# API Bola

Broken Object Level Authorization (BOLA/IDOR) testing for REST and GraphQL APIs, ...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-bola -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-bola -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-bola -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-bola -g -a gemini-cli -y`

## Description

Broken Object Level Authorization (BOLA/IDOR) testing for REST and GraphQL APIs, object ID harvesting and swapping across paths, query, body, batch, and nested resources with two-account differential evidence (OWASP API1)

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API BOLA, Broken Object Level Authorization (OWASP API1)

## Purpose
Test whether authenticated callers can access or modify other users' objects by manipulating object identifiers, when the server fails to enforce per-object authorization.

## Preconditions
- At least two accounts with distinct data (the two-account differential is mandatory for confirmation)
- A mapped API surface (consume reconnaissance API discovery; do not re-enumerate here)
- Object IDs observed in requests (numeric, UUID, slug, encoded)

## Attack Surface Signals
- Path segments with IDs: `/orders/1042`, `/users/{id}/documents/{uuid}`
- Query/body parameters: `?order_id=`, `{"userId": ...}`, filter params
- List endpoints that leak other-context IDs (harvest victims here)
- Batch/bulk endpoints accepting arrays of IDs
- GraphQL node/relay IDs (base64 `Order:5003`) and `user(id:)` arguments

## Methodology

### Step 1: Harvest Object IDs
```bash
# Legitimate IDs first (own account), then victim IDs from list endpoints,
# search responses, exports, logs, comments, and any shared context.
curl -sk -H "Authorization: Bearer USER_A" "https://TARGET/api/users/me" | jq -r '.id'
curl -sk -H "Authorization: Bearer USER_A" "https://TARGET/api/users/me/orders" | jq -r '.orders[].id'
```

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-bola/SKILL.md