api-authorization-and-bola

Detect broken API authorization controls on REST and GraphQL endpoints.

11|4|Updated Jun 7, 2026

Search Tags:#authorization #api #rest #graphql #bfla #bola #mass assignment

Ready to run

npx skills add https://github.com/sayseven7/frameseven --skill api-authorization-and-bola-sayseven7

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-authorization-and-bola
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/api-authorization-and-bola
Command: npx skills add https://github.com/sayseven7/frameseven --skill api-authorization-and-bola-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you verify whether an API enforces object-level and function-level authorization correctly, especially when resources are identified by IDs, nested routes, or hidden writable fields.

Core Features & Use Cases

Tests BOLA by replaying one account's requests with another account's token.
Checks BFLA, alternate HTTP verbs, and sibling or nested endpoints for privilege gaps.
Surfaces mass assignment risks by probing fields like role, org, verified, and tier.
Use it when reviewing REST or GraphQL APIs that expose object identifiers or role-sensitive actions.

Quick Start

Use this skill to compare Account A and Account B access to the same API resource and identify broken authorization.

Frequently Asked Questions about api-authorization-and-bola

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for BOLA vulnerabilities in REST and GraphQL APIs?▼

Detect mass assignment risks by probing hidden writable fields like role, org, verified, and tier through payload checks to prevent unauthorized privilege escalation or data modification.

How do I check BFLA and alternate HTTP verbs for privilege escalation?▼

Check BFLA by testing alternate HTTP verbs and comparing sibling or nested endpoints to identify function-level authorization gaps and privilege escalation weaknesses in your API.

What is cross-account replay testing for API authorization?▼

Cross-account replay testing is comparing Account A and Account B access to the same API resource to identify broken authorization controls and privilege gaps between different user contexts.

How do I find mass assignment vulnerabilities in API payloads?▼

Detect mass assignment risks by probing hidden writable fields like role, org, verified, and tier through payload checks to prevent unauthorized privilege escalation or data modification.

Can I use this to review role-sensitive actions in GraphQL endpoints?▼

Yes, you can use this skill when reviewing REST or GraphQL APIs that expose object identifiers or role-sensitive actions to verify object-level and function-level authorization enforcement.