I agree that might be cleaner to generater from another array. About blacklist vs whitelist, could probably be done whatever ways. The difference is that with a blacklist you may accidentally leak information trough the API if you add a column with secrets and forget to update the normalizer, while with a whitelist you still have to update it if you add a column but you wont accidentally leak stuff. I doubt that would happen though.