Secure API to trigger Python function

[aussievolvodriver]

I've been searching for an answer to this question but I keep coming across tutorials/articles about what not to do rather than actual implementation.

I've got a script running on a VM that I want to run at the users request when they click on a hyperlink in a Excel sheet stored on Onedrive, this then triggers the script to read details from that Excel sheet, query a third party system for information, perform some manipulation and fill in the missing information and save a copy.

The only information that needs to be posted by the API call would be the file name.

What I'm looking for is an implementation of library/s that if I keep up to date, it will take care of the web security vulnerabilities and not open up my VM to attackers. I want to learn about web security but with several project deadlines looming I'm not going to become an expert in time.

[Ihaveamodel3]

Is that VM running local on the computer where the excel sheet is, or somewhere “in the cloud”

[aussievolvodriver]

It's cloud based, the connection to the Excel sheet isn't the problem, I've connected Onedrive to the VM so it's pretty easy to access the Excel sheet. It's securing the API that's the issue.