How to create course using API?

Did you generate the CSRF token using the same credentials (e.g. OAuth bearer token or JWT) that you’re using to authenticate the request? Try using the /csrf/api/v1/token API endpoint to retrieve the CSRF token, then submit it with X-CSRFToken.