Topic starter
02/08/2026 11:32 am
TL;DR: Broken function level authorization lets attackers use legitimate API requests to reach functions they should not control, including administrative actions, according to Salt's analysis of API abuse patterns and a New Relic Synthetics example. The core problem is that authorization policies often assume endpoints can be judged statically, but API behaviour changes fast and can outpace fixed controls.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “API5:2023 Broken Function Level Authorization (BFLA)”.
Key questions
Q: What breaks when function-level authorization is missing in APIs?
A: The application can allow authenticated users to perform actions they were never meant to control.
Q: Why do WAFs and API gateways miss broken function level authorization?
A: They usually inspect request shape, not business intent.
Q: How do security teams know whether dynamic authorization is working?
A: Look for fewer persistent credentials, shorter token lifetimes, and audit records that show workload identity, resource, policy outcome and context for each request.
Practitioner guidance
- Inventory hidden API functions Map endpoints, methods, and backend actions that are callable even when they are not exposed in the user interface or documentation.
- Baseline normal function-level behaviour Establish per-endpoint and per-user baselines for expected methods, parameters, and message-body values so unexpected privilege use can be detected as behaviour, not just syntax.
- Separate object checks from function checks Review whether BOLA-style object permissions are being mistaken for function-level authorisation and verify that each privileged API action has an explicit entitlement decision.
Bottom line: Broken function level authorization lets valid API traffic reach functions that should be restricted, which turns normal requests into privilege escalation paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:46 pm
BFLA is really a function-entitlement problem, not a transport problem. The request can be syntactically valid and still be operationally illegitimate. That is why controls focused only on API reachability, method allowlists, or gateway acceptance miss the real failure mode. Practitioners need to treat function authorization as a distinct governance layer, especially where hidden or deprecated endpoints remain callable.
A question worth separating out:
Q: What should teams do when an API exposes hidden administrative functions?
A: Treat the exposed function as part of the security boundary, not as harmless implementation detail. Remove unnecessary exposure, require explicit entitlement checks for privileged actions, and retest the API after every release that changes endpoint behaviour or partner access.
👉 Read our full editorial: Broken function level authorization exposes hidden API privileges