public class Student
{
  public string Name { get; set; }
}

 [ApiController]
    public class TestController : ControllerBase
    {
        [HttpGet, Route("api/Test/GetString")]
        [SampleActionFilter]
        public ActionResult<Student> GetString(string name)
        {
            if(name.StartsWith("s"))
            {
                return Ok(new Student{ Name = $"This is data {name}" });
            }
            else
            {
                return Ok(new Student { Name = $"No Name" });
            }
        }
    }

 public class SampleActionFilterAttribute : TypeFilterAttribute
    {
        public SampleActionFilterAttribute() : 
        base(typeof(SampleActionFilterImpl))
        {
        }

    private class SampleActionFilterImpl : IActionFilter
    {
        public void OnActionExecuting(ActionExecutingContext context)
        {
        
            // perform some business logic work

        }

        public void OnActionExecuted(ActionExecutedContext context)
        {
            // perform some business logic work
            var myResult = (OkObjectResult)context.Result;

            //Add type checking here... sample code only
            //Modiy object values
            try
            {
                Student myVal = (Student)myResult.Value;
                myVal.Name = "Johnny";
            }
            catch { }
        }
    }
}

public override void OnActionExecuting(ActionExecutingContext context)
{
  context.Result = new UnauthorizedObjectResult("user is unauthorized");
}