What is the proper format for the flag service calls?
The flag service module (and probably the others you've listed in your comments) define their resources as actions, so you access them at a URL like:  

http://server/[endpoint]/[module]/[action].json.


So for the flag action provided by the flag module that would be something like:

http://server/endpoint/flag/flag.json


This little snippet works well for me, based on a REST server with no authentication turned on and an endpoint with the path 'api':

$url = 'http://server-name/api/flag/flag.json';

$args = array(
  'flag_name' =&gt; 'bookmarks',
  'content_id' =&gt; 8,
  'action' =&gt; 'flag',
  'uid' =&gt; 1,

  // You wouldn't normally want this, the flag module provides it as an override 
  // but it's a security risk. With proper authentication you can safely remove it.
  // I'm just using it for testing.
  'skip_permission_check' =&gt; 1 
);

// Perform the curl
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
curl_setopt($curl, CURLOPT_POST, 1); 
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode($args));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);

$response = curl_exec($curl);

$http_code = curl_getinfo($curl, CURLINFO_HTTP_CODE);

curl_close($curl);

if ($http_code == 200) {
  // Success
}


Answering the original question (What is the proper format for the flag service calls?), it's simply a matter of calling the correct URL and POSTing the required arguments to it, from whatever programming language you might be using.