Currently, the REST API doesn't indiciate if the given custom field has been defined as read-only or not. Here's a sample field definition for a read-only field as returned from `/api/v1/products/{productId}`
{"id": "7002184427275897244","key": "key","position": 3,"name": "read-only text field","type": "CustomFieldDefinitions::TextField","api_type": "string","required": true }