# Introducing global omit for model fields in Prisma ORM 5.16.0!

URL: https://www.prisma.io/blog/introducing-global-omit-for-model-fields-in-prisma-orm-5-16-0
Published: 2024-06-25
Authors: Jon Harrell
Description: Prisma ORM v5.16.0 allows you to omit fields globally or per-query. This blog post overviews the change and how to omit fields in your Prisma Client queries.

Discover the powerful new feature in Prisma ORM 5.16.0 that lets you globally or locally omit specific fields from your queries. Whether you need to ensure sensitive information (like a password) is never exposed or you want to streamline data retrieval for a single query, Prisma ORM has you covered. In this blog post, learn how to enhance your data management with code examples and guidance.

With Prisma ORM 5.16.0, we’re excited to introduce a global way of omitting fields from Prisma Client queries! This highly requested feature was directly influenced by the feedback we’ve received from our community through reactions on GitHub issues as well as feedback on our original implementation of the `omitApi` Preview feature. Thank you very much to everyone who helped us continue to develop this feature!

We believe that this release helps enhance developers’ need to balance performance and experience against security and privacy. Read on as we use this feature to simplify how you manage sensitive data in your query results.

### Omitting fields in Prisma ORM 5.16.0 [#omitting-fields-in-prisma-orm-5160]

With the `omitApi` Preview feature, originally released with Prisma ORM 5.13.0, you can now `omit` fields from your queries alongside the existing `select` functionality or on Prisma Client initialization. You can choose to omit fields globally, such as user passwords, or define fields to omit on a per-query basis, such as fields that aren’t necessary in all views. It’s now easier than ever to only send your frontend the data it needs.

### How to omit fields globally [#how-to-omit-fields-globally]

On Prisma Client initialization, you have the ability to mark fields as “omitted”. This means that for any query on that Prisma Client instance, those fields will never be returned. For example, you can initialize Prisma Client and always `omit` user passwords.

```tsx
const prisma = new PrismaClient({
  omit: {
    user: {
      // make sure that password and internalId are never queried.
      password: true,
      internalId: true,
    },
  },
});

const usersWithoutPasswords = await prisma.user.findMany({});
```

This can be overridden at the individual query level, if you want to re-include a globally omitted field:

```tsx
const prisma = new PrismaClient({
  omit: {
    user: {
      // never return password or internalId in queries
      password: true,
      internalId: true,
    },
  },
});

const usersWithPasswords = await prisma.user.findMany({
  // set omit to false for `internalId`. So `internalId` is returned in this query.
  // `password` remains omitted and is not returned. 
  omit: { internalId: false }, // omit now false, so internal field is returned
});
```

### How to omit fields locally [#how-to-omit-fields-locally]

Originally released in Prisma ORM 5.13.0, the per-query version of the `omitApi` preview feature is also available. This feature allows you to `omit` fields at the per-query level, similar to how you would use `select`.

```tsx
const usersWithoutPasswords = await prisma.user.findMany({
  omit: { password: true },
});
```

Now you have the flexibility to omit a field globally and only select it in specific circumstances, or vice versa!

### When to omit fields [#when-to-omit-fields]

Now that there are two ways to omit fields, the most common question is “when should I use each approach?”

If you are concerned about security or exposing sensitive information, you will want to use a **global omit** in most cases. This will guarantee that new queries written do not inadvertently include sensitive data in your queries. A solid use case for this would be always omitting user passwords. For teams storing regulated data on [HIPAA-compliant Prisma Postgres](https://www.prisma.io/postgres/hipaa) (Business plan), it is also a straightforward way to keep sensitive columns out of query results. It does not redact query-event logs, and a per-query `select` or `omit: false` can still bring a field back, so log sinks need their own controls.

If, however, you are concerned about data optimization, you will want to use a **local omit**. This will allow you to continue to use all fields on a model in most queries and then slim down the model where amount of data transferred is a concern. For example, if you have a table where the data in each column is fairly light, but there is one column that contains a large amount of JSON or Blob data, you could easily exclude that column so that your app isn’t required to transfer all of that data for each request.

### We want your continued feedback! [#we-want-your-continued-feedback]

The ability to omit fields globally is [our most requested feature](https://github.com/prisma/orm/issues/5042) and we’re excited to include this in our 5.16.0 release. If you have feedback please do not hesitate to add to our [dedicated GitHub discussion](https://github.com/prisma/orm/discussions/23924). We’ve had some great conversations about our `omitApi` Preview feature so far and we’re excited to keep those conversations going.