https://kevinsec.io/blog/api-bola-explained-with-realistic-examples/