"APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface for Object Level Access Control issues. Object level authorization checks should be considered in every function that accesses a data source using an ID supplied by the user."
"APIs expose endpoints that handle object identifiers" — Every API has URLs that include IDs: /users/42, /orders/1042, /documents/9. Those IDs are the target.
"Wide attack surface" — There are a lot of these endpoints. Every single one is a potential door.
"Object level authorization checks should be considered in every function that accesses a data source using an ID supplied by the user" — Every time a user sends you an ID, you must verify they're allowed to access what that ID points to. Every time. Not sometimes. Every time.
Most developers check authentication — "Is this user logged in?" — but forget authorization — "Does this logged-in user own this specific record?" They're two different questions. BOLA is what happens when you only ask the first one.