API / GraphQL
The UI is a subset of the schema. Hunt the schema.
Tags: api, graphql, idor
Checklist
- Discover — OpenAPI, swagger.json, /graphql, introspection, mobile APK, JS operations, old /api/v1.
- Unauth vs user vs admin — Every interesting operation three times.
- BOLA / BFLA — Object IDs and function-level (admin mutations as a user).
- Mass assignment — Extra JSON fields, GraphQL args the UI never sends.
- Batching — JSON arrays, GraphQL aliases, batch HTTP, rate-limit bypass.
- Introspection / field suggestions — If introspection is off, use clairvoyance / error suggestions / persisted-query dumps.
- Subscriptions and uploads — WS auth, multipart, nested file scalars.