I am not able to exclude password field from the response when sending a POST request to /users. Below you can find the User entity and the User controller. It works if I exclude the @NotNull and @Size decorators. Any suggestions?

User entity:

@Getter
@Setter
@AllArgsConstructor
@NoArgsConstructor
@Document("users")
public class User {
    @Id
    private String userId;

    @NotNull(message = "Email is required")
    @Size(min = 5, max = 100, message = "Email must be between 5 and 100 characters")
    private String email;

    @NotNull(message = "First name is required")
    @Size(min = 2, max = 50, message = "First name must be between 5 and 50 characters")
    private String firstname;

    @NotNull(message = "Last name is required")
    @Size(min = 2, max = 50, message = "Last name must be between 5 and 50 characters")
    private String lastname;

    @NotNull(message = "Password is required")
    @Size(min = 5, max = 20, message = "Password must be between 5 and 20 characters")
    @ToString.Exclude
    private String password;
}

UserController:

@RestController
@RequestMapping("/users")
@Validated
public class UserController {

    @Autowired
    private UserService userService;

    @PostMapping
    public ResponseEntity<User> createUser(@Valid @RequestBody User user) {
        return ResponseEntity.status(HttpStatus.CREATED).body(userService.createUser(user));
    }
}