Stop exposing grant funding_amount in the public REST API (#1268)

The /api/v1/ grants payload no longer includes funding_amount. The value
is still stored on the Grant model and shown to editors in /admin and in
the sponsor funding totals; it is simply not serialized over the public
API -- extending the same "already-public data only" principle that
already keeps personal email out.

Bump to 2.27.1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y9JS9XZfD86FdDLJiJFSBk

Author: jonfroehlich

docs/API.md

@@ -84,8 +84,8 @@ sub-resources are keyed by `short_name`:
 ### Grants — `GET /api/v1/grants/`
 
 Filters: `?project=<short_name>`, `?sponsor=<sponsor short_name>`. Each grant
-includes its `sponsor`, `funding_amount`, `grant_id`, `grant_url`, and the
-`projects` it funds.
+includes its `sponsor`, `grant_id`, `grant_url`, and the `projects` it funds.
+Funding amounts are intentionally **not** exposed by the API.
 
 ### People — `GET /api/v1/people/`
 

makeabilitylab/settings.py

@@ -86,8 +86,8 @@
     SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
 
 # Makeability Lab Global Variables, including Makeability Lab version
-ML_WEBSITE_VERSION = "2.27.0" # Keep this updated with each release and also change the short description below
-ML_WEBSITE_VERSION_DESCRIPTION = "Adds a public, read-only REST API (#1268) at /api/v1/ so external sites can treat the Makeability Lab website as the source of truth for already-public content instead of duplicating it. Endpoints cover publications (filterable by project, author, year, and venue type -- e.g. ?author=jonfroehlich&page_size=5 for a 'recent publications' widget), publicly-visible projects, grants, and people, plus project sub-resources for a project's publications, grants, people, and leadership (PIs/Co-PIs/leads) -- the exact data Project Sidewalk needs to render its funding, team, and papers from one place. Built on the already-bundled Django REST Framework: read-only (GET only), no auth and no throttle since the data is already public, paginated with a tunable page_size (max 100), absolute media/page URLs in every payload, and cross-origin requests enabled on /api/ only (via a tiny in-repo CORS middleware) so a browser-side widget can fetch it directly. Personal email is deliberately not exposed. Full reference: docs/API.md."
+ML_WEBSITE_VERSION = "2.27.1" # Keep this updated with each release and also change the short description below
+ML_WEBSITE_VERSION_DESCRIPTION = "Stops the public REST API (#1268) from exposing grant funding amounts: the /api/v1/ grants payload no longer includes the funding_amount field. The amount is still stored on the model and visible to editors in /admin (and in the sponsor funding totals) -- it is simply not served over the API. Personal email was already excluded; this extends that same 'already-public data only' principle to keep dollar figures out of the public API. Full reference: docs/API.md."
 DATE_MAKEABILITYLAB_FORMED = datetime.date(2012, 1, 1)  # Date Makeability Lab was formed
 MAX_BANNERS = 7 # Maximum number of banners on a page
 

website/api/serializers.py

@@ -178,7 +178,6 @@ class Meta:
             "title",
             "sponsor",
             "grant_id",
-            "funding_amount",
             "grant_url",
             "start_date",
             "end_date",

website/tests/test_api.py

@@ -172,7 +172,8 @@ def test_project_grants_subresource(self):
         self.assertEqual(body["count"], 1)
         grant = body["results"][0]
         self.assertEqual(grant["sponsor"]["short_name"], "NSF")
-        self.assertEqual(grant["funding_amount"], 500000)
+        # Funding amounts are intentionally not exposed by the public API.
+        self.assertNotIn("funding_amount", grant)
 
     def test_project_people_subresource(self):
         resp = self.client.get("/api/v1/projects/projectsidewalk/people/")