What is authprobe?

jbarach2012/authprobe — explained in plain English

Analysis updated 2026-05-18

★ 141PythonAudience · developerComplexity · 3/5LicenseSetup · easy

Mindmap

mindmap
  root((AuthProbe))
    What it does
      Multi identity scanning
      Object level auth checks
      OpenAPI driven
    Tech stack
      Python
      OpenAPI spec
      JUnit XML
    Use cases
      CI security gate
      Recruitment API testing
      Manual pentest support
    Audience
      Security reviewers
      API developers
    Setup
      pip install
      Built in demo
      Config file scan

mindmap root((AuthProbe)) What it does Multi identity scanning Object level auth checks OpenAPI driven Tech stack Python OpenAPI spec JUnit XML Use cases CI security gate Recruitment API testing Manual pentest support Audience Security reviewers API developers Setup pip install Built in demo Config file scan

What do people build with it?

USE CASE 1

Scan a recruitment or HR API to check if one candidate's data leaks to another candidate.

USE CASE 2

Gate a CI pipeline so a build fails if a broken authorization bug is found.

USE CASE 3

Run repeatable, evidence producing authorization tests instead of manual security review sessions.

USE CASE 4

Check an API for sequential or guessable object IDs that make data easier to enumerate.

What is it built with?

PythonOpenAPIJUnit XML

How does it compare?

	jbarach2012/authprobe	internrobotics/sim1	kurt-chan/ai-job-scraper
Stars	141	141	141
Language	Python	Python	Python
Setup difficulty	easy	hard	moderate
Complexity	3/5	5/5	3/5
Audience	developer	researcher	general

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · easy Time to first run · 5min

Only run it against APIs you own or have explicit permission to test.

Use freely for any purpose, including commercial use, as long as you keep the copyright notice, under the Apache 2.0 license.

So what is it?

AuthProbe is a security testing tool that checks whether an API lets one user read another user's private data by mistake. This class of bug is called Broken Object Level Authorization, or BOLA, and it has been the top risk on the OWASP API security list since 2019. AuthProbe is built specifically with recruitment and hiring APIs in mind, since those systems hold a lot of private candidate data, though the same checks apply to any API described by an OpenAPI specification. The tool works by logging in as two or more identities that you control, then walking through the objects each identity can see. It compares what each identity is allowed to fetch, and flags cases where one identity can pull up a record that belongs to someone else. This kind of flaw is hard to catch with a web application firewall or a single identity scanner, because the request itself looks perfectly normal, the problem only shows up when you compare what two different users can access. To try it out, you clone the repository, install it with pip, then run a built in demo that spins up both a vulnerable and a secure sample API and scans each one, showing example findings for the vulnerable one and a clean result for the secure one. To scan a real target, you write a small configuration file listing the target's base URL, its OpenAPI spec location, and at least two identities with their own login credentials, then run the scan command. AuthProbe checks for several related problems, including broken object level authorization, sequential ID enumeration, missing authentication entirely, numeric identifiers that are easy to guess, and status codes that let an attacker confirm whether an ID exists. It can output JUnit XML and exit with a non-zero status code, so it can be wired into a continuous integration pipeline to block a build if these issues are found. The project explicitly states it is meant for authorized use only, and it refuses to run against a non-local target unless you confirm you have permission. It is released under the Apache 2.0 license.

Copy-paste prompts

Prompt 1

Help me run the AuthProbe demo with python -m authprobe.demo and explain the sample findings it produces.

Prompt 2

Walk me through writing a minimal AuthProbe config file with two identities for my own API.

Prompt 3

Explain the difference between the bola, idor, and enumerable_id checks AuthProbe runs.

Prompt 4

Show me how to wire authprobe scan into a CI workflow so it fails the build on high severity findings.

Prompt 5

Explain why AuthProbe requires --i-have-authorization before scanning a non-local target.

Frequently asked questions