What permissions are needed to make REST API calls?

REST calls are similar to using the site - actions such as creating and deleting content that requires a permission on the community site will require the same permission when attempting the same action via REST. Once a user is granted an API key, any calls they make via REST with that key are subject to the same permissions as that user. 

I'm not sure your setup, if you need certain users to be making the REST calls, but whether you use accounts tied to real users or dummy accounts just for automated calls, the accounts in question need to be set up with the appropriate permissions to make those calls. If all of them need access to the same permissions, it might be best to create a role specifically for the REST app accounts to be added to, so you can manage permissions for it separately.

REST calls are similar to using the site - actions such as creating and deleting content that requires a permission on the community site will require the same permission when attempting the same action via REST. Once a user is granted an API key, any calls they make via REST with that key are subject to the same permissions as that user. 

I'm not sure your setup, if you need certain users to be making the REST calls, but whether you use accounts tied to real users or dummy accounts just for automated calls, the accounts in question need to be set up with the appropriate permissions to make those calls. If all of them need access to the same permissions, it might be best to create a role specifically for the REST app accounts to be added to, so you can manage permissions for it separately.

I should also note that in our upcoming v12 release, there will be an additional permission specifically allowing access to make REST/API calls. More details on that should be available once that version is released.

That's what I was kind of expecting but didn't see in in 11x.   The platform we're moving from has a couple of roles specifically for allowing READ or READ/WRITE calls so that's what I'm used to.  Thanks for the information! - Kim