Broken function-level authorization in APIs: what teams are missing

TL;DR: Broken function-level authorization lets non-privileged users invoke admin-only API functions, leading to price tampering, unauthorised money transfers, and shipment manipulation, according to Pynt. The control gap is not hidden endpoints but missing authorisation checks at the function layer, where business actions are actually enforced.

NHIMG editorial — based on content published by Pynt: broken function-level authorization in APIs

By the numbers:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
• Only 5.7% of organisations have full visibility into their service accounts.

Questions worth separating out

Q: How should security teams test REST APIs for broken authorization?

A: Test each endpoint with multiple identity contexts: no authentication, invalid or expired credentials, least-privilege service accounts, and users outside the resource ownership boundary.

Q: Why do API authorization gaps matter so much for non-human identities?

A: Non-human identities can repeat an abused action at machine speed, which turns one missing permission check into many unauthorised transactions or configuration changes.

Q: What do teams get wrong about hiding admin API endpoints?

A: Hiding an endpoint does not enforce authorisation.

Practitioner guidance

• Test action-level authorization on every privileged API Build negative test cases that attempt admin, transfer, and configuration functions from low-privilege roles and service accounts.
• Map API routes to business entitlements Maintain an inventory that links each endpoint, verb, and microservice action to a specific role or attribute decision.
• Include service accounts in access reviews Treat machine identities that call APIs as governed principals, especially when they can modify state or trigger financial transactions.

What's in the full article

Pynt's full article covers the operational detail this post intentionally leaves for the source:

• Concrete examples of broken function-level authorization across e-commerce, banking, and logistics workflows
• The specific API abuse patterns that let low-privilege callers reach admin-only actions
• Practical remediation discussion for aligning function checks with business roles and verbs
• Additional context on how API security controls fail when authorization is applied inconsistently

👉 Read Pynt's analysis of broken function-level authorization in APIs →

Broken function-level authorization in APIs: what teams are missing?

Explore further

View Full Forum →  |  NHI Foundation Course →