Find cross-user access flaws in your APIs.
What it does
Tests API object-access controls and produces findings showing whether one user can read, modify, or delete another user's resources.
When to use it
Use when assessing API object-level authorization, including multi-tenant isolation and authorization checks on newly added endpoints.
How to use it
Give it an API target and written testing authorization; it returns vulnerability findings with affected endpoints, proof of concept, impact, and remediation.
What you provide
- the target API URL
- authorized testing scope
Good to know
- cannot be undone: target-api.example.com
What you need · 6
Requires at least two test accounts with different privilege levels and distinct data sets.
Requires an intercepting proxy; the automated Autorize workflow specifically uses Burp Suite Professional, although OWASP ZAP is listed as an alternative.
Access · 2
This skill
target-api.example.com
Modifies and deletes API resources (irreversible)
Autorize
Installs the Autorize extension