Surely it will only expose the fields you've defined in your Serializer class?

https://www.django-rest-framework.org/api-guide/serializers/...