This stops the notices from filling up your log file but hides a security threat. Anyone can create and delete brands within your database without API keys or being logged into the site. It may be possible to leverage this for stored XSS attacks or other injection attacks.
I’m opening a PR with the developer since no one has yet.
For the READABLE endpoint you can use the suggested permission_callback but for the CREATABLE and DELETABLE I would use something like the following instead:
'permission_callback' => function() {
return current_user_can( 'manage_options' );
},
