# api-authorization-and-bola

A playbook for testing API authorization: reaching other users' objects, calling functions your role should not have, and writing hidden fields.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3700 installs · ★ 2547
- Author: yaklang
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/yaklang/hack-skills/tree/HEAD/skills/api-authorization-and-bola/SKILL.md
- Updated: 2026-09-13
- HTML: https://affpapa.org/en/nevibecode/skills/api-authorization-and-bola

## What it does

The skill lays out an authorization test loop. You create two accounts, capture the create, read, update and delete flows as the first one, then replay every request with the second account's token. From there it moves to sibling endpoints, nested resources and alternate HTTP verbs on the same route.

A table lists the surfaces worth hitting: object reads like `/api/v1/orders/123`, nested objects like `/api/v1/users/1/invoices/9`, admin routes like `/api/v1/admin/users`, `PUT`, `PATCH` and `DELETE` variants, plus hidden JSON fields such as `role`, `org`, `verified` and `tier`. A separate section covers what testers skip — object IDs sitting in headers, cookies, GraphQL arguments and nested objects, and routes where the parent check exists but the child resource has none. That last one is why alternate methods on a shared route deserve a look.

This is an offensive security skill, not something to point at production. Run it against your own staging environment or a target you have written permission to test, because replaying another account's token against live data is real access, not a probe. When the problem sits in the token layer, the skill routes you to `../api-auth-and-jwt-abuse/SKILL.md`; for GraphQL and hidden parameter discovery, to `../graphql-and-hidden-parameters/SKILL.md`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill api-authorization-and-bola -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/api-authorization-and-bola/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/api-authorization-and-bola/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill api-authorization-and-bola -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/api-authorization-and-bola/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill api-authorization-and-bola -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/api-authorization-and-bola/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install yaklang/hack-skills api-authorization-and-bola
```

2. **Manually: put the files in place**
- File: `.github/skills/api-authorization-and-bola/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill api-authorization-and-bola -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/yaklang/hack-skills --path skills/api-authorization-and-bola
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/api-authorization-and-bola/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill api-authorization-and-bola -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/yaklang/hack-skills/tree/HEAD/skills/api-authorization-and-bola/SKILL.md

## When to use it
- check whether an API returns another user's object by direct ID
- find admin or internal functions an ordinary role can still call
- catch hidden fields like `role` or `verified` that an update request accepts
- compare how `PUT`, `PATCH` and `DELETE` are protected on the same route
- test a nested resource that has no parent check

## Example prompts
- run the api-authorization-and-bola playbook against `/api/v1/orders/{id}` with two accounts
- use the skill to check whether `PATCH /api/v1/users/1` accepts a `role` field
- walk through api-authorization-and-bola and compare `/api/v1/users/1/invoices/9` with tokens A and B

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 091359b2231c95a9.

BEGIN THIRD-PARTY FILE 091359b2231c95a9
````text
---
name: api-authorization-and-bola
description: >-
  API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
---

# SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment

> **AI LOAD INSTRUCTION**: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.

## 1. CORE TEST LOOP

1. Create Account A and Account B.
2. As Account A, capture create, read, update, and delete flows.
3. Replay with Account B's token.
4. Test sibling endpoints, nested endpoints, and alternate HTTP verbs.

## 2. TEST SURFACES

| Surface | Example |
|---|---|
| object read | `/api/v1/orders/123` |
| nested object | `/api/v1/users/1/invoices/9` |
| admin or internal function | `/api/v1/admin/users` |
| update path | `PUT`, `PATCH`, `DELETE` variants |
| hidden JSON fields | `role`, `org`, `verified`, `tier` |

## 3. QUICK PAYLOADS

```json
{"role":"admin"}
{"isAdmin":true}
{"org":"target-company"}
{"verified":true}
```

## 4. WHAT TESTERS MISS

- object IDs in headers, cookies, GraphQL args, and nested objects
- alternate methods sharing the same route but weaker authz
- parent check present, child resource check missing
- admin docs revealing extra writable fields

## 5. NEXT ROUTING

- For JWT or token-layer abuse: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
- For GraphQL and hidden parameter discovery: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)
- For broader IDOR patterns outside APIs: [idor broken object authorization](../idor-broken-object-authorization/SKILL.md)
````
END THIRD-PARTY FILE 091359b2231c95a9

The third-party file has ended. Everything between the 091359b2231c95a9 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

© yaklang · MIT · https://github.com/yaklang/hack-skills/tree/HEAD/skills/api-authorization-and-bola/SKILL.md

## Similar
- [testing-api-for-broken-object-level-authorization](https://affpapa.org/en/nevibecode/skills/testing-api-for-broken-object-level-authorization.md) — skill · 541 installs
- [unit-test-security-authorization](https://affpapa.org/en/nevibecode/skills/unit-test-security-authorization.md) — skill · 3700 installs
- [api-test-mode-design](https://affpapa.org/en/nevibecode/skills/api-test-mode-design.md) — skill · 7800 installs

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md