it should be possible f.e. to enable rest api for a siteaccess which maps onto only a part of a site content.

In that case, the root element of the rest api should probably not list node 2 as content root (same goes for emdia and users, really)