The Sucuri plugin has already been supporting the WP REST API for several months. Under the hood, what the API does is simply route the requests coming from the API to the code that was already processing the creation of posts, for example, or the creation of comments, pages, categories, attachments, etc. The WP REST API relies on code that the Sucuri plugin was already monitoring.
However, I went ahead and added new unit-tests to our development environment to make sure that the WP REST API is fully covered, but unless WordPress is doing something weird with those API requests I can assure you that the current code covers what it was already covering before the REST API was introduced.