Use Managed Identity RBAC to Auth call between APIs in Same Tenant

Question

I'm new to Azure, and trying to use AAD Managed Identity to authenticate and authorize an API call from one API in our tenant to another in the same tenant. I understand how to create the managed identity, how to assign that identity to the calling app, but I am struggling to understand what IAM role (RBAC) I should assign to the identity inside my API that is being called. I know once I select the right role, I can select the manged identity as the user that needs the role, but what role will function as authN/authZ for the API?

Here are the steps as I understand it.

1. Create Managed Identity (Got it)
2. Add managed Identity as User-Assigned Identity to API application inside my tenant which is going to call the other API [API A] (No Problem)
3. Add IAM Role to API being called [API B] (This is the part I'm struggling with)
4. Add Managed Identity to RBAC Role created in 3 (This seems straightforward)

All the RBAC descriptions I have found to this point have to do with managing access to data... (blob storage, etc) but I want to use this to authenticate an API which is in an Azure App Service. What kind of role needs to be added to API B so that an API with the managed Identity assigned can hit the endpoints? Thanks!