Broken Object Level Authorization, or BOLA, is the top API security threat on the OWASP API Security Top 10. It occurs when an attacker can successfully make a request for a data object that should be restricted.