# Ledgerly API — Broken Object Authorization (CTF challenge)

> The Ledgerly REST API lets customers view their invoices. Log in as the demo customer (alice / alice-pass) to get a bearer token.

Canonical: https://codelivly.com/ctf/challenges/ledgerly-bola

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Medium |
| Points | 500 |
| Estimated time | 20 min |
| Type | Live instance |
| Solves | 18 |
| Author | Codelivly |

The Ledgerly REST API lets customers view their invoices. Log in as the demo customer (alice / alice-pass) to get a bearer token. The API checks that you're logged in — but not that an invoice is actually yours. Read another customer's invoice: the executive invoice (id 1001) holds the flag.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)