API Exploitation

What it is

API exploitation abuses weaknesses in application interfaces that exchange data and perform actions. Common issues include missing object-level authorization, excessive returned fields, unsafe input, and unrestricted resource use. An API is not protected merely because the visible interface hides a button or the endpoint is undocumented.

How it works

An attacker sends requests directly rather than following the intended interface. A legitimate login may be used to request another user's object or trigger an unauthorized operation. Server-side checks must verify the caller, the specific resource, and the allowed action; authentication alone does not establish permission for every record.

How people get tricked

Developers trust a client-supplied identifier, role, or hidden field. Users may see a safe interface while the underlying service accepts broader requests. This is a failure of authorization or business rules rather than necessarily a social scam.

Example scenario

A signed-in customer can retrieve someone else's invoice because the service checks only that a session exists, not that the invoice belongs to that customer.

Warning signs

• Cross-user access or unexpectedly broad response fields.
• High request volume against costly or sensitive operations.
• Client-supplied permission fields influence server decisions.

If it happens to you

Disable the affected operation if needed, fix the permission boundary, and investigate access logs for exposed records or actions. Apply the same checks to sibling endpoints and exports. Revoke exposed credentials and assess notification requirements based on evidence.