API authorization: why login is not enough

Describe ownership in business language

For a customer document portal, write down who can view, edit, download and delete each document. Include staff, customers and tenant boundaries. This permission map gives developers and reviewers a shared reference.

Review each access path

OWASP identifies missing object-level permission checks as an API risk. Hiding a button or using an unpredictable identifier is not a substitute for server-side authorization. Related export and attachment endpoints deserve the same attention as the main record view.

Make verification repeatable

Use approved accounts and synthetic records to check permitted and denied access. Keep the expected result alongside the test case. Add these cases to regression testing when permission rules change.

Practical checklist

• Map roles to allowed actions.
• Include attachments and exports.
• Verify tenant separation with approved data.
• Retest after permission changes.

A common question

Do random record IDs solve access control?

No. They can make guessing harder, but the server still needs to decide whether the current user is allowed to access the requested object.