Broken Function Level Authorization detection. Learns an authorization model from observed API interactions — which callers are supposed to invoke which operations — then flags violations against it. Served under /api/modules/bfla in an APIClarity deployment.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/apiclarity-bfla-module-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.0.3
info:
title: APIClarity BFLA
version: 0.0.1
description: APIClarity Module API
paths:
/version:
get:
operationId: getVersion
summary: Get the version of this Module
description: Get the version of this Module
tags:
- local-bfla
responses:
'200':
description: Version of the Module
content:
application/json:
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ModuleVersion'
/authorizationModel/{apiID}:
post:
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
tags:
- bfla
requestBody:
content:
'application/json':
schema:
$ref: '#/components/schemas/AuthorizationModel'
responses:
'201':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
get:
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
tags:
- bfla
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '#/components/schemas/AuthorizationModel'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/authorizationModel/{apiID}/state:
get:
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
tags:
- bfla
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '#/components/schemas/BFLAState'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/authorizationModel/{apiID}/approve:
put:
tags:
- local-bfla
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
- in: query
name: method
required: true
schema:
type: string
- in: query
name: path
required: true
schema:
type: string
- in: query
name: k8sClientUid
required: true
schema:
type: string
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/authorizationModel/{apiID}/deny:
put:
tags:
- local-bfla
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
- in: query
name: method
required: true
schema:
type: string
- in: query
name: path
required: true
schema:
type: string
- in: query
name: k8sClientUid
required: true
schema:
type: string
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/authorizationModel/{apiID}/learning/start:
put:
tags:
- bfla
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
- in: query
name: nr_traces
schema:
type: integer
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/authorizationModel/{apiID}/reset:
post:
tags:
- bfla
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/authorizationModel/{apiID}/learning/stop:
put:
tags:
- bfla
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/authorizationModel/{apiID}/detection/start:
put:
tags:
- bfla
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/authorizationModel/{apiID}/detection/stop:
put:
tags:
- bfla
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/event/{id}:
get:
tags:
- local-bfla
operationId: get_event
parameters:
- name: id
in: path
schema:
type: integer
required: true
summary: Get the event with the annotations and bfla status
responses:
'200':
description: API Event with annotations
content:
application/json:
schema:
$ref: '#/components/schemas/APIEventAnnotations'
/event/{id}/{operation}:
put:
tags:
- local-bfla
parameters:
- in: path
schema:
type: integer
required: true
name: id
- in: path
required: true
name: operation
schema:
$ref: '#/components/schemas/OperationEnum'
responses:
'200':
description: 'Success'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
default:
description: "Error response"
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
/apiFindings/{apiID}:
get:
tags:
- bfla
operationId: GetApiFindings
summary: 'Get findings for an API and module'
description: 'Asks for findings of an APIClarity module, and API. Implemented by each module'
parameters:
- name: apiID
in: path
required: true
schema:
$ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
- $ref: '../../../../../../api3/common/openapi.yaml#/components/parameters/Sensitive'
responses:
'200':
description: 'An API Findings Bundle'
content:
application/json:
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/APIFindings'
default:
description: 'Error response'
content:
'application/json':
schema:
$ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
components:
schemas:
APIEventAnnotations:
required: [bflaStatus, external, mismatchedScopes]
properties:
external:
type: boolean
mismatchedScopes:
type: boolean
destinationK8sObject:
$ref: '#/components/schemas/K8sObjectRef'
sourceK8sObject:
$ref: '#/components/schemas/K8sObjectRef'
bflaStatus:
$ref: '#/components/schemas/BFLAStatus'
detectedUser:
$ref: '#/components/schemas/DetectedUser'
DetectedUser:
required: [id, source, ip_address]
properties:
id:
type: string
source:
type: string
enum:
- JWT
- BASIC
- KONG_X_CONSUMER_ID
ip_address:
type: string
K8sObjectRef:
type: object
required: [uid, kind, name, namespace, apiVersion]
properties:
uid:
type: string
kind:
type: string
name:
type: string
namespace:
type: string
apiVersion:
type: string
BFLAState:
type: string
enum:
- BFLA_START
- BFLA_LEARNING
- BFLA_DETECTING
- BFLA_LEARNT
BFLAStatus:
type: string
enum:
- NO_SPEC
- LEARNING
- LEGITIMATE
- SUSPICIOUS_MEDIUM
- SUSPICIOUS_HIGH
AuthorizationModelAudience:
type: object
required: [end_users, authorized, external, statusCode, warningStatus]
properties:
warningStatus:
$ref: '#/components/schemas/BFLAStatus'
statusCode:
type: integer
lastTime:
type: 'string'
format: 'date-time'
authorized:
type: boolean
external:
type: boolean
end_users:
type: array
items:
$ref: '#/components/schemas/DetectedUser'
k8s_object:
$ref: '#/components/schemas/K8sObjectRef'
AuthorizationModelOperation:
type: object
required: [path, method, audience, tags]
properties:
path:
type: string
method:
type: string
tags:
items:
type: string
type: array
audience:
type: array
items:
$ref: '#/components/schemas/AuthorizationModelAudience'
SpecType:
type: string
enum:
- NONE
- PROVIDED
- RECONSTRUCTED
AuthorizationModel:
type: object
required: [specType, operations, learning]
properties:
specType:
$ref: '#/components/schemas/SpecType'
learning:
type: boolean
operations:
type: array
items:
$ref: '#/components/schemas/AuthorizationModelOperation'
OperationEnum:
type: string
enum:
- approve
- deny
- approve_user
- deny_user
AuthorizationModelNotification:
allOf:
- $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/BaseNotification'
- $ref: '#/components/schemas/AuthorizationModel'