API Security · Module 2
SOTEVIS LOCATE
Module 2 of the SOTEVIS suite
Find the endpoints missing an ownership check, without sending a test request.
Broken object-level authorisation is the number one risk in the OWASP API Security Top 10. SOTEVIS Locate finds it in the traffic you already have, ranks every finding, and hands your engineers real examples to confirm in minutes.
Patent pending · SOTEVIS is a Physivitis product
One endpoint refuses the out-of-bounds request, one serves it: the one that served it is ranked first
The flaw
One changed number, someone else's invoice
A customer opens her invoices. Every one is hers. She changes a single number in the address bar and another company's invoice appears. The server checked that she was logged in, but never checked that she owned the invoice. This is broken object-level authorisation, known as BOLA, and it tops the OWASP API Security Top 10.
Today, teams hunt for it with active scanners and penetration tests. Those need test accounts for different users, scripted attacks and current API specifications. They take time to set up, they are risky to point at production, and they only test what someone thought to test. Undocumented and legacy endpoints are often never tested at all.
A different starting point: your own users
Every day, real users make requests that fall outside what they own, by accident. An old bookmark. A share link that has since been revoked. A mistyped number. An endpoint with a working ownership check refuses some of these. An endpoint without one serves them all. SOTEVIS Locate watches for exactly that difference.
How it works
Learn what each user may see
Using SOTEVIS Map, it builds for each user the set of items the application has already shown them through endpoints that filter correctly: their documents, their orders, the items shared with them.
Watch the out-of-bounds requests
It collects requests by ordinary users for real items outside their own set, and records whether each endpoint refused or served them. Roles that legitimately work across accounts, such as support staff, are kept separate so they cannot hide the signal.
Rank the endpoints that never refuse
Each endpoint’s refusal rate is compared with that of endpoints that do enforce ownership. An endpoint that serves what others refuse is ranked as a likely missing check, and the case grows stronger when the same user and item were refused on one endpoint but served on another.
What every finding includes
- The endpoint and its rank in the list
- How many out-of-bounds requests it served, against the refusal rate of comparable endpoints
- Example user-and-item pairs an engineer can replay in a test environment to confirm the gap
- A clear "not enough evidence yet" status wherever traffic does not yet support a conclusion
Why passive changes everything
- No test accounts to create, rotate or maintain.
- Nothing is sent to your API, so production is never put at risk.
- Every endpoint real users touch is covered, including the ones nobody documented.
- It runs continuously, so a check that breaks in next week’s release shows up in next week’s traffic.
Designed for real APIs
- Endpoints you have deliberately made open, such as a preview, go on an allow-list, so the report shows real gaps rather than design choices.
- Every finding is presented for confirmation by your engineers, with the evidence attached.
- Where traffic does not yet contain the evidence needed, SOTEVIS Locate says so instead of guessing.
Validated in simulation
In simulation testing across 20 separately generated API environments, each with a hidden set of endpoints missing their ownership check, SOTEVIS Locate found all 40 vulnerable endpoints from ordinary traffic alone. It raised no findings against endpoints that enforced the check and ranked every vulnerable endpoint above every protected one. The only other endpoint it raised was one deliberately built to be open, which is exactly what the allow-list is for.
Simulation results · production pilots now open
Who uses it
Application security teams
Get a ranked list of real gaps instead of a backlog of untested endpoints.
Penetration testers and red teams
Spend their time confirming likely flaws rather than searching for them.
Engineering leaders
Get a short, evidenced fix list for each release.
Risk and compliance teams
Can show that access to customer data is checked continuously, not once a year.
Built for
Questions
What teams ask before a pilot
Find the missing lock before anyone tries the door
We are running pilots with organisations that operate customer-facing APIs. Bring us a mirror of your traffic and we will bring you a ranked list of the gaps in it.
Request a SOTEVIS pilotPatent pending · SOTEVIS is a Physivitis product