diff --git a/app/controllers/projects/variables_controller.rb b/app/controllers/projects/variables_controller.rb
index 58fa600eb34..b5635ca1b3b 100644
--- a/app/controllers/projects/variables_controller.rb
+++ b/app/controllers/projects/variables_controller.rb
@@ -7,7 +7,7 @@ class Projects::VariablesController < Projects::ApplicationController
         variables = @project.variables
           .map { |variable| variable.present(current_user: current_user) }
 
-        render status: :ok, json: { variables: variables }
+        render status: :ok, json: { variables: VariableSerializer.new.represent(variables) }
       end
     end
   end
@@ -19,7 +19,7 @@ class Projects::VariablesController < Projects::ApplicationController
           variables = @project.variables
             .map { |variable| variable.present(current_user: current_user) }
 
-          return render status: :ok, json: { variables: variables }
+          return render status: :ok, json: { variables: VariableSerializer.new.represent(variables) }
         end
 
         render status: :bad_request, json: @project.errors.full_messages
diff --git a/app/serializers/variable_entity.rb b/app/serializers/variable_entity.rb
new file mode 100644
index 00000000000..d576745c073
--- /dev/null
+++ b/app/serializers/variable_entity.rb
@@ -0,0 +1,7 @@
+class VariableEntity < Grape::Entity
+  expose :id
+  expose :key
+  expose :value
+
+  expose :protected?, as: :protected
+end
diff --git a/app/serializers/variable_serializer.rb b/app/serializers/variable_serializer.rb
new file mode 100644
index 00000000000..32ae82ab51c
--- /dev/null
+++ b/app/serializers/variable_serializer.rb
@@ -0,0 +1,3 @@
+class VariableSerializer < BaseSerializer
+  entity VariableEntity
+end
diff --git a/spec/controllers/projects/variables_controller_spec.rb b/spec/controllers/projects/variables_controller_spec.rb
index ddba6cd83f4..8e5d6023b79 100644
--- a/spec/controllers/projects/variables_controller_spec.rb
+++ b/spec/controllers/projects/variables_controller_spec.rb
@@ -24,7 +24,7 @@ describe Projects::VariablesController do
     it 'renders the ci_variable as json' do
       subject
 
-      expect(response.body).to include(variable.to_json)
+      expect(response).to match_response_schema('variable')
     end
   end
 
@@ -91,7 +91,7 @@ describe Projects::VariablesController do
       it 'has all variables in response' do
         subject
 
-        expect(response.body).to include(project.variables.reload.to_json)
+        expect(response).to match_response_schema('variable')
       end
     end
 
@@ -120,7 +120,7 @@ describe Projects::VariablesController do
       it 'has all variables in response' do
         subject
 
-        expect(response.body).to include(project.variables.reload.to_json)
+        expect(json_response['variables'].count).to eq(0)
       end
     end
   end
diff --git a/spec/fixtures/api/schemas/variable.json b/spec/fixtures/api/schemas/variable.json
new file mode 100644
index 00000000000..422b4738418
--- /dev/null
+++ b/spec/fixtures/api/schemas/variable.json
@@ -0,0 +1,6 @@
+{
+  "id": "string",
+  "key": "string",
+  "value": "string",
+  "protected": "boolean"
+}
diff --git a/spec/serializers/variable_entity_spec.rb b/spec/serializers/variable_entity_spec.rb
new file mode 100644
index 00000000000..effc0022633
--- /dev/null
+++ b/spec/serializers/variable_entity_spec.rb
@@ -0,0 +1,14 @@
+require 'spec_helper'
+
+describe VariableEntity do
+  let(:variable) { create(:ci_variable) }
+  let(:entity) { described_class.new(variable) }
+
+  describe '#as_json' do
+    subject { entity.as_json }
+
+    it 'contains required fields' do
+      expect(subject).to include(:id, :key, :value, :protected)
+    end
+  end
+end