Like MVC WebApi runs on the asynchronous ASP.NET pipeline, meaning execution timeout is unsupported.
In MVC I use the [AsyncTimeout] filter, WebApi does
[AsyncTimeout]
For each endpoint where you want a timeout, pipe a CancellationToken through, e.g.:
CancellationToken
[HttpGet] public Task GetAsync() { var tokenSource = new CancellationTokenSource(_timeoutInSec * 1000); return GetResponseAsync(tokenSource.Token); }