A retailer launches a limited-edition product — 5,000 units, one per customer. The website UI shows: “Limit: 1 per customer.” The UI enforces this by disabling the quantity selector above 1.
The purchase API endpoint accepts: product ID, quantity, payment token. The API does not enforce the quantity limit server-side — the limit was only in the UI. The API accepts any quantity value the client sends.
"quantity": 500. The API accepts it. 500 units are purchased in one transaction. The bot operator lists them on resale platforms within hours. This is the API3/BOPLA lesson applied to API6: UI limits are not API limits. The server must enforce the constraint — not the frontend.This scenario combines API3 (accepting a field value the server should control — quantity) with API6 (business flow abuse). The quantity limit is a business rule that must live in the API, not the UI. Both lessons apply simultaneously.