What's the best option for preventing API data leakage and object-level access issues?

The best overall option is server-side authorization checks on every object/request, using a deny-by-default policy.

In practice, that means:

• Authenticate the user
• Authorize access to the specific object/resource
• Enforce checks on the server for every API call
• Never trust client-side IDs, filters, or hidden UI controls
• Return only the fields the caller is allowed to see to avoid data leakage

This is commonly referred to as Object-Level Authorization / BOLA / IDOR prevention.

Best practices

• Use resource-scoped access control (e.g., user can only access objects in their tenant/org)
• Validate that the requested object belongs to the authenticated user’s allowed scope
• Apply field-level filtering/masking for sensitive data
• Use least privilege roles and permissions
• Add centralized authorization middleware so checks are consistent
• Log and monitor access denials and suspicious object access attempts

If you want the single “best option”

Implement robust server-side object-level authorization (BOLA/IDOR protection) with least-privilege access control.

If you want, I can also give you:

1. a quick checklist,
2. OWASP API Security guidance, or
3. example code in your stack.