api-authorization-and-bola — Skills

What it does

object IDs in headers, cookies, GraphQL args, and nested objects

alternate methods sharing the same route but weaker authz

parent check present, child resource check missing

admin docs revealing extra writable fields

For JWT or token-layer abuse: api auth and jwt abuse

For GraphQL and hidden parameter discovery: graphql and hidden parameters

For broader IDOR patterns outside APIs: idor broken object authorization

api authorization and bola

Source

Repository: https://github.com/yaklang/hack-skills

api-authorization-and-bola FAQ

What does the api-authorization-and-bola skill do?

>- API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization. object IDs in headers, cookies, GraphQL args, and nested objects alternate methods sharing the same route but weaker authz

What does api-authorization-and-bola require?

3. Replay with Account B's token. For JWT or token-layer abuse: api auth and jwt abuse Configuration keys: PATCH, DELETE.

How do I install api-authorization-and-bola?

Run: npx -y skills add https://github.com/yaklang/hack-skills --skill api-authorization-and-bola --agent claude-code — the source lives at github.com/yaklang/hack-skills.

Maintain api-authorization-and-bola?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[api-authorization-and-bola on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-api-authorization-and-bola?ref=badge)

npx agentictools info skills/yaklang-hack-skills-api-authorization-and-bola

The second line is the CLI lookup for this page — handy in READMEs and docs.