Find broken access controls in your APIs.
What it does
Checks APIs for broken object access, function-level authorization, method abuse, and unauthorized field changes.
When to use it
Use when an API exposes object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
How to use it
Give it an API to test; it checks authorization by capturing one account's flows and replaying them with another account's token.
What you provide
- the API to test
Good to know
- cannot be undone: API
Latest review
What you need · 1
Uses Account B's token to replay Account A's API flows; the files do not specify how the token is obtained.
Access · 1
This skill
API
Write
Creates accounts and changes API records (irreversible)