It seems to me that these two are not the same resource.
- Your shop's entire inventory. Analogous to the shop + what's in the back room.
- Your shop's available products for sale (catalog or listings).
From an API point of view, this could be two separate routes
/inventory → Protected for authorized persons only
/catalog → Available for anyone. Returns only inventory items which are present in the catalog.
Keep in mind that you don't need to model your REST interface (API) to be exactly like your database. Multiple resources can share database tables, or mix in other information.