As a security method to prevent Cross-Site Request Forgery 9s (CSRF) attacks, Drupal 8 requires a special X-CSRF-Token header to be passed when making a non-safe method. This includes any request that is not read-only, including POST, PATCH, and DELETE. The token can be retrieved by making a GET request to /session/token. This token is specific to the current session, so if the user were to log in or log out, a new session token would need to be requested.