test-driven-development
OBobra/superpowers298k2,631 new stars in the last 7 days
api-authorization-and-bola
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
- Star
- 2,440
- Category
- Browser & testing
- License
- MIT
- Last commit
- Sep 13, 2026
skills/api-authorization-and-bola/SKILL.md
View on GitHubSKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
AI LOAD INSTRUCTION: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
1. CORE TEST LOOP
- Create Account A and Account B.
- As Account A, capture create, read, update, and delete flows.
- Replay with Account B's token.
- Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
2. TEST SURFACES
| Surface | Example |
|---|---|
| object read | /api/v1/orders/123 |
| nested object | /api/v1/users/1/invoices/9 |
| admin or internal function | /api/v1/admin/users |
| update path | PUT, PATCH, DELETE variants |
| hidden JSON fields | role, org, verified, tier |
3. QUICK PAYLOADS
{"role":"admin"}
{"isAdmin":true}
{"org":"target-company"}
{"verified":true}
4. WHAT TESTERS MISS
- object IDs in headers, cookies, GraphQL args, and nested objects
- alternate methods sharing the same route but weaker authz
- parent check present, child resource check missing
- admin docs revealing extra writable fields
5. NEXT ROUTING
- For JWT or token-layer abuse: api auth and jwt abuse
- For GraphQL and hidden parameter discovery: graphql and hidden parameters
- For broader IDOR patterns outside APIs: idor broken object authorization
Similar Skills
migrate-to-shoehorn
MAmattpocock/skills288k10,178 new stars in the last 7 days
agent-runtime-gateway-smoke-test
AFaffaan-m/ECC278k4,046 new stars in the last 7 days
Featured
accessibility
Audit accessibility on Web, iOS, and Android to meet WCAG 2.2, with keyboard navigation and screen-reader support.
AFaffaan-m/ECC278k4,046 new stars in the last 7 days
ai-regression-testing
AFaffaan-m/ECC278k4,046 new stars in the last 7 days
Official
firecrawl-build-interact
FIfirecrawl/firecrawl191k2,010 new stars in the last 7 days