invisnet

The REST API is essential for any modern web framework, but with it comes a huge attack surface. WP REST API Security reduces the attack surface by disabling all the REST API endpoints by default, allowing you to enable only those actually needed. Those that are enabled require authentication by default, allowing you to choose which to make public.
<blockquote>
N.B. If you are using the new Block Editor you must keep nearly all the endpoints enabled for it to work, but none need be public.
</blockquote>

WP REST API Security

Provides a UI to control which REST API endpoints are enabled and which require authentication.

svrooij

Since wordpress version 4.9.? wordpress includes the functionality provided by this plugin in the core of wordpress.
Checkout https://developer.wordpress.org/rest-api/using-the-rest-api/global-parameters/#_fields for functionality included in the wordpress core, 
they made it even better by filtering the amount of data pulled from the database.
This plugin will no longer be maintained since it has been superseded by the core functionality.
The <a href="https://wordpress.org/plugins/rest-api/" rel="ugc">wp-rest-api-v2</a> returns a lot of properties. 
It could be very useful (or mobile-data-friendly) to only return the properties needed by the application.
If you only want titles and links of some articles it doesn’t make sense to return the content or the excerpt.
This isn’t limited to posts, it also works on custom posttypes, categories, pages, terms, taxonomies and comments.
Instead of returning:
<pre><code>{
 "id": 2138,
 "date": "2015-10-25T15:31:03",
 "guid": {
 "rendered": "http://worldofict.nl/?p=2138"
 },
 "modified": "2015-10-25T15:31:03",
 "modified_gmt": "2015-10-25T14:31:03",
 "slug": "rechtenvrije-fotos",
 "type": "post",
 "link": "http://worldofict.nl/tip/2138-rechtenvrije-fotos/",
 "title": {
 "rendered": "Rechtenvrije foto’s"
 },
 "content": {
 "rendered": ".. A lot of content .. "
 },
 "excerpt": {
 "rendered": " .. A lot of content ..."
 },
 "author": 2,
 "featured_image": 2139,
 "comment_status": "open",
 "ping_status": "open",
 "sticky": false,
 "format": "standard",
 //.. even more tags ....
}
</code></pre>
It can return (with <code>fields=id,title.rendered,link</code> as GET parameter)
<pre><code>{
 "id": 2138,
 "link": "http://worldofict.nl/tip/2138-rechtenvrije-fotos/",
 "title": {
 "rendered": "Rechtenvrije foto’s"
 }
}
</code></pre>
<h4>Notes</h4>
<ol>
<li>If you specify fields so it wouldn’t return data the default response is send back to the client.</li>
<li>(for developers) something wrong with this plugin? <a href="https://github.com/svrooij/rest-api-filter-fields/" rel="nofollow ugc">Github</a></li>
<li>If you liked the plugin <a href="https://github.com/sponsors/svrooij" rel="nofollow ugc">consider sponsoring me</a></li>
</ol>

REST API – Filter Fields

This is hands-down the best REST API extension available.

Best REST API plugin

Filter the properties returned by the Wordpress rest api V2 (only needed until wordpress 4.9)

WP REST API Security vs REST API – Filter Fields