We want to expose a process using Web API. What type of security and authenticat

For a process exposed using Web API, the basic authentication is used. So, that is the only authentication. You can however use queryParams for your Web API. So when the user passes queryParams in the HTTP request, you can check if the user should be returned a response based on your criteria. All the functions/expressions used in the Web API have same security behavior as specified by Appian (eg: if a user does not have view privileges on a entity, it won't return the data in queryEntity)

Also Appian on-cloud will be HTTPS enabled. So all the HTTP requests to the Web API will be on HTTPS