> For the complete documentation index, see [llms.txt](https://web-dev-guide.wishtack.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://web-dev-guide.wishtack.io/security/api-unauthorized-access-and-data-leak.md).

# API Unauthorized Access and Data Leak

The API should verify the permissions on the every resource and field.

```
POST /users/123456/
{ firstName: 'Foo', isAdmin: true }
```

The API should not leak confidential data. This often happens when using generic code.

```
GET /users/123456/
{ firstName: 'Foo', bankCard: { number: '...', ... } }
```