What is BOLA?
The API-native form of IDOR and the #1 risk in the OWASP API Security Top 10: an API returns or modifies an object without checking the caller owns it.
BOLA: The API-native form of IDOR and the #1 risk in the OWASP API Security Top 10: an API returns or modifies an object without checking the caller owns it.
In plain language
BOLA is IDOR for APIs. Because APIs expose object identifiers directly and are called programmatically, a missing ownership check is both easy to find and easy to exploit at scale — one script can walk every object ID.
SuperPentest tests BOLA by authenticating as two principals and attempting to read and modify each other’s objects across the API, verifying each violation and reproducing it from a clean session with hash-chained evidence.
A concrete example
A banking API exposes PATCH /v1/accounts/{id}/beneficiaries. The app always sends the logged-in user’s own account id, so it looks safe — but the server never verifies ownership, so swapping in a stranger’s id adds a payee to their account. Because the client dictates the id, one script walks the whole range. The fix is an ownership check on every object-scoped endpoint.
Related
BOLA testing → · IDOR → · Access-control replay →
Want this tested on your app? Book a demo or read how findings are verified.