Why Response model exclude and include in FastAPI? - Purpose & Use Cases

The Big Idea

Discover how to protect sensitive data effortlessly in your API responses!

The Scenario

Imagine building an API that returns user data, but you want to hide sensitive info like passwords or only show certain fields depending on the request.

The Problem

Manually removing or adding fields in every response is tiring, error-prone, and easy to forget. It leads to inconsistent data and security risks.

The Solution

FastAPI's response model exclude and include options let you easily control which fields appear in the output, keeping your code clean and safe.

Before vs After

✗ Before

user_dict = user.__dict__
if 'password' in user_dict:
    del user_dict['password']
return user_dict

✓ After

return UserResponse.from_orm(user).dict(exclude={'password'})

What It Enables

You can flexibly customize API responses without rewriting code or risking sensitive data leaks.

Real Life Example

Showing a public profile with only username and bio, while hiding email and password fields automatically.

Key Takeaways

Manually filtering response data is slow and risky.

FastAPI's exclude/include cleanly controls output fields.

This improves security and keeps code simple.

Practice

1. What does the response_model_exclude parameter do in FastAPI?

easy

A. It includes only specified fields in the API response.

B. It hides specified fields from the API response.

C. It changes the data type of response fields.

D. It validates the response data against the model.

Solution

1. Step 1: Understand the purpose of response_model_exclude

   This parameter is used to remove or hide certain fields from the response data.

2. Step 2: Compare with other parameters

   Unlike response_model_include which shows only specified fields, response_model_exclude hides specified fields.

3. Final Answer:

   It hides specified fields from the API response. -> Option B

4. Quick Check:

   Exclude means hide fields [OK]

Hint: Exclude hides fields; include shows fields [OK]

Common Mistakes:

• Confusing exclude with include
• Thinking it changes data types
• Assuming it validates data

2. Which of the following is the correct way to exclude the field password from a FastAPI response model?

easy

A. response_model_include=['password']

B. response_model_include={'password'}

C. response_model_exclude={'password'}

D. response_model_exclude=['password']

Solution

1. Step 1: Identify correct data type for exclude

   The response_model_exclude parameter expects a set or dict of field names to exclude.

2. Step 2: Check syntax correctness

   Using a set like {'password'} is valid; lists are not accepted and cause ValueError.

3. Final Answer:

   response_model_exclude={'password'} -> Option C

4. Quick Check:

   Exclude uses set or dict of fields [OK]

Hint: Use set {'password'} to exclude fields [OK]

Common Mistakes:

• Using include instead of exclude
• Using a list ['password'] instead of set {'password'}
• Passing a string instead of set

3. Given this FastAPI endpoint:

from fastapi import FastAPI
from pydantic import BaseModel

app = FastAPI()

class User(BaseModel):
    id: int
    username: str
    email: str
    password: str

@app.get('/user', response_model=User, response_model_exclude={'password'})
def get_user():
    return User(id=1, username='alice', email='[e-mail]', password='secret')

What will the API response JSON include?

medium

A. {"id": 1, "username": "alice", "email": "[e-mail]"}

B. {"id": 1, "username": "alice", "email": "[e-mail]", "password": "secret"}

C. {"username": "alice", "email": "[e-mail]"}

D. {"id": 1, "password": "secret"}

Solution

1. Step 1: Understand response_model_exclude effect

   The password field is excluded from the response, so it will not appear in the JSON output.

2. Step 2: Identify included fields

   All other fields id, username, and email remain and appear in the response.

3. Final Answer:

   {"id": 1, "username": "alice", "email": "[e-mail]"} -> Option A

4. Quick Check:

   Excluded field missing in output [OK]

Hint: Excluded fields do not appear in response JSON [OK]

Common Mistakes:

• Expecting excluded fields to appear
• Confusing exclude with include
• Ignoring response_model parameter

4. You wrote this FastAPI endpoint:

@app.get('/item', response_model=Item, response_model_include=['name', 'price'])
def get_item():
    return Item(id=5, name='Book', price=10.0, description='A good read')

But the endpoint raises a ValueError instead of returning the filtered response. What is the likely error?

medium

A. Using a list instead of a set for response_model_include

B. The response_model_include parameter should be a set, not a list

C. The response_model_include parameter is ignored if not a set or dict

D. The response_model_include parameter must be a dictionary

Solution

1. Step 1: Check expected type for response_model_include

   FastAPI expects response_model_include to be a set or dict of fields, not a list.

2. Step 2: Understand why list fails

   Passing a list causes a ValueError because Pydantic requires set or dict for include/exclude.

3. Final Answer:

   Using a list instead of a set for response_model_include -> Option A

4. Quick Check:

   Include needs set or dict [OK]

Hint: Use set {} for include, not list [] [OK]

Common Mistakes:

• Using list instead of set for include
• Expecting include to filter with wrong type
• Not checking parameter types

5. You want to return a user response with only id and username fields included, but exclude password and email. Which is the best way to do this in FastAPI?

hard

A. Use response_model_exclude={'password', 'email'} to exclude unwanted fields.

B. Return a custom dictionary with only id and username instead of the model.

C. Use both response_model_include={'id', 'username'} and response_model_exclude={'password', 'email'} together.

D. Use response_model_include={'id', 'username'} to include only needed fields.

Solution

1. Step 1: Understand include vs exclude

   Including only id and username is simpler and clearer than excluding fields.

2. Step 2: Avoid mixing include and exclude

   Using both can cause confusion or unexpected results; better to use include to specify exactly what to show.

3. Final Answer:

   Use response_model_include={'id', 'username'} to include only needed fields. -> Option D

4. Quick Check:

   Include specifies exact fields to show [OK]

Hint: Use include to specify exact fields to show [OK]

Common Mistakes:

• Mixing include and exclude causing conflicts
• Excluding fields but missing some unwanted fields
• Returning raw dict instead of model