Home·Guides·What is IDOR in an API?
What is IDOR in an API?
Routelint·
IDOR (insecure direct object reference) is when an API returns another account’s data because the handler trusted an id in the URL or body instead of checking who owns it.
In practice, User A opens an invoice at GET /api/invoices/inv-9001. User B pastes the same path with their own session and receives the same JSON. The route never asked whether inv-9001 belongs to the caller.
Routelint finds this without a hand-written exploit list. It captures the call while User A is signed in, then replays the same method, URL, and body as a peer identity. Matching account fields in the peer response are the finding. Evidence is redacted before it is stored.
Cross-user / IDOR is one of five suites on every security scan. It pairs with unguarded access (no session at all) and the API catalog (what the UI called). You need two identities linked as peers on the target to run it.
If you are searching how to test IDOR on a vibe-coded app that never shipped OpenAPI, start from live UI traffic: prove the host, capture the call, add User A and User B, then run the scan.