How a rest server should manage user enabling?

I have a rest java backend that use javaee 7 and a react/redux application. The same application is used by n different customer. Each customer can ask for m roles that are different from the roles of the other customers. One customer can, for example, pay to see a column in a list that shouldn't be visible for another customer. The question is.. Is there a pattern or a method to handle in a light way the possibilities to hide or show columns in a list, or hide/show field in a form ? (user enablings)

CUSTOMER X pay to see the phone number in customer list

CUSTOMER Y should not see at all, the phone number.

The application released for both is the same.

How the server should give this information to the frontend application without coupling with it?

Thanks.