What do "Protected Web API" refer in Microsoft Graph SSO Authentication Flow

Question

 

We are building a web-based, JavaScript Outlook Add-In which is required to call Microsoft Graph APIs to access the Outlook's user's emails and attachments.

The authentication process is being implemented using Single Sign-On (SSO) as outlined in the Microsoft documentation below:

Authorize to Microsoft Graph with SSO - Office Add-ins | Microsoft Learn

For the server-side code of the Office Add-In, I am referring to the documentation on:
Acquiring tokens for a web app that calls a web API on behalf of a user, and I need some clarification regarding the phrase "calls a protected web API."

What exactly does "protected web API" mean in this context?