Hello,
It is true that you need to pass the apiversion argument in all JSON API calls. I must update the documentation to that effect.
You can initiate an internal (move) transaction via the API. Authentication is basically the login that you did via curl. However, if the plugin requires that transactions are confirmed (by the user or the admin) you cannot override this when entering transactions via the JSON API. ( In contrast, you can override the need for confirmation if you enter transactions via the PHP API, using the skip_confirm argument.
If you check the “Enable legacy JSON APIs” option, that allows you to pass older apiversion arguments, but you cannot omit it altogether.
Hope this helps. Please let me know if I did not answer your question fully, or if you have any further questions.
with regards