Testers often approach API authorization testing by changing an object ID and checking whether another user's record appears. That approach catches straightforward IDOR vulnerabilities, but modern APIs require deeper testing.
Broken Object Level Authorization (BOLA) occurs when an API fails to verify that an authenticated user has permission to access a specific object. The difficult cases are rarely as simple as changing /users/123 to /users/124.
Modern APIs expose nested resources, multiple roles, tenant boundaries, administrative functions, and relationships between objects. An attacker may not need to guess another user's identifier at all. They may manipulate a parent resource, alter a role-dependent parameter, or reuse an identifier obtained legitimately elsewhere.
A penetration test should therefore map authorization relationships, not simply endpoints.
Also Read: Why CHIPS Act Manufacturers Can't Rely on CMMC Pen Testing Alone
Testers can establish what each role can read, create, modify, and delete, then test those permissions across tenants, object types, workflows, and API versions.
For example, a customer may have legitimate access to an invoice from their organization. Testers must determine whether that customer can also modify the invoice, access a related internal approval object, or use the invoice identifier with another endpoint to retrieve another organization's information.
Administrative APIs require similar scrutiny. An API may deny a normal user access to an obvious administrative endpoint while another endpoint exposes the same operation through a less obvious route.
This is why API penetration testing needs to examine authorization consistency across the application, rather than simply checking whether authentication works.
A meaningful finding should demonstrate the complete path: the legitimate identity used, the authorization boundary crossed, the affected object, and the resulting business impact.
The objective is not merely to prove that an API contains an IDOR.
It is to determine whether the application's relationship between identity, object, tenant, role, and action holds when someone deliberately tries to break it.