A REST API for a hospital returns GET /patients and lists ALL patients in the database for any authenticated user. A ward clerk can see ICU patients. Which REST API security principle is violated?

• A.Broken authentication (OWASP API2): the API does not verify the identity of the caller before listing patients. Each ward clerk should only receive a token with a shorter lifetime than a physician's token or an administrator's token
• B.Object-level authorization (IDOR / OWASP API1): the API does not restrict the data to only what the requesting user is authorized to access. Each user should only see data within their scope of care
• C.Unrestricted resource consumption (OWASP API4): the API returns an unbounded list with no page size limit. Each endpoint should only return a bounded page of records with a cursor token for the next page of the list
• D.Security misconfiguration (OWASP API8): the API runs with debug flags enabled in production. Each deployment should only expose the production settings to the clerks