REST API responses based on authentication, best practices?

Question

I have an API with endpoint GET /users/{id} which returns a User object. The User object can contain sensitive fields such as ca