Abstract: Technical solutions are directed to an application for field access control of APIs using data structure filtering. An application can identify an application programming interface (API) call from a second application requesting data entries and can receive, an API response destined for the second application. The API response can include a data structure with fields including the data entries. The application can select, responsive to the API response, an access profile associated with the client account and determine that the client account is not granted access to a data entry included in a field of the data structure. The application can modify, in response to the determination, the API response to exclude from the data structure the field or the data entry and transmit, to the second application, the modified API response excluding the field or the entry from the data structure.