Skip to main content

BOLA / IDOR

An object identifier is a reason to review authorization, not proof of BOLA.

Broken Object Level Authorization occurs when a caller can access or modify an object it should not be allowed to reach. OpenAPI can identify object-addressing operations, but only runtime behavior can prove the authorization failure.

01The pattern

Object-addressing operations create an authorization question.

Routes such as GET /users/{id}, PATCH /orders/{order_id}, or DELETE /documents/{document_id} tell you a caller can select a resource. The identifier itself is not a vulnerability.

02What OpenAPI helps with

Use the contract to build the object-authorization test plan.

Find object selectors

Identify path and operation parameters, including reusable and inherited parameters.

Find sensitive operations

Prioritize write, delete, privileged, financial, or sensitive-data endpoints.

Review declared identity

Check whether authentication is mandatory and what authorization metadata is declared.

03Runtime proof

BOLA confirmation requires more than the contract.

Meaningful dynamic verification compares identities or resource ownership contexts and requires authorized identities, safe target data, and controls against destructive behavior.

Boundary

An object-access finding is a signal to verify object-level authorization, not an exploit claim.

04AI agents

Agent tools make object boundaries even more important.

Prompt instructions or tool descriptions are not an authorization boundary. Object-level authorization still belongs server-side.