My API endpoints return full records (or full lists of records) and the client picks out what it needs. I suspect I'm sending far more data than the UI uses. Audit and fix my response payloads: 1. For each endpoint that feeds a screen, compare what it returns against what the UI actually renders. Flag fields that are never used on the client. 2. Flag anything sensitive that leaks out by default: password hashes, internal IDs, admin notes, other users' data included in joined records, full email addresses where a display name would do. Unused fields in a response are a security issue, not just a weight issue. 3. For list endpoints, check whether each item carries nested/joined data that duplicates across items (the same author object embedded 50 times). Normalize or slim these down. 4. Implement explicit field selection per endpoint: return only what the consuming screen needs. Where one endpoint serves multiple screens with different needs, support field selection or split the endpoints rather than returning the union of everything. 5. Keep the changes backward compatible if I have other consumers; flag anything that would break. Don't remove fields that are used for client-side logic even if they aren't displayed (IDs, slugs, permissions flags). The deliverable is the updated endpoints with before/after payload sizes for the heaviest ones, plus a list of any sensitive fields you found being over-exposed.