REST error message saying request modifies the database, but it doesn't
it's simply based on the name of the action, it has to be starting with get, so get, getsingle and so on are considered readonly and accepts over GET, the rest should be POST.

this being said, not sure using the rest api is the best option, you might want to use the 'normal' ajax backend and the js wrapper part of civi that takes care of calling the api the right way. this assume the same domain for civicrm and the dashboard