Presently in Joomla! 3 you cannot do that. Although TechJoomla have an API that you could use. https://techjoomla.com/rest-api-for-joomla
In Joomla! 4 you can use the inbuilt API as seen on this video: https://www.youtube.com/watch?v=lT9qodsvfZg
I gave a bit of a fuller answer on another post:
Crawling Joomla websites without parsing website's html
If your js is attached to a joomla page then you can get your users to login to joomla in the usual way. Then when your js executes an ajax call to the server, because the browser sends the session cookie in the http request, joomla knows if the http request is associated with a logged-in user. So inside your server code handling the ajax request you can do
See the docs for controller task - Model View Controller. Since you want to make it accessible to registered users and not to the public, you can simply check the user and return if your checks do not pass. You can see the getUser method documentation here - Accessing Current User Object
There are a few existing places to get an API for Joomla! 3.
Or in Joomla! 4 is a full API