I have an api which has certain attributes including user id and api-token. I get the api token and user id when I login using verified user and I can use this api to submit attributes successfully but If I change the user id, it does not submit the api because api-token is different for that user id and I do not know it.
Developer says, it can't be done but I think there is a security flaw just I am not able to detect it.

How should I use regular expression extractor to pass the api-token field with different user id or if there is any other way to do this using jmeter.

Please help me.

Thank you.

For non-telepathic forum users can you please provide as much details as possible? The most complex authentication challenge I can imagine is OAuth and even if it is the case - it can still be worked around as it evidenced by How to Run Performance Tests on OAuth Secured Apps with JMeter article.

Same for SAML/SSO and simulating of the electronic digital signature (HASP)

So I suggest determining what authentication is being used and update your question as if it is possible to authenticate manually I believe it's possible to simulate it with JMeter.