function rest_posts_by_id(WP_REST_Request $req) {
    $postIds = $req->get_param('post_ids');
    $postIds = explode(',', $postIds);

    $posts = get_posts(array( 'post__in' => $postIds ));
    array_walk($posts, function(&$item) {
        $item->thumbnail = get_the_post_thumbnail_url($item->ID);
    });

    return new WP_REST_Response($posts, 200);
}
add_action('rest_api_init', function() {
    register_rest_route('myapi/v1', '/posts', array(
            'methods' => WP_REST_Server::READABLE,
            'callback' => 'rest_posts_by_id',
            'permission_callback' => function() {
                return true;
            }
    ));
});

{"code":"rest_cannot_access","message":"Only authenticated users can access the REST API.","data":{"status":401}}