The URLs to access the REST API for GET, PATCH and DELETE are the same as if you were trying to view the page on the website. For example if you have a node with an NID of 1, you can view it in your browser at /node/1, but it will render the node using its display mode, run it through the appropriate templates and wrap it with all of the other regions you may have defined. In order to get the API you need to provide the _format request parameter. So in order to access the same node through the API in HAL JSON format you would use /node/1?_format=hal_json.
If you are using POST, PATCH, or DELETE with an authentication method other than HTTP basic authentication, you will need to provide the X-CSRF-Token request header to prevent request forgery attacks. You need to request a CSRF token at /rest/session/token.
We'll be demonstrating each of the REST...
