A unique identifier distinguishes one stored record or API resource from another. APIs use these values to locate and retrieve payments, orders, users, and other resources. Incremental database identifiers are efficient and acceptable internally; exposing them directly can reveal a predictable sequence. section 6.2
An attacker can change an identifier in a resource URI, such as /payments/{payment_id}, to enumerate resources. If authorization and access controls are weak, predictable identifiers can enable broken object-level authorization and data breaches. Secure API design therefore avoids exposing predictable resource IDs and addresses security before deployment. section 6.2 section 1.2.1
Payment resource enumeration
A payment returned with ID 1 and a later payment returned with ID 2 expose an incremental pattern. A tester may try other values in /payments/1, /payments/2, and neighboring paths to find resources that should remain inaccessible. section 6.2
Figure 6.4 When an API uses a predictable pattern to identify resources, such as incremental integer IDs, threat actors will play with those values to try to access resources that don’t belong to them.
Shows how predictable resource identifiers invite attempts to access resources belonging to other users. section 6.2
