wrapping ‘rest_api_init’ in ‘is_admin()’ function

Essentially, you shouldn’t wrap your REST route declarations inside is_admin() since WordPress will not load them (see @DarkNueron comment).

What you can do is pass a ‘permission_callback’ function to the register_rest_route function. If the function returns true, the request is allowed to continue; if false, an error is returned.

So you could do:

register_rest_route('your-namespace/v1', '/options/', [
   'methods'   => 'PATCH',
   'callback'  => [__CLASS__, 'update_option'],
   'permission_callback'   => function () {
        return current_user_can('manage_options');
   }
]);