Broken object level authorization
An authenticated user requests an object identifier belonging to someone else, and the application returns it. The single most common serious API flaw in multi-tenant products.
// VEYRA API
Map the actions behind your endpoints.
Most teams cannot produce an accurate list of their own API routes. Veyra builds one from your code, then describes what each route is actually capable of doing to your business.
// 01 · THE INVENTORY
Every route, and what it can do.
For each discovered route, Veyra attempts to establish the following. Where a property cannot be determined with confidence, it is marked unknown rather than guessed.
- HTTP METHOD & PATH
- The full route signature, including path parameters that identify objects.
- AUTHENTICATION
- Whether authentication is required, and which mechanism enforces it.
- AUTHORIZATION
- Which role or ownership check applies, and whether it is verified against the specific object requested.
- INPUT PARAMETERS
- Path, query, and body parameters, and which of them influence data access.
- SENSITIVE DATA
- Whether the route can return personal, financial, or otherwise sensitive records.
- DATABASE OPERATIONS
- Reads and writes reached by the handler, and whether they are scoped to a tenant.
- EXTERNAL SERVICES
- Third-party calls made during the request, which extend the trust boundary.
- DESTRUCTIVE ACTIONS
- Whether the route can cancel, delete, refund, transfer, or otherwise cause irreversible change.
- SOURCE LOCATION
- The repository, file, and function that implements the route.
- RISK CLASSIFICATION
- The resulting risk level, derived from the properties above rather than from the route name.
// 02 · EXAMPLE ROUTE
A route is a capability, not a string.
POST
/api/users/{id}/subscription/cancel
- AUTHENTICATION
- Required
- AUTHORIZATION
- Customer
- ACTION
- Subscription cancellation
- FINANCIAL IMPACT
- Possible
- DESTRUCTIVE ACTION
- YES
- RISK LEVEL
- HIGH
A route that cancels revenue deserves more scrutiny than a route that returns a marketing banner. Veyra ranks accordingly.
What API analysis catches.
The API classes that cause real incidents in small and midsize software companies are rarely exotic.
Broken function level authorization
An administrative or privileged route that is reachable by an ordinary account because the role check lives in the UI rather than the API.
Excessive data exposure
A response returns the whole record — internal flags, other users’ identifiers, password reset tokens — because the model is serialized directly.
Undocumented and legacy routes
Endpoints that still work, still reach the database, and are no longer in anyone’s mental model of the product.
Mass assignment
A request body that can set fields the client should never control, such as role, account identifier, or entitlement.
Missing rate and abuse controls
Routes that permit enumeration of identifiers, credential stuffing, or expensive operations without limit.
Common questions
Do you need an OpenAPI spec?
No. Routes are discovered from source code, so the inventory reflects what is deployed rather than what the documentation claims. If you do publish a spec, Veyra compares the two and flags routes that exist in code but not in the spec.
Does Veyra send traffic to our production API?
Only within the limits you configure during onboarding, and only against assets you have authorized. External checks are non-destructive, respect your maximum request rate and maintenance windows, and exclude any endpoint you list as out of scope.
How do you handle GraphQL?
GraphQL schemas are mapped to types, queries, mutations, and resolvers, and the same questions are asked of each resolver: what does it return, what does it change, and what authorization protects it.
Start with a baseline assessment.
Authorize your assets and receive a prioritized view of what is actually exposed.