# API Bopla

Broken Object Property Level Authorization testing covering unauthorized property reads...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-bopla -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-bopla -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-bopla -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-bopla -g -a gemini-cli -y`

## Description

Broken Object Property Level Authorization testing covering unauthorized property reads (excessive data exposure) and writes (mass assignment) with differential evidence

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API BOPLA, Broken Object Property Level Authorization (OWASP API3)

## Purpose
Test whether API responses expose restricted properties to unauthorized callers (READ) and whether unauthorized callers can modify properties they should not control (WRITE/mass assignment).

## Preconditions
- At least one valid account/session (for differential testing)
- Known API endpoints that return or accept object properties
- The authz_matrix tool available for cross-role comparison

## Attack Surface Signals
- API responses containing fields beyond what the UI displays
- Endpoints that accept JSON/XML bodies with multiple properties
- PATCH/PUT endpoints that update object fields
- OpenAPI specs listing restricted fields
- Different response shapes for different roles

## Methodology

### Unauthorized Property READ (Excessive Data Exposure)

Establish what the caller SHOULD see, then verify what they ACTUALLY receive:

```bash
# 1. Get the legitimate response for the lowest-privilege caller
curl -sk -H "Authorization: Bearer USER_TOKEN" "https://TARGET/api/users/me" | jq . > tmp/user_response.json

# 2. Check for restricted properties in the response
# Look for: role, isAdmin, internalId, permissions, balance, tenantId,
# is_verified, price_override, created_by, deleted_at, api_key, password_hash
jq 'keys' tmp/user_response.json

# 3. Compare against the same endpoint as a higher-privilege caller
# (if available) or against the UI display
curl -sk -H "Authorization: Bearer ADMIN_TOKEN" "https://TARGET/api/users/me" | jq . > tmp/admin_response.json
diff <(jq -S 'keys' tmp/user_response.json) <(jq -S 'keys' tmp/admin_response.json)
```

**IMPORTANT**: Field NAMES alone are not evidence. Verify the VALUE is:
- Genuinely sensitive (PII, credentials, internal flags, financial data)
- Not accessible to the caller through any intended UI
- Returned in a context where the caller should not see it

### Unauthorized Property WRITE (Mass Assignment)

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-bopla/SKILL.md