api-authorization-and-bola

1# SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
2 
3> **AI LOAD INSTRUCTION**: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
4 
5## 1. CORE TEST LOOP
6 
71. Create Account A and Account B.
82. As Account A, capture create, read, update, and delete flows.
93. Replay with Account B's token.
104. Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
11 
12## 2. TEST SURFACES
13 
14| Surface | Example |
15|---|---|
16| object read | `/api/v1/orders/123` |
17| nested object | `/api/v1/users/1/invoices/9` |
18| admin or internal function | `/api/v1/admin/users` |
19| update path | `PUT`, `PATCH`, `DELETE` variants |
20| hidden JSON fields | `role`, `org`, `verified`, `tier` |
21 
22## 3. QUICK PAYLOADS
23 
24```json
25{"role":"admin"}
26{"isAdmin":true}
27{"org":"target-company"}
28{"verified":true}
29```
30 
31## 4. WHAT TESTERS MISS
32 
33- object IDs in headers, cookies, GraphQL args, and nested objects
34- alternate methods sharing the same route but weaker authz
35- parent check present, child resource check missing
36- admin docs revealing extra writable fields
37 
38## 5. NEXT ROUTING
39 
40- For JWT or token-layer abuse: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
41- For GraphQL and hidden parameter discovery: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)
42…