# Proteceted fields not hidden in REST json

**URL:** https://discourse.cakephp.org/t/proteceted-fields-not-hidden-in-rest-json/4604
**Category:** Need Help
**Created:** [July 23, 2018, 7:27am UTC](https://discourse.cakephp.org/t/proteceted-fields-not-hidden-in-rest-json/4604 "2018-07-23T07:27:32Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![kani](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/kani/32/515_2.png) [@kani](https://discourse.cakephp.org/u/kani)
#### Post date: [July 23, 2018, 7:27am UTC](https://discourse.cakephp.org/t/proteceted-fields-not-hidden-in-rest-json/4604/1 "2018-07-23T07:27:32Z")

</div>

Cakephp 3.6.7  
CakeDC users plugin 7.0.2

```
/** vendor\cakedc\users\src\Model\Entity\User.php
 * Fields that are excluded from JSON an array versions of the entity.
 *
 * @var array
 */
protected $_hidden = [
    'password',
    'token',
    'token_expires',
    'api_token',
];

```

but those fields not hidden on API call