OWASP-API-2023 Practice Test

OWASP-API-2023 practice test: what's covered

• BOLA - Authentication - Property Authorization - Rate Limits - SSRF - Inventory - Third-Party APIs

Free OWASP-API-2023 sample questions

1. A mobile API returns invoices from GET /api/invoices/7821 after only checking that the caller is logged in. A tester changes 7821 to 7822 and receives another customer's invoice. What is the correct fix?

   • A. Enforce object ownership or tenant authorization on every invoice lookup before returning the record
   • B. Hide the invoice identifier in the mobile app while keeping the same server lookup behavior
   • C. Add a generic login banner that warns users not to change numbers in URLs
   • D. Rename the endpoint to /api/secure-invoices without changing the authorization query
   Show answer

   Correct: A. This is BOLA because the server trusts an object identifier without proving the object belongs to the caller. Obscuring IDs, warning users, or renaming routes is not a real control because attackers can still submit object IDs directly.

2. A partner portal uses UUIDs for order IDs and the developer says BOLA is impossible because IDs cannot be guessed easily. What should the security reviewer require?

   • A. Authorization checks that bind every order read and update to the authenticated partner account
   • B. Longer UUID strings so the object reference becomes harder to type manually
   • C. Client-side JavaScript checks that disable the edit button for other partners
   • D. A robots.txt disallow rule for the order API path to hide it from search engines
   Show answer

   Correct: A. Unpredictable IDs reduce enumeration but do not replace authorization. The server must still verify ownership for each object because leaked IDs, logs, links, or browser history can expose valid references.

3. An API gateway validates JWT signatures, then forwards DELETE /projects/{projectId}/members/{userId} to a service that trusts both path parameters. Where should object-level authorization happen?

   • A. In the service or shared authorization layer using project membership and caller role before the delete occurs
   • B. Only at the gateway because a valid JWT proves the caller may access every project object
   • C. Only in the browser because hidden buttons prevent unauthorized member deletion attempts
   • D. Only in audit logs after deletion because object-level checks slow down the request path
   Show answer

   Correct: A. JWT validation proves identity, not object authorization. The application must check whether this caller may modify this project and member relationship; UI hiding and after-the-fact logs are not preventative controls.

4. A GraphQL resolver returns any user profile when the client supplies a userId argument. The REST endpoints already have ownership checks. What risk remains?

   • A. The GraphQL resolver can become a separate BOLA path unless it reuses the same object authorization policy
   • B. GraphQL automatically prevents BOLA because clients cannot see SQL table names
   • C. The risk is only cosmetic because profiles are returned through a different protocol
   • D. The issue is solved by adding more fields to the GraphQL schema documentation
   Show answer

   Correct: A. BOLA can appear in any API style, including GraphQL. A safe REST path does not protect another resolver unless the same server-side authorization policy is consistently applied to the requested object.

5. A team is writing tests for BOLA in a multi-tenant customer API. Which TWO tests provide the strongest coverage? (Choose TWO)

   • A. Use two real test tenants and attempt to read or update tenant B objects with tenant A credentials
   • B. Assert that every object query includes an owner, tenant, or relationship constraint derived from the caller
   • C. Confirm that object IDs are visually complex when copied from the browser address bar
   • D. Check that the API response contains a modern content security policy header
   Show answer

   Correct: A and B. Strong BOLA testing uses cross-tenant attempts and verifies server-side relationship constraints. Complex IDs and browser headers are useful for other concerns, but they do not prove object authorization is enforced.

Last updated: 2026-10-19

OWASP-API-2023 practice test FAQ