We use a separate schema for the API (that way we can easily version our APIs as well). The API schemas only contain views/function that expose the tables/fields/etc that we want to expose.

SQL View queries get their own REST endpoints or you can use Postgrest like a language agnostic ORM.