Using Web API as a core system

The company where I'm working at, has a software system with two web applications, four desktop applications and a web API based on a SQL-database.

I implemented the API using WEB API 2.During load tests, I found that performance is excellent, even with lots of records we have. Accordingly, my company has asked me to design and implement a WEB API and an Authentication system for getting, processing, authenticating and responding all transactions from web, windows and Mobile apps.

Now here are the questions:

1- Is this the right way to use WEB APIs as the Core system and manage all transactions through it?

2- According to your experiences, does web API really have enough performance to act as a DATA ACCESS?

3- Does authenticating transactions through the web API have enough security?

4- If yes, now according to the Web API design patterns which layers are necessary in order to implement web or desktop applications? (Data access, Model, Service, View model, web, etc.)

Thank you in advance :)