--- title: How Does Edgescan Perform Broken Object Level Authorization (BOLA)? description: Edgescan includes Broken object level authorization as part of testing, and for API it's included as API1:2019 & API1:2023. --- [Skip to content](https://kb.edgescan.com/knowledge/does-edgescan-perform-broken-object-level-authorization#main-content) English Show submenu for translations [![Edgescan Cybersecurity Platform | EASM + RBVM + PTaaS](https://kb.edgescan.com/hs-fs/hubfs/Logos/23LOGOS-thicker/Edgescan-Logo-Black.png?width=200&height=40&name=Edgescan-Logo-Black.png)](https://www.edgescan.com/) Open main navigation Close main navigation - English Show submenu for translations Search the Edgescan knowledge base - There are no suggestions because the search field is empty. 1. [Help Center](https://kb.edgescan.com/knowledge?hsLang=en) 2. [Updates & Announcements](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en) 3. [OWASP API 2019](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#owasp-api-2019) # How Does Edgescan Perform Broken Object Level Authorization (BOLA)? ## Edgescan includes Broken object level authorization as part of testing, and for API it's included as API1:2023. Version Number: v1.0.1 Published Date: 9 Apr 2024 \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Broken object level authorization (BOLA) would consist of the most interesting findings that are often misunderstood for manual detection however; Edgescan can still automate a surface level by identifying UUIDs being set that are considered weak, trying to access a difference in response using an incremented UUID that may be due to the API not checking permissions on calls. Detecting administrator endpoints using administrator authenticated account and recording which endpoints are still accessible without authentication. - [Getting Started](https://kb.edgescan.com/knowledge/getting-started?hsLang=en#main-content) - [Quick Start](https://kb.edgescan.com/knowledge/getting-started?hsLang=en#quick-start) - [Prerequisites & Network Requirements](https://kb.edgescan.com/knowledge/getting-started?hsLang=en#prerequisites-network-requirements) - [Compliance Context](https://kb.edgescan.com/knowledge/getting-started?hsLang=en#compliance-context) - [Attack Surface Management](https://kb.edgescan.com/knowledge/attack-surface-management?hsLang=en#main-content) - [Concepts](https://kb.edgescan.com/knowledge/attack-surface-management?hsLang=en#concepts) - [Discovery Methods](https://kb.edgescan.com/knowledge/attack-surface-management?hsLang=en#discovery-methods) - [Asset Inventory](https://kb.edgescan.com/knowledge/attack-surface-management?hsLang=en#asset-inventory) - [Vulnerability Scanning](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#main-content) - [Enabling & Disabling Scanning](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#enabling-disabling-scanning) - [Scope & Targeting](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#scope-targeting) - [Setting Authentication](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#setting-authentication) - [DAST Scanning](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#dast-scanning) - [API Settings](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#api-settings) - [Scanning Complex Workflows](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#scanning-complex-workflows) - [Vulnerability Risk Ratings](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#vulnerability-risk-ratings) - [Additional Configurations](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#additional-configurations) - [Agentic PTaaS](https://kb.edgescan.com/knowledge/agentic-ptaas?hsLang=en#main-content) - [Overviews and Concepts](https://kb.edgescan.com/knowledge/agentic-ptaas?hsLang=en#overviews-and-concepts) - [Using Atomic](https://kb.edgescan.com/knowledge/agentic-ptaas?hsLang=en#using-atomic) - [Safety and Privacy](https://kb.edgescan.com/knowledge/agentic-ptaas?hsLang=en#safety-and-privacy) - [Human PTaaS](https://kb.edgescan.com/knowledge/human-ptaas?hsLang=en#main-content) - [Concepts & Methodologies](https://kb.edgescan.com/knowledge/human-ptaas?hsLang=en#concepts-methodologies) - [Scheduling PTaaS](https://kb.edgescan.com/knowledge/human-ptaas?hsLang=en#scheduling-ptaas) - [Platform Usage](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#main-content) - [Platform Navigation](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#platform-navigation) - [Asset Management](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#asset-management) - [Vulnerability Management](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#vulnerability-management) - [License Management](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#license-management) - [Credentials Vault](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#credentials-vault) - [Asset Blockers](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#asset-blockers) - [Reporting & Dashboards](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#reporting-dashboards) - [AI Insights](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#ai-insights) - [Compliance & Frameworks](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#compliance-frameworks) - [Additional License Details](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#additional-license-details) - [Platform Automation](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#main-content) - [Notifications & Events](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#notifications-events) - [Internal/Private Testing](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#internal-private-testing) - [API & Authentication](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#api-authentication) - [Scheduled Exports](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#scheduled-exports) - [Cloud Platforms](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#cloud-platforms) - [CloudHook](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#cloudhook) - [ITSM & Ticketing](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#itsm-ticketing) - [SIEM & SOAR](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#siem-soar) - [CI/CD & DevOps](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#ci-cd-devops) - [Communication Automation](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#communication-automation) - [Other Automations](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#other-automations) - [Organization Administration](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#main-content) - [Organization Setup](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#organization-setup) - [User Administration](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#user-administration) - [Roles Administration](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#roles-administration) - [Account Settings](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#account-settings) - [Organization Settings](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#organization-settings) - [Updates & Announcements](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#main-content) - [2026 Updates](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#2026-updates) - [2025 Updates](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#2025-updates) - [2024 Updates](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#2024-updates) - [2023 Updates](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#2023-updates) - [API Changes](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#api-changes) - [OWASP API 2019](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#owasp-api-2019) [![Chill listening crop-3](https://kb.edgescan.com/hs-fs/hubfs/Edgescan-blac-logo.webp?width=68&height=55&name=Edgescan-blac-logo.webp "Chill listening crop-3")](https://www.edgescan.com) Copyright © 2026 Edgescan. All rights reserved.