Custom Authorization in Web Api 2

I'm a newbie in ASP.Net MVC. I'm currently working on a project where I need to create an authorization in api controller that depends on the users role, if it is active and if it has a permit on a certain module. I've been searching all around about custom authorize attribute but I still don't get it. Im sorry.

I also see the thing about policy is it ok to use it in api controller?

Thank you! Your help is greatly appreciated! :D