Chapter 9 of the book Modern Authentication with Azure Active Directory for Web Applications describes how to invoke and expose web API, protecting them with Azure AD.
You can find the latest official samples demonstrating those exact scenarios in https://azure.microsoft.com/en-us/resources/samples/?service=active-directory&term=web+api