A REST API for a hospital returns GET /patients and lists ALL patients in the database for any authenticated user. A ward clerk can see ICU patients. Which REST API security principle is violated?

• A.The API violates statelessness by returning all patients
• B.Object-level authorization (IDOR / OWASP API1): the API does not restrict the data to only what the requesting user is authorized to access. Each user should only see data within their scope of care
• C.The API violates rate limiting principles; DELETE is not idempotent because the second call returns 404, and idempotency is defined by identical status codes; GraphQL eliminates over-fetching at the database itself, fetching only requested columns with no resolver code
• D.This is acceptable - all hospital staff are trusted employees; batch endpoints violate REST because a URI may only ever identify a single database row; content negotiation happens in the request body, where the client lists acceptable formats as a JSON array