skills.rest
sayseven7
sayseven7COMMUNITY
Explore all skills by this author →
WebsiteGitHub

api-authorization-and-bola

Detect broken API authorization controls on REST and GraphQL endpoints.

11|4|Updated Jun 7, 2026
Search Tags:#authorization#api#rest#graphql#bfla#bola#mass assignment
One-click install
npx skills add https://github.com/sayseven7/frameseven --skill api-authorization-and-bola-sayseven7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-authorization-and-bola
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/api-authorization-and-bola
Command: npx skills add https://github.com/sayseven7/frameseven --skill api-authorization-and-bola-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you verify whether an API enforces object-level and function-level authorization correctly, especially when resources are identified by IDs, nested routes, or hidden writable fields.

Core Features & Use Cases

  • Tests BOLA by replaying one account's requests with another account's token.
  • Checks BFLA, alternate HTTP verbs, and sibling or nested endpoints for privilege gaps.
  • Surfaces mass assignment risks by probing fields like role, org, verified, and tier.
  • Use it when reviewing REST or GraphQL APIs that expose object identifiers or role-sensitive actions.

Quick Start

Use this skill to compare Account A and Account B access to the same API resource and identify broken authorization.

Frequently Asked Questions about api-authorization-and-bola

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for BOLA vulnerabilities in REST and GraphQL APIs?▼

Detect mass assignment risks by probing hidden writable fields like role, org, verified, and tier through payload checks to prevent unauthorized privilege escalation or data modification.

How do I check BFLA and alternate HTTP verbs for privilege escalation?▼

Check BFLA by testing alternate HTTP verbs and comparing sibling or nested endpoints to identify function-level authorization gaps and privilege escalation weaknesses in your API.

What is cross-account replay testing for API authorization?▼

Cross-account replay testing is comparing Account A and Account B access to the same API resource to identify broken authorization controls and privilege gaps between different user contexts.

How do I find mass assignment vulnerabilities in API payloads?▼

Detect mass assignment risks by probing hidden writable fields like role, org, verified, and tier through payload checks to prevent unauthorized privilege escalation or data modification.

Can I use this to review role-sensitive actions in GraphQL endpoints?▼

Yes, you can use this skill when reviewing REST or GraphQL APIs that expose object identifiers or role-sensitive actions to verify object-level and function-level authorization enforcement.

Related Skills

Explore More Software Engineering Skills→
machenjiemachenjie
4

permission-boundary-modeling

Model authorization as subject-resource-action-condition rules with auditable backend enforcement.

Community
Advanced
langbyyilangbyyi
96

API Fuzzing for Bug Bounty

Fuzz REST, SOAP, and GraphQL APIs for vulnerabilities.

Community
Intermediate
xiaoliwanshuixiaoliwanshui
21

flutter-api-integration

Standardize Flutter HTTP API integration with Dio interceptors and JSON entity mappings.

Community
Advanced
AnsteorraAnsteorra
6

security-audit

Perform static and dynamic security audits on the KMP application.

Official
Advanced