REST or anything RESTful is a generally adhered to standard of getting things done via API. It also has the capability of documenting itself.
Now I had expected to write an answer here about how it's not a great idea to allow endpoints to update or modify any of your codebase but I see it seems the good folks at Automattic have thought it ok and they know the core a lot better than I do, I also presume you need to be authenticated before using it.
Go to [yourwordpresswebsite.com]/wp-json/
It brings up a sort of library of endpoints and how to use them
If you go to
routes then find
You can see the following
Which you can match up in the REST API docs on plugins
This sort of updating via API should IMO only be done for ease of something like mass-rollout. Say you have a hundred servers running the same core setup and your testing has concluded it's safe.
You can also just set up WordPress to update itself automatically instead and save yourself the bother.
There are some interesting examples of using composer to install / update WordPress. Look at johnpbloch, satispress. Also off the shelf Wordfence Central