Log every API request that includes an object ID. Set up alerts for patterns that indicate enumeration: the same token requesting 50+ different object IDs in a short window, sequential IDs being requested in order, or a high rate of 404 responses from the same source.

Real users don't request 10,000 order IDs in sequence. That pattern is an attack in progress.

T-Mobile's breach ran undetected for six weeks because nobody noticed 37 million queries coming from an unusual source. Monitoring would have flagged it on day one — or hour one. The attacker was walking through an unlocked door repeatedly. A camera would have caught them immediately.

Same token, many different object IDs in a short time. Sequential IDs being requested in order (1001, 1002, 1003...). Unusual spikes in requests to endpoints that return user data. High 404 rates from a single source — even 404s mean they're probing.

Monitoring detects attacks — it doesn't prevent them. If MIT 01 is missing, an attacker who flies under the rate limit can still exfiltrate data slowly without triggering alerts. Detection is not a substitute for proper authorization checks.