Invalidate cache on a REST endpoint
See the comment from @Clive, you can only add single objects as dependency. But you need to add a list tag as well, because the entity query may change because of entities added or modified that are not in the cached list.

$list_tags = \Drupal::entityTypeManager()-&gt;getDefinition('entity_type')-&gt;getListCacheTags();
$response-&gt;getCacheableMetadata()-&gt;addCacheTags($list_tags);