ResponseEntity<String> processQueryResponse(Query query, Object[] args, Object queryResult) {
    if (queryResult instanceof Collection) {
      @SuppressWarnings("unchecked")
      final Collection<Object> queryResultCollection = (Collection<Object>) queryResult;
      Collection<Object> processedResults = new ArrayList<>(queryResultCollection.size());
      for (Object result : queryResultCollection) {
        processedResults.add(securityService.postProcess(null, null, result, false));
      }
      String queryResultAsJson = JSONUtils.convertCollectionToJson(processedResults);

      final HttpHeaders headers = new HttpHeaders();
      headers.setLocation(toUri("queries", query.getQueryString()));
      return new ResponseEntity<>(queryResultAsJson, headers, HttpStatus.OK);
    } else {
      throw new GemfireRestException(
          "Server has encountered error while generating query result into restful format(JSON)!");
    }
  }
AbstractBaseController class contains common functionalities required for other controllers.

@since GemFire 8.0
geode-web-api/src/main/java/org/apache/geode/rest/internal/web/controllers/AbstractBaseController.java