Sometimes we want to filter some sensitive fields, we can do that with groups:

<?php

namespace App\Entity;

use ApiPlatform\Core\Annotation\ApiResource;
use App\Repository\UserRepository;
use Doctrine\Common\Collections\ArrayCollection;
use Doctrine\Common\Collections\Collection;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Serializer\Annotation\Groups;

/**
 * @ApiResource(
 *     itemOperations={"get"},
 *     collectionOperations={},
 ***     normalizationContext={
 *           "groups"={"read"}
 *     }**
 * )
 * @ORM\Entity(repositoryClass=UserRepository::class)
 */
class User implements PasswordAuthenticatedUserInterface
{
    /**
     * @ORM\Id
     * @ORM\GeneratedValue
     * @ORM\Column(type="integer")
     *** @Groups({"read"})**
     */
    private $id;

    /**
     * @ORM\Column(type="string", length=255)
     *** @Groups({"read"})**
     */
    private $username;

    /**
     * @ORM\Column(type="string", length=255)
     */
    private $password;

    /**
     * @ORM\Column(type="string", length=255)
     *** @Groups({"read"})**
     */
    private $name;

    /**
     * @ORM\Column(type="string", length=255)
     */
    private $email;

    /**
     * @ORM\OneToMany(targetEntity="App\Entity\BlogPost", mappedBy="author")
     *** @Groups({"read"})**
     */
    private $posts;

    /**
     * @ORM\OneToMany(targetEntity="App\Entity\Comment", mappedBy="author")
     *** @Groups({"read"})**
     */
    private $comments;

    public function __construct()
    {
        $this->posts = new ArrayCollection();
        $this->comments = new ArrayCollection();
    }

    public function getId(): ?int
    {
        return $this->id;
    }

    public function getUsername(): ?string
    {
        return $this->username;
    }

    public function setUsername(string $username): self
    {
        $this->username = $username;

        return $this;
    }

    public function getPassword(): ?string
    {
        return $this->password;
    }

    public function setPassword(string $password): self
    {
        $this->password = $password;

        return $this;
    }

    public function getName(): ?string
    {
        return $this->name;
    }

    public function setName(string $name): self
    {
        $this->name = $name;

        return $this;
    }

    public function getEmail(): ?string
    {
        return $this->email;
    }

    public function setEmail(string $email): self
    {
        $this->email = $email;

        return $this;
    }

    /**
     * @return Collection
     */
    public function getPosts(): Collection
    {
        return $this->posts;
    }

    /**
     * @return Collection
     */
    public function getComments(): Collection
    {
        return $this->comments;
    }

}

Using multiple groups, and include denormalization

<?php

namespace App\Entity;

use ApiPlatform\Core\Annotation\ApiResource;
use App\Repository\UserRepository;
use Doctrine\Common\Collections\ArrayCollection;
use Doctrine\Common\Collections\Collection;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Serializer\Annotation\Groups;
use Symfony\Component\Validator\Constraints as Assert;

/**
 *@ApiResource(
 ***     normalizationContext={"groups"={"get"}},**
 *     itemOperations={
 *          "get"={
 *              "security"="is_granted('IS_AUTHENTICATED_FULLY')",
 *              **"normalization_context"={
 *                  "groups"={"get"}
 *               }**
 *           },
 *           "put"={
 *              "security"="is_granted('IS_AUTHENTICATED_FULLY') and object.getUsername() == user.getUsername()",
 *              **"denormalization_context"={
 *                  "groups"={"put"}
 *               }**
 *          }
 *      },
 *     collectionOperations={
 *          "post"={
 *               **"denormalization_context"={
 *                  "groups"={"post"}
 *               }**
 *          }
 *     },
 * )
 *@ORM\Entity(repositoryClass=UserRepository::class)
 *@UniqueEntity("username")
 *@UniqueEntity("email")
 */
class User implements UserInterface, PasswordAuthenticatedUserInterface
{
/**
     *@ORM\Id
		 *@ORM\GeneratedValue
		 *@ORM\Column(type="integer")
     ***@Groups({"get"})**
     */
private $id;

/**
     *@ORM\Column(type="string", length=255)
     ***@Groups({"get", "post"})**
     *@Assert\NotBlank()
     *@Assert\Length(min=6, max=255)
     */
private $username;

/**
     *@ORM\Column(type="string", length=255)
     ***@Groups({"put", "post"})**
     *@Assert\NotBlank()
     *@Assert\Regex(
     *     pattern="/(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).{7,}/",
     *     message="Password must be seven characters long and contains at least one digit, one upper case and one lower case letter"
     * )
     */
private $password;

/**
     ***@Groups({"put", "post"})**
     *@Assert\NotBlank
*@Assert\Expression(
     *     "this.getPassword() === this.getRetypedPassword()",
     *     message="Passwords does not match"
     * )
     */
private $retypedPassword;

/**
     *@ORM\Column(type="string", length=255)
     ***@Groups({"get", "post", "put"})**
     *@Assert\NotBlank()
     *@Assert\Length(min=3, max=255)
     */
private $name;

/**
     *@ORM\Column(type="string", length=255)
     ***@Groups({"post", "put"})**
     *@Assert\NotBlank()
     *@Assert\Email()
     *@Assert\Length(min=6, max=255)
     */
private $email;

/**
     *@ORM\OneToMany(targetEntity="App\Entity\BlogPost", mappedBy="author")
     ***@Groups({"get"})**
     */
private $posts;

/**
     *@ORM\OneToMany(targetEntity="App\Entity\Comment", mappedBy="author")
     ***@Groups({"get"})**
     */
private $comments;

...