BOLA / IDOR
An object identifier is a reason to review authorization, not proof of BOLA.
Broken Object Level Authorization occurs when a caller can access or modify an object it should not be allowed to reach. OpenAPI can identify operations that address objects, but only runtime behavior can prove the authorization failure.
The pattern
Object-addressing operations create an authorization question.
Routes such as GET /users/{id}, PATCH /orders/{order_id}, or DELETE /documents/{document_id} tell you that a caller can select a resource. The security question is whether the server checks that the caller is authorized for the selected object.
The identifier itself is not a vulnerability. It is a static signal that object-level authorization must exist somewhere in the runtime path.
What OpenAPI helps with
Use the contract to build the object-authorization test plan.
Find object selectors
Identify path and operation parameters, including reusable components and inherited parameters.
Find sensitive operations
Prioritize write, delete, privileged, financial, or sensitive-data endpoints.
Review declared identity
Check whether authentication is mandatory and what authorization metadata is declared.
Runtime proof
BOLA confirmation requires more than the contract.
A meaningful dynamic test usually compares access across identities or resource ownership contexts: one principal owns object A, another principal should not be able to retrieve or mutate it, and the server must enforce that distinction.
That test needs authorized identities, safe target data, and controls against destructive behavior. A static scanner should not label BOLA as confirmed merely because an ID appears in a URL.
AI agents
Agent tools make object boundaries even more important.
If an agent can choose object identifiers from model-generated context, every object-level authorization check still needs to be enforced server-side. Prompt instructions or tool descriptions are not an authorization boundary.
Secure agent API access → · OpenAPI security checklist → · API security pillar →