepearate Schemas for DB and API and find a way to link them together

[SOHELAHMED7]

I suggest 2nd option: "use sepearate Schemas for DB and API and find a way to link them together"