Security repercussions and concerns for mapping fields of basic REST API

Question

I have a basic JWT REST API which uses a simple user table(email & password) for basic initial authentication and receiving bearer token.

Now I want to mask the initi