To test for broken object level authorization, create data with two separate accounts, then use account A's token to request, change and delete account B's objects by identifier. Every cross-account request should be denied. A success on any of them means the API trusts the ID and skips the ownership check.
Why scanners miss it
A scanner does not know which user owns which object. A request for order 1002 from user A looks like any other valid call. Only a test with two known identities can tell a legitimate read from a leak. OWASP lists this as API1 in the 2023 API Security Top 10.
Setup
You need two normal users in different tenants or organizations, each with a few objects of every type, and a note of every identifier. Add an admin account to test the separate question of role based access.
Test matrix
| Action | Token used | Object owner | Expected |
|---|---|---|---|
| Read | A | B | 403 or 404 |
| Update | A | B | 403 or 404 |
| Delete | A | B | 403 or 404 |
| Read nested child | A | B | 403 or 404 |
| List with B's filter | A | B | Only A's data |
Steps
- Create objects as A and as B, and record all IDs from the responses.
- For each endpoint that takes an ID in the path, query or body, replay A's request with B's ID.
- Repeat for GET, PUT, PATCH and DELETE.
- Test nested routes. OWASP's assessment guidance notes the outer resource may be checked while the inner one is not.
- Test every object type, including exports, attachments and reports.
- Try identifiers in other places: headers, JSON bodies, and bulk endpoints that take lists.
- Check that changing the ID format, such as a numeric ID to a UUID you invented, gives a clean denial.
What a good denial looks like
Use one status for both missing and forbidden objects when you want to hide existence, and do the ownership check on the server for every request. Switching to random IDs helps but does not replace the check.
Making it repeatable
Put these requests in a script that runs in CI against staging with seeded accounts. Failures then show up when someone adds a new endpoint without the ownership check.
Try it yourself
Look at how the demo flags endpoints returning data for a different user.
Click through it at your own pace, or open it full screen.
Quick check
Does using UUIDs fix BOLA?
No. They make guessing harder, but any leaked ID still works unless the server checks ownership.
Is BOLA the same as IDOR?
They describe the same class of flaw. BOLA is the API focused name used by OWASP.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
