REST authorization is the set of rules that decides which API endpoints, methods, and actions a user or session is allowed to access. It sits after authentication: the server first identifies who you are, then checks what that identity may do. In a REST API, these checks can be based on roles, ownership, scopes, tenant boundaries, or per-resource permissions.
It matters because broken authorization often turns a valid login into full compromise. If an application forgets to protect one route, trusts the wrong token claims, or checks permissions only on the front-end, an attacker can call sensitive endpoints directly. Defenders should verify authorization on every request, including alternate paths, forwarded requests, and custom handlers, so business logic never runs before the permission check.