Solutions / API abuse and business logic
The endpoint is fine. The use of it isn't.
BOLA, mass assignment, and workflow abuse use your API exactly as built, just not as intended. Cerberus scores intent against the actor's pattern, not the status code.
blockalertrate limitIllustrative product interface. The figures shown are an example of how Cerberus presents a detection, not benchmark or performance results.
200 OK abuse
Every request succeeds. There is no error code to alert on.
Business logic
The flaw is in intended functionality, so signatures never match.
No signature
Legacy WAFs look for bad payloads. This is a good payload, misused.
How it works
Intent against the actor's pattern.
A single authorized request is fine. Nineteen hundred of them in four minutes is not.
Coverage
What Cerberus catches here.
BOLA / IDOR
Accessing objects that belong to other users by walking IDs.
Mass assignment
Setting fields the client was never meant to control.
Workflow abuse
Driving multi-step flows out of order to skip checks or limits.
Rate-limit evasion
Spreading abuse below thresholds across actors and time.
Enumeration
Harvesting users, orders, or records by iterating identifiers.
Privilege escalation
Reaching for actions and data above the actor's real role.
FAQ
Common questions
What is BOLA, and why do scanners miss it?
Broken Object Level Authorization, first on the OWASP API Security Top 10 (API1:2023), is when an endpoint checks that you are allowed to call it but not that you are allowed to touch the specific object you asked for. Changing an id in a well-formed request returns someone else's record. Scanners miss it because nothing about the request is malformed and the scanner does not know which objects should belong to which caller. That ownership model lives in your application, not in the schema.
Why do WAFs not catch business logic abuse?
A WAF matches signatures against payloads. Business logic abuse has no payload to match: the requests are valid, the endpoints are permitted, and the credentials are real. What is wrong is the sequence, the quantity, or the object being referenced. A discount applied a thousand times and a discount applied once are byte-for-byte identical requests. The distinguishing information exists only across requests, which is a place a per-request filter cannot look.
What is mass assignment?
Mass assignment (API3:2023) is when a client sends fields the server binds to an internal object without filtering, so a request that should update a display name also sets role or is_admin or price. It is a property-level authorization failure rather than an input validation one, which is why blocklists of dangerous field names tend to leak: the risky field is whichever one your model happens to expose this release.
How do you separate abuse from an unusual but legitimate workflow?
By scoring against the actor's own history rather than a global rule. Bulk activity from an account that has always done bulk activity is not a finding; the same volume from an account that never has is. That framing keeps the false positive rate survivable, and it is also why the response is graduated. Borderline cases get a challenge or an alert. Only the clear ones get blocked.
Built APIs. Intended use.
See Cerberus read your own traffic, human and agentic, in one walkthrough tailored to your stack.