How Can I keep password protected posts in the json requests but not on frontend queries?

I sort of solved this by using this:

function ar6_password_post_filter( $where="" ) {

   if (!is_single() && !current_user_can('edit_private_posts') && !is_admin()) {

        $where .= " AND post_password = ''";

    }

    return $where;

}

add_filter( 'posts_where', 'ar6_password_post_filter' );

This allows user roles of administrator and editor to still see the password protected posts on the front end of the site but hides them from anyone else.

However, I would still like to hide password protected posts from admins on the front end but but not in the json api – so if anyone has any suggestions, I’d appreciate it.