Modify REST API response to only include fields requested in query parameter

Method 1: Convert objects to Map, remove surplus keys, convert Map to Json

@GetMapping("/v1/users")
@ResponseBody
public List<Map> getUsers(@RequestParam(required = false) Set<String> fields) { 
    List<User> users = ...;
    ObjectMapper oMapper = new ObjectMapper();
    return users.stream().map(u -> oMapper.convertValue(u, Map.class))
       .peek(map -> { 
          if (fields != null) map.keySet().retainAll(fields)
       })
       .collect(Collectors.toList());
}

Method 2: Use Gson

@GetMapping("/v1/users")
@ResponseBody
public String getUsers(@RequestParam(required = false) Set<String> fields) { 
    List<User> users = ...;
    Gson gson = new GsonBuilder()
            .setExclusionStrategies(new ExclusionStrategy() {
                @Override
                public boolean shouldSkipField(FieldAttributes f) {
                    return f.getDeclaringClass().equals(User.class)
                             && fields != null 
                             && !fields.contains(f.getFieldName())
                            ;
                }

                @Override
                public boolean shouldSkipClass(Class<?> clazz) {
                    return false;
                }
            }).create();
    return gson.toJson(users); 
}

Came across "https://github.com/monitorjbl/json-view". But was shot down by the team.

Btw, Jackson has @JsonView annotation support but it does not allow to include/exclude fields dynamically as you want. You can define fields subset and then return these subsets

public class Views {
    public static class Short {
    }
}

public class User {
    @JsonView(Views.Short.class)
    public String city;

    @JsonView(Views.Short.class)
    public String name;

    public String phone;

    public String country;
}

@GetMapping("/v1/users")
@ResponseBody
public String getUsers(@RequestParam(required = false) boolean shortView) { 
    List<User> users = ...;
    ObjectMapper mapper = new ObjectMapper();
    if (shortView) mapper = mapper.writerWithView(Views.Short.class);
    return mapper.writeValueAsString(users);
}

Here is an another approach:

Assumption 1: I believe its better to define return type of controller to be a domain object and let spring deal alone with conversion of it to JSON (unlike @Alexander Pavlov's answer). IMO its better for general code readability and for tools like swagger that introspect the controller and should know what should be returned.

Assumption 2: You don't have primitives in your User class.

Ok, now the controller obviously calls some "service" that makes some queries to the db, or in general does some logic that eventually produces the list of users (the list that you return to the client). The return object should be something like this:

class Users {

     private List<User> data;
}

class User { // + constructors, getters, setters, etc.
   private String name;
   private String city;
   private String phone;
   private String country;    
}

In this case in the service you can place "null" in field that you do not want to return:

User user = new User("John", "LA", null, null); // you only have name and city

Now you can place the annotation @JsonInclude(Include.NON_NULL) on class User and this will instruct Jackson to not include fields that have value 'null' into serialized response at all.

If you want this behaviour to be applied globally, you can configure ObjectMapper bean:

 ObjectMapper mapper = new ObjectMapper();
 mapper.setSerializationInclusion(Include.NON_NULL);

You can use @JsonInclude(JsonInclude.Include. NON_NULL) annotation. It should be applied to the class-level, directly above the class declaration. it instructs the Jackson JSON serialization/deserialization process to exclude fields with null values from the resulting JSON representation.

import com.fasterxml.jackson.annotation.JsonInclude;

@JsonInclude(JsonInclude.Include.NON_NULL)
public class ClassABC {
    // Class code here
}