API Rate Limiting and Enumeration Weakness

```sql
-- Check for sequential ID usage in APIs
SELECT 
    table_name,
    column_name,
    data_type,
    column_default,
    extra
FROM information_schema.columns
WHERE table_schema = DATABASE()
AND column_name IN ('id', 'document_id', 'resource_id')
AND (data_type IN ('int', 'bigint')
     OR extra = 'auto_increment');

-- Look for missing API rate limiting tables
SELECT 
    NOT EXISTS (
        SELECT 1 FROM information_schema.tables
        WHERE table_schema = DATABASE()
        AND table_name IN ('api_rate_limits', 'rate_limit_buckets', 'api_throttle')
    ) as missing_rate_limiting;

-- Check for API access logging
SELECT 
    EXISTS (
        SELECT 1 FROM information_schema.tables
        WHERE table_schema = DATABASE()
        AND (table_name LIKE '%api%log%' 
           OR table_name LIKE '%access%log%')
    ) as has_api_logging;

-- Identify potential IDOR vulnerabilities
SELECT 
    t.table_name,
    kcu.column_name as id_column,
    CASE 
        WHEN NOT EXISTS (
            SELECT 1 FROM information_schema.columns
            WHERE table_schema = DATABASE()
            AND table_name = t.table_name
            AND column_name IN ('user_id', 'owner_id', 'created_by')
        ) THEN 'No ownership tracking - IDOR risk'
        ELSE 'Has ownership columns'
    END as idor_risk
FROM information_schema.tables t
JOIN information_schema.key_column_usage kcu 
    ON t.table_name = kcu.table_name
WHERE kcu.constraint_name = 'PRIMARY'
AND t.table_schema = DATABASE();
```

```sql
-- Check for sequential ID usage in APIs
SELECT 
    t.name as table_name,
    c.name as column_name,
    ty.name as data_type,
    c.is_identity
FROM sys.columns c
JOIN sys.tables t ON c.object_id = t.object_id
JOIN sys.types ty ON c.user_type_id = ty.user_type_id
WHERE c.name IN ('id', 'document_id', 'resource_id')
AND (ty.name IN ('int', 'bigint') OR c.is_identity = 1);

-- Look for missing API rate limiting tables
SELECT 
    CASE WHEN NOT EXISTS (
        SELECT 1 FROM sys.tables
        WHERE name IN ('api_rate_limits', 'rate_limit_buckets', 'api_throttle')
    ) THEN 1 ELSE 0 END as missing_rate_limiting;

-- Check for API access logging
SELECT 
    CASE WHEN EXISTS (
        SELECT 1 FROM sys.tables
        WHERE name LIKE '%api%log%' 
           OR name LIKE '%access%log%'
    ) THEN 1 ELSE 0 END as has_api_logging;

-- Identify potential IDOR vulnerabilities
SELECT 
    t.name as table_name,
    kc.name as id_column,
    CASE 
        WHEN NOT EXISTS (
            SELECT 1 FROM sys.columns
            WHERE object_id = t.object_id
            AND name IN ('user_id', 'owner_id', 'created_by')
        ) THEN 'No ownership tracking - IDOR risk'
        ELSE 'Has ownership columns'
    END as idor_risk
FROM sys.tables t
JOIN sys.indexes i ON t.object_id = i.object_id
JOIN sys.index_columns ic ON i.object_id = ic.object_id AND i.index_id = ic.index_id
JOIN sys.columns kc ON ic.object_id = kc.object_id AND ic.column_id = kc.column_id
WHERE i.is_primary_key = 1;