I am working on an ASP.NET Core web application with Angular as the frontend. The API returns all responses in JSON format, and I need to handle file downloads securely.

My requirements are:

The files are sensitive and must not be accessible via static file hosting.
Access to files should be restricted based on user permissions.
The API may need to return multiple files in a single response.
Files can be of various formats, and the frontend should handle them appropriately (e.g., display or download).

Problem:
What is the best practice for securely including file data (or file links) in a JSON response while ensuring:

Access is controlled by the API?
Multiple files can be returned in a single response?
Direct exposure of static file URLs is avoided?
I am looking for examples, best practices, or recommendations for achieving this in ASP.NET Core.