When I perform a GET request against my site's REST API, the fields marked "Hide from REST API" still appear in the response to my GET request. Am I misunderstanding the usage of this setting? Shouldn't the field be not included in the REST API response?
The field shouldn't be available in the Rest response when you enable the option "Hide from REST API". I've rechecked this feature and it works well on my local site.