In reply to Chris.

This should 100% be in admin as a setting. "enable REST endpoints for authenticated users, only". Why does it have to be any more difficult than that?