many APIs are vulnerable to 'JSON Patch' where you have access to the op, you can add, remove, replace, move, copy

example :

{ 'op': 'replace', 'path': '/role', 'value': 'admin' },

more info :
datatracker.ietf.org/doc/html/rfc69…
jsonpatch.com

#BugBounty #bugbountytips