IDOR / object-ID canaries
Two-account object identifiers and verb swaps. Use records you created. The payload is the ID, not a dump.
Tags: idor, bac, api, graphql
Controlled probes
/api/invoices/{id_from_account_A} as account BPUT /api/invoices/{id} when GET is locked{"ids":["A","B"]}query { node(id:"GLOBAL_ID_FROM_A") { ... on Invoice { total } } }?user_id[]=A&user_id[]=B
Source: https://owasp.org/www-community/attacks/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet