REST response gets cached for guest user requests
This is probably the page cache for anonymous users, which works independently from the dynamic cache.

You can disable it with this command:

\Drupal::service('page_cache_kill_switch')-&gt;trigger();


You can trigger this anywhere in your code and it will be valid for any response  you send for the request. So this should also work for a REST response.