Object-level authorization is usually the first thing a real attacker checks on an API. If the server trusts the client to say which record it wants without checking who is asking, every object in the database becomes reachable.
What is BOLA / IDOR?
BOLA — Broken Object Level Authorization (OWASP API1:2023) — is the same class of issue commonly called IDOR (Insecure Direct Object Reference). When an authenticated user changes an identifier in the request (for example, /api/users/42 becomes /api/users/43) and the server returns the other user data, authorization is broken.
Why it matters
BOLA typically sits at the top of API security rankings because it is easy to chain, affects data confidentiality directly, and is frequently missed by automated scanners. Semantic scanners only guess identifiers; a tester who maps the application and understands the object model can confirm real impact.
How professional API testing approaches it
- Endpoint mapping — every route that references an object id, filename, order number, invoice id or email is a candidate.
- Multi-user testing — authorize with more than one account and compare what each can access.
- ID mutation — increment, decrement, and use IDs from the other account to test object-level checks.
- Mass assignment review — checking whether over-permissive bindings allow property-level abuse.
- Evidence capture — a clean request/response pair proving cross-account access is a report-ready finding.
Worth remembering
Authorization flaws are logic flaws; they demand manual testing and business understanding, not just payload lists.