Read the pages in order. The first builds an endpoint: the web event and its URL, the one checkbox that turns a job into an API, what a synchronous run cannot do, who the actions run as, and two worked endpoints, a lookup that answers JSON and a write that files a record. The second decides who may call it: authentication for your own servers, a signature check for a partner, and what to accept about anything a browser calls.
The endpoint is built from the same actions as any other job, so Guide 9 is the reference for each action and for reading a job run. Settle the credential question in Credentials and access before you tick the authentication setting.