Use `read_only_fields` in the serializer.
Look e.g. at TeamSerializer in accounts.