Customer would like to know if it is possible to cache API requests in Amazon CloudFront if the app cannot set cache-control headers

API requests are 'just' HTTP requests, so the documentation for CloudFront is applicable to all content, regardless as to whether it is an API, dynamically generated HTML, or static content.

You can configure CloudFront caching using MinTTL, MaxTTL (which will place a minimum/maximum limit provided by the origin) and DefaultTTL (which provides a cache TTL when the origin doesn't specify any). These are configured for each cache-behavior, and so it's the same for all URLs matching the bevhavior's path pattern. It also doesn't create or modify the cache-control headers that are passed to the client.

If you need more specific control over of caching (for instance, it is based on a cookie) or you want to actually set the cache=-control header for clients (so they are able to cache downstream) then you could use origin-facing Lambda@Edge to set cache-control before it returns through the cache.