my question is about the design of an API.

We are about to rebuild our entire API backend infrastructure from Meteor.JS to NodeJS/Express.

Although we found one problem concerning our API. We used to have Method.Call on Meteor and could define whatever we want using that.

Now we would like to follow some REST principles and therefor we would like to use only GET/POST/PUT/DELETE and PATCH

//Example POST

createTournament: async(req, res) => {
  if(!req.body || typeof req.body !== 'object'
    || !req.body.name || typeof req.body.name !== 'string'
    || !req.body.description || typeof req.body.description !== 'string'
    || !req.body.gameId || typeof req.body.gameId !== 'string')
  {
      return res.sendStatus(400);
  }
  const insertId = await (functions.createTournament(
    req.body.name,
    req.body.description,
    req.body.gameId);
  if (insertId) {
    res.status(201).send(insertId);
  } else {
    res.sendStatus(404);
  }
},

//My current patch function

patch: async(req, res) => {
  if (!req.params
  || !req.params.id  
  || !req.body) {
    res.sendStatus(400);
  }
  const tournament = await functions.patchTournament(req.params.id, req.body);
  res.status(200).send(tournament);
},

The problem is that only users with the role admin can patch a gameId, and other users can only patch a description.

This is a lightweight object, since the actual one has about 20 properties to be set.

While using PATCH, we were wondering if it was possible to authorize certain user roles to be able of only editing certain fields. And how we could do this in a clear and easy to understand manner.

Any help would be really great. If you have any questions feel free to ask me.