The API security risks scanners keep missing

APIs now carry the business logic that browsers used to. The mobile app, the single-page frontend, the partner integration — they are all thin clients over an API that makes the real decisions. Attackers know it, and the most damaging API flaws are precisely the ones automated scanners are worst at finding: authorization logic that only a human can reason about.

Broken object-level authorization (BOLA)

The number-one API risk, and for good reason. Change an identifier in a request — /orders/1001 to /orders/1002 — and read a record that belongs to someone else. To a scanner both requests return a clean 200; it has no way to know the second order belonged to another tenant. A tester who understands your data model finds it in minutes, because they know what should be forbidden.

Broken function-level authorization

The endpoint exists, the UI never shows it to you, and nothing on the server stops you calling it. Admin actions reachable by regular users, delete verbs left unguarded, internal endpoints exposed to the public routing table.

Mass assignment and over-permissive endpoints

Binding a request body straight onto a model lets an attacker set fields they should never control — role, isAdmin, tenantId, credit. The endpoint "works" exactly as written; that is the problem. The vulnerability is in what the developer forgot to exclude.

Broken object property-level authorization

A user may be allowed to read a record but not every field of it. APIs that return the whole object — including the fields the client happens not to render — leak data the moment someone reads the raw response.

Why manual testing still wins

• Business-logic abuse has no signature to match. A scanner matches patterns; authorization is context.
• Multi-step and multi-tenant flows need state a scanner cannot hold — logging in as two tenants and proving the boundary between them.
• Chained low-risk issues become a critical only a human connects: a leaked ID here, a mass-assignment there, and suddenly one account owns the whole system.

The right division of labor

Automate what automation is good at — schema fuzzing, known-CVE checks, coverage of every endpoint and method. Then put a specialist on the logic that decides who can do what to whom. The OWASP API Security Top 10 is a map of exactly where that human attention pays off.

How Byteramp tests APIs

Our penetration testing covers REST, GraphQL and gRPC — authenticated and unauthenticated, across tenants, against the auth, authorization, rate-limiting and separation controls customers never see. Findings land in Vector with reproducible steps and a fix pattern your engineers can act on, and every remediated issue gets re-tested by the specialist who found it. We work with product teams across Sweden and the Nordics who ship API-first and need the logic tested, not just the surface scanned.