Endpoint URL :

Method : Post
https://example.com/entity/flagging?_format=json

Headers Parameter:

X-CSRF-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Authorization: Basic Ud38dasd23rfcFECWq8239c2edc==
Content-Type: application/json

Body JSON:

{
  "entity_id":["38"],
  "entity_type":["node"],
  "flag_id":[{"target_id": "bookmark","target_type": "flag"}],
  "uid": ["1"]
}

Tested with:

Drupal 8.6.9

Flag 4.0 alpha3