Can response be null or empty fo api /restriction/byOperation/read

I have a use case where we have retrieving users from restriction api /restriction/byOperation/read , we got some Null pointer in one of use case where api didn’t retrieve the response so we added preventive check .
Just wanted to check whether in response if users and group can be null in any of the case.
“restrictions”: {
user”: [
{ “type”: “known”,
“username”: “”,
“userKey”: “”,
“accountId”: “”
group”: [
“type”: “”,
“name”: “”,