When you use Node-RED on IBM Cloud during hackathons you will notice REST calls in flows cannot be directly invoked from a web application. The reason for this is mostly that cors (cross-origin resource sharing) is not enabled for the Node-RED server. This blog post is a simple workaround for this problem.
By the way, you can use the IBM Cloud for free, if you simply create an IBM Lite account. Here you only need an e-mail address.
I developed this workaround to have full control and be very flexible during a hackathon, when using Node-RED for prototyping and building integrations to services and web-applications, without changing Node-RED settings or using cors browser enabler.