API authorization test matrix

Objective

Produce a coverage matrix that shows, per identity, which endpoints are reachable and which object IDs leak across accounts, and turn each gap into a scored finding.

Prerequisites

• An API you are authorized to test (your own app or an authorized lab).
• At least two authenticated sessions with different privilege levels.
• A place to log request pairs per matrix cell (spreadsheet or the automation script).

Environment

• Inventory the endpoints first (route table, OpenAPI spec, or a proxy log of real traffic).
• Two sessions: a low-privilege user and a higher-privilege user on the same environment.
• Record the tenant/owner of each object ID so cross-account access is measurable.

Steps

1. 1

   Build the matrix skeleton

   Rows are identities, columns are endpoints, and each cell records the status a given identity received. Start from real traffic rather than guessing the surface.

2. 2

   Test object-level authorization

   With the low-privilege session, request object IDs owned by the higher-privilege account. A 200 with another account’s data is an IDOR/BOLA finding; log the exact request pair.

3. 3

   Test function-level authorization

   Call privileged endpoints (admin actions, destructive operations) from the low-privilege session. Distinguish “reachable but harmless” from “reachable and effective” by checking the side effect.

4. 4

   Score and record the gaps

   Convert each confirmed gap into a scored finding with reproduction steps and evidence, so severity is comparable across the matrix.

How to verify

• Every endpoint has a status recorded for at least two identities.
• Each cross-account 200 is backed by a saved request pair, not an assumption.
• Confirmed gaps carry a score and a one-line impact for the report.