Direct answer
A user may be entitled to an object without being entitled to every property on it. Review response fields against the caller's role and business purpose, including fields hidden by the interface.
Create a property matrix
For a customer profile, identify fields visible to the customer, support staff and administrators. Use synthetic data and record which role may read internal notes, recovery details or other restricted properties. Confirm which fields are genuinely needed by each client.
Reference: OWASP API3: Broken Object Property Level Authorization.
Inspect the actual response
Call the same endpoint with each authorized test role and compare the complete response, not just the rendered page. Examine list, detail and export responses separately. A UI that hides a value does not prevent the browser or API client from receiving it.
- Use synthetic values for sensitive fields.
- Include mobile and alternate API versions if in scope.
- Capture only the minimum redacted evidence.
Check data purpose and indirect leakage
Distinguish a legitimate support workflow from disclosure to ordinary users. Review nested objects, error responses and metadata for unnecessary properties. A null field or property name alone may reveal less than a value, but can still warrant policy review.
Retest minimization
After the service changes its response schema, verify the restricted role no longer receives the property and an authorized support workflow still operates. Review client compatibility and related caching or export paths.
Assessment limits
A sampled response cannot prove every record, version or integration is filtered correctly. Data classification and permitted access must be supplied by the owner.
Frequently asked questions
Is hiding a field in the UI enough?
No. If the response still contains the field, the client can inspect it. Enforce the appropriate property boundary on the server.
Can an administrator legitimately see more fields?
Yes, if the role and purpose require them. Test each role against the documented policy.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.