Field-Level Security
When describing a change event of a Salesforce object, the describe call checks the user’s field-level security settings for that object. The describe call returns only the fields that the user has access to in the describe result of the change event. You can describe a change event through SOAP API or REST API by using the change event name as the sObject name, such as AccountChangeEvent. See describeSObjects() in the SOAP API Developer Guide and sObject Describe in the REST API Developer Guide.
When getting the change event schema corresponding to a Salesforce object, the returned schema includes all object fields, even the fields that the user doesn’t have access to. See Get the Event Schema in the Platform Events Developer Guide..