Api Authorization And Bola

A focused playbook for catching broken object and function level authorization in APIs. You get a four-step test loop (create two accounts, capture flows as Account A, replay with Account B's token, hit sibling and nested endpoints), plus the surfaces people actually forget to lock down: nested resources, alternate HTTP verbs on the same route, hidden JSON fields like "role" or "verified" that shouldn't be client-writable. The routing is smart too, pointing you toward JWT abuse or GraphQL skills when the problem shifts layers. Honestly more useful as a checklist than a deep methodology guide, but that's exactly what you need when you're staring at `/api/v1/users/123` and wondering what else is broken.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill api-authorization-and-bola --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment

AI LOAD INSTRUCTION: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.

1. CORE TEST LOOP

Create Account A and Account B.
As Account A, capture create, read, update, and delete flows.
Replay with Account B's token.
Test sibling endpoints, nested endpoints, and alternate HTTP verbs.

2. TEST SURFACES

Surface	Example
object read	`/api/v1/orders/123`
nested object	`/api/v1/users/1/invoices/9`
admin or internal function	`/api/v1/admin/users`
update path	`PUT`, `PATCH`, `DELETE` variants
hidden JSON fields	`role`, `org`, `verified`, `tier`

3. QUICK PAYLOADS

{"role":"admin"}
{"isAdmin":true}
{"org":"target-company"}
{"verified":true}

4. WHAT TESTERS MISS

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
Categories: Backend & APIs, Testing & QA, Security
First seen: May 16, 2026