domains / families / security / testing-api-for-broken-object-level-authorization

testing-api-for-broken-object-level-authorization

separate

'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR,

When to use

• Assessing REST or GraphQL APIs that use object identifiers in URL paths, query parameters, or request bodies
• Performing OWASP API Security Top 10 assessments where API1:2023 (BOLA) must be tested
• Testing multi-tenant SaaS applications where users from different tenants should not access each other's data
• Validating that API endpoints enforce per-object authorization checks beyond just authentication
• Evaluating APIs after new endpoints are added to ensure authorization middleware is applied consistently

When not to use

• Testing without written authorization from the API owner

Skill page

Source