As documented in Microsoft's "Complete basic operations using SharePoint REST endpoints," the REST API requires that you either use OAuth for request authorization or that you include the server's request form digest value.
Another important consideration when creating, updating, and deleting SharePoint entities is that if you aren't using OAuth to authorize your requests, these operations require the server's request form digest value as the value of the X-RequestDigest header. You can retrieve this value by making a POST request with an empty body to
http://<site url>/_api/contextinfo and extracting the value of the
d:FormDigestValue node in the XML that the contextinfo endpoint returns.
If you're using the authentication and authorization flow described in Authorization and authentication of SharePoint Add-ins, you don't need to include the request digest in your requests.