BOLA / IDOR

An object identifier is a reason to review authorization, not proof of BOLA.

Broken Object Level Authorization occurs when a caller can access or modify an object it should not be allowed to reach. OpenAPI can identify operations that address objects, but only runtime behavior can prove the authorization failure.

The pattern

Object-addressing operations create an authorization question.

Routes such as GET /users/{id}, PATCH /orders/{order_id}, or DELETE /documents/{document_id} tell you that a caller can select a resource. The security question is whether the server checks that the caller is authorized for the selected object.

The identifier itself is not a vulnerability. It is a static signal that object-level authorization must exist somewhere in the runtime path.

What OpenAPI helps with

Use the contract to build the object-authorization test plan.

Find object selectors

Identify path and operation parameters, including reusable components and inherited parameters.

Find sensitive operations

Prioritize write, delete, privileged, financial, or sensitive-data endpoints.

Review declared identity

Check whether authentication is mandatory and what authorization metadata is declared.

Review authentication semantics →

Runtime proof

BOLA confirmation requires more than the contract.

A meaningful dynamic test usually compares access across identities or resource ownership contexts: one principal owns object A, another principal should not be able to retrieve or mutate it, and the server must enforce that distinction.

That test needs authorized identities, safe target data, and controls against destructive behavior. A static scanner should not label BOLA as confirmed merely because an ID appears in a URL.

Speculynx wording stays bounded: an object-access finding is a signal to verify object-level authorization, not an exploit claim.

AI agents

Agent tools make object boundaries even more important.

If an agent can choose object identifiers from model-generated context, every object-level authorization check still needs to be enforced server-side. Prompt instructions or tool descriptions are not an authorization boundary.

Secure agent API access → · OpenAPI security checklist → · API security pillar →