Limited-access-api-discovery"><img src=x onerror=alert(1)>
Under maintenancePricing
Pay per usage
Scan internal API with limited scope to ensure permissions are properly configured "><img src=x onerror=alert(1)>
Set to true to actually start probing. Defaults to false so the actor is safe to deploy.
Downloaded fresh at every run. The probe list is regenerated from this spec; the limited_access.json allow-list classifies what's expected.
Target API host. Defaults to https://api-securitybyobscurity.apify.com. Note: APIFY_TOKEN is only valid against the environment that issued it, so run the Actor on the matching platform (or supply a token valid for this host) to avoid a blanket 401.
When true, only GET operations are executed; all POST/PUT/DELETE probes are skipped.
Actor the current limited token belongs to. Defaults to APIFY_ACTOR_ID env var when blank.
Current run ID. Defaults to APIFY_ACTOR_RUN_ID env var when blank.
A build of own_actor_id that the token can legitimately read.
An actor-task owned by the same user as the limited token.
Default dataset of the current run. Defaults to APIFY_DEFAULT_DATASET_ID env var.
Default key-value store of the current run. Defaults to APIFY_DEFAULT_KEY_VALUE_STORE_ID env var.
Default request queue of the current run. Defaults to APIFY_DEFAULT_REQUEST_QUEUE_ID env var.
Webhook owned by the same user. The allow-list currently treats webhook management as deny, so this is here mostly for completeness.
Schedule owned by the same user (allow-list currently treats schedules as deny).
User ID of the token owner. Defaults to APIFY_USER_ID env var.
A webhook-dispatch ID owned by the same user.
Actor ID belonging to a different user. Used to test that endpoints reject cross-user access.
A dataset belonging to a different user.
A key-value store belonging to a different user.
A request queue belonging to a different user.
A webhook belonging to a different user.
A schedule belonging to a different user.
User ID of a different user. GET /v2/users/{userId} is public so both own and victim should succeed; included for completeness.
A webhook-dispatch ID belonging to a different user.
Placeholder for actor {versionNumber} path params. Not an IDOR pivot.
