api-authorization-and-bola

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

Try your first task

Create a focused two-account authorization test matrix

Start a fresh conversation.

Use the api-authorization-and-bola skill to review the supplied authorized API request captures for Account A and Account B. Create a small replay matrix covering create, read, update, and delete operations, cross-account object identifiers, nested resources, alternate HTTP verbs, and hidden writable fields. Do not execute requests; return the prioritized matrix and the evidence each test should capture.

Required inputs

Authorized testing scope
Sanitized request and response captures for Account A
Sanitized request and response captures for Account B
Known object identifiers and role differences

Suggested template by Skill Leaderboard, grounded in the linked source. Task evidence ↗

Inside SKILL.md

48 lines

Section content has not been verified for this skill yet.

Full source remains withheld under the current source-display policy. Read the author’s source ↗