Example 1: The Aadhaar API Incident

Consider the case of a regional banking application that integrated with India's Aadhaar-enabled payment system. When a user requested their transaction history through the API, the application returned a raw User model with columns including:

• aadhaar_id (PII)
• password_hash (sensitive)
• last_login_ip (potentially revealing user behavior)
• internal_notes (confidential business data)

This exposed not just personal information but also operational secrets that could be weaponized against financial institutions.

The implications were immediate:

• Unauthorized access to banking records
• Potential for credential stuffing attacks
• Compromised business intelligence

In this scenario, the API's design created a perfect storm of vulnerabilities that could have cascaded through Northeast India's financial ecosystem.

Example: Implementing Secure User Profile API in Assam

To implement API Resources effectively in Assam's banking sector, developers should follow this structured approach:

1. Create Resource Classes:

                       // UserProfileResource.php
                       namespace App\Http\Resources;
   
                       use Illuminate\Http\Resources\Json\JsonResource;
   
                       class UserProfileResource extends JsonResource
                       {
                           public function toArray($request)
                           {
                               return [
                                   'id' => $this->id,
                                   'name' => $this->name,
                                   'email' => $this->email,
                                   'public_profile' => [
                                       'created_at' => $this->created_at->format('Y-m-d'),
                                       'last_login' => $this->last_login ? $this->last_login->format('Y-m-d H:i:s') : null,
                                   ],
                                   // Never expose these:
                                   // 'password_hash',
                                   // 'remember_token',
                                   // 'internal_notes'
                               ];
                           }
                       }
                   

2. Implement Field Masking:

                       // In UserController.php
                       public function show(User $user)
                       {
                           return new UserProfileResource($user);
                       }
                   

3. Add Security Middleware:

                       // routes/api.php
                       Route::middleware(['auth:sanctum', 'api.resource.assam'])->group(function () {
                           Route::get('/users/{user}', [UserController::class, 'show']);
                       });
                   

4. Create State-Specific Policy:

                       // App/Policies/AssamDataProtectionPolicy.php
                       namespace App\Policies;
   
                       use Illuminate\Auth\Authenticatable;
   
                       class AssamDataProtectionPolicy
                       {
                           public function before($user, $ability)
                           {
                               if ($user->state === 'Assam') {
                                   return $ability->allow('assam_data_protection');
                               }
                           }
                       }
                   

The result is an API that:

• Explicitly controls what data is exposed
• Complies with Assam's data protection regulations
• Maintains performance through efficient data packaging
• Provides clear separation between public and private data

Meghalaya serves as a model for how