The user's timezone can't be detected by a ReST call itself.
The client's public IP addresses we can be used in combination with freegeoip.net ReST service to find a rough location.
When a client logs into the system, the client's timezone is passed as a parameter in the ReST call /v1/auth/login/{username}.
The web pages that use the library jstz to detect the timezone and then does log-in via ReST. We remember the user's timezone in the database session record.