REST is not a strict specification and it's not a single implementation, you can just start doing it. That said, I wouldn't recommend going the allow everythin

REST is not a strict specification and it's not a single implementation, you can just start doing it. That said, I wouldn't recommend going the allow everything flexible resolver way like GraphQL: it's terrible for performance (eg. most APIs use N+1 queries unless you have something like https://github.com/join-monster/join-monster https://github.com/join-monster/join-monster), the complexity of the codebase skyrockets and having to specify all the fields you want is not exactly ergonomic in most situations.