Agent skill · security · yaklang
api-authorization-and-bola
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
Why this skill is useful
Provides a structured playbook for testing API authorization vulnerabilities that the AI wouldn't reliably generate on its own.
What it needs
About 1k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment AI LOAD INSTRUCTION: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control. 1. CORE TEST LOOP 1. Create Account A and Account B. 2. As Account A, capture create, read, update, and delete flows. 3. Replay with Account B's token. 4. Test sibling endpoints, nested endpoints, and alternate HTTP verbs. 2. TEST SURFACES Surface Example --- --- object read /api/v1/orders/123 nested object /api/v1/users/1/invoices/9 admin or internal function /api/v1/admin/users update path PUT, PATCH, DELETE variants hidden JSON fields role, org, verified, tier 3. QUICK PAYLOADS 4. WHAT TESTERS MISS object IDs in headers, cookies, GraphQL args, and nested objects alternate methods sharing the same route but weaker authz parent check present, child resource check missing admin docs revealing extra writable fields 5. NEXT ROUTING For JWT or token-layer abuse: api auth and jwt abuse For GraphQL and hidden parameter discovery: graphql and hidden parameters For broader IDOR patterns outside APIs: idor broken object authorization
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/api-authorization-and-bola