API testing: where authorisation flaws hide

Broken object-level authorisation is the recurring one, and it leads the OWASP API Security Top 10 for good reason: an endpoint that checks you are logged in but not that the record belongs to you. Changing an identifier in a request and receiving somebody else’s data is the single most common serious API finding, and no scanner can judge it, because the response looks perfectly valid.

Alongside it: broken function-level authorisation, where a lower-privileged user can call an administrative endpoint; excessive data exposure, where an endpoint returns more fields than the interface displays and the filtering happens in the client; and missing rate limiting, which turns an otherwise safe endpoint into an enumeration tool.

The reason these need a human is that each one requires knowing what SHOULD be allowed. An automated tool can tell that a request succeeded; only a tester who understands your permission model can tell that it should not have.