Restrict access to Element API endpoint
Yes it is you can see here how to check permissions 

You can get the current user with 

$currentUser = craft()-&gt;userSession-getUser();


Then you can check the same conditions like in the example link. If the conditions are false you can return an empty array instead of your endpoints 

if(!$currentUser-&gt;isInGroup('groupHandle')) {
    return [];
} 


Please make sure to check if the current user is not null