diff --git a/core/modules/layout_builder/tests/modules/layout_builder_rest_test/config/install/rest.resource.entity.node.yml b/core/modules/layout_builder/tests/modules/layout_builder_rest_test/config/install/rest.resource.entity.node.yml
new file mode 100644
index 0000000000..32831891e7
--- /dev/null
+++ b/core/modules/layout_builder/tests/modules/layout_builder_rest_test/config/install/rest.resource.entity.node.yml
@@ -0,0 +1,18 @@
+langcode: en
+status: true
+dependencies:
+  module:
+    - node
+    - basic_auth
+id: entity.node
+plugin_id: 'entity:node'
+granularity: resource
+configuration:
+  methods:
+    - GET
+    - POST
+    - PATCH
+  formats:
+    - json
+  authentication:
+    - basic_auth
diff --git a/core/modules/layout_builder/tests/modules/layout_builder_rest_test/layout_builder_rest_test.info.yml b/core/modules/layout_builder/tests/modules/layout_builder_rest_test/layout_builder_rest_test.info.yml
new file mode 100644
index 0000000000..025929f95f
--- /dev/null
+++ b/core/modules/layout_builder/tests/modules/layout_builder_rest_test/layout_builder_rest_test.info.yml
@@ -0,0 +1,10 @@
+name: 'Layout Builder Rest test'
+type: module
+description: 'Support module for testing layout building with rest module.'
+package: Testing
+version: VERSION
+core: 8.x
+dependencies:
+  - rest
+  - serialization
+  - node
diff --git a/core/modules/layout_builder/tests/src/Functional/Rest/OverrideFieldNotExposed.php b/core/modules/layout_builder/tests/src/Functional/Rest/OverrideFieldNotExposed.php
new file mode 100644
index 0000000000..b72c27ac95
--- /dev/null
+++ b/core/modules/layout_builder/tests/src/Functional/Rest/OverrideFieldNotExposed.php
@@ -0,0 +1,239 @@
+<?php
+
+namespace Drupal\Tests\layout_builder\Functional\Rest;
+
+use Drupal\Core\Url;
+use Drupal\node\Entity\Node;
+use Drupal\Tests\BrowserTestBase;
+use GuzzleHttp\RequestOptions;
+
+/**
+ * Tests that override field is not exposed via Rest.
+ *
+ * @group layout_builder
+ */
+class OverrideFieldNotExposed extends BrowserTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public static $modules = ['node', 'layout_builder', 'rest', 'serialization', 'layout_builder_rest_test', 'basic_auth'];
+
+  /**
+   * A test node.
+   *
+   * @var \Drupal\node\NodeInterface
+   */
+  protected $node;
+
+  /**
+   * The serializer service.
+   *
+   * @var \Symfony\Component\Serializer\Serializer
+   */
+  protected $serializer;
+
+  /**
+   * The MIME type that corresponds to $format.
+   *
+   * (Sadly this cannot be computed automatically yet.)
+   *
+   * @var string
+   */
+  protected static $mimeType = 'application/json';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+
+    $this->serializer = $this->container->get('serializer');
+
+    // @todo The Layout Builder UI relies on local tasks; fix in
+    //   https://www.drupal.org/project/drupal/issues/2917777.
+    $this->drupalPlaceBlock('local_tasks_block');
+
+    $this->createContentType(['type' => 'bundle_with_section_field']);
+    $this->createNode([
+      'type' => 'bundle_with_section_field',
+      'title' => 'The first node title',
+      'body' => [
+        [
+          'value' => 'The first node body',
+        ],
+      ],
+    ]);
+
+    // Create a node.
+    $this->node = Node::create([
+      'type' => 'bundle_with_section_field',
+      'title' => 'A node at rest will stay at rest.',
+    ]);
+    $this->node->save();
+
+    $this->drupalLogin($this->drupalCreateUser([
+      'configure any layout',
+      'administer node display',
+      'administer display modes',
+      'bypass node access',
+      'create bundle_with_section_field content',
+      'edit any bundle_with_section_field content',
+    ]));
+
+
+    $page = $this->getSession()->getPage();
+    $field_ui_prefix = 'admin/structure/types/manage/bundle_with_section_field/display';
+
+    // Enable Layout Builder for the default view modes, and overrides.
+    $this->drupalGet("$field_ui_prefix/default");
+    $page->checkField('layout[enabled]');
+    $page->pressButton('Save');
+    $page->checkField('layout[allow_custom]');
+    $page->pressButton('Save');
+  }
+
+  /**
+   * Tests that the override field is not available over Rest.
+   */
+  public function testOverrideFieldNotExposed() {
+    // Make a GET request and ensure override field is not included.
+    $response = $this->request(
+      'GET',
+      Url::fromRoute(
+        'rest.entity.node.GET',
+        ['node' => $this->node->id()])
+    );
+    $contents = $response->getBody()->getContents();
+    $patch_data = $this->serializer->decode($contents, 'json');
+    $this->assertSame('A node at rest will stay at rest.', $patch_data['title'][0]['value']);
+    $this->assertArrayNotHasKey('layout_builder__layout', $patch_data);
+
+    // Make a POST request without the override field.
+    $new_node = [
+      'type' => [
+        [
+          'target_id' => 'bundle_with_section_field',
+        ],
+      ],
+      'title' => [
+        [
+          'value' => 'On with the rest of the test. 🛫',
+        ],
+      ],
+    ];
+    $response = $this->request(
+      'POST',
+      Url::fromRoute(
+        'rest.entity.node.POST'),
+      [
+        RequestOptions::BODY => $this->serializer->encode($new_node, 'json'),
+        RequestOptions::HEADERS => ['Content-Type' => static::$mimeType],
+      ]
+    );
+
+    $this->assertEquals(201, $response->getStatusCode());
+
+    // Make a POST request with override field.
+    $new_node['layout_builder__layout'] = [];
+    $post_contents = $this->serializer->encode($new_node, 'json');
+    $response = $this->request(
+      'POST',
+      Url::fromRoute(
+        'rest.entity.node.POST'),
+      [
+        RequestOptions::BODY => $post_contents,
+        RequestOptions::HEADERS => ['Content-Type' => static::$mimeType],
+      ]
+    );
+
+    $this->assertEquals(403, $response->getStatusCode());
+    $post_response = $this->serializer->decode($response->getBody()->getContents(), 'json');
+    $this->assertEquals('Access denied on creating field \'layout_builder__layout\'.', $post_response['message']);
+
+
+    // Make a PATCH request without the override field.
+    $patch_data = [
+      'title' => [
+        [
+          'value' => 'New and improved title',
+        ],
+      ],
+      'type' => [
+        [
+          'target_id' => 'bundle_with_section_field',
+        ],
+      ],
+    ];
+    $response = $this->request(
+      'PATCH',
+      Url::fromRoute(
+        'rest.entity.node.PATCH',
+        ['node' => 2]
+      ),
+      [
+        RequestOptions::BODY => $this->serializer->encode($patch_data, 'json'),
+        RequestOptions::HEADERS => ['Content-Type' => static::$mimeType],
+      ]
+    );
+
+    $this->assertEquals(200, $response->getStatusCode());
+    $this->assertEquals('New and improved title', Node::load(2)->getTitle());
+
+    // Make a PATCH request with the override field.
+    $patch_data['title'][0]['value'] = 'This title will not save. ☹️';
+    $patch_data['layout_builder__layout'] = [];
+    $response = $this->request(
+      'PATCH',
+      Url::fromRoute(
+        'rest.entity.node.PATCH',
+        ['node' => 2]
+      ),
+      [
+        RequestOptions::BODY => $this->serializer->encode($patch_data, 'json'),
+        RequestOptions::HEADERS => ['Content-Type' => static::$mimeType],
+      ]
+    );
+
+    $this->assertEquals(403, $response->getStatusCode());
+    $patch_response = $this->serializer->decode($response->getBody()->getContents(), 'json');
+    $this->assertEquals('Access denied on updating field \'layout_builder__layout\'.', $patch_response['message']);
+    $this->assertEquals('New and improved title', Node::load(2)->getTitle());
+  }
+
+  /**
+   * Performs a HTTP request. Wraps the Guzzle HTTP client.
+   *
+   * Why wrap the Guzzle HTTP client? Because we want to keep the actual test
+   * code as simple as possible, and hence not require them to specify the
+   * 'http_errors = FALSE' request option, nor do we want them to have to
+   * convert Drupal Url objects to strings.
+   *
+   * We also don't want to follow redirects automatically, to ensure these tests
+   * are able to detect when redirects are added or removed.
+   *
+   * @see \GuzzleHttp\ClientInterface::request()
+   *
+   * @param string $method
+   *   HTTP method.
+   * @param \Drupal\Core\Url $url
+   *   URL to request.
+   * @param array $request_options
+   *   Request options to apply.
+   *
+   * @return \Psr\Http\Message\ResponseInterface
+   */
+  protected function request($method, Url $url, $request_options = []) {
+    $request_options[RequestOptions::HTTP_ERRORS] = FALSE;
+    $request_options[RequestOptions::ALLOW_REDIRECTS] = FALSE;
+    $request_options[RequestOptions::HEADERS] = [
+      'Content-Type' => static::$mimeType,
+      'Authorization' => 'Basic ' . base64_encode($this->loggedInUser->name->value . ':' . $this->loggedInUser->passRaw),
+      ];
+    $request_options['query'] = ['_format' => 'json'];
+    //$request_options = $this->decorateWithXdebugCookie($request_options);
+    $client = $this->getHttpClient();
+    return $client->request($method, $url->setAbsolute(TRUE)->toString(), $request_options);
+  }
+
+}