How should REST endpoints handle current-user and admin views of listings?

There is no universal REST rule that requires one particular URL shape. /me/listings and /admin/listings are perfectly reasonable if they make the API easier to understand. The important part is that the routes are predictable and that authorization is enforced independently of the path. Also, the sub claim in a JWT commonly identifies the authenticated user; it should be used by the server rather than copied into requests when it represents the caller.

I’d start with /listings for public or generally available listings, /listings?sellerId=... for viewing a particular seller when permitted, and /me/listings for the authenticated owner view. An admin-only listing query can remain /listings with an admin authorization policy, or use /admin/listings if the response and behavior are substantially different. Separate DTOs are fine, but avoid making route names carry all the business logic; let the authorization and representation rules determine what each caller receives.

A single /listings endpoint can work well. Use query parameters such as sellerId, page, and limit for filtering and pagination, then apply authorization and security trimming on the server. Never trust a sellerId supplied by the client to decide what the caller is allowed to see. If the caller is requesting their own listings, the server can derive the user ID from the authenticated token.