You shouldn’t arbitrarily include or exclude information. The response to a given input should always be the same output, and not depend on what API key you are calling with.
Developing a different getUser API for 20 different caller types does not scale.
Ofcourse, real solution here is that the airline software should not just pass along everything it received from Amadeus but rather that they should convert it and return only the relevant subset. This would avoid these type of issues.
This is frequently called property level authorization or field level authorization.
https://stackoverflow.com/questions/30002351/enforcing-prope...
https://help.salesforce.com/articleView?id=security_data_acc...
You're just wording it in an indirect way to make it seem like something different. It's not "Using API key to determine what kind of information is returned", it's "hiding sensitive fields based on permissions".