Another option might be to use a blacklist rather than a whitelist. I.e. get all in $data except certain fields that you don't want to list publicly (I'm assuming this normalize is to get the list of fields that might be used/requested for public use, right?)