domains / families / security / api-authorization-and-bola

api-authorization-and-bola

separate

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

When to use

• BOLA testing
• BFLA testing
• method abuse
• hidden field control
• object access testing
• function access testing
• mass assignment testing

When not to use

• JWT or token-layer abuse
• GraphQL and hidden parameter discovery
• broader IDOR patterns outside APIs

Skill page

Source