Usually I declare "protected" endpoints as this. So logged in users can use this endpoint.

add_action( 'wp_ajax_my_action', 'my_action_callback' );

Is there a way to make it only accessible to administrators (and not other users)?