Hello Team,
We are working on adding column permissions for tables where we don't want to the Authenticated user to have write and create access to some columns. But after creating some column permissions with only read access, we were able to call web API and create entry to the column which have only read access.
Our site is having Enhanced Data Model, where we were not able to add column permissions through web roles. But we have added the column permissions directly through column permission profile, where we added columns permissions, role access and also added "Authenticated Web Roles" in the web role section. But it is not working as expected and we are able to update the columns which is only having read access through web API.