If you want to go this route of using the REST API, you can invoke it client side and pass the user session token for authentication. See this thread for examples.

Is it possible to call a scripted REST API from a client script?

Please mark any post helpful or the correct answer to your questions so others can benefit.