Example of security config for a Spring-based RESTful application, see more in https://blog.gypsyengineer.com/en/security/tips-configuring-security-rest-api-spring.html

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.rememberMe().disable();
        http.authorizeRequests()
                .antMatchers("/api/foo").hasRole("bar")
                .antMatchers("/api/bat").hasRole("foo")
                .anyRequest().authenticated()
                .anyRequest().denyAll();
        // ...
    }
}