Direct answer
A bulk operation must enforce the relevant permission for every object, not only for the endpoint or the first item. Define how partial success and error details should behave before testing.
Map the intended batch behavior
Choose a harmless bulk read or update in a test environment and document the policy for allowed, denied and nonexistent objects. Create owned records for accounts A and B, including a record that is intentionally shared if the product supports sharing.
Reference: OWASP API1:2023 Broken Object Level Authorization.
Exercise controlled batches
As A, submit a batch of A-owned records as a positive control, then an agreed mixed batch containing B's disposable record. Inspect each returned item and the actual state of each record. A 200 status can represent partial success, while a 403 alone does not prove no earlier item changed.
- Use non-destructive operations or reversible fixtures.
- Compare state before and after the entire batch.
- Record result ordering and per-item errors without real data.
Check reporting and transactional rules
The documented design may reject the whole request or process allowed items only. Confirm that unauthorized items are never processed and that error messages do not disclose protected data. Check duplicate IDs and batch-size limits within the agreed request budget.
Retest related entry points
After a fix, repeat positive, mixed and all-denied cases and verify state. Include asynchronous jobs and alternate export routes if they share batch processing. Keep a legitimate sharing case so security enforcement does not break permitted collaboration.
Assessment limits
Batch and asynchronous processing may have delayed effects. This test covers the selected operation and fixtures, not every object action or background queue.
Frequently asked questions
Does a batch-level authorization check cover each object?
Not necessarily. A caller allowed to invoke a bulk endpoint may still lack permission for individual records in its payload.
Should a mixed batch always fail completely?
The product can define whole-batch rejection or safe partial processing. Either way, denied objects must not be acted on and the behavior should be documented.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.