I have a small external app which is communicating with a wordpress custom REST API endpoint, in the meaning is requesting some data aggregation from web but will never push back data to wordpress DB. Therefor I want to have some users who can access this endpoint through JWT Authentication but the role capabilities should be reduced just to this task. The users from this role should be not capable to log in to the Wordpress backend and do editorial tasks. How would I go for?
From the codex I know that I can create custom roles with the following function
<?php add_role( $role, $display_name, $capabilities ); ?> but how would I apply the capabilities on custom REST API endpoints?