I would like to create an API using Nginx (on Ubuntu server) that is able to run processes (execute commands) but www-data is not a user that has access to the data these processes will work on. What is the usual way to do this without compromising security. In other words, how can I make the API execute commands as another user?
www-data is just the user that runs the NGINX process by default, I assume your API is running behind NGINX, then your API would execute as www-data. In order to solve what I assume is a permission problem you are having when testing you need to change the permissions of your data (if local) to allow www-data user and/or group to read/write or creating a new user for NGINX to run.
A few pointers when working with an NGINX:
Don't give root access to the user running your web server, because then your web application would have root access over your system, opening up unnecessary vulnerabilities.
Don't make your data public (open permissions for all users) but restrict them to the owner and specific users that will be accessing them, even if you think your server is secured.
If this is not what you are looking for, please elaborate to get better and more accurate answers.
Edit: realised that I never gave you the commands to switch user:
chmod 500 file1 file2 file3 chmod -R 500 directory1/ chown www-data:www-data file1 file2 file3 chown -R www:data:www-data directory1
Should get you started!