Sure, you can tap into the dra_allow_rest_api filter. It currently returns true/false based on whether the user is logged in or not, but you could add some role-checking into that logic with the filter.

If TRUE is returned, then the plugin does nothing and all endpoints are available. If FALSE is returned, then the plugin performs its normal function. There is not currently a way to create custom endpoint whitelists for individual roles, however.

Cheers @dleeward, glad you found a solution 🙂