Last reviewed 10 September 2026 · we sell GuardAPI
GuardAPI vs writing the matrix yourself
The BOLA algorithm is not a secret. In 2026 you can download AuthzTrace, overstep, or AuthProbe and fail a build when identity B reads identity A’s object. This page exists so a Staff Engineer can pick a tool without a feature grid of vapor. We are not reviewing APIsec or Escape here — we have not run them hands-on for this note.
| Tool | You write | Fail rule | CI | Price |
|---|---|---|---|---|
| GuardAPI v6 | OpenAPI path + two Bearer tokens | Fail only if B’s 2xx body contains A’s id or markers. 200 without evidence = inconclusive (does not block). Bad tokens = error. | Action GuardAPI/ghost-api@v6, SARIF, dashboard ingest | Trial 14d / 1 repo. Team $199/mo / 3 repos. Scale $499/mo. |
| AuthzTrace | Authorization contract (owners, actors, expected access) | Contract expansion across objects; denied bodies that still leak markers can fail. Alpha. | Composite Action, SARIF, JUnit | OSS |
| overstep | Allow/deny matrix (HTTP and MCP) | Negative tests that succeed are vulns; confidence if victim data came back. Broader than BOLA (BFLA, BOPLA). | Example workflows, SARIF, Docker | OSS |
| AuthProbe | OpenAPI + identities (closest OSS twin of our graph) | Multi-identity probes; configurable fail-on severity; JUnit | CLI in CI | OSS (Apache-2) |
| DIY Playwright / curl | Every route you remember to test | Whatever you assert | Whatever you wire | Your time |
When OSS is the better choice
- You will maintain a full allow/deny matrix, including BFLA or MCP (overstep).
- You need nested parent-child ownership or custom headers AuthzTrace already models and we do not.
- You cannot send even a redacted verdict to a SaaS.
- You enjoy owning the runner code. The algorithm is not the hard part; keeping fixtures alive is.
When GuardAPI is the better choice
- You have OpenAPI + staging + two users and want a check this afternoon.
- You want a fail rule that will not block merge on empty 200s.
- You want SARIF plus a dashboard row without writing
authztrace.yaml. - You will not buy Escape ($50k+/yr on AWS Marketplace) or APIsec ($690+/mo per 100 endpoints) for this one class.
GuardAPI v6 is GET-only, cap 40 pairs, no GraphQL. If those limits are deal-breakers, use OSS or a platform. Do not expect us to pretend otherwise.