return whitelisted properties of an object