How do you use ClassSerializerInterceptor with @Exclude() and @Expose() to control response shape in NestJS?

Q: How do you use ClassSerializerInterceptor with @Exclude() and @Expose() to control response shape in NestJS?

// 1. Enable globally app.useGlobalInterceptors(new ClassSerializerInterceptor(app.get(Reflector))); // 2. Entity with exclusion rules import { Exclude, Expose, Transform } from 'class-transformer'; export class UserEntity { @Expose() id: number; @Expose() email: string; @Expose() name: string; @Exclude() password: string; // never included in response @Expose() @Transform(({ value }) => value.toISOString().split('T')[0]) createdAt: Date; // formatted as YYYY-MM-DD constructor(partial: Partial ) { Object.assign(this, partial); } } // 3. Controller — MUST return a class instance @Get(':id') async findOne(@Param('id', ParseIntPipe) id: number) { const user = await this.usersService.findOne(id); return new UserEntity(user); // plain object would bypass @Exclude } // 4. Override serialization for a specific route @Get(':id/admin') @SerializeOptions({ excludeExtraneousValues: true }) findOneAdmin(@Param('id', ParseIntPipe) id: number) { return new UserEntity(await this.usersService.findOne(id)); } Controllers must return class instances — plain objects have no metadata for the interceptor to read. @Exclude() — blacklist approach: all properties included by default, decorated ones are stripped. @Expose() with excludeExtraneousValues: true — whitelist approach: only decorated properties are included. @SerializeOptions() at route or controller level overrides the global interceptor configuration. ClassSerializerInterceptor must be registered via APP_INTERCEPTOR for DI support (e.g. injecting Reflector).

Difficulty: 5/10

ClassSerializerInterceptor, Exclude/Expose decorators, DTO shaping

Enable ClassSerializerInterceptor globally so it calls instanceToPlain() on every response. Decorate entity fields with @Exclude() to omit sensitive data and @Expose() for whitelist mode. Controllers must return class instances — returning plain objects bypasses the serialization decorators entirely.

ClassSerializerInterceptor with exclusion rules

ClassSerializerInterceptor requirements:

1
Controllers must return class instances — plain objects have no metadata for the interceptor to read.
2

How do you use ClassSerializerInterceptor with @Exclude() and @Expose() to control response shape in NestJS?

Difficulty: 5/10

ClassSerializerInterceptor, Exclude/Expose decorators, DTO shaping

Enable ClassSerializerInterceptor globally so it calls instanceToPlain() on every response. Decorate entity fields with @Exclude() to omit sensitive data and @Expose() for whitelist mode. Controllers must return class instances — returning plain objects bypasses the serialization decorators entirely.

ClassSerializerInterceptor with exclusion rules

ClassSerializerInterceptor requirements:

1
Controllers must return class instances — plain objects have no metadata for the interceptor to read.
2

How do you use ClassSerializerInterceptor with @Exclude() and @Expose() to control response shape in NestJS?

How do you use ClassSerializerInterceptor with @Exclude() and @Expose() to control response shape in NestJS?

Scenario Questions

Follow-up Questions