[](https://www.paloaltonetworks.com/?ts=markdown) * Sign In * Customer * Partner * Employee * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown) * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * EN * [USA (ENGLISH)](https://www.paloaltonetworks.com) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca) * [CHINA (简体中文)](https://www.paloaltonetworks.cn) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it) * [JAPAN (日本語)](https://www.paloaltonetworks.jp) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk) * ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get Support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) * [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html) ![x close icon to close mobile navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-black.svg) [![Palo Alto Networks logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)](https://www.paloaltonetworks.com/?ts=markdown) ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * [](https://www.paloaltonetworks.com/?ts=markdown) * Products ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Products [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [AI Security](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise Device Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical Device Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [OT Device Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Cortex Advanced Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Unit 42 Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Solutions ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Solutions Secure AI by Design * [Secure AI Ecosystem](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [Secure GenAI Usage](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) Network Security * [Cloud Network Security](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Data Center Security](https://www.paloaltonetworks.com/network-security/data-center?ts=markdown) * [DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Intrusion Detection and Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Device Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [OT Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Secure All Apps, Users and Locations](https://www.paloaltonetworks.com/sase/secure-users-data-apps-devices?ts=markdown) * [Secure Branch Transformation](https://www.paloaltonetworks.com/sase/secure-branch-transformation?ts=markdown) * [Secure Work on Any Device](https://www.paloaltonetworks.com/sase/secure-work-on-any-device?ts=markdown) * [VPN Replacement](https://www.paloaltonetworks.com/sase/vpn-replacement-for-secure-remote-access?ts=markdown) * [Web \& Phishing Security](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) Cloud Security * [Application Security Posture Management (ASPM)](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Code Security](https://www.paloaltonetworks.com/cortex/cloud/code-security?ts=markdown) * [Cloud Security Posture Management (CSPM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management (CIEM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management (DSPM)](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management (AI-SPM)](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Cloud Workload Protection (CWP)](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [Web Application \& API Security (WAAS)](https://www.paloaltonetworks.com/cortex/cloud/web-app-api-security?ts=markdown) Security Operations * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Security Information and Event Management](https://www.paloaltonetworks.com/cortex/modernize-siem?ts=markdown) * [Network Security Automation](https://www.paloaltonetworks.com/cortex/network-security-automation?ts=markdown) * [Incident Case Management](https://www.paloaltonetworks.com/cortex/incident-case-management?ts=markdown) * [SOC Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown) * [Threat Intel Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown) * [Compliance Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/compliance-management?ts=markdown) * [Internet Operations Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/internet-operations-management?ts=markdown) * [Extended Data Lake (XDL)](https://www.paloaltonetworks.com/cortex/cortex-xdl?ts=markdown) * [Agentic Assistant](https://www.paloaltonetworks.com/cortex/cortex-agentic-assistant?ts=markdown) Endpoint Security * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Industries](https://www.paloaltonetworks.com/industry?ts=markdown) * [Public Sector](https://www.paloaltonetworks.com/industry/public-sector?ts=markdown) * [Financial Services](https://www.paloaltonetworks.com/industry/financial-services?ts=markdown) * [Manufacturing](https://www.paloaltonetworks.com/industry/manufacturing?ts=markdown) * [Healthcare](https://www.paloaltonetworks.com/industry/healthcare?ts=markdown) * [Small \& Medium Business Solutions](https://www.paloaltonetworks.com/industry/small-medium-business-portfolio?ts=markdown) * Services ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Services [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Assess](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [AI Security Assessment](https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/assess/attack-surface-assessment?ts=markdown) * [Breach Readiness Review](https://www.paloaltonetworks.com/unit42/assess/breach-readiness-review?ts=markdown) * [BEC Readiness Assessment](https://www.paloaltonetworks.com/bec-readiness-assessment?ts=markdown) * [Cloud Security Assessment](https://www.paloaltonetworks.com/unit42/assess/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/assess/compromise-assessment?ts=markdown) * [Cyber Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/cyber-risk-assessment?ts=markdown) * [M\&A Cyber Due Diligence](https://www.paloaltonetworks.com/unit42/assess/mergers-acquisitions-cyber-due-diligence?ts=markdown) * [Penetration Testing](https://www.paloaltonetworks.com/unit42/assess/penetration-testing?ts=markdown) * [Purple Team Exercises](https://www.paloaltonetworks.com/unit42/assess/purple-teaming?ts=markdown) * [Ransomware Readiness Assessment](https://www.paloaltonetworks.com/unit42/assess/ransomware-readiness-assessment?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/assess/soc-assessment?ts=markdown) * [Supply Chain Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/assess/tabletop-exercise?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * [Respond](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Cloud Incident Response](https://www.paloaltonetworks.com/unit42/respond/cloud-incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Managed Detection and Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/unit42/respond/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * [Transform](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [IR Plan Development and Review](https://www.paloaltonetworks.com/unit42/transform/incident-response-plan-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/transform/security-program-design?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/transform/vciso?ts=markdown) * [Zero Trust Advisory](https://www.paloaltonetworks.com/unit42/transform/zero-trust-advisory?ts=markdown) [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-unit-42.svg) UNIT 42 RETAINER Custom-built to fit your organization's needs, you can choose to allocate your retainer hours to any of our offerings, including proactive cyber risk management services. Learn how you can put the world-class Unit 42 Incident Response team on speed dial. Learn more](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * Partners ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Partners NextWave Partners * [NextWave Partner Community](https://www.paloaltonetworks.com/partners?ts=markdown) * [Cloud Service Providers](https://www.paloaltonetworks.com/partners/nextwave-for-csp?ts=markdown) * [Global Systems Integrators](https://www.paloaltonetworks.com/partners/nextwave-for-gsi?ts=markdown) * [Technology Partners](https://www.paloaltonetworks.com/partners/technology-partners?ts=markdown) * [Service Providers](https://www.paloaltonetworks.com/partners/service-providers?ts=markdown) * [Solution Providers](https://www.paloaltonetworks.com/partners/nextwave-solution-providers?ts=markdown) * [Managed Security Service Providers](https://www.paloaltonetworks.com/partners/managed-security-service-providers?ts=markdown) * [XMDR Partners](https://www.paloaltonetworks.com/partners/managed-security-service-providers/xmdr?ts=markdown) Take Action * [Portal Login](https://www.paloaltonetworks.com/partners/nextwave-partner-portal?ts=markdown) * [Managed Services Program](https://www.paloaltonetworks.com/partners/managed-security-services-provider-program?ts=markdown) * [Become a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=becomepartner) * [Request Access](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=requestaccess) * [Find a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerlocator) [CYBERFORCE CYBERFORCE represents the top 1% of partner engineers trusted for their security expertise. Learn more](https://www.paloaltonetworks.com/cyberforce?ts=markdown) * Company ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Company Palo Alto Networks * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Management Team](https://www.paloaltonetworks.com/about-us/management?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com) * [Locations](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Ethics \& Compliance](https://www.paloaltonetworks.com/company/ethics-and-compliance?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Military \& Veterans](https://jobs.paloaltonetworks.com/military) [Why Palo Alto Networks?](https://www.paloaltonetworks.com/why-paloaltonetworks?ts=markdown) * [Precision AI Security](https://www.paloaltonetworks.com/precision-ai-security?ts=markdown) * [Our Platform Approach](https://www.paloaltonetworks.com/why-paloaltonetworks/platformization?ts=markdown) * [Accelerate Your Cybersecurity Transformation](https://www.paloaltonetworks.com/why-paloaltonetworks/nam-cxo-portfolio?ts=markdown) * [Awards \& Recognition](https://www.paloaltonetworks.com/about-us/awards?ts=markdown) * [Customer Stories](https://www.paloaltonetworks.com/customers?ts=markdown) * [Global Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Trust 360 Program](https://www.paloaltonetworks.com/resources/whitepapers/trust-360?ts=markdown) Careers * [Overview](https://jobs.paloaltonetworks.com/) * [Culture \& Benefits](https://jobs.paloaltonetworks.com/en/culture/) [A Newsweek Most Loved Workplace "Businesses that do right by their employees" Read more](https://www.paloaltonetworks.com/company/press/2021/palo-alto-networks-secures-top-ranking-on-newsweek-s-most-loved-workplaces-list-for-2021?ts=markdown) * More ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) More Resources * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Unit 42 Threat Research](https://unit42.paloaltonetworks.com/) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Tech Insider](https://techinsider.paloaltonetworks.com/) * [Knowledge Base](https://knowledgebase.paloaltonetworks.com/) * [Palo Alto Networks TV](https://tv.paloaltonetworks.com/) * [Perspectives of Leaders](https://www.paloaltonetworks.com/perspectives/?ts=markdown) * [Cyber Perspectives Magazine](https://www.paloaltonetworks.com/cybersecurity-perspectives/cyber-perspectives-magazine?ts=markdown) * [Regional Cloud Locations](https://www.paloaltonetworks.com/products/regional-cloud-locations?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Security Posture Assessment](https://www.paloaltonetworks.com/security-posture-assessment?ts=markdown) * [Threat Vector Podcast](https://unit42.paloaltonetworks.com/unit-42-threat-vector-podcast/) * [Packet Pushers Podcasts](https://www.paloaltonetworks.com/podcasts/packet-pusher?ts=markdown) Connect * [LIVE community](https://live.paloaltonetworks.com/) * [Events](https://events.paloaltonetworks.com/) * [Executive Briefing Center](https://www.paloaltonetworks.com/about-us/executive-briefing-program?ts=markdown) * [Demos](https://www.paloaltonetworks.com/demos?ts=markdown) * [Contact us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) [Blog Stay up-to-date on industry trends and the latest innovations from the world's largest cybersecurity Learn more](https://www.paloaltonetworks.com/blog/) * Sign In ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Sign In * Customer * Partner * Employee * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown) * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * EN ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Language * [USA (ENGLISH)](https://www.paloaltonetworks.com) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca) * [CHINA (简体中文)](https://www.paloaltonetworks.cn) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it) * [JAPAN (日本語)](https://www.paloaltonetworks.jp) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) * [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html) * [Demos and Trials](https://www.paloaltonetworks.com/get-started?ts=markdown) Search All * [Tech Docs](https://docs.paloaltonetworks.com/search) Close search modal [Deploy Bravely --- Secure your AI transformation with Prisma AIRS](https://www.deploybravely.com) [](https://www.paloaltonetworks.com/?ts=markdown) 1. [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) 2. [Cloud Security](https://www.paloaltonetworks.com/cyberpedia/cloud-security?ts=markdown) 3. [API Security](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security?ts=markdown) 4. [What Is Broken Object Property Level Authorization?](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization?ts=markdown) Table of Contents * [What Is API Security?](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security?ts=markdown) * [API Security Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#api?ts=markdown) * [Definition of an API](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#definition?ts=markdown) * [Why API Security Is Important](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#why?ts=markdown) * [Traditional Approach to Web Application Security](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#traditional?ts=markdown) * [Anatomy of an API Attack](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#anatomy?ts=markdown) * [API Security Risks](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#risks?ts=markdown) * [API Security for SOAP, REST and GraphQL](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#graphql?ts=markdown) * [API Security Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#best?ts=markdown) * [Cortex Cloud's API Security Solution](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#prisma?ts=markdown) * [API Security FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#faqs?ts=markdown) * [API Security Monitoring](https://www.paloaltonetworks.com/cyberpedia/api-security-monitoring?ts=markdown) * [What to Monitor: Traffic, Sessions, Anomalies, Threats](https://www.paloaltonetworks.com/cyberpedia/api-security-monitoring#monitor?ts=markdown) * [Services and Tools for Monitoring APIs](https://www.paloaltonetworks.com/cyberpedia/api-security-monitoring#services?ts=markdown) * [Response Mechanisms: Threat Detection, Response, Remediation for APIs](https://www.paloaltonetworks.com/cyberpedia/api-security-monitoring#response?ts=markdown) * [Ensuring the Best API Security Posture with Monitoring and Continuous Improvement](https://www.paloaltonetworks.com/cyberpedia/api-security-monitoring#ensuring?ts=markdown) * [Building a Monitoring-Driven API Security Lifecycle](https://www.paloaltonetworks.com/cyberpedia/api-security-monitoring#building?ts=markdown) * [API Security Monitoring FAQs](https://www.paloaltonetworks.com/cyberpedia/api-security-monitoring#faqs?ts=markdown) * [What Is Broken Function Level Authorization?](https://www.paloaltonetworks.com/cyberpedia/broken-function-level-authorization?ts=markdown) * [API5:2023 - Broken Function Level Authorization Explained](https://www.paloaltonetworks.com/cyberpedia/broken-function-level-authorization#broken?ts=markdown) * [Understanding Broken Function Level Authorization in API Security](https://www.paloaltonetworks.com/cyberpedia/broken-function-level-authorization#understanding?ts=markdown) * [How Broken Function Level Authorization Manifests in Real-World APIs](https://www.paloaltonetworks.com/cyberpedia/broken-function-level-authorization#how?ts=markdown) * [The Business Impact of Broken Function Level Authorization](https://www.paloaltonetworks.com/cyberpedia/broken-function-level-authorization#business?ts=markdown) * [Identifying Broken Function Level Authorization in Your APIs](https://www.paloaltonetworks.com/cyberpedia/broken-function-level-authorization#identifying?ts=markdown) * [Preventing Broken Function Level Authorization: Best Practices](https://www.paloaltonetworks.com/cyberpedia/broken-function-level-authorization#preventing?ts=markdown) * [Broken Function Level Authorization FAQs](https://www.paloaltonetworks.com/cyberpedia/broken-function-level-authorization#faqs?ts=markdown) * [What Is Unrestricted Access to Sensitive Business Flows?](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows?ts=markdown) * [API6:2023 - Unrestricted Access to Sensitive Business Flows Explained](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows#explained?ts=markdown) * [Understanding Unrestricted Access to Sensitive Business Flows in API Security](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows#understanding?ts=markdown) * [How Unrestricted Access to Sensitive Business Flows Manifests in Real-World APIs](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows#how?ts=markdown) * [The Business Impact of Unrestricted Access to Sensitive Business Flows](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows#flows?ts=markdown) * [Identifying Unrestricted Access to Sensitive Business Flows in Your APIs](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows#identifying?ts=markdown) * [Preventing Unrestricted Access to Sensitive Business Flows: Best Practices](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows#preventing?ts=markdown) * [Unrestricted Access to Sensitive Business Flows FAQs](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows#faqs?ts=markdown) * What Is Broken Object Property Level Authorization? * [API3:2023 - Broken Object Property Level Authorization Explained](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#explained?ts=markdown) * [Understanding Broken Object Property Level Authorization](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#understanding?ts=markdown) * [How Broken Object Property Level Authorization Manifests in Real-World APIs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#how?ts=markdown) * [The Business Impact of Broken Object Property Level Authorization](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#business?ts=markdown) * [Identifying Broken Object Property Level Authorization in Your APIs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#identifying?ts=markdown) * [Preventing Broken Object Property Level Authorization: Best Practices](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#preventing?ts=markdown) * [Broken Object Property Level Authorization FAQs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#faqs?ts=markdown) * [Cloud API Security: Strategy for the DevOps Era](https://www.paloaltonetworks.com/cyberpedia/cloud-api-security-strategy?ts=markdown) * [The Role of API Keys and Secrets in Cloud APIs --- Risks and Misuses](https://www.paloaltonetworks.com/cyberpedia/cloud-api-security-strategy#role?ts=markdown) * [The Gateway Layer in Cloud APIs: Why a Web API Security Gateway Is Critical](https://www.paloaltonetworks.com/cyberpedia/cloud-api-security-strategy#gateway?ts=markdown) * [Monitoring and Protecting APIs in Real Time in Cloud/DevOps Contexts](https://www.paloaltonetworks.com/cyberpedia/cloud-api-security-strategy#monitoring?ts=markdown) * [Strategy Checklist: Best Practices for Cloud API Security in DevOps](https://www.paloaltonetworks.com/cyberpedia/cloud-api-security-strategy#strategy?ts=markdown) * [Conclusion: Bridging DevOps Velocity with Secure API Posture](https://www.paloaltonetworks.com/cyberpedia/cloud-api-security-strategy#conclusion?ts=markdown) * [Cloud API Security FAQs](https://www.paloaltonetworks.com/cyberpedia/cloud-api-security-strategy#faqs?ts=markdown) * [API Security Checklist for Modern Application Teams](https://www.paloaltonetworks.com/cyberpedia/api-security-checklist?ts=markdown) * [Discover and Classify All APIs](https://www.paloaltonetworks.com/cyberpedia/api-security-checklist#discover?ts=markdown) * [Apply Core API Security Controls](https://www.paloaltonetworks.com/cyberpedia/api-security-checklist#apply?ts=markdown) * [Protect API Data at Every Layer](https://www.paloaltonetworks.com/cyberpedia/api-security-checklist#protect?ts=markdown) * [Secure API Endpoints and Runtime Behavior](https://www.paloaltonetworks.com/cyberpedia/api-security-checklist#secure?ts=markdown) * [Continuously Monitor, Test, and Improve](https://www.paloaltonetworks.com/cyberpedia/api-security-checklist#monitor?ts=markdown) * [Building Resilience Through Systematic Execution](https://www.paloaltonetworks.com/cyberpedia/api-security-checklist#resilience?ts=markdown) * [API Security Checklist FAQs](https://www.paloaltonetworks.com/cyberpedia/api-security-checklist#faqs?ts=markdown) * [What Is Broken Authentication?](https://www.paloaltonetworks.com/cyberpedia/broken-authentication-api2?ts=markdown) * [API2:2023 - Broken Authentication Explained](https://www.paloaltonetworks.com/cyberpedia/broken-authentication-api2#API2-2023?ts=markdown) * [Understanding Broken Authentication in API Security](https://www.paloaltonetworks.com/cyberpedia/broken-authentication-api2#understanding?ts=markdown) * [How Broken Authentication Manifests in Real-World APIs](https://www.paloaltonetworks.com/cyberpedia/broken-authentication-api2#broken?ts=markdown) * [The Business Impact of Broken Authentication](https://www.paloaltonetworks.com/cyberpedia/broken-authentication-api2#business?ts=markdown) * [Identifying Broken Authentication in Your APIs](https://www.paloaltonetworks.com/cyberpedia/broken-authentication-api2#identifying?ts=markdown) * [Preventing Broken Authentication: Best Practices](https://www.paloaltonetworks.com/cyberpedia/broken-authentication-api2#preventing?ts=markdown) * [Broken Authentication FAQs](https://www.paloaltonetworks.com/cyberpedia/broken-authentication-api2#faqs?ts=markdown) # What Is Broken Object Property Level Authorization? 4 min. read Table of Contents * * [API3:2023 - Broken Object Property Level Authorization Explained](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#explained?ts=markdown) * [Understanding Broken Object Property Level Authorization](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#understanding?ts=markdown) * [How Broken Object Property Level Authorization Manifests in Real-World APIs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#how?ts=markdown) * [The Business Impact of Broken Object Property Level Authorization](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#business?ts=markdown) * [Identifying Broken Object Property Level Authorization in Your APIs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#identifying?ts=markdown) * [Preventing Broken Object Property Level Authorization: Best Practices](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#preventing?ts=markdown) * [Broken Object Property Level Authorization FAQs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#faqs?ts=markdown) 1. API3:2023 - Broken Object Property Level Authorization Explained * * [API3:2023 - Broken Object Property Level Authorization Explained](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#explained?ts=markdown) * [Understanding Broken Object Property Level Authorization](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#understanding?ts=markdown) * [How Broken Object Property Level Authorization Manifests in Real-World APIs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#how?ts=markdown) * [The Business Impact of Broken Object Property Level Authorization](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#business?ts=markdown) * [Identifying Broken Object Property Level Authorization in Your APIs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#identifying?ts=markdown) * [Preventing Broken Object Property Level Authorization: Best Practices](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#preventing?ts=markdown) * [Broken Object Property Level Authorization FAQs](https://www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization#faqs?ts=markdown) Broken object property level authorization ranks third on OWASP's API Security Top 10 for 2023, representing a critical gap in how APIs control access to individual data fields. APIs routinely grant access to entire objects while failing to restrict which properties users can read or modify. This guide examines how property-level authorization failures manifest in cloud environments, the business consequences of exploitation, detection methodologies, and implementation strategies for granular access controls across REST, GraphQL, and microservice architectures. ## API3:2023 - Broken Object Property Level Authorization Explained Property-level authorization governs which specific attributes within an object a user can access or modify. While object-level authorization determines whether you can interact with a user record, property-level authorization controls whether you can read the social security number field within that record or change the account balance attribute. Most APIs grant or deny access at the object level but fail to implement granular controls at the property level. A developer might verify a user has permission to retrieve their profile object but neglects to filter sensitive properties like internal identifiers, salary details, or administrative flags before sending the response. Similarly, an API might validate object-level write permissions but allows clients to modify any property submitted in the request payload. ### The Dual Vulnerability Surface OWASP's API3:2023 encompasses two distinct attack vectors that share a common root cause. The first involves unauthorized reading of sensitive properties. REST APIs commonly serialize entire objects using methods like to\_json() or automatic ORM mappings, exposing internal fields such as is\_admin, credit\_score, or internal\_notes that developers never intended for client consumption. GraphQL amplifies the security risk by allowing clients to explicitly request any field unless the schema implementation actively restricts field-level access. The second vector [API security](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security?ts=markdown) must address involves unauthorized modification of object properties. Frameworks often bind HTTP request parameters directly to object attributes through mass assignment features. An attacker sends additional parameters beyond the legitimate form fields, injecting values for properties like account\_status, discount\_rate, or approval\_required. The API processes the entire payload without validating which properties the current user should control. ### Evolution from Legacy Risks In API3:2023, OWASP merged two previously separate vulnerabilities. 1. Excessive data exposure described the read-side problem where APIs leaked sensitive information through overly verbose responses. 2. Mass assignment referred to the write-side issue where APIs accepted unauthorized property modifications through parameter injection. Combining these risks reflects the technical reality that both stem from identical authorization gaps. Development teams implementing object-level checks assume the work is complete. Property-level enforcement requires additional logic at every endpoint, examining each field individually rather than applying blanket permissions to entire resources. The cognitive load increases substantially when APIs expose dozens of properties across hundreds of endpoints. [Cloud-native architectures](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-native?ts=markdown) compound the problem. [Microservices](https://www.paloaltonetworks.com/cyberpedia/what-are-microservices?ts=markdown) frequently share data models across service boundaries, and a property considered safe in one context becomes sensitive when exposed through a different [API gateway](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway?ts=markdown). Autogenerated API documentation tools display all available properties, inadvertently creating reconnaissance maps for attackers. The velocity of modern development cycles means property-level authorization rules rarely receive the same scrutiny as authentication or network security controls. ## Understanding Broken Object Property Level Authorization Object properties represent individual fields or attributes within a data structure. A user object might contain username, email, password\_hash, account\_balance, is\_verified, and role. Each property holds distinct information requiring separate access controls based on context and user privileges. ### Serialization Creates Exposure Points APIs transform internal objects into transmittable formats through serialization. Framework defaults typically serialize every accessible property unless developers explicitly configure filters. An ORM query like User.find(id) returns a complete object with all database columns. When passed to response.json(user), the serializer converts everything into the HTTP response body. Java's Jackson library, Python's Marshmallow, and Node's JSON.stringify() all exhibit this behavior. GraphQL schemas define available fields but rely on resolver-level authorization to restrict access. Without field-level permissions, clients can query any property defined in the schema. Deserialization presents the inverse problem. Web frameworks bind incoming JSON or form data directly to object attributes through parameter binding mechanisms. Rails' strong parameters, Laravel's mass assignment protection, and Spring's @ModelAttribute all attempt to solve the binding problem, but developers must actively configure which properties accept input. Default configurations often permit any submitted field to update the corresponding object property. ### Granular Authorization Requirements Least privilege demands that users access only the specific properties necessary for their role and context. An employee viewing their own profile needs name, email, and department but shouldn't see salary\_band, performance\_rating, or termination\_eligibility. A manager reviewing team members requires different property access than HR administrators processing payroll. Authorization systems traditionally operate at the resource level, checking whether a user can GET /api/users/123. Property-level authorization extends this model to individual fields: can the current user read users/123/salary? Can they modify users/123/role? Each property becomes an authorization decision point. Cloud APIs compound the complexity because properties serve multiple consumers. Microservice A might legitimately access internal identifiers for cross-service calls while the public API gateway must strip those same fields from client responses. The authorization context shifts based on the caller's identity, transport channel, and intended use of the data. ## How Broken Object Property Level Authorization Manifests in Real-World APIs API3:2023 vulnerabilities appear through two distinct attack patterns that exploit missing property-level controls. Developers implement object-level authorization but skip the granular inspection required for individual fields. ### Excessive Data Exposure Through Unfiltered Serialization APIs leak sensitive properties when serialization methods convert entire objects into response payloads without field filtering. A social platform API returns user profiles through GET /api/users/{id}. The endpoint retrieves the complete User object from the database and passes it to a serializer. Ruby on Rails developers call render json: @user, Python FastAPI returns UserModel directly, and Node Express uses res.json(user). Each framework serializes every property accessible on the object. The response includes intended fields like username and bio alongside sensitive properties like email\_verification\_token, password\_reset\_timestamp, internal\_user\_id, and account\_flags. A dating application demonstrates the risk when users report inappropriate behavior. The mutation response returns the reported user's profile, exposing fullName and recentLocation coordinates. The reporting user gains access to geographic tracking data and identity information that should remain private. GraphQL amplifies the exposure because clients explicitly request fields in their queries. Developers define comprehensive schemas with every database column mapped to a GraphQL type. Without field-level authorization in resolvers, clients query sensitive properties by reading the schema documentation. A query requesting user { id username salary creditScore } succeeds because the schema defines all four fields, even though only id and username should be publicly accessible. ### Unauthorized Property Modification Through Mass Assignment Web frameworks bind HTTP request parameters to object properties automatically. Rails accepts nested attributes, Laravel fills model properties from request data, and Spring Boot maps JSON to entity objects. Attackers exploit the behavior by injecting unauthorized parameters into legitimate requests. A rental marketplace requires hosts to approve guest bookings. The approval endpoint accepts POST /api/bookings/{id}/approve with a payload containing approved: true and comment: "Check-in after 3pm". An attacker replays the request with an additional property: total\_stay\_price: 1000000. The framework binds the malicious parameter to the Booking object's price field. Without property-level authorization, the database update modifies both legitimate and injected fields. Content moderation systems exhibit similar vulnerabilities. A video platform allows creators to edit metadata through PUT /api/videos/{id} with fields like title and description. An attacker includes content\_status: "approved" or blocked: false in the request body. The API updates the moderation flag because the framework binds all submitted parameters to the Video object's properties. Role elevation attacks follow the same pattern when attackers inject is\_admin: true or account\_type: "premium" into profile update requests. ## The Business Impact of Broken Object Property Level Authorization Property-level authorization failures translate directly into quantifiable business harm. Organizations face regulatory penalties, financial losses, and reputational damage when APIs expose or accept unauthorized property modifications. ### Privacy Violations and Regulatory Exposure Leaked object properties frequently contain personal identifiers governed by data protection regulations. APIs exposing social security numbers, medical records, or location coordinates violate [GDPR's](https://www.paloaltonetworks.com/cyberpedia/gdpr-compliance?ts=markdown) data minimization principle. Each unauthorized property disclosure constitutes a separate processing violation under Article 5. [CCPA](https://www.paloaltonetworks.com/cyberpedia/ccpa?ts=markdown) imposes penalties when APIs knowingly expose consumer data without proper authorization. [PCI DSS](https://www.paloaltonetworks.com/cyberpedia/pci-dss?ts=markdown) failures occur when payment APIs leak cardholder data beyond the minimum required fields. Acquiring banks revoke merchant accounts when card metadata, CVV codes, or track data appear in API responses. Compliance frameworks demand field-level [access controls](https://www.paloaltonetworks.com/cyberpedia/access-control?ts=markdown) with audit trails proving which users accessed sensitive properties. ### Financial Fraud Through Property Manipulation Mass assignment vulnerabilities enable direct monetary theft. E-commerce platforms suffer losses when attackers inject discount\_percentage: 100 or price: 0.01 into checkout requests. Marketplace platforms lose revenue when transaction fees are modified through commission\_rate parameter injection. Financial services APIs face fraud when attackers alter account\_balance, credit\_limit, or transaction\_amount properties. Insurance claim processing APIs demonstrate the risk when attackers modify claim\_status, payout\_amount, or approval\_override flags. Healthcare billing systems lose revenue when procedure codes, patient responsibility amounts, or insurance coverage percentages get manipulated through unvalidated property updates. ### Content Integrity and Platform Trust Content moderation bypass through property manipulation destroys platform trust. Social networks struggle with policy violations when creators unblock flagged content by modifying moderation\_status or violation\_flags. Streaming platforms face copyright claims when users inject content\_rights: verified into upload requests. Marketplaces lose seller and buyer confidence when product ratings, verification badges, or featured listing status can be self-modified through API exploitation. Platform integrity depends on immutable properties remaining protected from user manipulation. ## Identifying Broken Object Property Level Authorization in Your APIs Security teams must actively probe APIs for property-level authorization gaps using both manual inspection and automated tooling. Detection requires examining response payloads for unauthorized data exposure and testing whether APIs accept modifications to protected properties. ### Response Analysis for Unauthorized Property Exposure Start by capturing API responses across different user contexts. Authenticate as a low-privilege user and invoke endpoints that return objects. Document every property in the response payload. Repeat the same requests using administrative credentials or different user roles. Properties appearing consistently across all roles warrant scrutiny. Compare the response schema against intended data access policies. Look for database column names, internal identifiers, timestamps, status flags, and computed fields. Properties like created\_by\_user\_id, internal\_notes, last\_modified\_timestamp, or is\_verified often indicate implementation details rather than user-facing data. GraphQL introspection queries reveal the complete schema with \_\_schema and \_\_type queries, exposing every field developers defined. Proxy tools like Burp Suite or OWASP ZAP intercept API traffic and highlight response differences between user sessions. Security testers examine JSON responses for nested objects containing sensitive properties. A user profile might expose address.latitude, payment\_methods.last\_four, or preferences.internal\_flags deeper in the object hierarchy. Array responses amplify the risk when each list item contains unnecessary properties multiplied across hundreds of records. ### Parameter Injection Testing for Mass Assignment Legitimate API requests establish a baseline of expected properties. An account update accepts email and display\_name in the request body. Testers replay the request while injecting additional properties systematically. Add is\_admin: true, account\_balance: 999999, subscription\_tier: premium, or approval\_status: approved to the payload. Monitor response codes, error messages, and subsequent state changes. A 200 response with updated data confirms that the API accepted the malicious property. Verify exploitation by retrieving the modified object or observing privilege escalation. Role-based testing requires accounts at multiple permission levels. Low-privilege users attempt to modify properties that should require administrative access. Read-only fields present specific targets. Properties like created\_at, user\_id, total\_orders, or reputation\_score should resist modification attempts. Send PATCH or PUT requests containing these fields with altered values. APIs vulnerable to mass assignment update read-only properties despite business logic requirements for immutability. ### Automated Detection Through Schema Analysis API documentation tools expose property catalogs for systematic testing. OpenAPI specifications list every request and response property with data types. Automated scanners compare specification schemas against runtime responses, flagging discrepancies. Fuzzing frameworks inject randomized properties into requests while monitoring for successful bindings. Burp's Intruder module iterates through common property names like admin, role, status, price, approved across all API endpoints. Response size changes or status code variations indicate accepted parameters. Property enumeration discovers hidden fields through systematic testing. GraphQL field suggestions expose properties when queries contain typos. REST APIs leak property names through error messages showing rejected fields. Diff analysis between API versions reveals newly added properties requiring authorization review. ## Preventing Broken Object Property Level Authorization: Best Practices Property-level authorization demands intentional controls at each API layer. Security teams must enforce granular restrictions for both data retrieval and modification operations rather than relying on framework defaults. ### Restricting Response Data Through Explicit Field Selection Abandon automatic object serialization in favor of manual property enumeration. Define return values field by field rather than converting entire objects. Python FastAPI responses should specify UserPublicSchema with named attributes instead of passing raw SQLAlchemy models. Node.js endpoints construct response objects property by property: { userId: user.id, name: user.displayName, joinDate: user.createdAt }. Build presentation layer objects specifically for API consumption. Internal User entities contain authentication tokens, encrypted passwords, and administrative metadata. External representations expose only client-relevant attributes. Map internal objects to external contracts through transformation functions that evaluate caller permissions before adding each field. GraphQL requires resolver-level inspection for every requested field. Wrap field resolvers with authorization checks verifying that the requesting identity has read access. A salary field resolver queries permission rules before returning values. Unauthorized requests receive null or throw field-level errors rather than exposing protected data. Validation layers inspect outbound payloads against declared contracts. Define expected response structures through JSON Schema, OpenAPI specifications, or type definitions. Compare serialized output against contracts before transmission. Mismatches indicate leaked properties from configuration drift or unauthorized access paths. ### Blocking Unauthorized Modifications Through Input Control Explicitly enumerate acceptable input parameters for every mutation endpoint. Frameworks offer filtering mechanisms but require active configuration. Define permitted fields through decorator patterns, configuration arrays, or validation classes. Reject HTTP requests containing undeclared parameters rather than silently ignoring extras. Create dedicated request classes divorced from persistence models. Profile update operations accept ProfileUpdateRequest structures defining modifiable attributes. Controller logic extracts values from request objects and applies changes to domain entities through dedicated setter methods. Separation prevents direct parameter binding to database-mapped objects. Authorization checks precede property mutations. Evaluate whether the authenticated principal holds modification rights for each submitted field. Price updates require financial permissions, while profile pictures need only content management access. Implement attribute-based access control, evaluating user context against property sensitivity classifications. ### Applying Contextual Response Filtering Tailor property exposure to operational requirements and consumer trust levels. Mobile applications receive condensed profiles while administrative dashboards access extended attributes. Service-to-service communication includes internal identifiers unavailable to public consumers. The authorization context determines field inclusion rather than returning maximum data to all requesters. ## Broken Object Property Level Authorization FAQs ### What is attribute-based access control (ABAC)? ABAC evaluates access decisions using attributes from users, resources, and environmental context rather than static role assignments. Policies combine user department, data sensitivity classification, request time, and network origin to determine permissions. ABAC enables dynamic property-level authorization where field access varies based on requester attributes and operational conditions. ### What is field-level encryption? Field-level encryption protects individual object properties through cryptographic isolation. Sensitive attributes like social security numbers or payment credentials receive separate encryption keys. Applications decrypt only authorized fields based on user permissions. Encrypted properties remain protected even when entire objects get exposed through serialization errors or authorization bypasses. ### What is property sensitivity classification? Property sensitivity classification assigns risk levels to individual object attributes based on regulatory requirements and business impact. Classifications like public, internal, confidential, and restricted guide authorization decisions. Payment card numbers receive higher sensitivity ratings than display names. Classification metadata drives automated access controls and audit logging requirements. ### What is an authorization policy engine? Authorization policy engines centralize access control logic through declarative rule sets external to application code. Policies define which users can read or modify specific object properties under various conditions. Engines evaluate policies at runtime, returning permit or deny decisions. Centralized policy management ensures consistent authorization across distributed microservices. ### What are projection queries? Projection queries retrieve specific object properties from data stores rather than fetching complete records. Database queries explicitly list required columns instead of using SELECT asterisk. GraphQL queries name desired fields. Projections minimize data exposure by loading only authorized attributes into application memory before serialization. ### What is contextual data filtering? Contextual data filtering adjusts response properties based on requester identity, client type, and operational scenario. Administrative dashboards receive extended attributes while mobile applications get condensed views. Internal service requests access system metadata unavailable to public consumers. Authorization context determines which properties appear in serialized output. Related content [Secure Your Application Programming Interfaces (APIs) API security is critical for application protection. Gain complete visibility, protect against threats, and eliminate blind spots with our tipsheet.](https://www.paloaltonetworks.com/resources/datasheets/tip-sheet-secure-your-apis?ts=markdown) [Securing the API Attack Surface In partnership with the ESG research team, we surveyed IT, cybersecurity and application development professionals to uncover the latest trends in API security.](https://www.paloaltonetworks.com/resources/research/api-security-statistics-report?ts=markdown) [API Security API security involves real-time protection against OWASP Top 10 attacks, DoS, and bot attacks, including SQL injection and cross-site scripting.](https://www.paloaltonetworks.com/cortex/cloud/api-security?ts=markdown) [Web Application and API Security | WAAS Discover Cortex Cloud's WAAS module and automatically detect and protect your microservices-based web applications and APIs.](https://www.paloaltonetworks.com/cortex/cloud/web-app-api-security?ts=markdown) ![Share page on facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/facebook-circular-icon.svg) ![Share page on linkedin](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/linkedin-circular-icon.svg) [![Share page by an email](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/email-circular-icon.svg)](mailto:?subject=What%20Is%20Broken%20Object%20Property%20Level%20Authorization%3F&body=Broken%20object%20property%20level%20authorization%3A%20Learn%20how%20APIs%20expose%20sensitive%20data%20and%20accept%20unauthorized%20property%20modifications%20and%20how%20you%20can%20prevent%20it.%20at%20https%3A//www.paloaltonetworks.com/cyberpedia/broken-object-property-level-authorization) Back to Top [Previous](https://www.paloaltonetworks.com/cyberpedia/unrestricted-access-sensitive-business-flows?ts=markdown) What Is Unrestricted Access to Sensitive Business Flows? [Next](https://www.paloaltonetworks.com/cyberpedia/cloud-api-security-strategy?ts=markdown) Cloud API Security: Strategy for the DevOps Era {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language