Insecure Direct Object Reference (IDOR) and Broken Object Level Authorization (BOLA) are often used interchangeably, and for good reason: they describe the same underlying failure, a missing per-object authorization check, from two different vantage points.
A matter of emphasis
IDOR is the older, web-application-centric term. It emphasizes the symptom: a direct reference to an object (often in a URL or form field) that can be manipulated to access data belonging to someone else.
BOLA is the term popularized by the OWASP API Security project. It emphasizes the root cause: the authorization decision that should have been made at the object level but was not.
Practical guidance
In practice, treat them as synonyms when communicating risk, but prefer “BOLA” when discussing API endpoints and “IDOR” when discussing traditional web flows. Either way, the fix is identical: enforce object-level authorization on the server for every request.