<?php

...

#[ORM\Entity(repositoryClass: ReportRepository::class)]
#[ApiResource(
    uriTemplate: '/admin/reports{._format}',
    operations: [
        new GetCollection(security: "is_granted('ROLE_ADMIN')"),
        new Get(security: "is_granted('ROLE_ADMIN')"),
        new Patch(security: "is_granted('ROLE_ADMIN')"),
    ],
    normalizationContext: [
        AbstractNormalizer::GROUPS => ['Report:read:admin'],
    ],
    denormalizationContext: [
        AbstractNormalizer::GROUPS => ['Report:write:admin'],
    ],
    order: ['createdAt' => 'DESC']
)]
#[ApiResource(
    operations: [
        new GetCollection(),
        new Post(),
        new Get(
            security: 'object.getCreatedBy() == user',
            controller: NotFoundAction::class, 
            read: false, 
            output: false
        )
    ],
    normalizationContext: [
        AbstractNormalizer::GROUPS => ['Report:read'],
    ],
    denormalizationContext: [
        AbstractNormalizer::GROUPS => ['Report:write'],
    ],
    order: ['createdAt' => 'DESC']
)]
class Report
{
    ...