# GuardAPI

> GuardAPI is a GET-only Broken Object Level Authorization (BOLA/IDOR) merge gate for multi-tenant APIs. A GitHub Action parses an OpenAPI spec, pairs GET collection and GET item routes (max 40), lists as tenant A, then GETs the same object as tenant B. The job fails only if B’s HTTP 2xx body contains A’s id or unique markers. 401/403/404 without leaked fields pass. 200 without owner evidence is inconclusive and does not block merge. Invalid tokens error. Tokens never leave GitHub Secrets.

v6 shipped 10 September 2026. It is not an LLM OpenAPI grader, not a public URL scanner, and not SOC 2 certified.

## Product

- [Home](https://guard-api.com/): Fail the PR when tenant B can read tenant A
- [Install docs](https://guard-api.com/docs): Secrets, OpenAPI rules, verdicts, troubleshooting
- [Pricing](https://guard-api.com/pricing): Trial 14 days / 1 repo; Team $199/mo / 3 repos; Scale $499/mo
- [How to fail a PR when tenant B can read tenant A](https://guard-api.com/bola-in-ci)
- [vs OSS testers](https://guard-api.com/compare/oss): AuthzTrace, overstep, AuthProbe, DIY
- [About / citation](https://guard-api.com/about)

## Action

- GitHub: GuardAPI/ghost-api@v6 (historical repo name)
- Tokens: GitHub Secrets only
- Engine location: customer runner, not a hosted scanner

## Guides

- [Index](https://guard-api.com/guides): generated remediation sketches; product is BOLA-only