How to make a plugin api route have permission?

How to make a plugin api route have permission?