WordPress REST API: Restrict access to the media endpoint to only authenticated users

rest-api-restrict-media-endpoint.php

<?php

// restrict access to the media endpoint
add_action( 'init', function() {

	// _add_extra_api_post_type_arguments() in the WP REST API sets this to true
	// we'll turn it off for unauthenticated requests

	global $wp_post_types;
	$wp_post_types['attachment']->show_in_rest = is_user_logged_in();

}, 20 );